Create Interactive Tour

Windows Analysis Report
https://rotf.lol/47ht3vmu

Overview

General Information

Sample URL:	https://rotf.lol/47ht3vmu
Analysis ID:	782479
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

No high impact signatures.

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5256 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

chrome.exe (PID: 736 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1816 --field-trial-handle=1760,i,2164418309773911583,162360269692105305,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8 MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

chrome.exe (PID: 5864 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" "https://rotf.lol/47ht3vmu MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

cleanup

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: classification engine

Classification label: clean0.win@26/0@9/9

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\GoogleUpdater

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1816 --field-trial-handle=1760,i,2164418309773911583,162360269692105305,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" "https://rotf.lol/47ht3vmu
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1816 --field-trial-handle=1760,i,2164418309773911583,162360269692105305,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\GoogleUpdater

Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	2 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	4 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	5 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	3 Ingress Tool Transfer	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
https://rotf.lol/47ht3vmu	3%	Virustotal		Browse
https://rotf.lol/47ht3vmu	0%	Avira URL Cloud	safe

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
https://yxsza.cfd/favicon.ico	0%	Avira URL Cloud	safe
https://yxsza.cfd/c/index.php?lew	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
yxsza.cfd	188.114.96.3	true	false	unknown
a.nel.cloudflare.com	35.190.80.1	true	false	high
accounts.google.com	142.250.180.173	true	false	high
rotf.lol	188.114.97.3	true	false	unknown
www.google.com	142.251.209.36	true	false	high
clients.l.google.com	142.250.184.46	true	false	high
clients2.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://a.nel.cloudflare.com/report/v3?s=gu16u%2FRADRs6rFiOlAqxvText%2F5IJagZos1vn03GhEAVXsra%2FdD6UmioykgjXX%2F3WoDnQVNJPNarVZkm2OEgXUo54ZBzIq9oTne%2FKJBDupGfxwr%2FPXXbOgZnH1I%3D	false		high
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=104.0.5112.81&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1	false		high
https://a.nel.cloudflare.com/report/v3?s=MfAW0AOud5LpDH0gZUsX4xy68wCmp4eLqYM2ZfS0dk5W1O6cq%2BCCdC9Oaq%2BDVMWwKkG7BPnM8Ir5ACIRGZ6rXbzSfAlmJ9JnwfpS1fCXWklcwvNi%2FzoeLZuy5dY%3D	false		high
https://yxsza.cfd/c/index.php?lew	false	Avira URL Cloud: safe	unknown
https://rotf.lol/47ht3vmu	false		unknown
https://yxsza.cfd/favicon.ico	false	Avira URL Cloud: safe	unknown
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.184.46	clients.l.google.com	United States	15169	GOOGLEUS	false
142.251.209.36	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
188.114.97.3	rotf.lol	European Union	13335	CLOUDFLARENETUS	false
188.114.96.3	yxsza.cfd	European Union	13335	CLOUDFLARENETUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
142.250.180.173	accounts.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.1
127.0.0.1

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	782479
Start date and time:	2023-01-11 17:36:13 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 4m 30s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://rotf.lol/47ht3vmu
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean0.win@26/0@9/9
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.251.209.35, 34.104.35.123, 142.250.184.35
Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, fs.microsoft.com, edgedl.me.gvt1.com, login.live.com, update.googleapis.com, ctldl.windowsupdate.com, clientservices.googleapis.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtWriteVirtualMemory calls found.

