Edit tour

Windows Analysis Report
https://sharefile8.pages.dev/qvuv+pyrqwzcz6xaxlnoqwjmehzvhi7wuk+tdmwkgv96kzea82mtrq3s+h+nlysnemgyfcvtuhozuighqob+lce9yippttt6fi1kubdsdbqmwx5kxujjxwu5crv4iqguxis5l5bqjc2sd56vkdj

Overview

General Information

Sample URL:	https://sharefile8.pages.dev/qvuv+pyrqwzcz6xaxlnoqwjmehzvhi7wuk+tdmwkgv96kzea82mtrq3s+h+nlysnemgyfcvtuhozuighqob+lce9yippttt6fi1kubdsdbqmwx5kxujjxwu5crv4iqguxis5l5bqjc2sd56vkdj
Analysis ID:	1502058
Infos:

Detection

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Antivirus / Scanner detection for submitted sample

Phishing site detected (based on favicon image match)

Phishing site detected (based on logo match)

Detected non-DNS traffic on DNS port

HTML body contains low number of good links

HTML title does not match URL

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64

chrome.exe (PID: 348 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 880 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1900,i,388128914800657721,16740972578459867677,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5524 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://sharefile8.pages.dev/qvuv+pyrqwzcz6xaxlnoqwjmehzvhi7wuk+tdmwkgv96kzea82mtrq3s+h+nlysnemgyfcvtuhozuighqob+lce9yippttt6fi1kubdsdbqmwx5kxujjxwu5crv4iqguxis5l5bqjc2sd56vkdj" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Source: https://sharefile8.pages.dev/qvuv+pyrqwzcz6xaxlnoqwjmehzvhi7wuk+tdmwkgv96kzea82mtrq3s+h+nlysnemgyfcvtuhozuighqob+lce9yippttt6fi1kubdsdbqmwx5kxujjxwu5crv4iqguxis5l5bqjc2sd56vkdj?8c17e643600ec20fef4f6911ec4e48e7m0hanxc8=U2FsdGVkX1%2BCd7%2FhtiLMTnMBdpVwMmJ1KSyDrJ7KzEDSzbmdM%2BK6Tvtld6HHT92c1qgm7oreWjv5Cnz%2Fm8DY12gjkyk1dTaxJoP0hcT2jb5uWGaaTFriv%2F0MfsU%2FcnV4I3oFJmdjC0pWwBVCgYQhwAhU5EmscQU4wflljPHYfjZlY9ZaUOFxfmhvl2vlgvh4Go0gQHzNWQR5SgXefEaLV9OkQk9gBk4c44TDZrE1RqypEYZ4og7DiQOLh2FxHuIRSXXLRAxuo%2ByuNsy604Cf7hBMYrxq47spI8x3nSLnF%2FJQqEpgpBvF8P%2Bp3yneKAfoQYC5M0QIHjOcNPa3dnUZ2JohrO6tqas4kBMqWAVYWAdNv4CykAnDac%2FIIvSaKTZ3dd940GO6i1Z1OLWWjQEpl%2F1AfOZ507isTPp4%2FhF13ZhnPsZUFo%2FmTQAFkx4Du%2FjWvM4AtpSo7C0m6YBuWll%2F5M7OqWl8yTimYCbou7r9IJcWLUfo1HhwA2GKeWqF5r6GfC6K2VQ9Eh6TtmRu4MCo484KHNp3OA%2BQ7nTZpwUnGq8roJWW0L6icuBAscTU%2B2jfVDblCZ%2BKKbkWWEE0oDeAzyNwjKk5%2B6azk9AmMtdzygm4HYIq0SsbZ8rVbiC%2FjjlcECR3k3llDILBIFfTfA82Sgs1YrRYzpZ2VIiJyewnPxn82KwYBap26TJ1wElBovKL0dUR9QXIV0fsk39dsnmXkNcV%2BAZ2%2FMV%2B%2F%2FOdxYAUtZAYi5F51VJjktkNUZqhsirAF6%2BQWE8Ckrak3J04%2BqYzHRzRQlgFoLRsyIh20z%2FBvYsWN63W%2B%2BZdWDAGN6BqXEFQc8%2BBAS%2BUDiVk1VDi41E62y%2BoJYZbB7zMptoVuKAAF5p1haL9CvCs2gtnmvmqADEAvebUoDre9%2FOYJfVgU%2Fimz3dJMfrd9EbDrc4ost3U1zl%2F0aYgG%2Fue7fyp3sPmrag1198q7907y0%2FviUforIwJ5B0HMgtH28odoWlFsIwm1oYdMxFpfRKRsVf7JwCLok1OLQ83aqgJzFjoPKaS9PsgriyyzKs6uS8pfHk0Yt3D9hgjzGIAaZe3dI0k9%2BjWH3Ob4%2FsLu95r9UY2Iw12U%2BZtTSXDEf%2BYRLNi7oKlHmf20R2EpT8KMrfo%2BrVpX3w2lj7XQBYNsueqZLK3V9WT1fDkdGSliiKusiZAPix5kv3fP60nlD%2FQ3CKfto8kvPbaCXlteM%2FWrK8h2Xq7TELZUCH4P5Mu2CWRmmuJdewXolo6VkJ3pp4sJc0cJmJMbtmBvNP0qYZCOMiNOe4Z1IyDySDYX2w5n3wxoaoqOHswKQXGdNFjPZsubI3jt12v9JLz%2Bc%2FGk8lJzJseXdIwTzyHni0KoXwdSPh9Urz4V7MM4vFE13g8CyHoJ5MJwX6iN2d5u6jK7NCANH%2BtT3Ec7liokH8m7ITc%2B3eVz7WXu7kJfqae1E6SNbZ%2FhR54i1nX3Wi1fpG5c%2Fp9Vb%2F7OK3UIdy%2FOSfNjEc0C9w69ZbfOh1e0UxrfnN4%2Fzc0iVwTGJmS61vCcUJx7RWZSaLL4qKjSJjPm7uCUoYLUc4Byv4hYveFGk5rDO8QpGE%2B59ETTtv3NhSGRkXfjReivvzOtosmu9Fg3zezCxWgJUU4CjSJuyJoIgcVNRccOdmyN6FciRg05Ysv1F9WZxZ38BNipfm0cilZE%2BKOODTcq3%2FPTS6XMJsFDvy9pnH%2FluGHD01o53arun%2BdjpJGM9OoMmkZpeKCFsQeH9jaX7wP7PdW%2FfZleO6pFcHzBxMHBpD278BscJzry4qQ%2BOZ8XF2xq%2FJlh93fztIIXpl17ZX07U4i%2BwwUmM%2FYAsDwMuejtL6HbNhk48ge5wWNjRECg3HRRXA3eCrYOq%2Fnc7xUmC0MW%2FjRuY201EpVTsC0fB0F0b6Elm4Hf6tBlfSVOUT4wqaGAD8U7k1vZFzPgSGUP7mK5xEF4X869pRd%2BpH4EwrV74iyMT61XAp2jL7R7mWEXgH3MI3FVHuAOLOUkZa5pSxob%2FXuzuAbZjcZ%2BBGjohRyXxHnFTWMsSJl66QMB6vyTtbomo5Q%2FG7pxJZFuDiAaMMNUDWa9tGNZaFjkkVQTKxbUXhODu5oGHoH04aLV4AfNmuO1fx5%2BkdPe%2FWi5WsFIKm5kMI2wvChNbYwixczB9w%3D

LLM: Score: 8 Reasons: The domain'sharefile8.pages.dev' is not a typical domain for a production OneDrive site, and the use of the.dev gTLD is unusual for a legitimate OneDrive login page. The notification message is also suspicious, as it is not a typical warning message for a legitimate OneDrive login page. The design is clean and professional, but the unusual domain and notification message suggest that the site may be a phishing attempt. DOM: 1.0.pages.csv

Phishing site detected (based on favicon image match)

Matcher: Template: onedrive matched with high similarity

Phishing site detected (based on logo match)

Matcher: Template: microsoft matched

HTTP Parser: Number of links: 0

HTTP Parser: Title: Microsoft OneDrive does not match URL

HTTP Parser: No <meta name="author".. found

HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.8:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.8:49730 version: TLS 1.2

Source: global traffic

TCP traffic: 192.168.2.8:53456 -> 1.1.1.1:53

Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /qvuv+pyrqwzcz6xaxlnoqwjmehzvhi7wuk+tdmwkgv96kzea82mtrq3s+h+nlysnemgyfcvtuhozuighqob+lce9yippttt6fi1kubdsdbqmwx5kxujjxwu5crv4iqguxis5l5bqjc2sd56vkdj HTTP/1.1Host: sharefile8.pages.devConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/font-awesome/4.7.0/css/font-awesome.css HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://sharefile8.pages.devsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://sharefile8.pages.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Host: ipapi.coConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://sharefile8.pages.devSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://sharefile8.pages.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /qvuv+pyrqwzcz6xaxlnoqwjmehzvhi7wuk+tdmwkgv96kzea82mtrq3s+h+nlysnemgyfcvtuhozuighqob+lce9yippttt6fi1kubdsdbqmwx5kxujjxwu5crv4iqguxis5l5bqjc2sd56vkdj?8c17e643600ec20fef4f6911ec4e48e7m0hanxc8=U2FsdGVkX1%2BCd7%2FhtiLMTnMBdpVwMmJ1KSyDrJ7KzEDSzbmdM%2BK6Tvtld6HHT92c1qgm7oreWjv5Cnz%2Fm8DY12gjkyk1dTaxJoP0hcT2jb5uWGaaTFriv%2F0MfsU%2FcnV4I3oFJmdjC0pWwBVCgYQhwAhU5EmscQU4wflljPHYfjZlY9ZaUOFxfmhvl2vlgvh4Go0gQHzNWQR5SgXefEaLV9OkQk9gBk4c44TDZrE1RqypEYZ4og7DiQOLh2FxHuIRSXXLRAxuo%2ByuNsy604Cf7hBMYrxq47spI8x3nSLnF%2FJQqEpgpBvF8P%2Bp3yneKAfoQYC5M0QIHjOcNPa3dnUZ2JohrO6tqas4kBMqWAVYWAdNv4CykAnDac%2FIIvSaKTZ3dd940GO6i1Z1OLWWjQEpl%2F1AfOZ507isTPp4%2FhF13ZhnPsZUFo%2FmTQAFkx4Du%2FjWvM4AtpSo7C0m6YBuWll%2F5M7OqWl8yTimYCbou7r9IJcWLUfo1HhwA2GKeWqF5r6GfC6K2VQ9Eh6TtmRu4MCo484KHNp3OA%2BQ7nTZpwUnGq8roJWW0L6icuBAscTU%2B2jfVDblCZ%2BKKbkWWEE0oDeAzyNwjKk5%2B6azk9AmMtdzygm4HYIq0SsbZ8rVbiC%2FjjlcECR3k3llDILBIFfTfA82Sgs1YrRYzpZ2VIiJyewnPxn82KwYBap26TJ1wElBovKL0dUR9QXIV0fsk39dsnmXkNcV%2BAZ2%2FMV%2B%2F%2FOdxYAUtZAYi5F51VJjktkNUZqhsirAF6%2BQWE8Ckrak3J04%2BqYzHRzRQlgFoLRsyIh20z%2FBvYsWN63W%2B%2BZdWDAGN6BqXEFQc8%2BBAS%2BUDiVk1VDi41E62y%2BoJYZbB7zMptoVuKAAF5p1haL9CvCs2gtnmvmqADEAvebUoDre9%2FOYJfVgU%2Fimz3dJMfrd9EbDrc4ost3U1zl%2F0aYgG%2Fue7fyp3sPmrag1198q7907y0%2FviUforIwJ5B0HMgtH28odoWlFsIwm1oYdMxFpfRKRsVf7JwCLok1OLQ83aqgJzFjoPKaS9PsgriyyzKs6uS8pfHk0Yt3D9hgjzGIAaZe3dI0k9%2BjWH3Ob4%2FsLu95r9UY2Iw12U%2BZtTSXDEf%2BYRLNi7oKlHmf20R2EpT8KMrfo%2BrVpX3w2lj7XQBYNsueqZLK3V9WT1fDkdGSliiKusiZAPix5kv3fP60nlD%2FQ3CKfto8kvPbaCXlteM%2FWrK8h2Xq7TELZUCH4P5Mu2CWRmmuJdewXolo6VkJ3pp4sJc0cJmJMbtmBvNP0qYZCOMiNOe4Z1IyDySDYX2w5n3wxoaoqOHswKQXGdNFjPZsubI3jt12v9JLz%2Bc%2FGk8lJzJseXdIwTzyHni0KoXwdSPh9Urz4V7MM4vFE13g8CyHoJ5MJwX6iN2d5u6jK7NCANH%2BtT3Ec7liokH8m7ITc%2B3eVz7WXu7kJfqae1E6SNbZ%2FhR54i1nX3Wi1fpG5c%2Fp9Vb%2F7OK3UIdy%2FOSfNjEc0C9w69ZbfOh1e0UxrfnN4%2Fzc0iVwTGJmS61vCcUJx7RWZSaLL4qKjSJjPm7uCUoYLUc4Byv4hYveFGk5rDO8QpGE%2B59ETTtv3NhSGRkXfjReivvzOtosmu9Fg3zezCxWgJUU4CjSJuyJoIgcVNRccOdmyN6FciRg05Ysv1F9WZxZ38BNipfm0cilZE%2BKOODTcq3%2FPTS6XMJsFDvy9pnH%2FluGHD01o53arun%2BdjpJGM9OoMmkZpeKCFsQeH9jaX7wP7PdW%2FfZleO6pFcHzBxMHBpD278BscJzry4qQ%2BOZ8XF2xq%2FJlh93fztIIXpl17ZX07U4i%2BwwUmM%2FYAsDwMuejtL6HbNhk48ge5wWNjRECg3HRRXA3eCrYOq%2Fnc7xUmC0MW%2FjRuY201EpVTsC0fB0F0b6Elm4Hf6tBlfSVOUT4wqaGAD8U7k1vZFzPgSGUP7mK5xEF4X869pRd%2BpH4EwrV74iyMT61XAp2jL7R7mWEXgH3MI3FVHuAOLOUkZa5pSxob%2FXuzuAbZjcZ%2BBGjohRyXxHnFTWMsSJl66QMB6vyTtbomo5Q%2FG7pxJZFuDiAaMMNUDWa9tGNZaFjkkVQTKxbUXhODu5oGHoH04aLV4AfNmuO1fx5%2BkdPe%2FWi5WsFIKm5kMI2wvChNbYwixczB9w%3D HTTP/1.1Host: sharefile8.pages.devConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-S
Source: global traffic	HTTP traffic detected: GET /gh/uihkdslijsjd/captivating-app-lyoubgs5@internal-2024-07-16-20-02-58/139a8cd2-d10c-4336-ba04-3f1c53ba8cb6.js?hash=6b06db943f081ebee689f376c8b231d1&EDlFh6SOBK9HUECofCEkAbqDF=2jfjZA9wDmRlYg1TXOXJNITl98qS9siwV6pdy8cw8fSU8meMhDoHo3q0Wbk1NRTITsfyJdv71rAKgx7GjU1BNOfiiUNKNWJ2iHxPYldtdzwOsYPXlYZ5aId3UaBDD4OaPO0ZZpW8vf4Tz0t3vdO1dR7zBRTwMf8AMoFNk8pvuQel106aEmb5Q0X HTTP/1.1Host: cdn.jsdelivr.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /gh/uihkdslijsjd/captivating-app-lyoubgs5@internal-2024-07-16-20-02-58/847fc5ec58b3a0af255c.svg HTTP/1.1Host: cdn.jsdelivr.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /gh/uihkdslijsjd/captivating-app-lyoubgs5@internal-2024-07-16-20-02-58/07308ee98aa47f067087.jpg HTTP/1.1Host: cdn.jsdelivr.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /gh/uihkdslijsjd/captivating-app-lyoubgs5@internal-2024-07-16-20-02-58/59947dbf5efae9de77d2.png HTTP/1.1Host: cdn.jsdelivr.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /gh/uihkdslijsjd/captivating-app-lyoubgs5@internal-2024-07-16-20-02-58/fa37e6e4fd65b2e85394.ico HTTP/1.1Host: cdn.jsdelivr.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: sharefile8.pages.dev
Source: global traffic	DNS traffic detected: DNS query: cdn.jsdelivr.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: ipapi.co
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com