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

⊘No static file info

Network Behavior

Download Network PCAP: filtered – full

Network Port Distribution

Total Packets: 159
• 443 (HTTPS)
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2023 17:37:14.065809965 CET	49712	443	192.168.2.7	188.114.97.3
Jan 11, 2023 17:37:14.065826893 CET	443	49712	188.114.97.3	192.168.2.7
Jan 11, 2023 17:37:14.065896988 CET	49712	443	192.168.2.7	188.114.97.3
Jan 11, 2023 17:37:14.202848911 CET	49713	443	192.168.2.7	142.250.184.46
Jan 11, 2023 17:37:14.202898979 CET	443	49713	142.250.184.46	192.168.2.7
Jan 11, 2023 17:37:14.202977896 CET	49713	443	192.168.2.7	142.250.184.46
Jan 11, 2023 17:37:14.209110975 CET	49714	443	192.168.2.7	142.250.180.173
Jan 11, 2023 17:37:14.209181070 CET	443	49714	142.250.180.173	192.168.2.7
Jan 11, 2023 17:37:14.209274054 CET	49714	443	192.168.2.7	142.250.180.173
Jan 11, 2023 17:37:14.210510015 CET	49716	443	192.168.2.7	142.250.184.46
Jan 11, 2023 17:37:14.210524082 CET	443	49716	142.250.184.46	192.168.2.7
Jan 11, 2023 17:37:14.210597992 CET	49716	443	192.168.2.7	142.250.184.46
Jan 11, 2023 17:37:14.210870981 CET	49717	443	192.168.2.7	142.250.180.173
Jan 11, 2023 17:37:14.210923910 CET	443	49717	142.250.180.173	192.168.2.7
Jan 11, 2023 17:37:14.210993052 CET	49717	443	192.168.2.7	142.250.180.173
Jan 11, 2023 17:37:14.211745024 CET	49712	443	192.168.2.7	188.114.97.3
Jan 11, 2023 17:37:14.211766958 CET	443	49712	188.114.97.3	192.168.2.7
Jan 11, 2023 17:37:14.213227034 CET	49713	443	192.168.2.7	142.250.184.46
Jan 11, 2023 17:37:14.213258028 CET	443	49713	142.250.184.46	192.168.2.7
Jan 11, 2023 17:37:14.213459015 CET	49714	443	192.168.2.7	142.250.180.173
Jan 11, 2023 17:37:14.213495970 CET	443	49714	142.250.180.173	192.168.2.7
Jan 11, 2023 17:37:14.213912010 CET	49716	443	192.168.2.7	142.250.184.46
Jan 11, 2023 17:37:14.213924885 CET	443	49716	142.250.184.46	192.168.2.7
Jan 11, 2023 17:37:14.214176893 CET	49717	443	192.168.2.7	142.250.180.173
Jan 11, 2023 17:37:14.214215040 CET	443	49717	142.250.180.173	192.168.2.7
Jan 11, 2023 17:37:14.432149887 CET	443	49713	142.250.184.46	192.168.2.7
Jan 11, 2023 17:37:14.481225014 CET	49713	443	192.168.2.7	142.250.184.46
Jan 11, 2023 17:37:14.505415916 CET	443	49716	142.250.184.46	192.168.2.7
Jan 11, 2023 17:37:14.517330885 CET	443	49714	142.250.180.173	192.168.2.7
Jan 11, 2023 17:37:14.521487951 CET	443	49712	188.114.97.3	192.168.2.7
Jan 11, 2023 17:37:14.522079945 CET	443	49717	142.250.180.173	192.168.2.7
Jan 11, 2023 17:37:14.537132978 CET	49717	443	192.168.2.7	142.250.180.173
Jan 11, 2023 17:37:14.537204027 CET	443	49717	142.250.180.173	192.168.2.7
Jan 11, 2023 17:37:14.537595987 CET	49712	443	192.168.2.7	188.114.97.3
Jan 11, 2023 17:37:14.537631035 CET	443	49712	188.114.97.3	192.168.2.7
Jan 11, 2023 17:37:14.538028955 CET	49714	443	192.168.2.7	142.250.180.173
Jan 11, 2023 17:37:14.538090944 CET	443	49714	142.250.180.173	192.168.2.7
Jan 11, 2023 17:37:14.539438009 CET	49716	443	192.168.2.7	142.250.184.46
Jan 11, 2023 17:37:14.539479017 CET	443	49716	142.250.184.46	192.168.2.7
Jan 11, 2023 17:37:14.539686918 CET	443	49717	142.250.180.173	192.168.2.7
Jan 11, 2023 17:37:14.539729118 CET	443	49712	188.114.97.3	192.168.2.7
Jan 11, 2023 17:37:14.539751053 CET	49713	443	192.168.2.7	142.250.184.46
Jan 11, 2023 17:37:14.539781094 CET	443	49713	142.250.184.46	192.168.2.7
Jan 11, 2023 17:37:14.539819002 CET	49717	443	192.168.2.7	142.250.180.173
Jan 11, 2023 17:37:14.539860964 CET	49712	443	192.168.2.7	188.114.97.3
Jan 11, 2023 17:37:14.540391922 CET	443	49714	142.250.180.173	192.168.2.7
Jan 11, 2023 17:37:14.540513039 CET	49714	443	192.168.2.7	142.250.180.173
Jan 11, 2023 17:37:14.540694952 CET	443	49716	142.250.184.46	192.168.2.7
Jan 11, 2023 17:37:14.540889025 CET	49716	443	192.168.2.7	142.250.184.46
Jan 11, 2023 17:37:14.541163921 CET	443	49713	142.250.184.46	192.168.2.7
Jan 11, 2023 17:37:14.541266918 CET	49713	443	192.168.2.7	142.250.184.46
Jan 11, 2023 17:37:14.542798042 CET	443	49716	142.250.184.46	192.168.2.7
Jan 11, 2023 17:37:14.542895079 CET	49716	443	192.168.2.7	142.250.184.46
Jan 11, 2023 17:37:14.543332100 CET	443	49713	142.250.184.46	192.168.2.7
Jan 11, 2023 17:37:14.543401003 CET	49713	443	192.168.2.7	142.250.184.46
Jan 11, 2023 17:37:14.835009098 CET	49712	443	192.168.2.7	188.114.97.3
Jan 11, 2023 17:37:14.835072994 CET	443	49712	188.114.97.3	192.168.2.7
Jan 11, 2023 17:37:14.835408926 CET	443	49712	188.114.97.3	192.168.2.7
Jan 11, 2023 17:37:14.835630894 CET	49717	443	192.168.2.7	142.250.180.173
Jan 11, 2023 17:37:14.835691929 CET	443	49717	142.250.180.173	192.168.2.7
Jan 11, 2023 17:37:14.835731030 CET	49714	443	192.168.2.7	142.250.180.173
Jan 11, 2023 17:37:14.835773945 CET	443	49714	142.250.180.173	192.168.2.7
Jan 11, 2023 17:37:14.835988045 CET	443	49717	142.250.180.173	192.168.2.7
Jan 11, 2023 17:37:14.836066961 CET	443	49714	142.250.180.173	192.168.2.7
Jan 11, 2023 17:37:14.836091995 CET	49712	443	192.168.2.7	188.114.97.3
Jan 11, 2023 17:37:14.836136103 CET	443	49712	188.114.97.3	192.168.2.7
Jan 11, 2023 17:37:14.836910963 CET	49716	443	192.168.2.7	142.250.184.46
Jan 11, 2023 17:37:14.836939096 CET	443	49716	142.250.184.46	192.168.2.7
Jan 11, 2023 17:37:14.837029934 CET	49713	443	192.168.2.7	142.250.184.46
Jan 11, 2023 17:37:14.837059021 CET	443	49713	142.250.184.46	192.168.2.7
Jan 11, 2023 17:37:14.837194920 CET	49717	443	192.168.2.7	142.250.180.173
Jan 11, 2023 17:37:14.837201118 CET	443	49716	142.250.184.46	192.168.2.7
Jan 11, 2023 17:37:14.837235928 CET	443	49717	142.250.180.173	192.168.2.7
Jan 11, 2023 17:37:14.837358952 CET	49716	443	192.168.2.7	142.250.184.46
Jan 11, 2023 17:37:14.837374926 CET	443	49716	142.250.184.46	192.168.2.7
Jan 11, 2023 17:37:14.837404013 CET	443	49713	142.250.184.46	192.168.2.7
Jan 11, 2023 17:37:14.877192974 CET	49717	443	192.168.2.7	142.250.180.173
Jan 11, 2023 17:37:14.879769087 CET	49712	443	192.168.2.7	188.114.97.3
Jan 11, 2023 17:37:14.879769087 CET	49714	443	192.168.2.7	142.250.180.173
Jan 11, 2023 17:37:14.879769087 CET	49716	443	192.168.2.7	142.250.184.46
Jan 11, 2023 17:37:14.879822016 CET	443	49714	142.250.180.173	192.168.2.7
Jan 11, 2023 17:37:14.881181002 CET	49713	443	192.168.2.7	142.250.184.46
Jan 11, 2023 17:37:14.881218910 CET	443	49713	142.250.184.46	192.168.2.7
Jan 11, 2023 17:37:14.898047924 CET	443	49716	142.250.184.46	192.168.2.7
Jan 11, 2023 17:37:14.898386955 CET	443	49716	142.250.184.46	192.168.2.7
Jan 11, 2023 17:37:14.898487091 CET	49716	443	192.168.2.7	142.250.184.46
Jan 11, 2023 17:37:14.900397062 CET	49716	443	192.168.2.7	142.250.184.46
Jan 11, 2023 17:37:14.900438070 CET	443	49716	142.250.184.46	192.168.2.7
Jan 11, 2023 17:37:14.900960922 CET	443	49717	142.250.180.173	192.168.2.7
Jan 11, 2023 17:37:14.901278019 CET	443	49717	142.250.180.173	192.168.2.7
Jan 11, 2023 17:37:14.901360989 CET	49717	443	192.168.2.7	142.250.180.173
Jan 11, 2023 17:37:14.902956963 CET	49717	443	192.168.2.7	142.250.180.173
Jan 11, 2023 17:37:14.902990103 CET	443	49717	142.250.180.173	192.168.2.7
Jan 11, 2023 17:37:14.920907021 CET	49714	443	192.168.2.7	142.250.180.173
Jan 11, 2023 17:37:14.981266975 CET	49713	443	192.168.2.7	142.250.184.46
Jan 11, 2023 17:37:15.204823971 CET	443	49712	188.114.97.3	192.168.2.7
Jan 11, 2023 17:37:15.205107927 CET	443	49712	188.114.97.3	192.168.2.7
Jan 11, 2023 17:37:15.205228090 CET	49712	443	192.168.2.7	188.114.97.3
Jan 11, 2023 17:37:15.224730968 CET	49712	443	192.168.2.7	188.114.97.3
Jan 11, 2023 17:37:15.224788904 CET	443	49712	188.114.97.3	192.168.2.7
Jan 11, 2023 17:37:15.258850098 CET	49719	443	192.168.2.7	188.114.96.3
Jan 11, 2023 17:37:15.258917093 CET	443	49719	188.114.96.3	192.168.2.7
Jan 11, 2023 17:37:15.259022951 CET	49719	443	192.168.2.7	188.114.96.3
Jan 11, 2023 17:37:15.259352922 CET	49719	443	192.168.2.7	188.114.96.3
Jan 11, 2023 17:37:15.259390116 CET	443	49719	188.114.96.3	192.168.2.7
Jan 11, 2023 17:37:15.324795008 CET	443	49719	188.114.96.3	192.168.2.7
Jan 11, 2023 17:37:15.336101055 CET	49719	443	192.168.2.7	188.114.96.3
Jan 11, 2023 17:37:15.336169004 CET	443	49719	188.114.96.3	192.168.2.7
Jan 11, 2023 17:37:15.337687016 CET	443	49719	188.114.96.3	192.168.2.7
Jan 11, 2023 17:37:15.337799072 CET	49719	443	192.168.2.7	188.114.96.3
Jan 11, 2023 17:37:15.340147972 CET	49719	443	192.168.2.7	188.114.96.3
Jan 11, 2023 17:37:15.340198040 CET	443	49719	188.114.96.3	192.168.2.7
Jan 11, 2023 17:37:15.340387106 CET	49719	443	192.168.2.7	188.114.96.3
Jan 11, 2023 17:37:15.340400934 CET	443	49719	188.114.96.3	192.168.2.7
Jan 11, 2023 17:37:15.340418100 CET	443	49719	188.114.96.3	192.168.2.7
Jan 11, 2023 17:37:15.381225109 CET	49719	443	192.168.2.7	188.114.96.3
Jan 11, 2023 17:37:15.381294966 CET	443	49719	188.114.96.3	192.168.2.7
Jan 11, 2023 17:37:15.417382002 CET	443	49719	188.114.96.3	192.168.2.7
Jan 11, 2023 17:37:15.417429924 CET	443	49719	188.114.96.3	192.168.2.7
Jan 11, 2023 17:37:15.417613029 CET	443	49719	188.114.96.3	192.168.2.7
Jan 11, 2023 17:37:15.417697906 CET	49719	443	192.168.2.7	188.114.96.3
Jan 11, 2023 17:37:15.417749882 CET	443	49719	188.114.96.3	192.168.2.7
Jan 11, 2023 17:37:15.417932987 CET	49719	443	192.168.2.7	188.114.96.3
Jan 11, 2023 17:37:15.417932987 CET	49719	443	192.168.2.7	188.114.96.3
Jan 11, 2023 17:37:15.418117046 CET	443	49719	188.114.96.3	192.168.2.7
Jan 11, 2023 17:37:15.418245077 CET	49719	443	192.168.2.7	188.114.96.3
Jan 11, 2023 17:37:15.521199942 CET	49720	443	192.168.2.7	35.190.80.1
Jan 11, 2023 17:37:15.521270037 CET	443	49720	35.190.80.1	192.168.2.7
Jan 11, 2023 17:37:15.521388054 CET	49720	443	192.168.2.7	35.190.80.1
Jan 11, 2023 17:37:15.521790981 CET	49720	443	192.168.2.7	35.190.80.1
Jan 11, 2023 17:37:15.521822929 CET	443	49720	35.190.80.1	192.168.2.7
Jan 11, 2023 17:37:15.522114038 CET	49719	443	192.168.2.7	188.114.96.3
Jan 11, 2023 17:37:15.522166967 CET	443	49719	188.114.96.3	192.168.2.7
Jan 11, 2023 17:37:15.580991030 CET	443	49720	35.190.80.1	192.168.2.7
Jan 11, 2023 17:37:15.614012957 CET	49720	443	192.168.2.7	35.190.80.1
Jan 11, 2023 17:37:15.614054918 CET	443	49720	35.190.80.1	192.168.2.7
Jan 11, 2023 17:37:15.617126942 CET	443	49720	35.190.80.1	192.168.2.7
Jan 11, 2023 17:37:15.617255926 CET	49720	443	192.168.2.7	35.190.80.1
Jan 11, 2023 17:37:15.619100094 CET	49721	443	192.168.2.7	188.114.96.3
Jan 11, 2023 17:37:15.619172096 CET	443	49721	188.114.96.3	192.168.2.7
Jan 11, 2023 17:37:15.619328022 CET	49721	443	192.168.2.7	188.114.96.3
Jan 11, 2023 17:37:15.619802952 CET	49721	443	192.168.2.7	188.114.96.3
Jan 11, 2023 17:37:15.619868994 CET	443	49721	188.114.96.3	192.168.2.7
Jan 11, 2023 17:37:15.620961905 CET	49720	443	192.168.2.7	35.190.80.1
Jan 11, 2023 17:37:15.620979071 CET	443	49720	35.190.80.1	192.168.2.7
Jan 11, 2023 17:37:15.621304989 CET	49720	443	192.168.2.7	35.190.80.1
Jan 11, 2023 17:37:15.621314049 CET	443	49720	35.190.80.1	192.168.2.7
Jan 11, 2023 17:37:15.621543884 CET	443	49720	35.190.80.1	192.168.2.7
Jan 11, 2023 17:37:15.653058052 CET	49722	443	192.168.2.7	188.114.96.3
Jan 11, 2023 17:37:15.653126955 CET	443	49722	188.114.96.3	192.168.2.7
Jan 11, 2023 17:37:15.653203964 CET	49722	443	192.168.2.7	188.114.96.3
Jan 11, 2023 17:37:15.653633118 CET	49722	443	192.168.2.7	188.114.96.3
Jan 11, 2023 17:37:15.653664112 CET	443	49722	188.114.96.3	192.168.2.7
Jan 11, 2023 17:37:15.676947117 CET	443	49721	188.114.96.3	192.168.2.7
Jan 11, 2023 17:37:15.677468061 CET	49721	443	192.168.2.7	188.114.96.3
Jan 11, 2023 17:37:15.677515984 CET	443	49721	188.114.96.3	192.168.2.7
Jan 11, 2023 17:37:15.678301096 CET	443	49721	188.114.96.3	192.168.2.7
Jan 11, 2023 17:37:15.678955078 CET	49721	443	192.168.2.7	188.114.96.3
Jan 11, 2023 17:37:15.678986073 CET	443	49721	188.114.96.3	192.168.2.7
Jan 11, 2023 17:37:15.679116011 CET	443	49721	188.114.96.3	192.168.2.7
Jan 11, 2023 17:37:15.679800987 CET	49721	443	192.168.2.7	188.114.96.3
Jan 11, 2023 17:37:15.679816008 CET	443	49721	188.114.96.3	192.168.2.7
Jan 11, 2023 17:37:15.681165934 CET	49720	443	192.168.2.7	35.190.80.1
Jan 11, 2023 17:37:15.681188107 CET	443	49720	35.190.80.1	192.168.2.7
Jan 11, 2023 17:37:15.722676039 CET	443	49722	188.114.96.3	192.168.2.7
Jan 11, 2023 17:37:15.723103046 CET	49722	443	192.168.2.7	188.114.96.3
Jan 11, 2023 17:37:15.723179102 CET	443	49722	188.114.96.3	192.168.2.7
Jan 11, 2023 17:37:15.724123955 CET	443	49722	188.114.96.3	192.168.2.7
Jan 11, 2023 17:37:15.725373983 CET	49722	443	192.168.2.7	188.114.96.3
Jan 11, 2023 17:37:15.725405931 CET	443	49722	188.114.96.3	192.168.2.7
Jan 11, 2023 17:37:15.725567102 CET	443	49722	188.114.96.3	192.168.2.7
Jan 11, 2023 17:37:15.726382017 CET	49722	443	192.168.2.7	188.114.96.3
Jan 11, 2023 17:37:15.726402998 CET	443	49722	188.114.96.3	192.168.2.7
Jan 11, 2023 17:37:15.751104116 CET	443	49720	35.190.80.1	192.168.2.7
Jan 11, 2023 17:37:15.751208067 CET	49720	443	192.168.2.7	35.190.80.1
Jan 11, 2023 17:37:15.756419897 CET	49720	443	192.168.2.7	35.190.80.1
Jan 11, 2023 17:37:15.756448984 CET	443	49720	35.190.80.1	192.168.2.7
Jan 11, 2023 17:37:15.757514000 CET	49723	443	192.168.2.7	35.190.80.1
Jan 11, 2023 17:37:15.757599115 CET	443	49723	35.190.80.1	192.168.2.7
Jan 11, 2023 17:37:15.757687092 CET	49723	443	192.168.2.7	35.190.80.1
Jan 11, 2023 17:37:15.758028030 CET	49723	443	192.168.2.7	35.190.80.1
Jan 11, 2023 17:37:15.758086920 CET	443	49723	35.190.80.1	192.168.2.7
Jan 11, 2023 17:37:15.782788038 CET	443	49721	188.114.96.3	192.168.2.7
Jan 11, 2023 17:37:15.814191103 CET	443	49723	35.190.80.1	192.168.2.7
Jan 11, 2023 17:37:15.819859028 CET	49723	443	192.168.2.7	35.190.80.1
Jan 11, 2023 17:37:15.819932938 CET	443	49723	35.190.80.1	192.168.2.7
Jan 11, 2023 17:37:15.820931911 CET	443	49723	35.190.80.1	192.168.2.7
Jan 11, 2023 17:37:15.821554899 CET	49723	443	192.168.2.7	35.190.80.1
Jan 11, 2023 17:37:15.821599007 CET	443	49723	35.190.80.1	192.168.2.7
Jan 11, 2023 17:37:15.821702957 CET	49723	443	192.168.2.7	35.190.80.1
Jan 11, 2023 17:37:15.821716070 CET	443	49723	35.190.80.1	192.168.2.7
Jan 11, 2023 17:37:15.821732998 CET	443	49723	35.190.80.1	192.168.2.7
Jan 11, 2023 17:37:15.839730978 CET	49721	443	192.168.2.7	188.114.96.3
Jan 11, 2023 17:37:15.839783907 CET	443	49721	188.114.96.3	192.168.2.7
Jan 11, 2023 17:37:15.841430902 CET	49721	443	192.168.2.7	188.114.96.3
Jan 11, 2023 17:37:15.841650009 CET	443	49721	188.114.96.3	192.168.2.7
Jan 11, 2023 17:37:15.841763973 CET	49721	443	192.168.2.7	188.114.96.3
Jan 11, 2023 17:37:15.847770929 CET	443	49722	188.114.96.3	192.168.2.7
Jan 11, 2023 17:37:15.848067999 CET	443	49722	188.114.96.3	192.168.2.7
Jan 11, 2023 17:37:15.848157883 CET	49722	443	192.168.2.7	188.114.96.3
Jan 11, 2023 17:37:15.848165035 CET	443	49722	188.114.96.3	192.168.2.7
Jan 11, 2023 17:37:15.848203897 CET	443	49722	188.114.96.3	192.168.2.7
Jan 11, 2023 17:37:15.848257065 CET	49722	443	192.168.2.7	188.114.96.3
Jan 11, 2023 17:37:15.848273993 CET	443	49722	188.114.96.3	192.168.2.7
Jan 11, 2023 17:37:15.848520041 CET	443	49722	188.114.96.3	192.168.2.7
Jan 11, 2023 17:37:15.848606110 CET	49722	443	192.168.2.7	188.114.96.3
Jan 11, 2023 17:37:15.854500055 CET	49724	443	192.168.2.7	188.114.96.3
Jan 11, 2023 17:37:15.854557991 CET	443	49724	188.114.96.3	192.168.2.7
Jan 11, 2023 17:37:15.854672909 CET	49724	443	192.168.2.7	188.114.96.3
Jan 11, 2023 17:37:15.855283022 CET	49724	443	192.168.2.7	188.114.96.3
Jan 11, 2023 17:37:15.855315924 CET	443	49724	188.114.96.3	192.168.2.7
Jan 11, 2023 17:37:15.859920025 CET	49722	443	192.168.2.7	188.114.96.3
Jan 11, 2023 17:37:15.859962940 CET	443	49722	188.114.96.3	192.168.2.7
Jan 11, 2023 17:37:15.881232023 CET	49723	443	192.168.2.7	35.190.80.1
Jan 11, 2023 17:37:15.931744099 CET	443	49724	188.114.96.3	192.168.2.7
Jan 11, 2023 17:37:15.932236910 CET	49724	443	192.168.2.7	188.114.96.3
Jan 11, 2023 17:37:15.932311058 CET	443	49724	188.114.96.3	192.168.2.7
Jan 11, 2023 17:37:15.933346987 CET	443	49724	188.114.96.3	192.168.2.7
Jan 11, 2023 17:37:15.934012890 CET	49724	443	192.168.2.7	188.114.96.3
Jan 11, 2023 17:37:15.934041977 CET	443	49724	188.114.96.3	192.168.2.7
Jan 11, 2023 17:37:15.934231043 CET	443	49724	188.114.96.3	192.168.2.7
Jan 11, 2023 17:37:15.934586048 CET	49724	443	192.168.2.7	188.114.96.3
Jan 11, 2023 17:37:15.934602022 CET	443	49724	188.114.96.3	192.168.2.7
Jan 11, 2023 17:37:15.966003895 CET	443	49723	35.190.80.1	192.168.2.7
Jan 11, 2023 17:37:15.966099977 CET	443	49723	35.190.80.1	192.168.2.7
Jan 11, 2023 17:37:15.966181993 CET	49723	443	192.168.2.7	35.190.80.1
Jan 11, 2023 17:37:15.968533039 CET	49723	443	192.168.2.7	35.190.80.1
Jan 11, 2023 17:37:15.968579054 CET	443	49723	35.190.80.1	192.168.2.7
Jan 11, 2023 17:37:16.206897974 CET	49725	443	192.168.2.7	142.251.209.36
Jan 11, 2023 17:37:16.206981897 CET	443	49725	142.251.209.36	192.168.2.7
Jan 11, 2023 17:37:16.207103014 CET	49725	443	192.168.2.7	142.251.209.36
Jan 11, 2023 17:37:16.207473040 CET	49725	443	192.168.2.7	142.251.209.36
Jan 11, 2023 17:37:16.207508087 CET	443	49725	142.251.209.36	192.168.2.7
Jan 11, 2023 17:37:16.279134989 CET	443	49724	188.114.96.3	192.168.2.7
Jan 11, 2023 17:37:16.287141085 CET	443	49725	142.251.209.36	192.168.2.7
Jan 11, 2023 17:37:16.293843985 CET	49725	443	192.168.2.7	142.251.209.36
Jan 11, 2023 17:37:16.293912888 CET	443	49725	142.251.209.36	192.168.2.7
Jan 11, 2023 17:37:16.295295000 CET	443	49725	142.251.209.36	192.168.2.7
Jan 11, 2023 17:37:16.295387983 CET	49725	443	192.168.2.7	142.251.209.36
Jan 11, 2023 17:37:16.298352003 CET	49725	443	192.168.2.7	142.251.209.36
Jan 11, 2023 17:37:16.298387051 CET	443	49725	142.251.209.36	192.168.2.7
Jan 11, 2023 17:37:16.298535109 CET	443	49725	142.251.209.36	192.168.2.7
Jan 11, 2023 17:37:16.381242990 CET	49724	443	192.168.2.7	188.114.96.3
Jan 11, 2023 17:37:16.381290913 CET	443	49724	188.114.96.3	192.168.2.7
Jan 11, 2023 17:37:16.381339073 CET	49725	443	192.168.2.7	142.251.209.36
Jan 11, 2023 17:37:16.381367922 CET	443	49725	142.251.209.36	192.168.2.7
Jan 11, 2023 17:37:16.381618023 CET	49724	443	192.168.2.7	188.114.96.3
Jan 11, 2023 17:37:16.381773949 CET	443	49724	188.114.96.3	192.168.2.7
Jan 11, 2023 17:37:16.381849051 CET	49724	443	192.168.2.7	188.114.96.3
Jan 11, 2023 17:37:16.481276035 CET	49725	443	192.168.2.7	142.251.209.36
Jan 11, 2023 17:37:26.275142908 CET	443	49725	142.251.209.36	192.168.2.7
Jan 11, 2023 17:37:26.275227070 CET	443	49725	142.251.209.36	192.168.2.7
Jan 11, 2023 17:37:26.275366068 CET	49725	443	192.168.2.7	142.251.209.36
Jan 11, 2023 17:37:28.906029940 CET	49725	443	192.168.2.7	142.251.209.36
Jan 11, 2023 17:37:28.906061888 CET	443	49725	142.251.209.36	192.168.2.7
Jan 11, 2023 17:37:59.894607067 CET	49713	443	192.168.2.7	142.250.184.46
Jan 11, 2023 17:37:59.894670010 CET	443	49713	142.250.184.46	192.168.2.7
Jan 11, 2023 17:37:59.896532059 CET	49714	443	192.168.2.7	142.250.180.173
Jan 11, 2023 17:37:59.896550894 CET	443	49714	142.250.180.173	192.168.2.7
Jan 11, 2023 17:38:15.457119942 CET	49714	443	192.168.2.7	142.250.180.173
Jan 11, 2023 17:38:15.457171917 CET	49713	443	192.168.2.7	142.250.184.46
Jan 11, 2023 17:38:15.457375050 CET	443	49714	142.250.180.173	192.168.2.7
Jan 11, 2023 17:38:15.457427979 CET	443	49713	142.250.184.46	192.168.2.7
Jan 11, 2023 17:38:15.457463026 CET	49714	443	192.168.2.7	142.250.180.173
Jan 11, 2023 17:38:15.457503080 CET	49713	443	192.168.2.7	142.250.184.46
Jan 11, 2023 17:38:15.457727909 CET	49760	443	192.168.2.7	35.190.80.1
Jan 11, 2023 17:38:15.457772017 CET	443	49760	35.190.80.1	192.168.2.7
Jan 11, 2023 17:38:15.457856894 CET	49760	443	192.168.2.7	35.190.80.1
Jan 11, 2023 17:38:15.461976051 CET	49760	443	192.168.2.7	35.190.80.1
Jan 11, 2023 17:38:15.462017059 CET	443	49760	35.190.80.1	192.168.2.7
Jan 11, 2023 17:38:15.512550116 CET	443	49760	35.190.80.1	192.168.2.7
Jan 11, 2023 17:38:15.548208952 CET	49760	443	192.168.2.7	35.190.80.1
Jan 11, 2023 17:38:15.548239946 CET	443	49760	35.190.80.1	192.168.2.7
Jan 11, 2023 17:38:15.549772978 CET	443	49760	35.190.80.1	192.168.2.7
Jan 11, 2023 17:38:15.550853014 CET	49760	443	192.168.2.7	35.190.80.1
Jan 11, 2023 17:38:15.550879002 CET	443	49760	35.190.80.1	192.168.2.7
Jan 11, 2023 17:38:15.551075935 CET	49760	443	192.168.2.7	35.190.80.1
Jan 11, 2023 17:38:15.551075935 CET	443	49760	35.190.80.1	192.168.2.7
Jan 11, 2023 17:38:15.551105022 CET	443	49760	35.190.80.1	192.168.2.7
Jan 11, 2023 17:38:15.603431940 CET	49760	443	192.168.2.7	35.190.80.1
Jan 11, 2023 17:38:15.681106091 CET	443	49760	35.190.80.1	192.168.2.7
Jan 11, 2023 17:38:15.681195974 CET	443	49760	35.190.80.1	192.168.2.7
Jan 11, 2023 17:38:15.681272030 CET	49760	443	192.168.2.7	35.190.80.1
Jan 11, 2023 17:38:15.691265106 CET	49760	443	192.168.2.7	35.190.80.1
Jan 11, 2023 17:38:15.691298962 CET	443	49760	35.190.80.1	192.168.2.7
Jan 11, 2023 17:38:15.710860014 CET	49761	443	192.168.2.7	35.190.80.1
Jan 11, 2023 17:38:15.710915089 CET	443	49761	35.190.80.1	192.168.2.7
Jan 11, 2023 17:38:15.710994005 CET	49761	443	192.168.2.7	35.190.80.1
Jan 11, 2023 17:38:15.711199999 CET	49761	443	192.168.2.7	35.190.80.1
Jan 11, 2023 17:38:15.711220026 CET	443	49761	35.190.80.1	192.168.2.7
Jan 11, 2023 17:38:15.753957987 CET	443	49761	35.190.80.1	192.168.2.7
Jan 11, 2023 17:38:15.754363060 CET	49761	443	192.168.2.7	35.190.80.1
Jan 11, 2023 17:38:15.754390955 CET	443	49761	35.190.80.1	192.168.2.7
Jan 11, 2023 17:38:15.754865885 CET	443	49761	35.190.80.1	192.168.2.7
Jan 11, 2023 17:38:15.755520105 CET	49761	443	192.168.2.7	35.190.80.1
Jan 11, 2023 17:38:15.755520105 CET	49761	443	192.168.2.7	35.190.80.1
Jan 11, 2023 17:38:15.755548000 CET	443	49761	35.190.80.1	192.168.2.7
Jan 11, 2023 17:38:15.755563021 CET	443	49761	35.190.80.1	192.168.2.7
Jan 11, 2023 17:38:15.755708933 CET	443	49761	35.190.80.1	192.168.2.7
Jan 11, 2023 17:38:15.806639910 CET	49761	443	192.168.2.7	35.190.80.1
Jan 11, 2023 17:38:15.900962114 CET	443	49761	35.190.80.1	192.168.2.7
Jan 11, 2023 17:38:15.901134968 CET	443	49761	35.190.80.1	192.168.2.7
Jan 11, 2023 17:38:15.901233912 CET	49761	443	192.168.2.7	35.190.80.1
Jan 11, 2023 17:38:15.905282974 CET	49761	443	192.168.2.7	35.190.80.1
Jan 11, 2023 17:38:15.905323029 CET	443	49761	35.190.80.1	192.168.2.7
Jan 11, 2023 17:38:16.332326889 CET	49762	443	192.168.2.7	142.251.209.36
Jan 11, 2023 17:38:16.332418919 CET	443	49762	142.251.209.36	192.168.2.7
Jan 11, 2023 17:38:16.332565069 CET	49762	443	192.168.2.7	142.251.209.36
Jan 11, 2023 17:38:16.332746983 CET	49762	443	192.168.2.7	142.251.209.36
Jan 11, 2023 17:38:16.332771063 CET	443	49762	142.251.209.36	192.168.2.7
Jan 11, 2023 17:38:16.405972004 CET	443	49762	142.251.209.36	192.168.2.7
Jan 11, 2023 17:38:16.406307936 CET	49762	443	192.168.2.7	142.251.209.36
Jan 11, 2023 17:38:16.406352043 CET	443	49762	142.251.209.36	192.168.2.7
Jan 11, 2023 17:38:16.407418966 CET	443	49762	142.251.209.36	192.168.2.7
Jan 11, 2023 17:38:16.407866001 CET	49762	443	192.168.2.7	142.251.209.36
Jan 11, 2023 17:38:16.407896996 CET	443	49762	142.251.209.36	192.168.2.7
Jan 11, 2023 17:38:16.407994986 CET	443	49762	142.251.209.36	192.168.2.7
Jan 11, 2023 17:38:16.462918043 CET	49762	443	192.168.2.7	142.251.209.36
Jan 11, 2023 17:38:26.384699106 CET	443	49762	142.251.209.36	192.168.2.7
Jan 11, 2023 17:38:26.384810925 CET	443	49762	142.251.209.36	192.168.2.7
Jan 11, 2023 17:38:26.384874105 CET	49762	443	192.168.2.7	142.251.209.36