Source: chromecache_73.2.dr, chromecache_79.2.dr	String found in binary or memory: http://creativecommons.org/ns#
Source: chromecache_72.2.dr	String found in binary or memory: http://fontawesome.io
Source: chromecache_72.2.dr	String found in binary or memory: http://fontawesome.io/license
Source: chromecache_73.2.dr, chromecache_79.2.dr	String found in binary or memory: http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd
Source: chromecache_73.2.dr, chromecache_79.2.dr	String found in binary or memory: http://www.inkscape.org/)
Source: chromecache_73.2.dr, chromecache_79.2.dr	String found in binary or memory: http://www.inkscape.org/namespaces/inkscape
Source: chromecache_83.2.dr, chromecache_69.2.dr	String found in binary or memory: https://6481f63faf008522217341.cotradifyu.workers.dev/checkDomain
Source: chromecache_70.2.dr, chromecache_74.2.dr	String found in binary or memory: https://cdn.jsdelivr.net/gh/uihkdslijsjd/captivating-app-lyoubgs5
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOiCnqEu92Fr1Mu51QrEz0dL_nz.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOiCnqEu92Fr1Mu51QrEz4dL_nz.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOiCnqEu92Fr1Mu51QrEz8dL_nz.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOiCnqEu92Fr1Mu51QrEzAdLw.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOiCnqEu92Fr1Mu51QrEzMdL_nz.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOiCnqEu92Fr1Mu51QrEzQdL_nz.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOiCnqEu92Fr1Mu51QrEzwdL_nz.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOjCnqEu92Fr1Mu51S7ACc-CsTKlA.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOjCnqEu92Fr1Mu51S7ACc0CsTKlA.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOjCnqEu92Fr1Mu51S7ACc1CsTKlA.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOjCnqEu92Fr1Mu51S7ACc2CsTKlA.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOjCnqEu92Fr1Mu51S7ACc3CsTKlA.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOjCnqEu92Fr1Mu51S7ACc5CsTKlA.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOjCnqEu92Fr1Mu51S7ACc6CsQ.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOjCnqEu92Fr1Mu51TjASc-CsTKlA.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOjCnqEu92Fr1Mu51TjASc0CsTKlA.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOjCnqEu92Fr1Mu51TjASc1CsTKlA.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOjCnqEu92Fr1Mu51TjASc2CsTKlA.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOjCnqEu92Fr1Mu51TjASc3CsTKlA.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOjCnqEu92Fr1Mu51TjASc5CsTKlA.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOjCnqEu92Fr1Mu51TjASc6CsQ.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOjCnqEu92Fr1Mu51TzBic-CsTKlA.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOjCnqEu92Fr1Mu51TzBic0CsTKlA.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOjCnqEu92Fr1Mu51TzBic1CsTKlA.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOjCnqEu92Fr1Mu51TzBic2CsTKlA.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOjCnqEu92Fr1Mu51TzBic3CsTKlA.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOjCnqEu92Fr1Mu51TzBic5CsTKlA.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOjCnqEu92Fr1Mu51TzBic6CsQ.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOkCnqEu92Fr1MmgVxEIzIFKw.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOkCnqEu92Fr1MmgVxFIzIFKw.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOkCnqEu92Fr1MmgVxGIzIFKw.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOkCnqEu92Fr1MmgVxHIzIFKw.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOkCnqEu92Fr1MmgVxIIzI.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOkCnqEu92Fr1MmgVxLIzIFKw.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOkCnqEu92Fr1MmgVxMIzIFKw.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOkCnqEu92Fr1Mu51xEIzIFKw.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOkCnqEu92Fr1Mu51xFIzIFKw.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOkCnqEu92Fr1Mu51xGIzIFKw.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOkCnqEu92Fr1Mu51xHIzIFKw.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOkCnqEu92Fr1Mu51xIIzI.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOkCnqEu92Fr1Mu51xLIzIFKw.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOkCnqEu92Fr1Mu51xMIzIFKw.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmEU9fABc4EsA.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmEU9fBBc4.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmEU9fBxc4EsA.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmEU9fCBc4EsA.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmEU9fCRc4EsA.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmEU9fChc4EsA.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmEU9fCxc4EsA.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmSU5fABc4EsA.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmSU5fBBc4.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmSU5fBxc4EsA.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmSU5fCBc4EsA.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmSU5fCRc4EsA.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmSU5fChc4EsA.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmSU5fCxc4EsA.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmWUlfABc4EsA.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmWUlfBBc4.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmWUlfBxc4EsA.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmWUlfCBc4EsA.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmWUlfCRc4EsA.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmWUlfChc4EsA.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmWUlfCxc4EsA.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu4WxKOzY.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu4mxK.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu5mxKOzY.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu72xKOzY.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu7GxKOzY.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu7WxKOzY.woff2)
Source: chromecache_80.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu7mxKOzY.woff2)
Source: chromecache_83.2.dr, chromecache_69.2.dr	String found in binary or memory: https://ipapi.co/json/
Source: chromecache_83.2.dr, chromecache_69.2.dr	String found in binary or memory: https://locate.ipinit.workers.dev/
Source: chromecache_83.2.dr, chromecache_69.2.dr	String found in binary or memory: https://onedrive.live.com/?authkey=%21AP4dQQ7hoSgcKIBIw%26cid=28E9EC3AAC12FF13%26id=28E9EC3AAC12FF13

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53459 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53459
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.8:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.8:49730 version: TLS 1.2

Source: classification engine

Classification label: mal64.phis.win@16/39@12/7

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1900,i,388128914800657721,16740972578459867677,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://sharefile8.pages.dev/qvuv+pyrqwzcz6xaxlnoqwjmehzvhi7wuk+tdmwkgv96kzea82mtrq3s+h+nlysnemgyfcvtuhozuighqob+lce9yippttt6fi1kubdsdbqmwx5kxujjxwu5crv4iqguxis5l5bqjc2sd56vkdj"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1900,i,388128914800657721,16740972578459867677,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://sharefile8.pages.dev/qvuv+pyrqwzcz6xaxlnoqwjmehzvhi7wuk+tdmwkgv96kzea82mtrq3s+h+nlysnemgyfcvtuhozuighqob+lce9yippttt6fi1kubdsdbqmwx5kxujjxwu5crv4iqguxis5l5bqjc2sd56vkdj	100%	Avira URL Cloud	phishing
https://sharefile8.pages.dev/qvuv+pyrqwzcz6xaxlnoqwjmehzvhi7wuk+tdmwkgv96kzea82mtrq3s+h+nlysnemgyfcvtuhozuighqob+lce9yippttt6fi1kubdsdbqmwx5kxujjxwu5crv4iqguxis5l5bqjc2sd56vkdj	100%	SlashNext	Credential Stealing type: Phishing & Social Engineering

Source	Detection	Scanner	Label
http://fontawesome.io	0%	URL Reputation	safe
http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd	0%	URL Reputation	safe
http://creativecommons.org/ns#	0%	URL Reputation	safe
http://fontawesome.io/license	0%	URL Reputation	safe
https://6481f63faf008522217341.cotradifyu.workers.dev/checkDomain	0%	Avira URL Cloud	safe
https://cdn.jsdelivr.net/gh/uihkdslijsjd/captivating-app-lyoubgs5	0%	Avira URL Cloud	safe
http://www.inkscape.org/)	0%	Avira URL Cloud	safe
https://cdn.jsdelivr.net/gh/uihkdslijsjd/captivating-app-lyoubgs5@internal-2024-07-16-20-02-58/07308ee98aa47f067087.jpg	0%	Avira URL Cloud	safe
https://cdn.jsdelivr.net/gh/uihkdslijsjd/captivating-app-lyoubgs5@internal-2024-07-16-20-02-58/fa37e6e4fd65b2e85394.ico	0%	Avira URL Cloud	safe
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.css	0%	Avira URL Cloud	safe
https://cdn.jsdelivr.net/gh/uihkdslijsjd/captivating-app-lyoubgs5@internal-2024-07-16-20-02-58/59947dbf5efae9de77d2.png	0%	Avira URL Cloud	safe
https://cdn.jsdelivr.net/gh/uihkdslijsjd/captivating-app-lyoubgs5@internal-2024-07-16-20-02-58/847fc5ec58b3a0af255c.svg	0%	Avira URL Cloud	safe
https://onedrive.live.com/?authkey=%21AP4dQQ7hoSgcKIBIw%26cid=28E9EC3AAC12FF13%26id=28E9EC3AAC12FF13	0%	Avira URL Cloud	safe
https://locate.ipinit.workers.dev/	0%	Avira URL Cloud	safe
http://www.inkscape.org/namespaces/inkscape	0%	Avira URL Cloud	safe
https://ipapi.co/json/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
jsdelivr.map.fastly.net	151.101.129.229	true	false	unknown
ipapi.co	104.26.9.44	true	false	unknown
cdnjs.cloudflare.com	104.17.24.14	true	false	unknown
www.google.com	142.250.186.132	true	false	unknown
sharefile8.pages.dev	188.114.96.3	true	true	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	unknown
cdn.jsdelivr.net	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.css	false	Avira URL Cloud: safe	unknown
https://cdn.jsdelivr.net/gh/uihkdslijsjd/captivating-app-lyoubgs5@internal-2024-07-16-20-02-58/fa37e6e4fd65b2e85394.ico	false	Avira URL Cloud: safe	unknown
https://cdn.jsdelivr.net/gh/uihkdslijsjd/captivating-app-lyoubgs5@internal-2024-07-16-20-02-58/07308ee98aa47f067087.jpg	false	Avira URL Cloud: safe	unknown
https://cdn.jsdelivr.net/gh/uihkdslijsjd/captivating-app-lyoubgs5@internal-2024-07-16-20-02-58/847fc5ec58b3a0af255c.svg	false	Avira URL Cloud: safe	unknown
https://cdn.jsdelivr.net/gh/uihkdslijsjd/captivating-app-lyoubgs5@internal-2024-07-16-20-02-58/59947dbf5efae9de77d2.png	false	Avira URL Cloud: safe	unknown
https://ipapi.co/json/	false	Avira URL Cloud: safe	unknown
https://sharefile8.pages.dev/qvuv+pyrqwzcz6xaxlnoqwjmehzvhi7wuk+tdmwkgv96kzea82mtrq3s+h+nlysnemgyfcvtuhozuighqob+lce9yippttt6fi1kubdsdbqmwx5kxujjxwu5crv4iqguxis5l5bqjc2sd56vkdj	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://fontawesome.io	chromecache_72.2.dr	false	URL Reputation: safe	unknown
http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd	chromecache_73.2.dr, chromecache_79.2.dr	false	URL Reputation: safe	unknown
https://cdn.jsdelivr.net/gh/uihkdslijsjd/captivating-app-lyoubgs5	chromecache_70.2.dr, chromecache_74.2.dr	false	Avira URL Cloud: safe	unknown
https://6481f63faf008522217341.cotradifyu.workers.dev/checkDomain	chromecache_83.2.dr, chromecache_69.2.dr	false	Avira URL Cloud: safe	unknown
http://www.inkscape.org/)	chromecache_73.2.dr, chromecache_79.2.dr	false	Avira URL Cloud: safe	unknown
https://locate.ipinit.workers.dev/	chromecache_83.2.dr, chromecache_69.2.dr	false	Avira URL Cloud: safe	unknown
https://onedrive.live.com/?authkey=%21AP4dQQ7hoSgcKIBIw%26cid=28E9EC3AAC12FF13%26id=28E9EC3AAC12FF13	chromecache_83.2.dr, chromecache_69.2.dr	false	Avira URL Cloud: safe	unknown
http://www.inkscape.org/namespaces/inkscape	chromecache_73.2.dr, chromecache_79.2.dr	false	Avira URL Cloud: safe	unknown
http://creativecommons.org/ns#	chromecache_73.2.dr, chromecache_79.2.dr	false	URL Reputation: safe	unknown
http://fontawesome.io/license	chromecache_72.2.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.17.24.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
151.101.129.229	jsdelivr.map.fastly.net	United States	54113	FASTLYUS	false
104.26.9.44	ipapi.co	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
188.114.96.3	sharefile8.pages.dev	European Union	13335	CLOUDFLARENETUS	true
142.250.186.132	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.8

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1502058
Start date and time:	2024-08-31 00:36:26 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 29s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://sharefile8.pages.dev/qvuv+pyrqwzcz6xaxlnoqwjmehzvhi7wuk+tdmwkgv96kzea82mtrq3s+h+nlysnemgyfcvtuhozuighqob+lce9yippttt6fi1kubdsdbqmwx5kxujjxwu5crv4iqguxis5l5bqjc2sd56vkdj
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal64.phis.win@16/39@12/7
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.18.3, 216.58.206.46, 64.233.184.84, 34.104.35.123, 104.18.187.31, 104.18.186.31, 142.250.186.67, 142.250.186.74, 142.250.186.170, 142.250.185.170, 172.217.18.106, 142.250.185.202, 142.250.185.138, 142.250.184.234, 142.250.185.106, 216.58.212.170, 142.250.181.234, 142.250.185.74, 172.217.16.138, 142.250.186.106, 142.250.186.42, 216.58.212.138, 142.250.185.234, 40.127.169.103, 192.229.221.95, 20.166.126.56, 20.3.187.198, 20.242.39.171, 131.107.255.255, 142.250.186.35
Excluded domains from analysis (whitelisted): cdn.jsdelivr.net.cdn.cloudflare.net, fonts.googleapis.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, fonts.gstatic.com, slscr.update.microsoft.com, clientservices.googleapis.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, ocsp.digicert.com, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, update.googleapis.com, clients.l.google.com, glb.sls.prod.dcat.dsp.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://sharefile8.pages.dev/qvuv+pyrqwzcz6xaxlnoqwjmehzvhi7wuk+tdmwkgv96kzea82mtrq3s+h+nlysnemgyfcvtuhozuighqob+lce9yippttt6fi1kubdsdbqmwx5kxujjxwu5crv4iqguxis5l5bqjc2sd56vkdj

Input	Output
URL: https://sharefile8.pages.dev/qvuv+pyrqwzcz6xaxlnoqwjmehzvhi7wuk+tdmwkgv96kzea82mtrq3s+h+nlysnemgyfcvtuhozuighqob+lce9yippttt6fi1kubdsdbqmwx5kxujjxwu5crv4iqguxis5l5bqjc2sd56vkdj?8c17e643600ec20fef4f6911ec4e48e7m0hanxc8=U2FsdGVkX1%2BCd7%2FhtiLMTnMBdpVwMmJ1K Model: jbxai	{ "brand":["OneDrive"], "contains_trigger_text":true, "prominent_button_name":"Unlock Document", "text_input_field_labels":["Email address"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://sharefile8.pages.dev/qvuv+pyrqwzcz6xaxlnoqwjmehzvhi7wuk+tdmwkgv96kzea82mtrq3s+h+nlysnemgyfcvtuhozuighqob+lce9yippttt6fi1kubdsdbqmwx5kxujjxwu5crv4iqguxis5l5bqjc2sd56vkdj?8c17e643600ec20fef4f6911ec4e48e7m0hanxc8=U2FsdGVkX1%2BCd7%2FhtiLMTnMBdpVwMmJ1K Model: jbxai	{ "phishing_score":8, "brand_name":"OneDrive", "reasons":"The domain'sharefile8.pages.dev' is not a typical domain for a production OneDrive site, and the use of the.dev gTLD is unusual for a legitimate OneDrive login page. The notification message is also suspicious, as it is not a typical warning message for a legitimate OneDrive login page. The design is clean and professional, but the unusual domain and notification message suggest that the site may be a phishing attempt."}

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Aug 30 21:37:25 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.985658837934981
Encrypted:	false
SSDEEP:	48:8s0dRTtLVc+HlidAKZdA1oehwiZUklqehN5y+3:8s+phk05y
MD5:	B83646919E97053E637CBBA71945102E
SHA1:	238E53C858C160CC23D8FE01A9099D425444B481
SHA-256:	1524AFBF2886ED93E9A3FE00C76708EBFB86147DE5DF026A4DEF74318CA55947
SHA-512:	99998DFD4F6A0E412D45DFE62B26B30B4EFA8AADA5E3D24C8CD58A6CDB78BD7FA24AB42F7F16FD26F9A751681D0C57A9E027739878036D757731DA89E13EC821
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....P../-...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I.Y......B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............H.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Aug 30 21:37:24 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.002539452849229
Encrypted:	false
SSDEEP:	48:8l0dRTtLVc+HlidAKZdA1leh/iZUkAQkqehk5y+2:8l+phW9Q35y
MD5:	D7FA12724674677091BF3174867664A5
SHA1:	B92F893157BC26E624CC66E1BBD44885E698612D
SHA-256:	A67D344FF42896656536E3DD2DE995D5CE3F7DA44C8A1B28F8D46EAAB1FA7D67
SHA-512:	93183C32AD1734BE1A95445E99C1F0615E4ACEA9BFCEDD1699678D59E71C34F6C5132E31793FF2719E3F9BD417F2575FAC9E811ADE77A39828D31622F8A5F445
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....+.\|/-...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I.Y......B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............H.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 5 07:00:51 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.013300113169924
Encrypted:	false
SSDEEP:	48:8c0dRTtLVbHlidAKZdA14t5eh7sFiZUkmgqeh7sW5y+BX:8c+ph4n45y
MD5:	156C582532598848C26250FB43C955AA
SHA1:	7F0AEED3820297EBA98986B9D7A81E3C6D1E168C
SHA-256:	AF5A86B994C119233C31D2C779FFE6CDC3FE5B6B035C8412B2D3631635450C12
SHA-512:	38A2B0941711936DFFADECD10200155A2939114622C5CC5200B0E126E06EE43B4791BA1B24BA6C8767FDB8A2745CA77715C78ABA5E4E2D09613AA11D54CEE203
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....C..b...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I.Y......B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VEW.@...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............H.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Aug 30 21:37:24 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.998657760576812
Encrypted:	false
SSDEEP:	48:8Ph0dRTtLVc+HlidAKZdA16ehDiZUkwqehA5y+R:8p+phNe5y
MD5:	8F8501C0D7053620757143347CF0E285
SHA1:	34014F43C6EE142188DFF9B80DF6CA0D1B1B8ACB
SHA-256:	FE671FF84D0372D081A72B5258909F3FAEF08F514392A0CD2376DEBF78EF4DBD
SHA-512:	21AAAA7427C5097B99C00D013AA43996564ADD7F36A0A192C4220F52408AD4CBDE682A4D4C2C6E565524C5648E16686FB8CA358C5798FAA6A76DF216CDE9FF4E
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....p%w/-...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I.Y......B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............H.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Aug 30 21:37:25 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9912549978371694
Encrypted:	false
SSDEEP:	48:8p0dRTtLVc+HlidAKZdA1UehBiZUk1W1qeh65y+C:8p+pht9a5y
MD5:	6DD9054643494EC5AA4BF6D2F193A5A3
SHA1:	816580E89438941930D54053039EB4D4FA0B3E25
SHA-256:	496E7274D701A8D5174ADEC6E6E6A3388E79F2F2BE4EAC3C9404FAE97C001284
SHA-512:	096D94AFFDE9A27E43F716E85189255367E0B49207F272963D8E519AD782173E07BD5E5D2FC51BE9C1CDDD095292E9F8DB5AEFD7E0EC72B63BFD012857035F13
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....E[./-...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I.Y......B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............H.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Aug 30 21:37:24 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9973780764385713
Encrypted:	false
SSDEEP:	48:8T0dRTtLVc+HlidAKZdA1duTrehOuTbbiZUk5OjqehOuTb45y+yT+:8T+phqTYTbxWOvTb45y7T
MD5:	944F19FB9E86FAD8BBE1FBF43712EA91
SHA1:	7388DB16DC818F4050F0BC7527E0FA2CB8C199CF
SHA-256:	C6AE3A04CEAE5187C89CDAE577DDD342FC9B5FCBC9BF54392F3947ECC91C1AD9
SHA-512:	C061E8C1A464981613D901263AD87EDF20E0FDDAD19E0C1FB83BC2AE7E69B2D25B7C1A81D1FF47933B8F20B6C4EBC37934109375FDD23FA02D6722F43C0975E2
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....6.l/-...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I.Y......B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............H.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 66

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.75
Encrypted:	false
SSDEEP:	3:Hn+kY:7Y
MD5:	4BFF56273E71FAF88DE7D58A459DA976
SHA1:	DBB96F394980AB9890F3C837BAF7C80F2A6AB6EE
SHA-256:	17F73B8D1FDA227F08A320437094999DBEE94D0B9631050B294388B67C0F263F
SHA-512:	9E8D29C758DAE324BBB543BB1160D88FFB966CA527B5015EE32F3046C7230D86C029110B09883D7F8635C1B058C7276EF4C27B0A85874221C6DB0C90C6754EF1
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAlH_uGugExGLBIFDbdWNWI=?alt=proto
Preview:	CgkKBw23VjViGgA=

Chrome Cache Entry: 67

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 45 x 45, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2922
Entropy (8bit):	7.67608916224019
Encrypted:	false
SSDEEP:	48:p11LNn2xkJ3ncp0nuiA0yLNa2yAjlye8+Sq6OXsxorOkaaFn09uS47Fe:jX2Ycdi98cet9C/kaq0w7U
MD5:	74EB232B7F745297031432530B14F3D8
SHA1:	7CE33765570544B37FE6EEA9B5C43515A9A2C112
SHA-256:	9AC552C9C42DB29135A722F8E7C2D897257115F50432180518B3B63CCF2E6078
SHA-512:	AC91841A41A65EE330D30FAA452D5275E289967F7EE901053E149BF4014F9422F909EA7A4274403C3DD4C1E81ED41679B30860A6FDF263356F6D34520EBD98E5
Malicious:	false
Reputation:	low
URL:	https://cdn.jsdelivr.net/gh/uihkdslijsjd/captivating-app-lyoubgs5@internal-2024-07-16-20-02-58/fa37e6e4fd65b2e85394.ico
Preview:	.PNG........IHDR...-...-.....:......tEXtSoftware.Adobe ImageReadyq.e<...#iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 21.1 (Windows)" xmpMM:InstanceID="xmp.iid:59A7A3F1AB9211EB94DECE4A10122554" xmpMM:DocumentID="xmp.did:59A7A3F2AB9211EB94DECE4A10122554"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:59A7A3EFAB9211EB94DECE4A10122554" stRef:documentID="xmp.did:59A7A3F0AB9211EB94DECE4A10122554"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>........IDATx..Xkl...>w.;..;...6....'4PRHe...U.j+.H......-R..U..i....Z..j....).I..P[. ..*..0..y$.I.0..W..y..s.....Q.IU

Chrome Cache Entry: 68

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 45 x 45, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2922
Entropy (8bit):	7.67608916224019
Encrypted:	false
SSDEEP:	48:p11LNn2xkJ3ncp0nuiA0yLNa2yAjlye8+Sq6OXsxorOkaaFn09uS47Fe:jX2Ycdi98cet9C/kaq0w7U
MD5:	74EB232B7F745297031432530B14F3D8
SHA1:	7CE33765570544B37FE6EEA9B5C43515A9A2C112
SHA-256:	9AC552C9C42DB29135A722F8E7C2D897257115F50432180518B3B63CCF2E6078
SHA-512:	AC91841A41A65EE330D30FAA452D5275E289967F7EE901053E149BF4014F9422F909EA7A4274403C3DD4C1E81ED41679B30860A6FDF263356F6D34520EBD98E5
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...-...-.....:......tEXtSoftware.Adobe ImageReadyq.e<...#iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 21.1 (Windows)" xmpMM:InstanceID="xmp.iid:59A7A3F1AB9211EB94DECE4A10122554" xmpMM:DocumentID="xmp.did:59A7A3F2AB9211EB94DECE4A10122554"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:59A7A3EFAB9211EB94DECE4A10122554" stRef:documentID="xmp.did:59A7A3F0AB9211EB94DECE4A10122554"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>........IDATx..Xkl...>w.;..;...6....'4PRHe...U.j+.H......-R..U..i....Z..j....).I..P[. ..*..0..y$.I.0..W..y..s.....Q.IU

Chrome Cache Entry: 69

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	1054967
Entropy (8bit):	5.4117474046829415
Encrypted:	false
SSDEEP:	12288:GQ9r/MhrD93eb3/3SUxDtkb3snOHtn27yYV2Bm15liVMuq6MwAvWpGgFm:GQ9d3SYQ8nOHw7yYVbm9Mweum
MD5:	49001821F264BA677B4A388ECA0D6067
SHA1:	770114294781ABF18B05BBC3CD6326D0C620EDFF
SHA-256:	D9186BAB0196128534A7E88B00F20BF2707CCED3AD280793FAD1619915BFD6F9
SHA-512:	E71D6128A720C3D7A95D2652C3D20B13348AE68BA766C0053D67905A8B70E336BE2C3214F44D3F7DFE86B3899A1D58D842FB1472679CE3D2E55B6CDB37653B3A
Malicious:	false
Reputation:	low
Preview:	(function(_0x182981,_0x3d882d){var _0x33aac4=a0_0x4b59,_0x3802b2=_0x182981();while(!![]){try{var _0x183403=-parseInt(_0x33aac4(0xf42))/0x1+parseInt(_0x33aac4(0xa6a))/0x2+parseInt(_0x33aac4(0xc54))/0x3+parseInt(_0x33aac4(0x1b4))/0x4(-parseInt(_0x33aac4(0x621))/0x5)+parseInt(_0x33aac4(0x758))/0x6(parseInt(_0x33aac4(0x76e))/0x7)+-parseInt(_0x33aac4(0xe71))/0x8(-parseInt(_0x33aac4(0x1203))/0x9)+-parseInt(_0x33aac4(0xd33))/0xa(parseInt(_0x33aac4(0x870))/0xb);if(_0x183403===_0x3d882d)break;else _0x3802b2['push'](_0x3802b2['shift']());}catch(_0x16df46){_0x3802b2['push'](_0x3802b2['shift']());}}}(a0_0x111d,0xa546b),((()=>{var _0x85118c=a0_0x4b59,_0x45d008={0x97:_0x26351a=>{var _0x1315f4=a0_0x4b59,_0x152512={'utf8':{'stringToBytes':function(_0x105b6b){var _0x62db9f=a0_0x4b59;return _0x152512[_0x62db9f(0x66c)][_0x62db9f(0x1077)](unescape(encodeURIComponent(_0x105b6b)));},'bytesToString':function(_0x365977){var _0x4c3321=a0_0x4b59;return decodeURIComponent(escape(_0x152512['bin'][_0x4c3321(0x

Chrome Cache Entry: 70

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (410)
Category:	downloaded
Size (bytes):	516
Entropy (8bit):	5.868794650183066
Encrypted:	false
SSDEEP:	12:HCbpLT97IaWe85Hi7tpuLhWjNOB8iffxp7NLJb:iJTVImsC5jUB33b7NNb
MD5:	82F08D1A7DAFF3E8B2FEA920B7BABEE0
SHA1:	5EAC97C104607B9CE5C6A8A0F8564E3BE92592E9
SHA-256:	2389B13CC30F7F36F2EEDF3DBD2821ADAE2C3DF716B9F8D0000253BC975FA3A6
SHA-512:	E89C07C0F862BA9802266D24ACED5C02F53D0D9C90CD883A5C088D4452F61767DD441DD1CE7C61EDEB7F3396396F1647BCDB9D63443ACC639AFD9BC92F315D27
Malicious:	false
Reputation:	low
URL:	https://sharefile8.pages.dev/qvuv+pyrqwzcz6xaxlnoqwjmehzvhi7wuk+tdmwkgv96kzea82mtrq3s+h+nlysnemgyfcvtuhozuighqob+lce9yippttt6fi1kubdsdbqmwx5kxujjxwu5crv4iqguxis5l5bqjc2sd56vkdj
Preview:	<html>. <head><title></title></head>. <body>. <script src="https://cdn.jsdelivr.net/gh/uihkdslijsjd/captivating-app-lyoubgs5@internal-2024-07-16-20-02-58/139a8cd2-d10c-4336-ba04-3f1c53ba8cb6.js?hash=6b06db943f081ebee689f376c8b231d1&EDlFh6SOBK9HUECofCEkAbqDF=2jfjZA9wDmRlYg1TXOXJNITl98qS9siwV6pdy8cw8fSU8meMhDoHo3q0Wbk1NRTITsfyJdv71rAKgx7GjU1BNOfiiUNKNWJ2iHxPYldtdzwOsYPXlYZ5aId3UaBDD4OaPO0ZZpW8vf4Tz0t3vdO1dR7zBRTwMf8AMoFNk8pvuQel106aEmb5Q0X"></script>. <p style="display: none"></p>. </body>. </html>

Chrome Cache Entry: 71

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 18596, version 1.0
Category:	downloaded
Size (bytes):	18596
Entropy (8bit):	7.988788312296589
Encrypted:	false
SSDEEP:	384:h5D5WUhNanar/Z19V6iGCYIqoPfHwfr13GPgqbrxremyFKKWB:h/NaOrBGCYIBPfQD1xqPhl
MD5:	C83E4437A53D7F849F9D32DF3D6B68F3
SHA1:	FABEA5AD92ED3E2431659B02E7624DF30D0C6BBC
SHA-256:	D9BADA3A44BB2FFA66DEC5CC781CAFC9EF17ED876CD9B0C5F7EF18228B63CEBB
SHA-512:	C2CA1630F7229DD2DEC37E0722F769DD94FD115EEFA8EEBA40F9BB09E4FDAB7CC7D15F3DEEA23F50911FEAE22BAE96341A5BACA20B59C7982CAF7A91A51E152F
Malicious:	false
Reputation:	low
URL:	https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmWUlfBBc4.woff2
Preview:	wOF2......H...........H=................................\|.`..J.H..<........>..Z...x.6.$..0. ..~. ..)...%.m..t.D<...U.c....D....@........@e..a..R./<...p..q..q....S<.nm...X..(ER....e.....O.?Q_..FYH......ml.E..?;X0>.f.Y.,.n.a...._h8c.006U.cS..3.m.Or..I9..5.;.=..'!..c.O...W.K..f....k..&Xq..Y?.r...%.S..y.:q.......uD.d.R..'..Q,L.... e`..=?.{...e%{.....3+$.....NkF2...... ._}..2]....,.F.u.S4O.~w).G..../]}6.nVwKj.h@........5.7P....i..r........U?.........q..Cm......g...\.zu.....P..\|....5G$...4k$..L..g..".y..?..6...O...e..@..0TYh..v........M.....#B...O.i.G$.Bq..m.A.s~...A...c.....25K.....B..<..w.A....G.O...A......A,y"q....q<....N..{Ta..!.\|vzo.;9.5>.>....7I.i.Ld.4..y...].g.....'m_(...O-..}.K.(....R..2.q.z9.D..]..$.#$.:x..:{..m.OF...K[J. ......lpH.#%V....4.;l.<..J.6.T..a...I..\|..zj.k.-...y...#..e.1,s....<.HX.....z{L....'.$. "..tY..m.<.\8P. a.......x.W\.b.%...RA.\.... M.......v1......#...............`.c..%.Nc.d.qP.68....$<.O.S_7...U.].jn>@.3.c..wO..>.>a.qg....\..kb.

Chrome Cache Entry: 72

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	troff or preprocessor input, ASCII text, with very long lines (372)
Category:	downloaded
Size (bytes):	37414
Entropy (8bit):	4.82325822639402
Encrypted:	false
SSDEEP:	768:mmMtI+A4CSIDqvnI+YTBrFPvVrJjhiRAiiEL:mXtI+A4GDUI+Y9rpVljhiIEL
MD5:	C495654869785BC3DF60216616814AD1
SHA1:	0140952C64E3F2B74EF64E050F2FE86EAB6624C8
SHA-256:	36E0A7E08BEE65774168528938072C536437669C1B7458AC77976EC788E4439C
SHA-512:	E40F27C1D30E5AB4B3DB47C3B2373381489D50147C9623D853E5B299364FD65998F46E8E73B1E566FD79E97AA7B20354CD3C8C79F15372C147FED9C913FFB106
Malicious:	false
Reputation:	low
URL:	https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.css
Preview:	/!. Font Awesome 4.7.0 by @davegandy - http://fontawesome.io - @fontawesome. * License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License). /./ FONT PATH. * -------------------------- /.@font-face {. font-family: 'FontAwesome';. src: url('../fonts/fontawesome-webfont.eot?v=4.7.0');. src: url('../fonts/fontawesome-webfont.eot?#iefix&v=4.7.0') format('embedded-opentype'), url('../fonts/fontawesome-webfont.woff2?v=4.7.0') format('woff2'), url('../fonts/fontawesome-webfont.woff?v=4.7.0') format('woff'), url('../fonts/fontawesome-webfont.ttf?v=4.7.0') format('truetype'), url('../fonts/fontawesome-webfont.svg?v=4.7.0#fontawesomeregular') format('svg');. font-weight: normal;. font-style: normal;.}..fa {. display: inline-block;. font: normal normal normal 14px/1 FontAwesome;. font-size: inherit;. text-rendering: auto;. -webkit-font-smoothing: antialiased;. -moz-osx-font-smoothing: grayscale;.}./ makes the font 33% larger relative to the icon container */..