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2023 17:37:12.639843941 CET	60326	53	192.168.2.7	8.8.8.8
Jan 11, 2023 17:37:12.657330990 CET	53	60326	8.8.8.8	192.168.2.7
Jan 11, 2023 17:37:13.461947918 CET	61178	53	192.168.2.7	8.8.8.8
Jan 11, 2023 17:37:13.473248005 CET	63926	53	192.168.2.7	8.8.8.8
Jan 11, 2023 17:37:13.495141029 CET	53	61178	8.8.8.8	192.168.2.7
Jan 11, 2023 17:37:13.501983881 CET	53	63926	8.8.8.8	192.168.2.7
Jan 11, 2023 17:37:13.912220001 CET	60326	53	192.168.2.7	8.8.8.8
Jan 11, 2023 17:37:13.931835890 CET	53	60326	8.8.8.8	192.168.2.7
Jan 11, 2023 17:37:15.230946064 CET	60765	53	192.168.2.7	8.8.8.8
Jan 11, 2023 17:37:15.253743887 CET	53	60765	8.8.8.8	192.168.2.7
Jan 11, 2023 17:37:15.446202040 CET	58283	53	192.168.2.7	8.8.8.8
Jan 11, 2023 17:37:15.466135025 CET	53	58283	8.8.8.8	192.168.2.7
Jan 11, 2023 17:37:16.175753117 CET	50024	53	192.168.2.7	8.8.8.8
Jan 11, 2023 17:37:16.203567028 CET	53	50024	8.8.8.8	192.168.2.7
Jan 11, 2023 17:38:15.692841053 CET	63187	53	192.168.2.7	8.8.8.8
Jan 11, 2023 17:38:15.709722996 CET	53	63187	8.8.8.8	192.168.2.7
Jan 11, 2023 17:38:16.310758114 CET	64760	53	192.168.2.7	8.8.8.8
Jan 11, 2023 17:38:16.330771923 CET	53	64760	8.8.8.8	192.168.2.7