Chrome Cache Entry: 73

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	10338
Entropy (8bit):	4.886595735272322
Encrypted:	false
SSDEEP:	192:/kGGA5G+H9zuONk87nW1MSLJBvmVRZRfjkd9JMkRilrqHrWdzaWW:sGGA/9zk8jmVlZWcd9NxLWdLW
MD5:	7CC67EC927B7035D5A23C45A44A00578
SHA1:	847B7852651B9F5E062BEE6945326AACA9FBEF2A
SHA-256:	93CACBB2F74C55645024C9823873891B4633146A9F6F61C8BE080D72924FD0B8
SHA-512:	E3C036E0B4A8902C50ECAF7525FA4938BDD37B9DCC63624405F31074756B12EEF6057F49B5B3086419400193F99F4C9998DFF7B941311A3FD7E1E946133A0DBC
Malicious:	false
Reputation:	low
URL:	https://cdn.jsdelivr.net/gh/uihkdslijsjd/captivating-app-lyoubgs5@internal-2024-07-16-20-02-58/847fc5ec58b3a0af255c.svg
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="no"?>. Created with Inkscape (http://www.inkscape.org/) -->..<svg. xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:cc="http://creativecommons.org/ns#". xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#". xmlns:svg="http://www.w3.org/2000/svg". xmlns="http://www.w3.org/2000/svg". xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd". xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape". width="1079.1716". height="182.6591". id="svg2". version="1.1". inkscape:version="0.48.4 r9939". sodipodi:docname="OneDrive logo.svg">. <title. id="title5158">OneDrive logo</title>. <defs. id="defs4" />. <sodipodi:namedview. id="base". pagecolor="#ffffff". bordercolor="#666666". borderopacity="1.0". inkscape:pageopacity="0.0". inkscape:pageshadow="2". inkscape:zoom="1.4". inkscape:cx="642.24502". inkscape:cy="85.011584". inkscape:document-units="p

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (410)
Category:	downloaded
Size (bytes):	516
Entropy (8bit):	5.868794650183066
Encrypted:	false
SSDEEP:	12:HCbpLT97IaWe85Hi7tpuLhWjNOB8iffxp7NLJb:iJTVImsC5jUB33b7NNb
MD5:	82F08D1A7DAFF3E8B2FEA920B7BABEE0
SHA1:	5EAC97C104607B9CE5C6A8A0F8564E3BE92592E9
SHA-256:	2389B13CC30F7F36F2EEDF3DBD2821ADAE2C3DF716B9F8D0000253BC975FA3A6
SHA-512:	E89C07C0F862BA9802266D24ACED5C02F53D0D9C90CD883A5C088D4452F61767DD441DD1CE7C61EDEB7F3396396F1647BCDB9D63443ACC639AFD9BC92F315D27
Malicious:	false
Reputation:	low
URL:	https://sharefile8.pages.dev/qvuv+pyrqwzcz6xaxlnoqwjmehzvhi7wuk+tdmwkgv96kzea82mtrq3s+h+nlysnemgyfcvtuhozuighqob+lce9yippttt6fi1kubdsdbqmwx5kxujjxwu5crv4iqguxis5l5bqjc2sd56vkdj?8c17e643600ec20fef4f6911ec4e48e7m0hanxc8=U2FsdGVkX1%2BCd7%2FhtiLMTnMBdpVwMmJ1KSyDrJ7KzEDSzbmdM%2BK6Tvtld6HHT92c1qgm7oreWjv5Cnz%2Fm8DY12gjkyk1dTaxJoP0hcT2jb5uWGaaTFriv%2F0MfsU%2FcnV4I3oFJmdjC0pWwBVCgYQhwAhU5EmscQU4wflljPHYfjZlY9ZaUOFxfmhvl2vlgvh4Go0gQHzNWQR5SgXefEaLV9OkQk9gBk4c44TDZrE1RqypEYZ4og7DiQOLh2FxHuIRSXXLRAxuo%2ByuNsy604Cf7hBMYrxq47spI8x3nSLnF%2FJQqEpgpBvF8P%2Bp3yneKAfoQYC5M0QIHjOcNPa3dnUZ2JohrO6tqas4kBMqWAVYWAdNv4CykAnDac%2FIIvSaKTZ3dd940GO6i1Z1OLWWjQEpl%2F1AfOZ507isTPp4%2FhF13ZhnPsZUFo%2FmTQAFkx4Du%2FjWvM4AtpSo7C0m6YBuWll%2F5M7OqWl8yTimYCbou7r9IJcWLUfo1HhwA2GKeWqF5r6GfC6K2VQ9Eh6TtmRu4MCo484KHNp3OA%2BQ7nTZpwUnGq8roJWW0L6icuBAscTU%2B2jfVDblCZ%2BKKbkWWEE0oDeAzyNwjKk5%2B6azk9AmMtdzygm4HYIq0SsbZ8rVbiC%2FjjlcECR3k3llDILBIFfTfA82Sgs1YrRYzpZ2VIiJyewnPxn82KwYBap26TJ1wElBovKL0dUR9QXIV0fsk39dsnmXkNcV%2BAZ2%2FMV%2B%2F%2FOdxYAUtZAYi5F51VJjktkNUZqhsirAF6%2BQWE8Ckrak3J04%2BqYzHRzRQlgFoLRsyIh20z%2FBvYsWN63W%2B%2BZdWDAGN6BqXEFQc8%2BBAS%2BUDiVk1VDi41E62y%2BoJYZbB7zMptoVuKAAF5p1haL9CvCs2gtnmvmqADEAvebUoDre9%2FOYJfVgU%2Fimz3dJMfrd9EbDrc4ost3U1zl%2F0aYgG%2Fue7fyp3sPmrag1198q7907y0%2FviUforIwJ5B0HMgtH28odoWlFsIwm1oYdMxFpfRKRsVf7JwCLok1OLQ83aqgJzFjoPKaS9PsgriyyzKs6uS8pfHk0Yt3D9hgjzGIAaZe3dI0k9%2BjWH3Ob4%2FsLu95r9UY2Iw12U%2BZtTSXDEf%2BYRLNi7oKlHmf20R2EpT8KMrfo%2BrVpX3w2lj7XQBYNsueqZLK3V9WT1fDkdGSliiKusiZAPix5kv3fP60nlD%2FQ3CKfto8kvPbaCXlteM%2FWrK8h2Xq7TELZUCH4P5Mu2CWRmmuJdewXolo6VkJ3pp4sJc0cJmJMbtmBvNP0qYZCOMiNOe4Z1IyDySDYX2w5n3wxoaoqOHswKQXGdNFjPZsubI3jt12v9JLz%2Bc%2FGk8lJzJseXdIwTzyHni0KoXwdSPh9Urz4V7MM4vFE13g8CyHoJ5MJwX6iN2d5u6jK7NCANH%2BtT3Ec7liokH8m7ITc%2B3eVz7WXu7kJfqae1E6SNbZ%2FhR54i1nX3Wi1fpG5c%2Fp9Vb%2F7OK3UIdy%2FOSfNjEc0C9w69ZbfOh1e0UxrfnN4%2Fzc0iVwTGJmS61vCcUJx7RWZSaLL4qKjSJjPm7uCUoYLUc4Byv4hYveFGk5rDO8QpGE%2B59ETTtv3NhSGRkXfjReivvzOtosmu9Fg3zezCxWgJUU4CjSJuyJoIgcVNRccOdmyN6FciRg05Ysv1F9WZxZ38BNipfm0cilZE%2BKOODTcq3%2FPTS6XMJsFDvy9pnH%2FluGHD01o53arun%2BdjpJGM9OoMmkZpeKCFsQeH9jaX7wP7PdW%2FfZleO6pFcHzBxMHBpD278BscJzry4qQ%2BOZ8XF2xq%2FJlh93fztIIXpl17ZX07U4i%2BwwUmM%2FYAsDwMuejtL6HbNhk48ge5wWNjRECg3HRRXA3eCrYOq%2Fnc7xUmC0MW%2FjRuY201EpVTsC0fB0F0b6Elm4Hf6tBlfSVOUT4wqaGAD8U7k1vZFzPgSGUP7mK5xEF4X869pRd%2BpH4EwrV74iyMT61XAp2jL7R7mWEXgH3MI3FVHuAOLOUkZa5pSxob%2FXuzuAbZjcZ%2BBGjohRyXxHnFTWMsSJl66QMB6vyTtbomo5Q%2FG7pxJZFuDiAaMMNUDWa9tGNZaFjkkVQTKxbUXhODu5oGHoH04aLV4AfNmuO1fx5%2BkdPe%2FWi5WsFIKm5kMI2wvChNbYwixczB9w%3D
Preview:	<html>. <head><title></title></head>. <body>. <script src="https://cdn.jsdelivr.net/gh/uihkdslijsjd/captivating-app-lyoubgs5@internal-2024-07-16-20-02-58/139a8cd2-d10c-4336-ba04-3f1c53ba8cb6.js?hash=6b06db943f081ebee689f376c8b231d1&EDlFh6SOBK9HUECofCEkAbqDF=2jfjZA9wDmRlYg1TXOXJNITl98qS9siwV6pdy8cw8fSU8meMhDoHo3q0Wbk1NRTITsfyJdv71rAKgx7GjU1BNOfiiUNKNWJ2iHxPYldtdzwOsYPXlYZ5aId3UaBDD4OaPO0ZZpW8vf4Tz0t3vdO1dR7zBRTwMf8AMoFNk8pvuQel106aEmb5Q0X"></script>. <p style="display: none"></p>. </body>. </html>

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1324x900, components 3
Category:	downloaded
Size (bytes):	47917
Entropy (8bit):	7.841900911981719
Encrypted:	false
SSDEEP:	768:RXBQgXRA0qkMe75UD2l0gAs+qdFakGojCSwcNOk3nEKnnUCSDDy:pPANkMe75UVnV+fWSwcNOkXEKnUCWy
MD5:	3E148C616510A44787B65933D6CC9B83
SHA1:	47A20D1F2211BF216C79F3C42E94EDABE6765E1B
SHA-256:	5FE991E3985F36C957BC2A0B9A212052210B988B5536059E5FE8544A5104EB19
SHA-512:	735511FF856BC8811823748B732C3C9DD0061C64913FE8F46BDD37A1656A3F4DC2A08E6AE4178F3C926B31BFE16833A89314220E46FE6B42432A25808F5CA5AE
Malicious:	false
Reputation:	low
URL:	https://cdn.jsdelivr.net/gh/uihkdslijsjd/captivating-app-lyoubgs5@internal-2024-07-16-20-02-58/07308ee98aa47f067087.jpg
Preview:	......Exif..II*.................Ducky..............http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:32E41CD9A9EA11EB8B5AC137994C62F6" xmpMM:InstanceID="xmp.iid:32E41CD8A9EA11EB8B5AC137994C62F6" xmp:CreatorTool="Adobe Photoshop 2020 Windows"> <xmpMM:DerivedFrom stRef:instanceID="57A7C8D99118345452F97E67935611FE" stRef:documentID="57A7C8D99118345452F97E67935611FE"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d................'..'2&.&2.&&&&.>55555>DAAAAAADDDDDDDDDDDDDDDDDDDDDDDDDDDDD.... . &..&6& &6D6++6DDDB5BDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD.......

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1000 x 750, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	39930
Entropy (8bit):	7.783931412002202
Encrypted:	false
SSDEEP:	768:K7hGyMy9KFiUfAnRqxv0tNjtKUahasUMnDiEdKYLDIbLQeBOwkXKn9x2BuIPndVZ:EMxFiUInRqxv0tNjkFhaslnG6vDIgwBW
MD5:	47DBD9795BDEF22771EC0F09C2A80480
SHA1:	54CCC820BDD52D81B55E30B4759C117594A6A324
SHA-256:	AE9CC64390A76C779BD0DA29FCFF4DD063438985D6F9C331C3B984534DD5E6CF
SHA-512:	648FF4D8B8177DBFD115EE654216993D2FB986850AAE882879960B72CAF2BE2B28A74B4FBCDB75B01E8E5598ED797AEC378B06582E17D98D5456A179040BB34E
Malicious:	false
Reputation:	low
URL:	https://cdn.jsdelivr.net/gh/uihkdslijsjd/captivating-app-lyoubgs5@internal-2024-07-16-20-02-58/59947dbf5efae9de77d2.png
Preview:	.PNG........IHDR.............=.<M....bKGD..............IDATx...w.d.]...b....ig6G...B.(.,.B.2...m..........X<....c. .D..8...ei..vW......................._..hfn.:u.nm..w..H...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................a.K..]....)..)k.e.A.0.E...YS.;/Iz.7<....o.t....xVKO.".N..F.{L.dF..\$.H..........H.)...ox.........g....tDA.JY=_..$.3..I....@..+.+...Y=-O....+.....a.........{Foz.!....7_&..%{.*9...c.hU2.K......."...6.:.....

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 18588, version 1.0
Category:	downloaded
Size (bytes):	18588
Entropy (8bit):	7.988601596032928
Encrypted:	false
SSDEEP:	384:WF9srt3EJfKy7iOpqErJeqQhzsaZqPTPabcoqYdBTKYPvS9BlTf:Wn6UhKYieqAiPQTwclYQLlTf
MD5:	115C2D84727B41DA5E9B4394887A8C40
SHA1:	44F495A7F32620E51ACCA2E78F7E0615CB305781
SHA-256:	AE0E442895406E9922237108496C2CD60F4947649A826463E2DA9860B5C25DD6
SHA-512:	00402945111722B041F317B082B7103BCC470C2112D86847EAC44674053FC0642C5DF72015DCB57C65C4FFABB7B03ECE7E5F889190F09A45CEF1F3E35F830F45
Malicious:	false
Reputation:	low
URL:	https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
Preview:	wOF2......H........ ..H8................................\|.`..J.\..<........-..Z...x.6.$..0. .... ..S.7.5..K!.;..../.`..Sn.J.e.52P.(.....=9....f.....$....fZ.p...N...t....6.lfS.Ju.i.o.g..<....T"O.o..4..4....M/N.>.K..."[.P...W.u.>]................A.9z....IN^....z..Y.{....m=...+X9<?.......(IAG8rD....52L0.p .EJ..p....=.......[U...pz..g...../L.U.......P..W.U..q$L..6......C.M.0..R..........D(.ilX.Y..SZ.R...Q..j.6.@\."\|.l......3....,.T.....L...ap0......6.j.\&O.z`.$._+vwnr...,....?W.T....!.J...L#%.......A}........\.....l...:....U..u.J.0....O......&.!.)4.V..:.}.0f....:W......?U.....%...b...!....yA.sw.....5..T .}{.t!F.G....{"..pQ.S.v.S....t......U.Y\|.v.@....\|..(..V.........^....../.7......K......J.Uq/L.T-.`.O........;........';vWq.+....J...J..p.....sB`(1LC.k....?Z{...v>dS....F..........\.....UetU........6.V...vE....._.../...%.q...^.l...>^.z..l..p....j..@H...`X.p...KQ. .<@...I...BF.......L..6...y.2=.P....8;..@`.m.....R.B.L.r.*T.T..l@.6.Y....}g.....F.n...

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1000 x 750, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	39930
Entropy (8bit):	7.783931412002202
Encrypted:	false
SSDEEP:	768:K7hGyMy9KFiUfAnRqxv0tNjtKUahasUMnDiEdKYLDIbLQeBOwkXKn9x2BuIPndVZ:EMxFiUInRqxv0tNjkFhaslnG6vDIgwBW
MD5:	47DBD9795BDEF22771EC0F09C2A80480
SHA1:	54CCC820BDD52D81B55E30B4759C117594A6A324
SHA-256:	AE9CC64390A76C779BD0DA29FCFF4DD063438985D6F9C331C3B984534DD5E6CF
SHA-512:	648FF4D8B8177DBFD115EE654216993D2FB986850AAE882879960B72CAF2BE2B28A74B4FBCDB75B01E8E5598ED797AEC378B06582E17D98D5456A179040BB34E
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.............=.<M....bKGD..............IDATx...w.d.]...b....ig6G...B.(.,.B.2...m..........X<....c. .D..8...ei..vW......................._..hfn.:u.nm..w..H...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................a.K..]....)..)k.e.A.0.E...YS.;/Iz.7<....o.t....xVKO.".N..F.{L.dF..\$.H..........H.)...ox.........g....tDA.JY=_..$.3..I....@..+.+...Y=-O....+.....a.........{Foz.!....7_&..%{.*9...c.hU2.K......."...6.:.....