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Jan 11, 2023 17:37:13.931973934 CET	192.168.2.7	8.8.8.8	d022	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2023 17:37:12.639843941 CET	192.168.2.7	8.8.8.8	0x9b50	Standard query (0)	clients2.google.com	A (IP address)	IN (0x0001)	false
Jan 11, 2023 17:37:13.461947918 CET	192.168.2.7	8.8.8.8	0x222	Standard query (0)	rotf.lol	A (IP address)	IN (0x0001)	false
Jan 11, 2023 17:37:13.473248005 CET	192.168.2.7	8.8.8.8	0xbc54	Standard query (0)	accounts.google.com	A (IP address)	IN (0x0001)	false
Jan 11, 2023 17:37:13.912220001 CET	192.168.2.7	8.8.8.8	0x9b50	Standard query (0)	clients2.google.com	A (IP address)	IN (0x0001)	false
Jan 11, 2023 17:37:15.230946064 CET	192.168.2.7	8.8.8.8	0xf963	Standard query (0)	yxsza.cfd	A (IP address)	IN (0x0001)	false
Jan 11, 2023 17:37:15.446202040 CET	192.168.2.7	8.8.8.8	0x997e	Standard query (0)	a.nel.cloudflare.com	A (IP address)	IN (0x0001)	false
Jan 11, 2023 17:37:16.175753117 CET	192.168.2.7	8.8.8.8	0xb533	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jan 11, 2023 17:38:15.692841053 CET	192.168.2.7	8.8.8.8	0x71da	Standard query (0)	a.nel.cloudflare.com	A (IP address)	IN (0x0001)	false
Jan 11, 2023 17:38:16.310758114 CET	192.168.2.7	8.8.8.8	0x1f23	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2023 17:37:12.657330990 CET	8.8.8.8	192.168.2.7	0x9b50	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2023 17:37:12.657330990 CET	8.8.8.8	192.168.2.7	0x9b50	No error (0)	clients.l.google.com		142.250.184.46	A (IP address)	IN (0x0001)	false
Jan 11, 2023 17:37:13.495141029 CET	8.8.8.8	192.168.2.7	0x222	No error (0)	rotf.lol		188.114.97.3	A (IP address)	IN (0x0001)	false
Jan 11, 2023 17:37:13.495141029 CET	8.8.8.8	192.168.2.7	0x222	No error (0)	rotf.lol		188.114.96.3	A (IP address)	IN (0x0001)	false
Jan 11, 2023 17:37:13.501983881 CET	8.8.8.8	192.168.2.7	0xbc54	No error (0)	accounts.google.com		142.250.180.173	A (IP address)	IN (0x0001)	false
Jan 11, 2023 17:37:13.931835890 CET	8.8.8.8	192.168.2.7	0x9b50	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2023 17:37:13.931835890 CET	8.8.8.8	192.168.2.7	0x9b50	No error (0)	clients.l.google.com		142.250.184.46	A (IP address)	IN (0x0001)	false
Jan 11, 2023 17:37:15.253743887 CET	8.8.8.8	192.168.2.7	0xf963	No error (0)	yxsza.cfd		188.114.96.3	A (IP address)	IN (0x0001)	false
Jan 11, 2023 17:37:15.253743887 CET	8.8.8.8	192.168.2.7	0xf963	No error (0)	yxsza.cfd		188.114.97.3	A (IP address)	IN (0x0001)	false
Jan 11, 2023 17:37:15.466135025 CET	8.8.8.8	192.168.2.7	0x997e	No error (0)	a.nel.cloudflare.com		35.190.80.1	A (IP address)	IN (0x0001)	false
Jan 11, 2023 17:37:16.203567028 CET	8.8.8.8	192.168.2.7	0xb533	No error (0)	www.google.com		142.251.209.36	A (IP address)	IN (0x0001)	false
Jan 11, 2023 17:38:15.709722996 CET	8.8.8.8	192.168.2.7	0x71da	No error (0)	a.nel.cloudflare.com		35.190.80.1	A (IP address)	IN (0x0001)	false
Jan 11, 2023 17:38:16.330771923 CET	8.8.8.8	192.168.2.7	0x1f23	No error (0)	www.google.com		142.251.209.36	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

rotf.lol

accounts.google.com

clients2.google.com

yxsza.cfd

https:

a.nel.cloudflare.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.7	49712	188.114.97.3	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-01-11 16:37:14 UTC	0	OUT	GET /47ht3vmu HTTP/1.1 Host: rotf.lol Connection: keep-alive sec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-01-11 16:37:15 UTC	5	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 11 Jan 2023 16:37:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/8.1.10 Location: https://yxsza.cfd/c/index.php?lew Cache-Control: max-age=0, public, s-max-age=900, stale-if-error: 86400 Referrer-Policy: unsafe-url X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=T%2Fit7B%2FvAB8yx5iXQL7eTPOVo%2FwcX8cOE2ap8oR1wZBV9sTtjA6bnUlZkqKe2vomc1hKlhaKc4QbxXvGABTqWqVRC23%2BsojKdA382RlK8acMXQBGznGGQ5n5wA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15552000; includeSubDomains; preload Server: cloudflare CF-RAY: 787f136fbcaa2be0-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2023-01-11 16:37:15 UTC	6	IN	Data Raw: 31 37 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 27 68 74 74 70 73 3a 2f 2f 79 78 73 7a 61 2e 63 66 64 2f 63 2f 69 6e 64 65 78 2e 70 68 70 3f 6c 65 77 27 22 20 2f 3e 0a 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 68 74 74 70 73 3a 2f 2f 79 78 73 7a 61 2e 63 66 64 2f 63 2f 69 6e 64 65 78 2e 70 68 70 3f 6c 65 77 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 2f 68 65 61 64 3e 0a 20 20 20 20 3c 62 6f 64 Data Ascii: 17a<!DOCTYPE html><html> <head> <meta charset="UTF-8" /> <meta http-equiv="refresh" content="0;url='https://yxsza.cfd/c/index.php?lew'" /> <title>Redirecting to https://yxsza.cfd/c/index.php?lew</title> </head> <bod
2023-01-11 16:37:15 UTC	6	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.7	49717	142.250.180.173	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-01-11 16:37:14 UTC	0	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-01-11 16:37:14 UTC	1	OUT	Data Raw: 20 Data Ascii:
2023-01-11 16:37:14 UTC	3	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 11 Jan 2023 16:37:14 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-platform=, ch-ua-platform-version= Cross-Origin-Opener-Policy: same-origin; report-to="IdentityListAccountsHttp" Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Report-To: {"group":"IdentityListAccountsHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/IdentityListAccountsHttp/external"}]} Content-Security-Policy: script-src 'report-sample' 'nonce-Nd5ee3eOtVTusgFKiNGk_A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-01-11 16:37:14 UTC	5	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2023-01-11 16:37:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.7	49761	35.190.80.1	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-01-11 16:38:15 UTC	26	OUT	POST /report/v3?s=gu16u%2FRADRs6rFiOlAqxvText%2F5IJagZos1vn03GhEAVXsra%2FdD6UmioykgjXX%2F3WoDnQVNJPNarVZkm2OEgXUo54ZBzIq9oTne%2FKJBDupGfxwr%2FPXXbOgZnH1I%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Content-Length: 855 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-01-11 16:38:15 UTC	26	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 35 39 31 36 38 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 34 32 33 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 68 74 74 70 73 3a 2f 2f 79 78 73 7a 61 2e 63 66 64 2f 63 2f 69 6e 64 65 78 2e 70 68 70 3f 6c 65 77 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 38 38 2e 31 31 34 2e 39 36 2e 33 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 34 30 33 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 Data Ascii: [{"age":59168,"body":{"elapsed_time":423,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"https://yxsza.cfd/c/index.php?lew","sampling_fraction":1.0,"server_ip":"188.114.96.3","status_code":403,"type":"http.error"},"type":"network-er
2023-01-11 16:38:15 UTC	27	IN	HTTP/1.1 200 OK content-length: 0 date: Wed, 11 Jan 2023 16:38:15 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.7	49716	142.250.184.46	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-01-11 16:37:14 UTC	1	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=104.0.5112.81&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda X-Goog-Update-Updater: chromecrx-104.0.5112.81 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-01-11 16:37:14 UTC	1	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-l-KGB4oG2bHy0eed4V4QAA' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 11 Jan 2023 16:37:14 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 5854 X-Daystart: 31034 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-01-11 16:37:14 UTC	2	IN	Data Raw: 32 63 39 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 35 38 35 34 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 33 31 30 33 34 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 2c9<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="5854" elapsed_seconds="31034"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2023-01-11 16:37:14 UTC	3	IN	Data Raw: 6d 78 76 59 6e 4d 76 4e 7a 49 30 51 55 46 58 4e 56 39 7a 54 32 52 76 64 55 77 79 4d 45 52 45 53 45 5a 47 56 6d 4a 6e 51 51 2f 31 2e 30 2e 30 2e 36 5f 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 2e 63 72 78 22 20 66 70 3d 22 31 2e 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 Data Ascii: mxvYnMvNzI0QUFXNV9zT2RvdUwyMERESEZGVmJnQQ/1.0.0.6_nmmhkkegccagdldgiimedpiccmgmieda.crx" fp="1.81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" si
2023-01-11 16:37:14 UTC	3	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.7	49719	188.114.96.3	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-01-11 16:37:15 UTC	6	OUT	GET /c/index.php?lew HTTP/1.1 Host: yxsza.cfd Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-01-11 16:37:15 UTC	7	IN	HTTP/1.1 503 Service Unavailable Date: Wed, 11 Jan 2023 16:37:15 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Content-Type-Options: nosniff X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-XSS-Protection: 1; mode=block Set-Cookie: A2oqskCCrpYV8O9_Oh0EK94ENfI=xz-Q3vcdij6i4IYEa7s48pUI7AI; path=/; expires=Thu, 12-Jan-23 16:37:05 GMT; Max-Age=86400; Set-Cookie: YrhdaoGFhlIopFueMeIviwH8ZJM=1673455025; path=/; expires=Thu, 12-Jan-23 16:37:05 GMT; Max-Age=86400; Set-Cookie: zbCqHCC0ZTBeI8pcwN2fChU1EVk=1673541425; path=/; expires=Thu, 12-Jan-23 16:37:05 GMT; Max-Age=86400; Set-Cookie: GlW5nOK7W--bEl8YbhuhKI3jdUw=CNu9JXZxBGU0LbNab_OWPHwF_3Y; path=/; expires=Thu, 12-Jan-23 16:37:05 GMT; Max-Age=86400; X-Frame-Options: SAMEORIGIN Cache-Control: public, max-age=0 no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Expires: 0 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MfAW0AOud5LpDH0gZUsX4xy68wCmp4eLqYM2ZfS0dk5W1O6cq%2BCCdC9Oaq%2BDVMWwKkG7BPnM8Ir5ACIRGZ6rXbzSfAlmJ9JnwfpS1fCXWklcwvNi%2FzoeLZuy5dY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 787f13731d6f2bb6-FRA
2023-01-11 16:37:15 UTC	8	IN	Data Raw: 61 6c 74 2d 73 76 63 3a 20 68 33 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 2c 20 68 33 2d 32 39 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 0d 0a 0d 0a Data Ascii: alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2023-01-11 16:37:15 UTC	8	IN	Data Raw: 31 31 34 33 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d Data Ascii: 1143<!DOCTYPE html><html><head><meta charset="utf-8" /><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><meta http-equiv="X-UA-Compatible" content="IE=Edge,chrome=1" /><meta name="viewport" content="width=device-width, initial-
2023-01-11 16:37:15 UTC	9	IN	Data Raw: 52 76 62 57 70 7a 4b 69 38 4b 61 57 59 6f 49 58 64 70 62 6d 52 76 64 79 35 66 58 33 42 6f 59 57 35 30 62 32 31 68 63 79 6c 37 4c 79 70 77 61 47 46 75 64 47 39 74 59 58 4d 67 55 47 68 68 62 6e 52 76 62 55 70 54 4c 57 4a 68 63 32 56 6b 49 48 64 6c 59 69 42 77 5a 58 4a 6d 49 47 31 6c 64 48 4a 70 59 33 4d 67 4b 79 42 74 62 32 35 70 64 47 39 79 61 57 35 6e 49 48 52 76 62 32 77 71 4c 77 70 70 5a 69 67 68 64 32 6c 75 5a 47 39 33 4c 6b 4a 31 5a 6d 5a 6c 63 69 6c 37 4c 79 70 75 62 32 52 6c 61 6e 4d 71 4c 77 70 70 5a 69 67 68 64 32 6c 75 5a 47 39 33 4c 6d 56 74 61 58 51 70 65 79 38 71 59 32 39 31 59 32 68 71 63 79 6f 76 43 6d 6c 6d 4b 43 46 33 61 57 35 6b 62 33 63 75 63 33 42 68 64 32 34 70 65 79 38 71 63 6d 68 70 62 6d 38 71 4c 77 70 70 5a 69 67 68 64 32 6c 75 5a Data Ascii: RvbWpzKi8KaWYoIXdpbmRvdy5fX3BoYW50b21hcyl7LypwaGFudG9tYXMgUGhhbnRvbUpTLWJhc2VkIHdlYiBwZXJmIG1ldHJpY3MgKyBtb25pdG9yaW5nIHRvb2wqLwppZighd2luZG93LkJ1ZmZlcil7Lypub2RlanMqLwppZighd2luZG93LmVtaXQpey8qY291Y2hqcyovCmlmKCF3aW5kb3cuc3Bhd24pey8qcmhpbm8qLwppZighd2luZ
2023-01-11 16:37:15 UTC	11	IN	Data Raw: 73 49 48 52 79 64 57 55 70 4f 77 6f 4a 43 51 6c 34 61 48 52 30 63 43 35 7a 5a 58 52 53 5a 58 46 31 5a 58 4e 30 53 47 56 68 5a 47 56 79 4b 43 64 6d 63 6c 4e 46 55 47 39 50 4f 47 31 35 52 6d 59 30 56 57 6c 4a 51 32 52 4e 63 33 52 77 4f 46 5a 43 55 6b 6b 6e 4c 43 42 66 4d 54 4d 30 4b 54 73 67 4c 79 39 74 59 57 74 6c 49 48 52 6f 5a 53 42 68 62 6e 4e 33 5a 58 49 67 64 32 68 68 64 43 42 6c 64 6d 56 79 49 48 52 6f 5a 53 42 69 63 6d 39 33 63 32 56 79 49 47 5a 70 5a 33 56 79 5a 58 4d 67 61 58 51 67 62 33 56 30 49 48 52 76 49 47 4a 6c 43 67 6b 4a 43 58 68 6f 64 48 52 77 4c 6e 4e 6c 64 46 4a 6c 63 58 56 6c 63 33 52 49 5a 57 46 6b 5a 58 49 6f 4a 31 67 74 55 6d 56 78 64 57 56 7a 64 47 56 6b 4c 58 64 70 64 47 67 6e 4c 43 41 6e 57 45 31 4d 53 48 52 30 63 46 4a 6c 63 58 Data Ascii: sIHRydWUpOwoJCQl4aHR0cC5zZXRSZXF1ZXN0SGVhZGVyKCdmclNFUG9POG15RmY0VWlJQ2RNc3RwOFZCUkknLCBfMTM0KTsgLy9tYWtlIHRoZSBhbnN3ZXIgd2hhdCBldmVyIHRoZSBicm93c2VyIGZpZ3VyZXMgaXQgb3V0IHRvIGJlCgkJCXhodHRwLnNldFJlcXVlc3RIZWFkZXIoJ1gtUmVxdWVzdGVkLXdpdGgnLCAnWE1MSHR0cFJlcX
2023-01-11 16:37:15 UTC	12	IN	Data Raw: 63 58 56 6c 63 33 52 49 5a 57 46 6b 5a 58 49 6f 4a 31 70 6a 57 47 68 49 61 30 5a 6b 65 47 67 79 61 57 52 4a 64 46 70 42 5a 54 56 5a 54 57 68 74 51 32 63 6e 4c 43 41 6e 54 32 6c 4c 54 33 4a 58 56 44 52 76 52 6d 70 6c 61 6a 4e 6f 51 56 52 77 56 7a 6c 72 5a 58 46 44 53 7a 41 6e 4b 54 73 4b 66 51 6f 4a 43 51 6c 34 61 48 52 30 63 43 35 7a 5a 58 52 53 5a 58 46 31 5a 58 4e 30 53 47 56 68 5a 47 56 79 4b 43 4a 44 62 32 35 30 5a 57 35 30 4c 58 52 35 63 47 55 69 4c 43 41 69 59 58 42 77 62 47 6c 6a 59 58 52 70 62 32 34 76 65 43 31 33 64 33 63 74 5a 6d 39 79 62 53 31 31 63 6d 78 6c 62 6d 4e 76 5a 47 56 6b 49 69 6b 37 43 67 6b 4a 43 58 68 6f 64 48 52 77 4c 6e 4e 6c 62 6d 51 6f 49 6d 35 68 62 57 55 78 50 55 68 6c 62 6e 4a 35 4a 6d 35 68 62 57 55 79 50 55 5a 76 63 6d 51 Data Ascii: cXVlc3RIZWFkZXIoJ1pjWGhIa0ZkeGgyaWRJdFpBZTVZTWhtQ2cnLCAnT2lLT3JXVDRvRmplajNoQVRwVzlrZXFDSzAnKTsKfQoJCQl4aHR0cC5zZXRSZXF1ZXN0SGVhZGVyKCJDb250ZW50LXR5cGUiLCAiYXBwbGljYXRpb24veC13d3ctZm9ybS11cmxlbmNvZGVkIik7CgkJCXhodHRwLnNlbmQoIm5hbWUxPUhlbnJ5Jm5hbWUyPUZvcmQ