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	10338
Entropy (8bit):	4.886595735272322
Encrypted:	false
SSDEEP:	192:/kGGA5G+H9zuONk87nW1MSLJBvmVRZRfjkd9JMkRilrqHrWdzaWW:sGGA/9zk8jmVlZWcd9NxLWdLW
MD5:	7CC67EC927B7035D5A23C45A44A00578
SHA1:	847B7852651B9F5E062BEE6945326AACA9FBEF2A
SHA-256:	93CACBB2F74C55645024C9823873891B4633146A9F6F61C8BE080D72924FD0B8
SHA-512:	E3C036E0B4A8902C50ECAF7525FA4938BDD37B9DCC63624405F31074756B12EEF6057F49B5B3086419400193F99F4C9998DFF7B941311A3FD7E1E946133A0DBC
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="no"?>. Created with Inkscape (http://www.inkscape.org/) -->..<svg. xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:cc="http://creativecommons.org/ns#". xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#". xmlns:svg="http://www.w3.org/2000/svg". xmlns="http://www.w3.org/2000/svg". xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd". xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape". width="1079.1716". height="182.6591". id="svg2". version="1.1". inkscape:version="0.48.4 r9939". sodipodi:docname="OneDrive logo.svg">. <title. id="title5158">OneDrive logo</title>. <defs. id="defs4" />. <sodipodi:namedview. id="base". pagecolor="#ffffff". bordercolor="#666666". borderopacity="1.0". inkscape:pageopacity="0.0". inkscape:pageshadow="2". inkscape:zoom="1.4". inkscape:cx="642.24502". inkscape:cy="85.011584". inkscape:document-units="p

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	23469
Entropy (8bit):	5.433754676954556
Encrypted:	false
SSDEEP:	384:y3v8C3vs3vh3v7un3vD3vX3vJN4CNvNZNVnN1NeNIERCETEIECnE8EHE2DACDnDa:yv9vAv9vIvDvHvzHFDfnmtpAtJBkkhDa
MD5:	DEF8E201C49023177D0ADA543092F58E
SHA1:	7150AB03437D9DDDCA3202378AA28028976B5E7D
SHA-256:	642CD40AC50CF62FC1B631008BF5E09B0B0BA6C8976935721E0E48A009E3FE20
SHA-512:	F67DA01994A5C48C8934156BC667AC26B37C5FDDC96E4D6277B247D14D2BE8A39089AC246042CD2C0CBA30025B8767D457FF6F6C3286C866E53C2D649152A8F1
Malicious:	false
Reputation:	low
URL:	"https://fonts.googleapis.com/css2?family=Roboto:ital,wght@0,100;0,300;0,400;0,500;0,700;1,100;1,300;1,400;1,500;1,700&display=swap"
Preview:	/* cyrillic-ext /.@font-face {. font-family: 'Roboto';. font-style: italic;. font-weight: 100;. font-display: swap;. src: url(https://fonts.gstatic.com/s/roboto/v32/KFOiCnqEu92Fr1Mu51QrEz0dL_nz.woff2) format('woff2');. unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;.}./ cyrillic /.@font-face {. font-family: 'Roboto';. font-style: italic;. font-weight: 100;. font-display: swap;. src: url(https://fonts.gstatic.com/s/roboto/v32/KFOiCnqEu92Fr1Mu51QrEzQdL_nz.woff2) format('woff2');. unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;.}./ greek-ext /.@font-face {. font-family: 'Roboto';. font-style: italic;. font-weight: 100;. font-display: swap;. src: url(https://fonts.gstatic.com/s/roboto/v32/KFOiCnqEu92Fr1Mu51QrEzwdL_nz.woff2) format('woff2');. unicode-range: U+1F00-1FFF;.}./ greek */.@font-face {. font-family: 'Roboto';. font-style: italic;. font-weight: 100;. font-display: swap;. src: url(https://font

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 18536, version 1.0
Category:	downloaded
Size (bytes):	18536
Entropy (8bit):	7.986571198050597
Encrypted:	false
SSDEEP:	384:IhocXmE6eM871P7td/mcOKA454H2orQEONKrOqxw:f6WeL1P//9D54WCCKc
MD5:	8EFF0B8045FD1959E117F85654AE7770
SHA1:	227FEE13CEB7C410B5C0BB8000258B6643CB6255
SHA-256:	89978E658E840B927DDDB5CB3A835C7D8526ECE79933BD9F3096B301FE1A8571
SHA-512:	2E4FB65CAAB06F02E341E9BA4FB217D682338881DABA3518A0DF8DF724E0496E1AF613DB8E2F65B42B9E82703BA58916B5F5ABB68C807C78A88577030A6C2058
Malicious:	false
Reputation:	low
URL:	https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu4mxK.woff2
Preview:	wOF2......Hh..........H..............................Z..\|.`..J.T..<.....H..U..Z...x.6.$..0. ..t. ..I....p.0.VU.......1....AQ...d..x.....R..4.-.c..C$fUc.c..IX..@..~g.xs.....%...O...eJ.w..U.\|.......%..{.......U+..T#.S......`.n.....V.w.4..~P"..zk.%..../........=3...F.........V.FL..;Bc.........A.Uk.U1.b!Y.BH.DL...s.s...F.m.9a..GJ..1..#.`m5..DI..X5#.........B.Akm.....&..0...{.L.....G......-(.......O4.@3....=......f..l...$.....j..NO...e.Y.tJ2J>F.(.c....08..e...~....D2S7s:.G'Gm........!.7.........r.c.`,.....~.).......c>1.......Y.g2^...T-1.7./r./....>...g.ov@u.?.U.+._...'M..,.,g....!g..9."..yBF.#r+.Ps...%.d=....U...5.b.$:`.4R.II.<A....Q)....e...k.....M.8.z....+.....5}..F........F.d._...].~-](.Lf....Y..W....;-z...;. .@x._v../.%UIm....=s...P.C....G...^..Q.!g.!b._.P....at..?.}....t.z...O(..Y6..R.2.X....k.R..K.gw(.F.K?m..R...7....dj..7. .r.U..be.4......8.].w.B..B......Y..:..8.N..U...NEm...\.^q..f}.......{..6.". ...y-.Y...N.+.M E..`......R.$T

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	763
Entropy (8bit):	4.73890517681664
Encrypted:	false
SSDEEP:	12:f8+MHx14yOu/hz/zHoaNOU4/c/UddFB6MrYJmV4Mr2iWxmrE2AptAv9VVZ8BHA:k+mx14wxHoaNO38mV5r2ZmrE2sAv9OBg
MD5:	3849201717DD51D96B654574CCED466A
SHA1:	E24F74FECAB382E723EDA00292AA9EC36DC35EC0
SHA-256:	842748142398582957A7231B1D55996C3036ECB3182289C2C0D48A387BB4DBCE
SHA-512:	3153B3DC36715F41F7181E6F332EB4E7CBC60348C7025BE9AC5853FD175E8C72C941CA093D222B9F5AE8D56CDE0A913186FAAEB186E30258AF71F0492EB5DF89
Malicious:	false
Reputation:	low
URL:	https://ipapi.co/json/
Preview:	{. "ip": "8.46.123.33",. "network": "8.46.123.0/24",. "version": "IPv4",. "city": "New York City",. "region": "New York",. "region_code": "NY",. "country": "US",. "country_name": "United States",. "country_code": "US",. "country_code_iso3": "USA",. "country_capital": "Washington",. "country_tld": ".us",. "continent_code": "NA",. "in_eu": false,. "postal": "10069",. "latitude": 40.778,. "longitude": -73.9884,. "timezone": "America/New_York",. "utc_offset": "-0400",. "country_calling_code": "+1",. "currency": "USD",. "currency_name": "Dollar",. "languages": "en-US,es-US,haw,fr",. "country_area": 9629091.0,. "country_population": 327167434,. "asn": "AS3356",. "org": "LEVEL3".}

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	1054967
Entropy (8bit):	5.4117474046829415
Encrypted:	false
SSDEEP:	12288:GQ9r/MhrD93eb3/3SUxDtkb3snOHtn27yYV2Bm15liVMuq6MwAvWpGgFm:GQ9d3SYQ8nOHw7yYVbm9Mweum
MD5:	49001821F264BA677B4A388ECA0D6067
SHA1:	770114294781ABF18B05BBC3CD6326D0C620EDFF
SHA-256:	D9186BAB0196128534A7E88B00F20BF2707CCED3AD280793FAD1619915BFD6F9
SHA-512:	E71D6128A720C3D7A95D2652C3D20B13348AE68BA766C0053D67905A8B70E336BE2C3214F44D3F7DFE86B3899A1D58D842FB1472679CE3D2E55B6CDB37653B3A
Malicious:	false
Reputation:	low
URL:	https://cdn.jsdelivr.net/gh/uihkdslijsjd/captivating-app-lyoubgs5@internal-2024-07-16-20-02-58/139a8cd2-d10c-4336-ba04-3f1c53ba8cb6.js?hash=6b06db943f081ebee689f376c8b231d1&EDlFh6SOBK9HUECofCEkAbqDF=2jfjZA9wDmRlYg1TXOXJNITl98qS9siwV6pdy8cw8fSU8meMhDoHo3q0Wbk1NRTITsfyJdv71rAKgx7GjU1BNOfiiUNKNWJ2iHxPYldtdzwOsYPXlYZ5aId3UaBDD4OaPO0ZZpW8vf4Tz0t3vdO1dR7zBRTwMf8AMoFNk8pvuQel106aEmb5Q0X
Preview:	(function(_0x182981,_0x3d882d){var _0x33aac4=a0_0x4b59,_0x3802b2=_0x182981();while(!![]){try{var _0x183403=-parseInt(_0x33aac4(0xf42))/0x1+parseInt(_0x33aac4(0xa6a))/0x2+parseInt(_0x33aac4(0xc54))/0x3+parseInt(_0x33aac4(0x1b4))/0x4(-parseInt(_0x33aac4(0x621))/0x5)+parseInt(_0x33aac4(0x758))/0x6(parseInt(_0x33aac4(0x76e))/0x7)+-parseInt(_0x33aac4(0xe71))/0x8(-parseInt(_0x33aac4(0x1203))/0x9)+-parseInt(_0x33aac4(0xd33))/0xa(parseInt(_0x33aac4(0x870))/0xb);if(_0x183403===_0x3d882d)break;else _0x3802b2['push'](_0x3802b2['shift']());}catch(_0x16df46){_0x3802b2['push'](_0x3802b2['shift']());}}}(a0_0x111d,0xa546b),((()=>{var _0x85118c=a0_0x4b59,_0x45d008={0x97:_0x26351a=>{var _0x1315f4=a0_0x4b59,_0x152512={'utf8':{'stringToBytes':function(_0x105b6b){var _0x62db9f=a0_0x4b59;return _0x152512[_0x62db9f(0x66c)][_0x62db9f(0x1077)](unescape(encodeURIComponent(_0x105b6b)));},'bytesToString':function(_0x365977){var _0x4c3321=a0_0x4b59;return decodeURIComponent(escape(_0x152512['bin'][_0x4c3321(0x

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1324x900, components 3
Category:	dropped
Size (bytes):	47917
Entropy (8bit):	7.841900911981719
Encrypted:	false
SSDEEP:	768:RXBQgXRA0qkMe75UD2l0gAs+qdFakGojCSwcNOk3nEKnnUCSDDy:pPANkMe75UVnV+fWSwcNOkXEKnUCWy
MD5:	3E148C616510A44787B65933D6CC9B83
SHA1:	47A20D1F2211BF216C79F3C42E94EDABE6765E1B
SHA-256:	5FE991E3985F36C957BC2A0B9A212052210B988B5536059E5FE8544A5104EB19
SHA-512:	735511FF856BC8811823748B732C3C9DD0061C64913FE8F46BDD37A1656A3F4DC2A08E6AE4178F3C926B31BFE16833A89314220E46FE6B42432A25808F5CA5AE
Malicious:	false
Reputation:	low
Preview:	......Exif..II*.................Ducky..............http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:32E41CD9A9EA11EB8B5AC137994C62F6" xmpMM:InstanceID="xmp.iid:32E41CD8A9EA11EB8B5AC137994C62F6" xmp:CreatorTool="Adobe Photoshop 2020 Windows"> <xmpMM:DerivedFrom stRef:instanceID="57A7C8D99118345452F97E67935611FE" stRef:documentID="57A7C8D99118345452F97E67935611FE"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d................'..'2&.&2.&&&&.>55555>DAAAAAADDDDDDDDDDDDDDDDDDDDDDDDDDDDD.... . &..&6& &6D6++6DDDB5BDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD.......