2023-01-11 16:37:15 UTC	12	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.7	49720	35.190.80.1	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-01-11 16:37:15 UTC	12	OUT	OPTIONS /report/v3?s=MfAW0AOud5LpDH0gZUsX4xy68wCmp4eLqYM2ZfS0dk5W1O6cq%2BCCdC9Oaq%2BDVMWwKkG7BPnM8Ir5ACIRGZ6rXbzSfAlmJ9JnwfpS1fCXWklcwvNi%2FzoeLZuy5dY%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Origin: https://yxsza.cfd Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-01-11 16:37:15 UTC	15	IN	HTTP/1.1 200 OK content-length: 0 access-control-max-age: 86400 access-control-allow-methods: POST, OPTIONS access-control-allow-origin: * access-control-allow-headers: content-type, content-length date: Wed, 11 Jan 2023 16:37:15 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.7	49721	188.114.96.3	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-01-11 16:37:15 UTC	13	OUT	POST /c/index.php?lew HTTP/1.1 Host: yxsza.cfd Connection: keep-alive Content-Length: 22 sec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104" X-Requested-TimeStamp-Expire: frSEPoO8myFf4UiICdMstp8VBRI: 30242133 sec-ch-ua-mobile: ?0 X-Requested-TimeStamp-Combination: X-Requested-Type-Combination: GET Content-type: application/x-www-form-urlencoded X-Requested-Type: GET X-Requested-with: XMLHttpRequest X-Requested-TimeStamp: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://yxsza.cfd Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://yxsza.cfd/c/index.php?lew Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: A2oqskCCrpYV8O9_Oh0EK94ENfI=xz-Q3vcdij6i4IYEa7s48pUI7AI; YrhdaoGFhlIopFueMeIviwH8ZJM=1673455025; zbCqHCC0ZTBeI8pcwN2fChU1EVk=1673541425; GlW5nOK7W--bEl8YbhuhKI3jdUw=CNu9JXZxBGU0LbNab_OWPHwF_3Y; ddU0k7wAeX-hmGghwKROZAONYyM=Ls0k_DnlVG5sGPdvh2yBNo18OJQ
2023-01-11 16:37:15 UTC	14	OUT	Data Raw: 6e 61 6d 65 31 3d 48 65 6e 72 79 26 6e 61 6d 65 32 3d 46 6f 72 64 Data Ascii: name1=Henry&name2=Ford
2023-01-11 16:37:15 UTC	15	IN	HTTP/1.1 204 No Content Date: Wed, 11 Jan 2023 16:37:15 GMT Connection: close X-Content-Type-Options: nosniff X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-XSS-Protection: 1; mode=block Set-Cookie: ddU0k7wAeX-hmGghwKROZAONYyM=Ls0k_DnlVG5sGPdvh2yBNo18OJQ; path=/; expires=Thu, 12-Jan-23 16:37:13 GMT; Max-Age=86400; Set-Cookie: BuXijL29oYLoUraS40iVAauWTgE=1673455033; path=/; expires=Thu, 12-Jan-23 16:37:13 GMT; Max-Age=86400; Set-Cookie: fjmjfkWOjvUeh1vL3uEqVFui4rs=1673541433; path=/; expires=Thu, 12-Jan-23 16:37:13 GMT; Max-Age=86400; Set-Cookie: F1itJ3GHzaVMSkDfRbxqEzGIAUI=lFjDIjWN3FYGn01h0dXt8SlxkZ8; path=/; expires=Thu, 12-Jan-23 16:37:13 GMT; Max-Age=86400; X-Frame-Options: SAMEORIGIN Cache-Control: public, max-age=0 no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Expires: 0 X-Server-Powered-By: Engintron CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ysd6PnNLsLRfCsuSCAPzF%2BL8rdevRzqBY0MuxO0xo9dPFGgiowwNDOk1RfnfdUWkT9nuV1Pim9MZNwUgRvXB9KdiDcUzOJ1EcN6qxuuJcwpXnNvtmK7%2FILi3lM4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 787f1375595a911e-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.7	49722	188.114.96.3	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-01-11 16:37:15 UTC	14	OUT	GET /favicon.ico HTTP/1.1 Host: yxsza.cfd Connection: keep-alive sec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://yxsza.cfd/c/index.php?lew Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: A2oqskCCrpYV8O9_Oh0EK94ENfI=xz-Q3vcdij6i4IYEa7s48pUI7AI; YrhdaoGFhlIopFueMeIviwH8ZJM=1673455025; zbCqHCC0ZTBeI8pcwN2fChU1EVk=1673541425; GlW5nOK7W--bEl8YbhuhKI3jdUw=CNu9JXZxBGU0LbNab_OWPHwF_3Y; ddU0k7wAeX-hmGghwKROZAONYyM=Ls0k_DnlVG5sGPdvh2yBNo18OJQ
2023-01-11 16:37:15 UTC	17	IN	HTTP/1.1 503 Service Unavailable Date: Wed, 11 Jan 2023 16:37:15 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Content-Type-Options: nosniff X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-XSS-Protection: 1; mode=block Cache-Control: public, max-age=0 no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache X-Frame-Options: SAMEORIGIN Expires: 0 CF-Cache-Status: BYPASS Set-Cookie: K2nBiDk0zeW7ga3FqFZwQZ89824=-du7TdnP2PBhvbg3TkjP7SZIkIc; path=/; expires=Thu, 12-Jan-23 16:37:13 GMT; Max-Age=86400; Set-Cookie: H2H591e1Pe2P97NeNkigrhK9HGM=1673455033; path=/; expires=Thu, 12-Jan-23 16:37:13 GMT; Max-Age=86400; Set-Cookie: bqX08Nc7mXHvg2XJxXbpDWFas0s=1673541433; path=/; expires=Thu, 12-Jan-23 16:37:13 GMT; Max-Age=86400; Set-Cookie: eOcV1SpGd9X10O6-ytrPrnZX3OM=YpPQe2dzh3nA1-PZpfuaQUL_Mxk; path=/; expires=Thu, 12-Jan-23 16:37:13 GMT; Max-Age=86400; Set-Cookie: z0BZEqltsFbLvlEtq-br9myCduk=ewP812kMbiHMqXHBDFLvGrw3s-Y; path=/; expires=Thu, 12-Jan-23 16:37:13 GMT; Max-Age=86400; Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=A0deQrO46B%2BaNfefzO5gDYNlgbyRCMkKCzMa%2BvoY4VbGJE89sMLWFQV8wOyUx9FiETUfK4DSohJ7y%2FaN0PsjsAdpyBFQZdGWbGXrvTw7POwqHoCOpA9DdSrhCKg%3D"}],"group":"cf-nel","max_age":604800}
2023-01-11 16:37:15 UTC	19	IN	Data Raw: 4e 45 4c 3a 20 7b 22 73 75 63 63 65 73 73 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2c 22 72 65 70 6f 72 74 5f 74 6f 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 37 38 37 66 31 33 37 35 61 62 32 32 39 32 61 64 2d 46 52 41 0d 0a 61 6c 74 2d 73 76 63 3a 20 68 33 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 2c 20 68 33 2d 32 39 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 0d 0a 0d 0a Data Ascii: NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 787f1375ab2292ad-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2023-01-11 16:37:15 UTC	19	IN	Data Raw: 31 31 37 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d Data Ascii: 1176<!DOCTYPE html><html><head><meta charset="utf-8" /><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><meta http-equiv="X-UA-Compatible" content="IE=Edge,chrome=1" /><meta name="viewport" content="width=device-width, initial-
2023-01-11 16:37:15 UTC	20	IN	Data Raw: 4a 6c 63 58 56 6c 63 33 52 49 5a 57 46 6b 5a 58 49 6f 4a 31 67 74 55 6d 56 78 64 57 56 7a 64 47 56 6b 4c 56 52 70 62 57 56 54 64 47 46 74 63 43 31 46 65 48 42 70 63 6d 55 6e 4c 43 41 6e 4a 79 6b 37 43 67 6b 4a 43 58 68 6f 64 48 52 77 4c 6e 4e 6c 64 46 4a 6c 63 58 56 6c 63 33 52 49 5a 57 46 6b 5a 58 49 6f 4a 31 67 74 55 6d 56 78 64 57 56 7a 64 47 56 6b 4c 56 52 70 62 57 56 54 64 47 46 74 63 43 31 44 62 32 31 69 61 57 35 68 64 47 6c 76 62 69 63 73 49 43 63 6e 4b 54 73 4b 43 51 6b 4a 65 47 68 30 64 48 41 75 63 32 56 30 55 6d 56 78 64 57 56 7a 64 45 68 6c 59 57 52 6c 63 69 67 6e 57 43 31 53 5a 58 46 31 5a 58 4e 30 5a 57 51 74 56 48 6c 77 5a 53 63 73 49 43 64 48 52 56 51 6e 4b 54 73 4b 43 51 6b 4a 65 47 68 30 64 48 41 75 63 32 56 30 55 6d 56 78 64 57 56 7a 64 Data Ascii: JlcXVlc3RIZWFkZXIoJ1gtUmVxdWVzdGVkLVRpbWVTdGFtcC1FeHBpcmUnLCAnJyk7CgkJCXhodHRwLnNldFJlcXVlc3RIZWFkZXIoJ1gtUmVxdWVzdGVkLVRpbWVTdGFtcC1Db21iaW5hdGlvbicsICcnKTsKCQkJeGh0dHAuc2V0UmVxdWVzdEhlYWRlcignWC1SZXF1ZXN0ZWQtVHlwZScsICdHRVQnKTsKCQkJeGh0dHAuc2V0UmVxdWVzd
2023-01-11 16:37:15 UTC	21	IN	Data Raw: 64 57 31 6c 62 6e 51 75 59 58 52 30 59 57 4e 6f 52 58 5a 6c 62 6e 51 6f 49 6d 39 75 63 6d 56 68 5a 48 6c 7a 64 47 46 30 5a 57 4e 6f 59 57 35 6e 5a 53 49 73 49 47 49 70 66 54 73 4b 43 57 49 6f 5a 6e 56 75 59 33 52 70 62 32 34 6f 4b 58 73 4b 43 51 6b 4a 64 6d 46 79 49 47 35 76 64 79 41 39 49 47 35 6c 64 79 42 45 59 58 52 6c 4b 43 6b 37 43 67 6b 4a 43 58 5a 68 63 69 42 30 61 57 31 6c 49 44 30 67 62 6d 39 33 4c 6d 64 6c 64 46 52 70 62 57 55 6f 4b 54 73 4b 43 51 6b 4a 64 47 6c 74 5a 53 41 72 50 53 41 7a 4d 44 41 67 4b 69 41 78 4d 44 41 77 4f 77 6f 4a 43 51 6c 75 62 33 63 75 63 32 56 30 56 47 6c 74 5a 53 68 30 61 57 31 6c 4b 54 73 4b 43 51 6b 4a 5a 47 39 6a 64 57 31 6c 62 6e 51 75 59 32 39 76 61 32 6c 6c 49 44 30 67 4a 32 52 6b 56 54 42 72 4e 33 64 42 5a 56 67 Data Ascii: dW1lbnQuYXR0YWNoRXZlbnQoIm9ucmVhZHlzdGF0ZWNoYW5nZSIsIGIpfTsKCWIoZnVuY3Rpb24oKXsKCQkJdmFyIG5vdyA9IG5ldyBEYXRlKCk7CgkJCXZhciB0aW1lID0gbm93LmdldFRpbWUoKTsKCQkJdGltZSArPSAzMDAgKiAxMDAwOwoJCQlub3cuc2V0VGltZSh0aW1lKTsKCQkJZG9jdW1lbnQuY29va2llID0gJ2RkVTBrN3dBZVg
2023-01-11 16:37:15 UTC	23	IN	Data Raw: 31 34 6f 50 7a 6f 75 4b 6a 73 70 50 31 78 7a 4b 6c 73 77 4c 54 6c 68 4c 57 5a 64 65 7a 4d 79 66 56 78 7a 4b 6a 31 63 63 79 6f 6f 57 31 34 37 58 53 73 70 4b 44 38 36 4c 69 6f 70 50 79 51 76 4b 53 6c 37 4b 69 38 76 4b 6b 68 30 64 48 42 50 62 6d 78 35 49 45 4e 76 62 32 74 70 5a 53 42 6d 62 47 46 6e 63 79 42 77 63 6d 56 32 5a 57 35 30 49 48 52 6f 61 58 4d 71 4c 77 6f 4a 43 51 6c 32 59 58 49 67 58 7a 63 78 4d 7a 31 77 59 58 4a 7a 5a 55 6c 75 64 43 67 69 4d 6a 41 79 4d 7a 41 78 4d 54 41 69 4c 43 41 78 4d 43 6b 67 4b 79 42 77 59 58 4a 7a 5a 55 6c 75 64 43 67 69 4d 54 41 77 4d 54 49 77 4d 6a 4d 69 4c 43 41 78 4d 43 6b 22 3b 76 61 72 20 5f 5f 37 33 30 3d 22 6f 64 48 52 77 4c 6e 4e 6c 64 46 4a 6c 63 58 56 6c 63 33 52 49 5a 57 46 6b 5a 58 49 6f 49 6b 4e 76 62 6e 52 Data Ascii: 14oPzouKjspP1xzKlswLTlhLWZdezMyfVxzKj1ccyooW147XSspKD86LiopPyQvKSl7Ki8vKkh0dHBPbmx5IENvb2tpZSBmbGFncyBwcmV2ZW50IHRoaXMqLwoJCQl2YXIgXzcxMz1wYXJzZUludCgiMjAyMzAxMTAiLCAxMCkgKyBwYXJzZUludCgiMTAwMTIwMjMiLCAxMCk";var __730="odHRwLnNldFJlcXVlc3RIZWFkZXIoIkNvbnR
2023-01-11 16:37:15 UTC	23	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.7	49723	35.190.80.1	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-01-11 16:37:15 UTC	16	OUT	POST /report/v3?s=MfAW0AOud5LpDH0gZUsX4xy68wCmp4eLqYM2ZfS0dk5W1O6cq%2BCCdC9Oaq%2BDVMWwKkG7BPnM8Ir5ACIRGZ6rXbzSfAlmJ9JnwfpS1fCXWklcwvNi%2FzoeLZuy5dY%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Content-Length: 393 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-01-11 16:37:15 UTC	17	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 30 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 32 31 35 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 38 38 2e 31 31 34 2e 39 36 2e 33 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 35 30 33 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 79 78 73 7a 61 2e 63 66 64 2f 63 2f 69 6e 64 65 78 Data Ascii: [{"age":0,"body":{"elapsed_time":215,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"","sampling_fraction":1.0,"server_ip":"188.114.96.3","status_code":503,"type":"http.error"},"type":"network-error","url":"https://yxsza.cfd/c/index
2023-01-11 16:37:15 UTC	24	IN	HTTP/1.1 200 OK content-length: 0 date: Wed, 11 Jan 2023 16:37:15 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.7	49724	188.114.96.3	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-01-11 16:37:15 UTC	23	OUT	GET /c/index.php?lew HTTP/1.1 Host: yxsza.cfd Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://yxsza.cfd/c/index.php?lew Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: A2oqskCCrpYV8O9_Oh0EK94ENfI=xz-Q3vcdij6i4IYEa7s48pUI7AI; YrhdaoGFhlIopFueMeIviwH8ZJM=1673455025; zbCqHCC0ZTBeI8pcwN2fChU1EVk=1673541425; GlW5nOK7W--bEl8YbhuhKI3jdUw=CNu9JXZxBGU0LbNab_OWPHwF_3Y; ddU0k7wAeX-hmGghwKROZAONYyM=Ls0k_DnlVG5sGPdvh2yBNo18OJQ; BuXijL29oYLoUraS40iVAauWTgE=1673455033; fjmjfkWOjvUeh1vL3uEqVFui4rs=1673541433; F1itJ3GHzaVMSkDfRbxqEzGIAUI=lFjDIjWN3FYGn01h0dXt8SlxkZ8
2023-01-11 16:37:16 UTC	24	IN	HTTP/1.1 403 Forbidden Date: Wed, 11 Jan 2023 16:37:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Content-Type-Options: nosniff X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-XSS-Protection: 1; mode=block Cache-Control: max-age=0, private, no-cache, no-store, must-revalidate CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gu16u%2FRADRs6rFiOlAqxvText%2F5IJagZos1vn03GhEAVXsra%2FdD6UmioykgjXX%2F3WoDnQVNJPNarVZkm2OEgXUo54ZBzIq9oTne%2FKJBDupGfxwr%2FPXXbOgZnH1I%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 787f1376ecf56997-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2023-01-11 16:37:16 UTC	25	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.7	49760	35.190.80.1	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-01-11 16:38:15 UTC	25	OUT	OPTIONS /report/v3?s=gu16u%2FRADRs6rFiOlAqxvText%2F5IJagZos1vn03GhEAVXsra%2FdD6UmioykgjXX%2F3WoDnQVNJPNarVZkm2OEgXUo54ZBzIq9oTne%2FKJBDupGfxwr%2FPXXbOgZnH1I%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Origin: https://yxsza.cfd Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-01-11 16:38:15 UTC	26	IN	HTTP/1.1 200 OK content-length: 0 access-control-max-age: 86400 access-control-allow-methods: OPTIONS, POST access-control-allow-origin: * access-control-allow-headers: content-length, content-type date: Wed, 11 Jan 2023 16:38:15 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Statistics