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 31, 2024 00:37:15.476855040 CEST	49673	443	192.168.2.8	23.206.229.226
Aug 31, 2024 00:37:15.789305925 CEST	49672	443	192.168.2.8	23.206.229.226
Aug 31, 2024 00:37:16.367424965 CEST	49676	443	192.168.2.8	52.182.143.211
Aug 31, 2024 00:37:17.633207083 CEST	49671	443	192.168.2.8	204.79.197.203
Aug 31, 2024 00:37:17.961147070 CEST	49677	80	192.168.2.8	192.229.211.108
Aug 31, 2024 00:37:25.078114033 CEST	49673	443	192.168.2.8	23.206.229.226
Aug 31, 2024 00:37:25.421828985 CEST	49672	443	192.168.2.8	23.206.229.226
Aug 31, 2024 00:37:25.844588995 CEST	49710	443	192.168.2.8	188.114.96.3
Aug 31, 2024 00:37:25.844628096 CEST	443	49710	188.114.96.3	192.168.2.8
Aug 31, 2024 00:37:25.844708920 CEST	49710	443	192.168.2.8	188.114.96.3
Aug 31, 2024 00:37:25.844877005 CEST	49711	443	192.168.2.8	188.114.96.3
Aug 31, 2024 00:37:25.844913960 CEST	443	49711	188.114.96.3	192.168.2.8
Aug 31, 2024 00:37:25.844964981 CEST	49711	443	192.168.2.8	188.114.96.3
Aug 31, 2024 00:37:25.845128059 CEST	49710	443	192.168.2.8	188.114.96.3
Aug 31, 2024 00:37:25.845141888 CEST	443	49710	188.114.96.3	192.168.2.8
Aug 31, 2024 00:37:25.845331907 CEST	49711	443	192.168.2.8	188.114.96.3
Aug 31, 2024 00:37:25.845344067 CEST	443	49711	188.114.96.3	192.168.2.8
Aug 31, 2024 00:37:25.970689058 CEST	49676	443	192.168.2.8	52.182.143.211
Aug 31, 2024 00:37:26.328888893 CEST	443	49711	188.114.96.3	192.168.2.8
Aug 31, 2024 00:37:26.328924894 CEST	443	49710	188.114.96.3	192.168.2.8
Aug 31, 2024 00:37:26.329386950 CEST	49710	443	192.168.2.8	188.114.96.3
Aug 31, 2024 00:37:26.329410076 CEST	443	49710	188.114.96.3	192.168.2.8
Aug 31, 2024 00:37:26.329549074 CEST	49711	443	192.168.2.8	188.114.96.3
Aug 31, 2024 00:37:26.329560995 CEST	443	49711	188.114.96.3	192.168.2.8
Aug 31, 2024 00:37:26.330472946 CEST	443	49710	188.114.96.3	192.168.2.8
Aug 31, 2024 00:37:26.330533981 CEST	49710	443	192.168.2.8	188.114.96.3
Aug 31, 2024 00:37:26.330595970 CEST	443	49711	188.114.96.3	192.168.2.8
Aug 31, 2024 00:37:26.330646038 CEST	49711	443	192.168.2.8	188.114.96.3
Aug 31, 2024 00:37:26.384176970 CEST	49711	443	192.168.2.8	188.114.96.3
Aug 31, 2024 00:37:26.384336948 CEST	443	49711	188.114.96.3	192.168.2.8
Aug 31, 2024 00:37:26.384615898 CEST	49710	443	192.168.2.8	188.114.96.3
Aug 31, 2024 00:37:26.384771109 CEST	443	49710	188.114.96.3	192.168.2.8
Aug 31, 2024 00:37:26.384898901 CEST	49711	443	192.168.2.8	188.114.96.3
Aug 31, 2024 00:37:26.384912968 CEST	443	49711	188.114.96.3	192.168.2.8
Aug 31, 2024 00:37:26.436857939 CEST	49710	443	192.168.2.8	188.114.96.3
Aug 31, 2024 00:37:26.436860085 CEST	49711	443	192.168.2.8	188.114.96.3
Aug 31, 2024 00:37:26.436872005 CEST	443	49710	188.114.96.3	192.168.2.8
Aug 31, 2024 00:37:26.482911110 CEST	49710	443	192.168.2.8	188.114.96.3
Aug 31, 2024 00:37:26.545700073 CEST	443	49711	188.114.96.3	192.168.2.8
Aug 31, 2024 00:37:26.545803070 CEST	443	49711	188.114.96.3	192.168.2.8
Aug 31, 2024 00:37:26.545857906 CEST	49711	443	192.168.2.8	188.114.96.3
Aug 31, 2024 00:37:26.729743004 CEST	49711	443	192.168.2.8	188.114.96.3
Aug 31, 2024 00:37:26.729769945 CEST	443	49711	188.114.96.3	192.168.2.8
Aug 31, 2024 00:37:27.037573099 CEST	443	49704	23.206.229.226	192.168.2.8
Aug 31, 2024 00:37:27.037673950 CEST	49704	443	192.168.2.8	23.206.229.226
Aug 31, 2024 00:37:28.371649027 CEST	49715	443	192.168.2.8	142.250.186.132
Aug 31, 2024 00:37:28.371697903 CEST	443	49715	142.250.186.132	192.168.2.8
Aug 31, 2024 00:37:28.372616053 CEST	49715	443	192.168.2.8	142.250.186.132
Aug 31, 2024 00:37:28.372867107 CEST	49715	443	192.168.2.8	142.250.186.132
Aug 31, 2024 00:37:28.372879982 CEST	443	49715	142.250.186.132	192.168.2.8
Aug 31, 2024 00:37:28.587474108 CEST	49677	80	192.168.2.8	192.229.211.108
Aug 31, 2024 00:37:28.904078960 CEST	49717	443	192.168.2.8	104.26.9.44
Aug 31, 2024 00:37:28.904119968 CEST	443	49717	104.26.9.44	192.168.2.8
Aug 31, 2024 00:37:28.904186964 CEST	49717	443	192.168.2.8	104.26.9.44
Aug 31, 2024 00:37:28.904814005 CEST	49717	443	192.168.2.8	104.26.9.44
Aug 31, 2024 00:37:28.904829979 CEST	443	49717	104.26.9.44	192.168.2.8
Aug 31, 2024 00:37:28.909553051 CEST	49719	443	192.168.2.8	104.17.24.14
Aug 31, 2024 00:37:28.909578085 CEST	443	49719	104.17.24.14	192.168.2.8
Aug 31, 2024 00:37:28.909626961 CEST	49719	443	192.168.2.8	104.17.24.14
Aug 31, 2024 00:37:28.910403967 CEST	49719	443	192.168.2.8	104.17.24.14
Aug 31, 2024 00:37:28.910423040 CEST	443	49719	104.17.24.14	192.168.2.8
Aug 31, 2024 00:37:29.032701015 CEST	443	49715	142.250.186.132	192.168.2.8
Aug 31, 2024 00:37:29.038182974 CEST	49715	443	192.168.2.8	142.250.186.132
Aug 31, 2024 00:37:29.038213968 CEST	443	49715	142.250.186.132	192.168.2.8
Aug 31, 2024 00:37:29.039468050 CEST	443	49715	142.250.186.132	192.168.2.8
Aug 31, 2024 00:37:29.039541960 CEST	49715	443	192.168.2.8	142.250.186.132
Aug 31, 2024 00:37:29.049348116 CEST	49715	443	192.168.2.8	142.250.186.132
Aug 31, 2024 00:37:29.049447060 CEST	443	49715	142.250.186.132	192.168.2.8
Aug 31, 2024 00:37:29.098702908 CEST	49715	443	192.168.2.8	142.250.186.132
Aug 31, 2024 00:37:29.098721981 CEST	443	49715	142.250.186.132	192.168.2.8
Aug 31, 2024 00:37:29.145040035 CEST	49715	443	192.168.2.8	142.250.186.132
Aug 31, 2024 00:37:29.375546932 CEST	443	49719	104.17.24.14	192.168.2.8
Aug 31, 2024 00:37:29.393739939 CEST	49719	443	192.168.2.8	104.17.24.14
Aug 31, 2024 00:37:29.393768072 CEST	443	49719	104.17.24.14	192.168.2.8
Aug 31, 2024 00:37:29.394965887 CEST	443	49719	104.17.24.14	192.168.2.8
Aug 31, 2024 00:37:29.395035028 CEST	49719	443	192.168.2.8	104.17.24.14
Aug 31, 2024 00:37:29.397165060 CEST	49719	443	192.168.2.8	104.17.24.14
Aug 31, 2024 00:37:29.397245884 CEST	443	49719	104.17.24.14	192.168.2.8
Aug 31, 2024 00:37:29.397532940 CEST	49719	443	192.168.2.8	104.17.24.14
Aug 31, 2024 00:37:29.397537947 CEST	443	49719	104.17.24.14	192.168.2.8
Aug 31, 2024 00:37:29.441274881 CEST	49719	443	192.168.2.8	104.17.24.14
Aug 31, 2024 00:37:29.485660076 CEST	443	49717	104.26.9.44	192.168.2.8
Aug 31, 2024 00:37:29.493127108 CEST	49717	443	192.168.2.8	104.26.9.44
Aug 31, 2024 00:37:29.493139982 CEST	443	49717	104.26.9.44	192.168.2.8
Aug 31, 2024 00:37:29.494278908 CEST	443	49717	104.26.9.44	192.168.2.8
Aug 31, 2024 00:37:29.494330883 CEST	49717	443	192.168.2.8	104.26.9.44
Aug 31, 2024 00:37:29.496222973 CEST	49717	443	192.168.2.8	104.26.9.44
Aug 31, 2024 00:37:29.496296883 CEST	443	49717	104.26.9.44	192.168.2.8
Aug 31, 2024 00:37:29.496632099 CEST	49717	443	192.168.2.8	104.26.9.44
Aug 31, 2024 00:37:29.496646881 CEST	443	49717	104.26.9.44	192.168.2.8
Aug 31, 2024 00:37:29.521022081 CEST	443	49719	104.17.24.14	192.168.2.8
Aug 31, 2024 00:37:29.521078110 CEST	443	49719	104.17.24.14	192.168.2.8
Aug 31, 2024 00:37:29.521105051 CEST	443	49719	104.17.24.14	192.168.2.8
Aug 31, 2024 00:37:29.521127939 CEST	443	49719	104.17.24.14	192.168.2.8
Aug 31, 2024 00:37:29.521135092 CEST	49719	443	192.168.2.8	104.17.24.14
Aug 31, 2024 00:37:29.521161079 CEST	443	49719	104.17.24.14	192.168.2.8
Aug 31, 2024 00:37:29.521173954 CEST	49719	443	192.168.2.8	104.17.24.14
Aug 31, 2024 00:37:29.521193027 CEST	443	49719	104.17.24.14	192.168.2.8
Aug 31, 2024 00:37:29.521222115 CEST	443	49719	104.17.24.14	192.168.2.8
Aug 31, 2024 00:37:29.521234989 CEST	49719	443	192.168.2.8	104.17.24.14
Aug 31, 2024 00:37:29.521239042 CEST	443	49719	104.17.24.14	192.168.2.8
Aug 31, 2024 00:37:29.521301031 CEST	49719	443	192.168.2.8	104.17.24.14
Aug 31, 2024 00:37:29.521608114 CEST	443	49719	104.17.24.14	192.168.2.8
Aug 31, 2024 00:37:29.527961969 CEST	443	49719	104.17.24.14	192.168.2.8
Aug 31, 2024 00:37:29.527995110 CEST	443	49719	104.17.24.14	192.168.2.8
Aug 31, 2024 00:37:29.528011084 CEST	49719	443	192.168.2.8	104.17.24.14
Aug 31, 2024 00:37:29.528017044 CEST	443	49719	104.17.24.14	192.168.2.8
Aug 31, 2024 00:37:29.528065920 CEST	49719	443	192.168.2.8	104.17.24.14
Aug 31, 2024 00:37:29.551610947 CEST	49717	443	192.168.2.8	104.26.9.44
Aug 31, 2024 00:37:29.607508898 CEST	443	49719	104.17.24.14	192.168.2.8
Aug 31, 2024 00:37:29.607589960 CEST	443	49719	104.17.24.14	192.168.2.8
Aug 31, 2024 00:37:29.607614994 CEST	443	49719	104.17.24.14	192.168.2.8
Aug 31, 2024 00:37:29.607659101 CEST	49719	443	192.168.2.8	104.17.24.14
Aug 31, 2024 00:37:29.607667923 CEST	443	49719	104.17.24.14	192.168.2.8
Aug 31, 2024 00:37:29.607741117 CEST	49719	443	192.168.2.8	104.17.24.14
Aug 31, 2024 00:37:29.607829094 CEST	443	49719	104.17.24.14	192.168.2.8
Aug 31, 2024 00:37:29.607916117 CEST	443	49719	104.17.24.14	192.168.2.8
Aug 31, 2024 00:37:29.607964039 CEST	49719	443	192.168.2.8	104.17.24.14
Aug 31, 2024 00:37:29.607969999 CEST	443	49719	104.17.24.14	192.168.2.8
Aug 31, 2024 00:37:29.608732939 CEST	443	49719	104.17.24.14	192.168.2.8
Aug 31, 2024 00:37:29.608772039 CEST	443	49719	104.17.24.14	192.168.2.8
Aug 31, 2024 00:37:29.608803988 CEST	49719	443	192.168.2.8	104.17.24.14
Aug 31, 2024 00:37:29.608809948 CEST	443	49719	104.17.24.14	192.168.2.8
Aug 31, 2024 00:37:29.608859062 CEST	49719	443	192.168.2.8	104.17.24.14
Aug 31, 2024 00:37:29.609244108 CEST	443	49719	104.17.24.14	192.168.2.8
Aug 31, 2024 00:37:29.609324932 CEST	443	49719	104.17.24.14	192.168.2.8
Aug 31, 2024 00:37:29.609370947 CEST	49719	443	192.168.2.8	104.17.24.14
Aug 31, 2024 00:37:29.609375000 CEST	443	49719	104.17.24.14	192.168.2.8
Aug 31, 2024 00:37:29.610224962 CEST	443	49719	104.17.24.14	192.168.2.8
Aug 31, 2024 00:37:29.610251904 CEST	443	49719	104.17.24.14	192.168.2.8
Aug 31, 2024 00:37:29.610272884 CEST	443	49719	104.17.24.14	192.168.2.8
Aug 31, 2024 00:37:29.610291958 CEST	49719	443	192.168.2.8	104.17.24.14
Aug 31, 2024 00:37:29.610299110 CEST	443	49719	104.17.24.14	192.168.2.8
Aug 31, 2024 00:37:29.610332966 CEST	49719	443	192.168.2.8	104.17.24.14
Aug 31, 2024 00:37:29.610377073 CEST	443	49719	104.17.24.14	192.168.2.8
Aug 31, 2024 00:37:29.610416889 CEST	49719	443	192.168.2.8	104.17.24.14
Aug 31, 2024 00:37:29.640703917 CEST	49719	443	192.168.2.8	104.17.24.14
Aug 31, 2024 00:37:29.640738010 CEST	443	49719	104.17.24.14	192.168.2.8
Aug 31, 2024 00:37:29.708439112 CEST	443	49717	104.26.9.44	192.168.2.8
Aug 31, 2024 00:37:29.708580971 CEST	443	49717	104.26.9.44	192.168.2.8
Aug 31, 2024 00:37:29.708640099 CEST	49717	443	192.168.2.8	104.26.9.44
Aug 31, 2024 00:37:29.712466002 CEST	49717	443	192.168.2.8	104.26.9.44
Aug 31, 2024 00:37:29.712491989 CEST	443	49717	104.26.9.44	192.168.2.8
Aug 31, 2024 00:37:29.725177050 CEST	49720	443	192.168.2.8	184.28.90.27
Aug 31, 2024 00:37:29.725212097 CEST	443	49720	184.28.90.27	192.168.2.8
Aug 31, 2024 00:37:29.725286007 CEST	49720	443	192.168.2.8	184.28.90.27
Aug 31, 2024 00:37:29.728641987 CEST	49720	443	192.168.2.8	184.28.90.27
Aug 31, 2024 00:37:29.728657007 CEST	443	49720	184.28.90.27	192.168.2.8
Aug 31, 2024 00:37:30.163992882 CEST	49710	443	192.168.2.8	188.114.96.3
Aug 31, 2024 00:37:30.164084911 CEST	443	49710	188.114.96.3	192.168.2.8
Aug 31, 2024 00:37:30.192253113 CEST	49721	443	192.168.2.8	188.114.96.3
Aug 31, 2024 00:37:30.192296982 CEST	443	49721	188.114.96.3	192.168.2.8
Aug 31, 2024 00:37:30.192395926 CEST	49721	443	192.168.2.8	188.114.96.3
Aug 31, 2024 00:37:30.193203926 CEST	49721	443	192.168.2.8	188.114.96.3
Aug 31, 2024 00:37:30.193217993 CEST	443	49721	188.114.96.3	192.168.2.8
Aug 31, 2024 00:37:30.217910051 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:30.217947960 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:30.218301058 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:30.218676090 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:30.218691111 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:30.325967073 CEST	443	49710	188.114.96.3	192.168.2.8
Aug 31, 2024 00:37:30.326113939 CEST	443	49710	188.114.96.3	192.168.2.8
Aug 31, 2024 00:37:30.326170921 CEST	49710	443	192.168.2.8	188.114.96.3
Aug 31, 2024 00:37:30.329505920 CEST	49710	443	192.168.2.8	188.114.96.3
Aug 31, 2024 00:37:30.329529047 CEST	443	49710	188.114.96.3	192.168.2.8
Aug 31, 2024 00:37:30.369469881 CEST	443	49720	184.28.90.27	192.168.2.8
Aug 31, 2024 00:37:30.369558096 CEST	49720	443	192.168.2.8	184.28.90.27
Aug 31, 2024 00:37:30.661667109 CEST	443	49721	188.114.96.3	192.168.2.8
Aug 31, 2024 00:37:30.700159073 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:30.711793900 CEST	49721	443	192.168.2.8	188.114.96.3
Aug 31, 2024 00:37:30.745626926 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:30.774725914 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:30.774748087 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:30.775043964 CEST	49721	443	192.168.2.8	188.114.96.3
Aug 31, 2024 00:37:30.775055885 CEST	443	49721	188.114.96.3	192.168.2.8
Aug 31, 2024 00:37:30.775527954 CEST	443	49721	188.114.96.3	192.168.2.8
Aug 31, 2024 00:37:30.776011944 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:30.776078939 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:30.779407024 CEST	49721	443	192.168.2.8	188.114.96.3
Aug 31, 2024 00:37:30.779525995 CEST	443	49721	188.114.96.3	192.168.2.8
Aug 31, 2024 00:37:30.790020943 CEST	49720	443	192.168.2.8	184.28.90.27
Aug 31, 2024 00:37:30.790051937 CEST	443	49720	184.28.90.27	192.168.2.8
Aug 31, 2024 00:37:30.790416956 CEST	443	49720	184.28.90.27	192.168.2.8
Aug 31, 2024 00:37:30.821902990 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:30.822123051 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:30.822134972 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:30.822525024 CEST	49721	443	192.168.2.8	188.114.96.3
Aug 31, 2024 00:37:30.837927103 CEST	49720	443	192.168.2.8	184.28.90.27
Aug 31, 2024 00:37:30.864509106 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:30.867932081 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:30.867943048 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:30.921330929 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:30.923644066 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:30.923852921 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:30.923911095 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:30.923923969 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:30.923963070 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:30.924000025 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:30.924029112 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:30.924041033 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:30.924051046 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:30.924077034 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:30.925263882 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:30.925297976 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:30.925333023 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:30.925343990 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:30.925383091 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:30.925390005 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:30.968142986 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:30.968162060 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:30.976144075 CEST	49720	443	192.168.2.8	184.28.90.27
Aug 31, 2024 00:37:31.014722109 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.014760017 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.014776945 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.014797926 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.014842033 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.014873981 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.014877081 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.014894962 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.014918089 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.015695095 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.015744925 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.015753031 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.015789986 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.016011953 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.016020060 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.016592979 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.016633987 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.016665936 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.016678095 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.016689062 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.016712904 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.017565012 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.017608881 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.017637968 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.017644882 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.017652035 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.017682076 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.018409014 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.018465996 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.018471956 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.018502951 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.018552065 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.018604994 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.018614054 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.018654108 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.019402981 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.020499945 CEST	443	49720	184.28.90.27	192.168.2.8
Aug 31, 2024 00:37:31.064589977 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.064613104 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.105596066 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.105634928 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.105668068 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.105678082 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.105689049 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.105721951 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.105756998 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.105843067 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.105854034 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.106098890 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.106129885 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.106148958 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.106158018 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.106203079 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.106918097 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.108550072 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.108560085 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.108587027 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.108594894 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.108601093 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.108602047 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.108613968 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.108625889 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.108660936 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.108680010 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.112440109 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.112462997 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.112514019 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.112525940 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.113137960 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.113158941 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.113213062 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.113219976 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.113260031 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.162946939 CEST	443	49720	184.28.90.27	192.168.2.8
Aug 31, 2024 00:37:31.163027048 CEST	443	49720	184.28.90.27	192.168.2.8
Aug 31, 2024 00:37:31.163225889 CEST	49720	443	192.168.2.8	184.28.90.27
Aug 31, 2024 00:37:31.164724112 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.180893898 CEST	49720	443	192.168.2.8	184.28.90.27
Aug 31, 2024 00:37:31.180919886 CEST	443	49720	184.28.90.27	192.168.2.8
Aug 31, 2024 00:37:31.180960894 CEST	49720	443	192.168.2.8	184.28.90.27
Aug 31, 2024 00:37:31.180965900 CEST	443	49720	184.28.90.27	192.168.2.8
Aug 31, 2024 00:37:31.197499990 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.197537899 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.197614908 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.197637081 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.197684050 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.199090958 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.199109077 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.199172020 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.199184895 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.199237108 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.199781895 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.199801922 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.199848890 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.199856043 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.199878931 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.199894905 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.200594902 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.200612068 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.200659037 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.200665951 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.200700998 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.202508926 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.202526093 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.202625990 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.202635050 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.202671051 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.203988075 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.204005957 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.204085112 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.204093933 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.204128981 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.256911993 CEST	49730	443	192.168.2.8	184.28.90.27
Aug 31, 2024 00:37:31.256953955 CEST	443	49730	184.28.90.27	192.168.2.8
Aug 31, 2024 00:37:31.257090092 CEST	49730	443	192.168.2.8	184.28.90.27
Aug 31, 2024 00:37:31.257539034 CEST	49730	443	192.168.2.8	184.28.90.27
Aug 31, 2024 00:37:31.257551908 CEST	443	49730	184.28.90.27	192.168.2.8
Aug 31, 2024 00:37:31.286870003 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.286891937 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.286961079 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.286981106 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.287022114 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.287049055 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.287712097 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.287729979 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.287813902 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.287822008 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.287873030 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.288557053 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.288572073 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.288640976 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.288650990 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.288690090 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.289453030 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.289469957 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.289549112 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.289556980 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.289593935 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.290164948 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.290184021 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.290318966 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.290327072 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.290570021 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.291198015 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.291213989 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.291260004 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.291270018 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.291331053 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.291922092 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.291935921 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.291992903 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.292001009 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.292071104 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.292929888 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.292948961 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.292996883 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.293009043 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.293056011 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.379487991 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.379519939 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.379585981 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.379605055 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.379661083 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.379669905 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.379954100 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.379970074 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.380017996 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.380026102 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.380048037 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.380065918 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.380763054 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.380780935 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.380877972 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.380884886 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.380920887 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.381572962 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.381597042 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.381632090 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.381638050 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.381668091 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.381697893 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.387650967 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.387679100 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.387715101 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.387726068 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.387759924 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.387772083 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.388247013 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.388267994 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.388314962 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.388322115 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.388345957 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.388365030 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.389333010 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.389354944 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.389400959 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.389408112 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.389456987 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.389465094 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.389731884 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.389749050 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.389806032 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.389811039 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.389847994 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.470763922 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.470784903 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.470865011 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.470877886 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.470916033 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.471499920 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.471517086 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.471540928 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.471585989 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.471590996 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.471642017 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.472024918 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.472039938 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.472083092 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.472090006 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.472105026 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.472127914 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.472491980 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.472508907 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.472577095 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.472583055 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.472625971 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.473011017 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.473031998 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.473061085 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.473102093 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.473105907 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.473141909 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.473675013 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.473690987 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.473742962 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.473750114 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.473794937 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.474410057 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.474426031 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.474474907 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.474482059 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.474522114 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.474847078 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.474864960 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.474916935 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.474922895 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.474972010 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.561592102 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.561614990 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.561654091 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.561666965 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.561702967 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.561717987 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.562367916 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.562387943 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.562422991 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.562460899 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.562465906 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.562501907 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.562712908 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.562728882 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.562768936 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.562774897 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.562794924 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.562809944 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.563110113 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.563123941 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.563188076 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.563194990 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.563235044 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.563857079 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.563873053 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.563930988 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.563941956 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.563952923 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.564006090 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.564670086 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.564691067 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.564729929 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.564735889 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.564775944 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.564790964 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.565093040 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.565110922 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.565157890 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.565164089 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.565213919 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.565607071 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.565622091 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.565650940 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.565684080 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.565689087 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.565726995 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.578013897 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.652410984 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.652431965 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.652486086 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.652509928 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.652539968 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.652565956 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.653028965 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.653048038 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.653098106 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.653105974 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.653141975 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.653770924 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.653789043 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.653825998 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.653975010 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.653980017 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.654021978 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.654181004 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.654205084 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.654233932 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.654239893 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.654267073 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.654284000 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.654359102 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.654373884 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.654427052 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.654433012 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.654485941 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.654860020 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.654877901 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.654917002 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.654922962 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.654952049 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.654964924 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.655280113 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.655298948 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.655333996 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.655342102 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.655364037 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.655380011 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.655848026 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.655869007 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.655909061 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.655916929 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.655970097 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.691688061 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.743170023 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.743192911 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.743241072 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.743257046 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.743292093 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.743307114 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.743755102 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.743777990 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.743827105 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.743834972 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.743890047 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.744364977 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.744383097 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.744431019 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.744437933 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.744477987 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.747747898 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.747769117 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.747807980 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.747816086 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.747863054 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.747875929 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.748322010 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.748343945 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.748384953 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.748389959 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.748425007 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.748434067 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.749502897 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.749526024 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.749568939 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.749576092 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.749613047 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.749628067 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.749743938 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.749763012 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.749799013 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.749804974 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.749833107 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.749867916 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.750508070 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.750530005 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.750565052 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.750571012 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.750602007 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.750614882 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.751004934 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.833853006 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.833874941 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.833934069 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.833947897 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.833992004 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.834455967 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.834477901 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.834510088 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.834517956 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.834557056 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.834570885 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.835185051 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.835205078 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.835259914 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.835267067 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.835306883 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.838402987 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.838474989 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.838483095 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.838505983 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.838557005 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.897079945 CEST	443	49730	184.28.90.27	192.168.2.8
Aug 31, 2024 00:37:31.897208929 CEST	49730	443	192.168.2.8	184.28.90.27
Aug 31, 2024 00:37:31.923860073 CEST	49723	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:31.923877001 CEST	443	49723	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:31.941920042 CEST	49730	443	192.168.2.8	184.28.90.27
Aug 31, 2024 00:37:31.941940069 CEST	443	49730	184.28.90.27	192.168.2.8
Aug 31, 2024 00:37:31.942261934 CEST	443	49730	184.28.90.27	192.168.2.8
Aug 31, 2024 00:37:31.943687916 CEST	49730	443	192.168.2.8	184.28.90.27
Aug 31, 2024 00:37:31.988512039 CEST	443	49730	184.28.90.27	192.168.2.8
Aug 31, 2024 00:37:32.175450087 CEST	443	49730	184.28.90.27	192.168.2.8
Aug 31, 2024 00:37:32.175519943 CEST	443	49730	184.28.90.27	192.168.2.8
Aug 31, 2024 00:37:32.175574064 CEST	49730	443	192.168.2.8	184.28.90.27
Aug 31, 2024 00:37:32.176620960 CEST	49730	443	192.168.2.8	184.28.90.27
Aug 31, 2024 00:37:32.176642895 CEST	443	49730	184.28.90.27	192.168.2.8
Aug 31, 2024 00:37:32.176651955 CEST	49730	443	192.168.2.8	184.28.90.27
Aug 31, 2024 00:37:32.176659107 CEST	443	49730	184.28.90.27	192.168.2.8
Aug 31, 2024 00:37:32.421225071 CEST	49732	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:32.421257019 CEST	443	49732	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:32.421585083 CEST	49732	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:32.424173117 CEST	49733	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:32.424173117 CEST	49732	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:32.424196959 CEST	443	49733	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:32.424201965 CEST	443	49732	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:32.425631046 CEST	49733	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:32.426126003 CEST	49733	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:32.426126003 CEST	49734	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:32.426153898 CEST	443	49733	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:32.426162958 CEST	443	49734	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:32.429425955 CEST	49734	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:32.433222055 CEST	49734	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:32.433238983 CEST	443	49734	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:32.885148048 CEST	443	49733	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:32.889242887 CEST	443	49732	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:32.892515898 CEST	443	49734	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:32.938023090 CEST	49733	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:32.938023090 CEST	49734	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:33.096518040 CEST	443	49732	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:33.101290941 CEST	49732	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:33.828996897 CEST	49734	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:33.829015017 CEST	443	49734	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:33.829071045 CEST	49732	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:33.829098940 CEST	443	49732	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:33.829164028 CEST	49733	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:33.829171896 CEST	443	49733	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:33.829621077 CEST	443	49732	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:33.829634905 CEST	443	49733	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:33.830121994 CEST	443	49734	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:33.830133915 CEST	443	49734	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:33.830178976 CEST	49734	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:33.879399061 CEST	49733	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:33.895023108 CEST	49732	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:33.903644085 CEST	49734	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:33.903714895 CEST	443	49734	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:33.905635118 CEST	49733	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:33.905795097 CEST	443	49733	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:33.907213926 CEST	49732	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:33.907358885 CEST	443	49732	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:33.908237934 CEST	49734	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:33.908250093 CEST	443	49734	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:33.908617020 CEST	49733	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:33.908809900 CEST	49732	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:33.952502966 CEST	443	49733	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:33.952502012 CEST	443	49732	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:33.956676960 CEST	49734	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:34.002983093 CEST	443	49734	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.003046989 CEST	443	49734	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.003076077 CEST	443	49734	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.003079891 CEST	49734	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:34.003092051 CEST	443	49734	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.003123999 CEST	49734	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:34.003129005 CEST	443	49734	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.003420115 CEST	443	49734	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.003447056 CEST	443	49734	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.003462076 CEST	49734	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:34.003467083 CEST	443	49734	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.003508091 CEST	49734	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:34.004210949 CEST	443	49733	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.004276037 CEST	443	49733	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.004302979 CEST	443	49734	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.004304886 CEST	443	49733	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.004312038 CEST	49733	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:34.004318953 CEST	443	49733	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.004358053 CEST	49733	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:34.004363060 CEST	443	49733	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.004416943 CEST	443	49732	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.004892111 CEST	443	49732	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.004940033 CEST	49732	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:34.004956961 CEST	443	49732	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.005016088 CEST	443	49732	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.005044937 CEST	443	49732	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.005049944 CEST	49732	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:34.005058050 CEST	443	49732	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.005089045 CEST	49732	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:34.005095959 CEST	443	49732	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.005209923 CEST	443	49733	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.005244970 CEST	49733	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:34.005249977 CEST	443	49733	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.005260944 CEST	443	49733	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.005300999 CEST	49733	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:34.005307913 CEST	443	49733	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.005945921 CEST	443	49732	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.005980015 CEST	443	49732	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.005987883 CEST	49732	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:34.005997896 CEST	443	49732	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.006036043 CEST	49732	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:34.006134987 CEST	443	49733	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.006166935 CEST	49733	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:34.006172895 CEST	443	49733	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.008637905 CEST	49734	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:34.008665085 CEST	443	49734	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.008704901 CEST	49734	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:34.013214111 CEST	443	49732	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.013274908 CEST	443	49732	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.013313055 CEST	49732	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:34.013326883 CEST	443	49732	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.019330025 CEST	443	49733	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.019376040 CEST	49733	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:34.019391060 CEST	443	49733	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.062464952 CEST	49733	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:34.090924025 CEST	443	49733	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.091010094 CEST	443	49733	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.091054916 CEST	49733	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:34.091068983 CEST	443	49733	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.091535091 CEST	443	49733	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.091573954 CEST	49733	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:34.091581106 CEST	443	49733	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.091672897 CEST	443	49733	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.091701031 CEST	443	49733	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.091713905 CEST	49733	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:34.091720104 CEST	443	49733	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.091749907 CEST	49733	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:34.092477083 CEST	443	49733	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.092549086 CEST	443	49733	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.092582941 CEST	49733	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:34.092587948 CEST	443	49733	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.093502998 CEST	443	49733	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.093535900 CEST	443	49733	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.093539000 CEST	49733	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:34.093548059 CEST	443	49733	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.093580008 CEST	49733	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:34.093585014 CEST	443	49733	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.093647003 CEST	443	49732	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.093678951 CEST	443	49732	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.093705893 CEST	49732	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:34.093710899 CEST	443	49732	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.093724012 CEST	443	49732	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.093754053 CEST	49732	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:34.094357014 CEST	443	49732	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.094383955 CEST	443	49732	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.094460964 CEST	49732	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:34.094475031 CEST	443	49732	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.094511032 CEST	49732	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:34.094517946 CEST	443	49732	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.094540119 CEST	443	49733	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.094575882 CEST	49733	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:34.094582081 CEST	443	49733	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.095267057 CEST	443	49732	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.095308065 CEST	49732	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:34.095316887 CEST	443	49732	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.095391035 CEST	443	49733	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.095418930 CEST	443	49733	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.095432043 CEST	49733	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:34.095438004 CEST	443	49733	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.095467091 CEST	49733	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:34.095488071 CEST	443	49733	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.096082926 CEST	443	49732	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.096121073 CEST	49732	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:34.096128941 CEST	443	49732	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.096174002 CEST	443	49732	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.096204042 CEST	443	49732	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.096239090 CEST	49732	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:34.096246004 CEST	443	49732	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.096280098 CEST	49732	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:34.096997976 CEST	443	49732	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.097103119 CEST	443	49732	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.097146988 CEST	49732	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:34.097671986 CEST	49732	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:34.097686052 CEST	443	49732	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.140604019 CEST	49733	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:34.140619993 CEST	443	49733	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.151774883 CEST	443	49733	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.151829958 CEST	49733	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:34.151846886 CEST	443	49733	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.151863098 CEST	443	49733	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.151913881 CEST	49733	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:34.152651072 CEST	49733	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:34.152667046 CEST	443	49733	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.177962065 CEST	49739	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:34.177993059 CEST	443	49739	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.178054094 CEST	49739	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:34.178256989 CEST	49739	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:34.178273916 CEST	443	49739	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.638777018 CEST	443	49739	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.639069080 CEST	49739	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:34.639084101 CEST	443	49739	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.640077114 CEST	443	49739	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.640396118 CEST	49739	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:34.640664101 CEST	49739	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:34.640729904 CEST	443	49739	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.640811920 CEST	49739	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:34.640822887 CEST	443	49739	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.687048912 CEST	49739	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:34.740430117 CEST	443	49739	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.740499020 CEST	443	49739	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.740537882 CEST	443	49739	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.740628004 CEST	443	49739	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:34.740664959 CEST	49739	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:34.740700960 CEST	49739	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:34.741568089 CEST	49739	443	192.168.2.8	151.101.129.229
Aug 31, 2024 00:37:34.741586924 CEST	443	49739	151.101.129.229	192.168.2.8
Aug 31, 2024 00:37:38.043066025 CEST	53456	53	192.168.2.8	1.1.1.1
Aug 31, 2024 00:37:38.050107956 CEST	53	53456	1.1.1.1	192.168.2.8
Aug 31, 2024 00:37:38.050205946 CEST	53456	53	192.168.2.8	1.1.1.1
Aug 31, 2024 00:37:38.050262928 CEST	53456	53	192.168.2.8	1.1.1.1
Aug 31, 2024 00:37:38.057229996 CEST	53	53456	1.1.1.1	192.168.2.8
Aug 31, 2024 00:37:38.506289959 CEST	53	53456	1.1.1.1	192.168.2.8
Aug 31, 2024 00:37:38.507184029 CEST	53456	53	192.168.2.8	1.1.1.1
Aug 31, 2024 00:37:38.514842987 CEST	53	53456	1.1.1.1	192.168.2.8
Aug 31, 2024 00:37:38.514899015 CEST	53456	53	192.168.2.8	1.1.1.1
Aug 31, 2024 00:37:38.931835890 CEST	443	49715	142.250.186.132	192.168.2.8
Aug 31, 2024 00:37:38.931900978 CEST	443	49715	142.250.186.132	192.168.2.8
Aug 31, 2024 00:37:38.931957006 CEST	49715	443	192.168.2.8	142.250.186.132
Aug 31, 2024 00:37:40.133755922 CEST	49715	443	192.168.2.8	142.250.186.132
Aug 31, 2024 00:37:40.133790970 CEST	443	49715	142.250.186.132	192.168.2.8
Aug 31, 2024 00:37:45.568778992 CEST	443	49721	188.114.96.3	192.168.2.8
Aug 31, 2024 00:37:45.568866014 CEST	443	49721	188.114.96.3	192.168.2.8
Aug 31, 2024 00:37:45.568918943 CEST	49721	443	192.168.2.8	188.114.96.3
Aug 31, 2024 00:37:46.111712933 CEST	49721	443	192.168.2.8	188.114.96.3
Aug 31, 2024 00:37:46.111740112 CEST	443	49721	188.114.96.3	192.168.2.8
Aug 31, 2024 00:38:06.955276012 CEST	49703	80	192.168.2.8	199.232.210.172
Aug 31, 2024 00:38:06.961644888 CEST	80	49703	199.232.210.172	192.168.2.8
Aug 31, 2024 00:38:06.967350960 CEST	49703	80	192.168.2.8	199.232.210.172
Aug 31, 2024 00:38:28.386507034 CEST	53459	443	192.168.2.8	142.250.186.132
Aug 31, 2024 00:38:28.386554003 CEST	443	53459	142.250.186.132	192.168.2.8
Aug 31, 2024 00:38:28.386699915 CEST	53459	443	192.168.2.8	142.250.186.132
Aug 31, 2024 00:38:28.387284994 CEST	53459	443	192.168.2.8	142.250.186.132
Aug 31, 2024 00:38:28.387306929 CEST	443	53459	142.250.186.132	192.168.2.8
Aug 31, 2024 00:38:29.025659084 CEST	443	53459	142.250.186.132	192.168.2.8
Aug 31, 2024 00:38:29.026122093 CEST	53459	443	192.168.2.8	142.250.186.132
Aug 31, 2024 00:38:29.026134014 CEST	443	53459	142.250.186.132	192.168.2.8
Aug 31, 2024 00:38:29.026479006 CEST	443	53459	142.250.186.132	192.168.2.8
Aug 31, 2024 00:38:29.027618885 CEST	53459	443	192.168.2.8	142.250.186.132
Aug 31, 2024 00:38:29.027689934 CEST	443	53459	142.250.186.132	192.168.2.8
Aug 31, 2024 00:38:29.079080105 CEST	53459	443	192.168.2.8	142.250.186.132
Aug 31, 2024 00:38:38.932663918 CEST	443	53459	142.250.186.132	192.168.2.8
Aug 31, 2024 00:38:38.932732105 CEST	443	53459	142.250.186.132	192.168.2.8
Aug 31, 2024 00:38:38.932873964 CEST	53459	443	192.168.2.8	142.250.186.132
Aug 31, 2024 00:38:40.114597082 CEST	53459	443	192.168.2.8	142.250.186.132
Aug 31, 2024 00:38:40.114634037 CEST	443	53459	142.250.186.132	192.168.2.8

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 31, 2024 00:37:23.913898945 CEST	53	55558	1.1.1.1	192.168.2.8
Aug 31, 2024 00:37:23.921928883 CEST	53	49597	1.1.1.1	192.168.2.8
Aug 31, 2024 00:37:24.912391901 CEST	53	63690	1.1.1.1	192.168.2.8
Aug 31, 2024 00:37:25.830034018 CEST	49574	53	192.168.2.8	1.1.1.1
Aug 31, 2024 00:37:25.830202103 CEST	60429	53	192.168.2.8	1.1.1.1
Aug 31, 2024 00:37:25.836919069 CEST	53	49574	1.1.1.1	192.168.2.8
Aug 31, 2024 00:37:25.841665983 CEST	53	60429	1.1.1.1	192.168.2.8
Aug 31, 2024 00:37:26.745346069 CEST	59299	53	192.168.2.8	1.1.1.1
Aug 31, 2024 00:37:26.745492935 CEST	55111	53	192.168.2.8	1.1.1.1
Aug 31, 2024 00:37:26.751916885 CEST	53	55111	1.1.1.1	192.168.2.8
Aug 31, 2024 00:37:28.357789040 CEST	53156	53	192.168.2.8	1.1.1.1
Aug 31, 2024 00:37:28.357789040 CEST	59049	53	192.168.2.8	1.1.1.1
Aug 31, 2024 00:37:28.369374990 CEST	53	53156	1.1.1.1	192.168.2.8
Aug 31, 2024 00:37:28.369411945 CEST	53	59049	1.1.1.1	192.168.2.8
Aug 31, 2024 00:37:28.851803064 CEST	53	55971	1.1.1.1	192.168.2.8
Aug 31, 2024 00:37:28.889934063 CEST	53990	53	192.168.2.8	1.1.1.1
Aug 31, 2024 00:37:28.890494108 CEST	50508	53	192.168.2.8	1.1.1.1
Aug 31, 2024 00:37:28.896418095 CEST	53407	53	192.168.2.8	1.1.1.1
Aug 31, 2024 00:37:28.896920919 CEST	53954	53	192.168.2.8	1.1.1.1
Aug 31, 2024 00:37:28.900362968 CEST	53	53990	1.1.1.1	192.168.2.8
Aug 31, 2024 00:37:28.901041031 CEST	53	50508	1.1.1.1	192.168.2.8
Aug 31, 2024 00:37:28.904494047 CEST	53	55818	1.1.1.1	192.168.2.8
Aug 31, 2024 00:37:28.905064106 CEST	53	53407	1.1.1.1	192.168.2.8
Aug 31, 2024 00:37:28.905699968 CEST	53	53954	1.1.1.1	192.168.2.8
Aug 31, 2024 00:37:30.207940102 CEST	50938	53	192.168.2.8	1.1.1.1
Aug 31, 2024 00:37:30.208199024 CEST	60762	53	192.168.2.8	1.1.1.1
Aug 31, 2024 00:37:30.217124939 CEST	53	50938	1.1.1.1	192.168.2.8
Aug 31, 2024 00:37:30.217274904 CEST	53	60762	1.1.1.1	192.168.2.8
Aug 31, 2024 00:37:30.911216974 CEST	53	53026	1.1.1.1	192.168.2.8
Aug 31, 2024 00:37:38.041601896 CEST	53	64121	1.1.1.1	192.168.2.8
Aug 31, 2024 00:37:42.154055119 CEST	53	52451	1.1.1.1	192.168.2.8
Aug 31, 2024 00:38:01.249444962 CEST	53	60375	1.1.1.1	192.168.2.8
Aug 31, 2024 00:38:06.791402102 CEST	138	138	192.168.2.8	192.168.2.255
Aug 31, 2024 00:38:23.527656078 CEST	53	56303	1.1.1.1	192.168.2.8
Aug 31, 2024 00:38:23.964416027 CEST	53	52376	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 31, 2024 00:37:25.830034018 CEST	192.168.2.8	1.1.1.1	0xe031	Standard query (0)	sharefile8.pages.dev	A (IP address)	IN (0x0001)	false
Aug 31, 2024 00:37:25.830202103 CEST	192.168.2.8	1.1.1.1	0x6e17	Standard query (0)	sharefile8.pages.dev	65	IN (0x0001)	false
Aug 31, 2024 00:37:26.745346069 CEST	192.168.2.8	1.1.1.1	0xe73c	Standard query (0)	cdn.jsdelivr.net	A (IP address)	IN (0x0001)	false
Aug 31, 2024 00:37:26.745492935 CEST	192.168.2.8	1.1.1.1	0x60ab	Standard query (0)	cdn.jsdelivr.net	65	IN (0x0001)	false
Aug 31, 2024 00:37:28.357789040 CEST	192.168.2.8	1.1.1.1	0xf77a	Standard query (0)	www.google.com	65	IN (0x0001)	false
Aug 31, 2024 00:37:28.357789040 CEST	192.168.2.8	1.1.1.1	0x833	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Aug 31, 2024 00:37:28.889934063 CEST	192.168.2.8	1.1.1.1	0xf663	Standard query (0)	ipapi.co	A (IP address)	IN (0x0001)	false
Aug 31, 2024 00:37:28.890494108 CEST	192.168.2.8	1.1.1.1	0x8c8d	Standard query (0)	ipapi.co	65	IN (0x0001)	false
Aug 31, 2024 00:37:28.896418095 CEST	192.168.2.8	1.1.1.1	0xa41a	Standard query (0)	cdnjs.cloudflare.com	A (IP address)	IN (0x0001)	false
Aug 31, 2024 00:37:28.896920919 CEST	192.168.2.8	1.1.1.1	0x2ae8	Standard query (0)	cdnjs.cloudflare.com	65	IN (0x0001)	false
Aug 31, 2024 00:37:30.207940102 CEST	192.168.2.8	1.1.1.1	0x30be	Standard query (0)	cdn.jsdelivr.net	A (IP address)	IN (0x0001)	false
Aug 31, 2024 00:37:30.208199024 CEST	192.168.2.8	1.1.1.1	0x7b33	Standard query (0)	cdn.jsdelivr.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Aug 31, 2024 00:37:25.836919069 CEST	1.1.1.1	192.168.2.8	0xe031	No error (0)	sharefile8.pages.dev		188.114.96.3	A (IP address)	IN (0x0001)	false
Aug 31, 2024 00:37:25.836919069 CEST	1.1.1.1	192.168.2.8	0xe031	No error (0)	sharefile8.pages.dev		188.114.97.3	A (IP address)	IN (0x0001)	false
Aug 31, 2024 00:37:25.841665983 CEST	1.1.1.1	192.168.2.8	0x6e17	No error (0)	sharefile8.pages.dev			65	IN (0x0001)	false
Aug 31, 2024 00:37:26.751857996 CEST	1.1.1.1	192.168.2.8	0xe73c	No error (0)	cdn.jsdelivr.net	cdn.jsdelivr.net.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 31, 2024 00:37:26.751916885 CEST	1.1.1.1	192.168.2.8	0x60ab	No error (0)	cdn.jsdelivr.net	cdn.jsdelivr.net.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 31, 2024 00:37:28.369374990 CEST	1.1.1.1	192.168.2.8	0xf77a	No error (0)	www.google.com			65	IN (0x0001)	false
Aug 31, 2024 00:37:28.369411945 CEST	1.1.1.1	192.168.2.8	0x833	No error (0)	www.google.com		142.250.186.132	A (IP address)	IN (0x0001)	false
Aug 31, 2024 00:37:28.900362968 CEST	1.1.1.1	192.168.2.8	0xf663	No error (0)	ipapi.co		104.26.9.44	A (IP address)	IN (0x0001)	false
Aug 31, 2024 00:37:28.900362968 CEST	1.1.1.1	192.168.2.8	0xf663	No error (0)	ipapi.co		172.67.69.226	A (IP address)	IN (0x0001)	false
Aug 31, 2024 00:37:28.900362968 CEST	1.1.1.1	192.168.2.8	0xf663	No error (0)	ipapi.co		104.26.8.44	A (IP address)	IN (0x0001)	false
Aug 31, 2024 00:37:28.901041031 CEST	1.1.1.1	192.168.2.8	0x8c8d	No error (0)	ipapi.co			65	IN (0x0001)	false
Aug 31, 2024 00:37:28.905064106 CEST	1.1.1.1	192.168.2.8	0xa41a	No error (0)	cdnjs.cloudflare.com		104.17.24.14	A (IP address)	IN (0x0001)	false
Aug 31, 2024 00:37:28.905064106 CEST	1.1.1.1	192.168.2.8	0xa41a	No error (0)	cdnjs.cloudflare.com		104.17.25.14	A (IP address)	IN (0x0001)	false
Aug 31, 2024 00:37:28.905699968 CEST	1.1.1.1	192.168.2.8	0x2ae8	No error (0)	cdnjs.cloudflare.com			65	IN (0x0001)	false
Aug 31, 2024 00:37:30.217124939 CEST	1.1.1.1	192.168.2.8	0x30be	No error (0)	cdn.jsdelivr.net	jsdelivr.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 31, 2024 00:37:30.217124939 CEST	1.1.1.1	192.168.2.8	0x30be	No error (0)	jsdelivr.map.fastly.net		151.101.129.229	A (IP address)	IN (0x0001)	false
Aug 31, 2024 00:37:30.217124939 CEST	1.1.1.1	192.168.2.8	0x30be	No error (0)	jsdelivr.map.fastly.net		151.101.65.229	A (IP address)	IN (0x0001)	false
Aug 31, 2024 00:37:30.217124939 CEST	1.1.1.1	192.168.2.8	0x30be	No error (0)	jsdelivr.map.fastly.net		151.101.1.229	A (IP address)	IN (0x0001)	false
Aug 31, 2024 00:37:30.217124939 CEST	1.1.1.1	192.168.2.8	0x30be	No error (0)	jsdelivr.map.fastly.net		151.101.193.229	A (IP address)	IN (0x0001)	false
Aug 31, 2024 00:37:30.217274904 CEST	1.1.1.1	192.168.2.8	0x7b33	No error (0)	cdn.jsdelivr.net	cdn.jsdelivr.net.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 31, 2024 00:37:36.176017046 CEST	1.1.1.1	192.168.2.8	0xd51c	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 31, 2024 00:37:36.176017046 CEST	1.1.1.1	192.168.2.8	0xd51c	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