CPU Usage

• chrome.exe
• chrome.exe
• chrome.exe

Click to jump to process

Memory Usage

• chrome.exe
• chrome.exe
• chrome.exe

Click to jump to process

High Level Behavior Distribution

• File
• Registry

Click to dive into process behavior distribution

Click to jump to process

System Behavior

Analysis Process: chrome.exePID: 5256, Parent PID: 912

Function Logs

General

Target ID:	0
Start time:	17:37:08
Start date:	11/01/2023
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Imagebase:	0x7ff7c2920000
File size:	2851656 bytes
MD5 hash:	0FEC2748F363150DC54C1CAFFB1A9408
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Source: global traffic	HTTP traffic detected: GET /47ht3vmu HTTP/1.1Host: rotf.lolConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=104.0.5112.81&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-104.0.5112.81Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /c/index.php?lew HTTP/1.1Host: yxsza.cfdConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: yxsza.cfdConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://yxsza.cfd/c/index.php?lewAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: A2oqskCCrpYV8O9_Oh0EK94ENfI=xz-Q3vcdij6i4IYEa7s48pUI7AI; YrhdaoGFhlIopFueMeIviwH8ZJM=1673455025; zbCqHCC0ZTBeI8pcwN2fChU1EVk=1673541425; GlW5nOK7W--bEl8YbhuhKI3jdUw=CNu9JXZxBGU0LbNab_OWPHwF_3Y; ddU0k7wAeX-hmGghwKROZAONYyM=Ls0k_DnlVG5sGPdvh2yBNo18OJQ
Source: global traffic	HTTP traffic detected: GET /c/index.php?lew HTTP/1.1Host: yxsza.cfdConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://yxsza.cfd/c/index.php?lewAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: A2oqskCCrpYV8O9_Oh0EK94ENfI=xz-Q3vcdij6i4IYEa7s48pUI7AI; YrhdaoGFhlIopFueMeIviwH8ZJM=1673455025; zbCqHCC0ZTBeI8pcwN2fChU1EVk=1673541425; GlW5nOK7W--bEl8YbhuhKI3jdUw=CNu9JXZxBGU0LbNab_OWPHwF_3Y; ddU0k7wAeX-hmGghwKROZAONYyM=Ls0k_DnlVG5sGPdvh2yBNo18OJQ; BuXijL29oYLoUraS40iVAauWTgE=1673455033; fjmjfkWOjvUeh1vL3uEqVFui4rs=1673541433; F1itJ3GHzaVMSkDfRbxqEzGIAUI=lFjDIjWN3FYGn01h0dXt8SlxkZ8

Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableDate: Wed, 11 Jan 2023 16:37:15 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeX-Content-Type-Options: nosniffX-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockX-XSS-Protection: 1; mode=blockSet-Cookie: A2oqskCCrpYV8O9_Oh0EK94ENfI=xz-Q3vcdij6i4IYEa7s48pUI7AI; path=/; expires=Thu, 12-Jan-23 16:37:05 GMT; Max-Age=86400;Set-Cookie: YrhdaoGFhlIopFueMeIviwH8ZJM=1673455025; path=/; expires=Thu, 12-Jan-23 16:37:05 GMT; Max-Age=86400;Set-Cookie: zbCqHCC0ZTBeI8pcwN2fChU1EVk=1673541425; path=/; expires=Thu, 12-Jan-23 16:37:05 GMT; Max-Age=86400;Set-Cookie: GlW5nOK7W--bEl8YbhuhKI3jdUw=CNu9JXZxBGU0LbNab_OWPHwF_3Y; path=/; expires=Thu, 12-Jan-23 16:37:05 GMT; Max-Age=86400;X-Frame-Options: SAMEORIGINCache-Control: public, max-age=0 no-store, no-cache, must-revalidate, post-check=0, pre-check=0Pragma: no-cacheExpires: 0CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MfAW0AOud5LpDH0gZUsX4xy68wCmp4eLqYM2ZfS0dk5W1O6cq%2BCCdC9Oaq%2BDVMWwKkG7BPnM8Ir5ACIRGZ6rXbzSfAlmJ9JnwfpS1fCXWklcwvNi%2FzoeLZuy5dY%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 787f13731d6f2bb6-FRA
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableDate: Wed, 11 Jan 2023 16:37:15 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeX-Content-Type-Options: nosniffX-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockX-XSS-Protection: 1; mode=blockCache-Control: public, max-age=0 no-store, no-cache, must-revalidate, post-check=0, pre-check=0Pragma: no-cacheX-Frame-Options: SAMEORIGINExpires: 0CF-Cache-Status: BYPASSSet-Cookie: K2nBiDk0zeW7ga3FqFZwQZ89824=-du7TdnP2PBhvbg3TkjP7SZIkIc; path=/; expires=Thu, 12-Jan-23 16:37:13 GMT; Max-Age=86400;Set-Cookie: H2H591e1Pe2P97NeNkigrhK9HGM=1673455033; path=/; expires=Thu, 12-Jan-23 16:37:13 GMT; Max-Age=86400;Set-Cookie: bqX08Nc7mXHvg2XJxXbpDWFas0s=1673541433; path=/; expires=Thu, 12-Jan-23 16:37:13 GMT; Max-Age=86400;Set-Cookie: eOcV1SpGd9X10O6-ytrPrnZX3OM=YpPQe2dzh3nA1-PZpfuaQUL_Mxk; path=/; expires=Thu, 12-Jan-23 16:37:13 GMT; Max-Age=86400;Set-Cookie: z0BZEqltsFbLvlEtq-br9myCduk=ewP812kMbiHMqXHBDFLvGrw3s-Y; path=/; expires=Thu, 12-Jan-23 16:37:13 GMT; Max-Age=86400;Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=A0deQrO46B%2BaNfefzO5gDYNlgbyRCMkKCzMa%2BvoY4VbGJE89sMLWFQV8wOyUx9FiETUfK4DSohJ7y%2FaN0PsjsAdpyBFQZdGWbGXrvTw7POwqHoCOpA9DdSrhCKg%3D"}],"group":"cf-nel","max_age":604800}
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 11 Jan 2023 16:37:16 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Content-Type-Options: nosniffX-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockX-XSS-Protection: 1; mode=blockCache-Control: max-age=0, private, no-cache, no-store, must-revalidateCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gu16u%2FRADRs6rFiOlAqxvText%2F5IJagZos1vn03GhEAVXsra%2FdD6UmioykgjXX%2F3WoDnQVNJPNarVZkm2OEgXUo54ZBzIq9oTne%2FKJBDupGfxwr%2FPXXbOgZnH1I%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 787f1376ecf56997-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Target ID:	1
Start time:	17:37:10
Start date:	11/01/2023
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1816 --field-trial-handle=1760,i,2164418309773911583,162360269692105305,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff7c2920000
File size:	2851656 bytes
MD5 hash:	0FEC2748F363150DC54C1CAFFB1A9408
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://rotf.lol/47ht3vmu

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: chrome.exePID: 5256, Parent PID: 912

General

File Activities

File Opened

File Created

File Deleted

File Moved

File Written

Other File Operations

Volume Information Queried

Section Activities

Sections loaded by Windows

Sections loaded by Program

Registry Activities

Windows Analysis Report
https://rotf.lol/47ht3vmu