sharefile8.pages.dev

https:

cdnjs.cloudflare.com

ipapi.co

cdn.jsdelivr.net

fs.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49711	188.114.96.3	443	880	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 22:37:26 UTC	810	OUT	GET /qvuv+pyrqwzcz6xaxlnoqwjmehzvhi7wuk+tdmwkgv96kzea82mtrq3s+h+nlysnemgyfcvtuhozuighqob+lce9yippttt6fi1kubdsdbqmwx5kxujjxwu5crv4iqguxis5l5bqjc2sd56vkdj HTTP/1.1 Host: sharefile8.pages.dev Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-30 22:37:26 UTC	724	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 22:37:26 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=0, must-revalidate referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xXSSgjnzxWN2Ks0nfbsin%2B5ZKsu59ynOgU9hdL1%2BUaDPgtk8On9eYMkUB8k2e9LNcLrH4NOCc07cvDNAiRxIlzVloATuNQr8RRWpm%2FeECtkQ6lHdGwLDh456hnJToeJHoVdUur77EQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8bb843f03fd64334-EWR alt-svc: h3=":443"; ma=86400
2024-08-30 22:37:26 UTC	523	IN	Data Raw: 32 30 34 0d 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 20 20 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 6a 73 64 65 6c 69 76 72 2e 6e 65 74 2f 67 68 2f 75 69 68 6b 64 73 6c 69 6a 73 6a 64 2f 63 61 70 74 69 76 61 74 69 6e 67 2d 61 70 70 2d 6c 79 6f 75 62 67 73 35 40 69 6e 74 65 72 6e 61 6c 2d 32 30 32 34 2d 30 37 2d 31 36 2d 32 30 2d 30 32 2d 35 38 2f 31 33 39 61 38 63 64 32 2d 64 31 30 63 2d 34 33 33 36 2d 62 61 30 34 2d 33 66 31 63 35 33 62 61 38 63 62 36 2e 6a 73 3f 68 61 73 68 3d 36 62 30 36 64 62 39 34 33 66 30 38 31 65 62 65 65 36 38 39 66 33 37 36 63 38 62 32 33 31 64 31 26 45 44 6c 46 68 36 53 4f 42 Data Ascii: 204<html> <head><title></title></head> <body> <script src="https://cdn.jsdelivr.net/gh/uihkdslijsjd/captivating-app-lyoubgs5@internal-2024-07-16-20-02-58/139a8cd2-d10c-4336-ba04-3f1c53ba8cb6.js?hash=6b06db943f081ebee689f376c8b231d1&EDlFh6SOB
2024-08-30 22:37:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49719	104.17.24.14	443	880	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 22:37:29 UTC	622	OUT	GET /ajax/libs/font-awesome/4.7.0/css/font-awesome.css HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://sharefile8.pages.dev sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: style Referer: https://sharefile8.pages.dev/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-30 22:37:29 UTC	944	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 22:37:29 GMT Content-Type: text/css; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=30672000 ETag: W/"5eb03e5f-9226" Last-Modified: Mon, 04 May 2020 16:10:07 GMT cf-cdnjs-via: cfworker/kv Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * X-Content-Type-Options: nosniff CF-Cache-Status: HIT Age: 787579 Expires: Wed, 20 Aug 2025 22:37:29 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mCdMqboukBK1vA22E2dON0HynG%2B66aWGDeDPW%2BxFVIcqEZcq90XzmlGk8Ou9veztEZnbgSzi7W5fBEvJfJREOnNf4IFhXOfngh6gMWDxf%2BxCQF77W7sOuJASIvYCamEiSnqZoFr8"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15780000 Server: cloudflare CF-RAY: 8bb844031e350fab-EWR alt-svc: h3=":443"; ma=86400
2024-08-30 22:37:29 UTC	425	IN	Data Raw: 37 63 30 31 0d 0a 2f 2a 21 0a 20 2a 20 20 46 6f 6e 74 20 41 77 65 73 6f 6d 65 20 34 2e 37 2e 30 20 62 79 20 40 64 61 76 65 67 61 6e 64 79 20 2d 20 68 74 74 70 3a 2f 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2e 69 6f 20 2d 20 40 66 6f 6e 74 61 77 65 73 6f 6d 65 0a 20 2a 20 20 4c 69 63 65 6e 73 65 20 2d 20 68 74 74 70 3a 2f 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2e 69 6f 2f 6c 69 63 65 6e 73 65 20 28 46 6f 6e 74 3a 20 53 49 4c 20 4f 46 4c 20 31 2e 31 2c 20 43 53 53 3a 20 4d 49 54 20 4c 69 63 65 6e 73 65 29 0a 20 2a 2f 0a 2f 2a 20 46 4f 4e 54 20 50 41 54 48 0a 20 2a 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 46 6f 6e 74 41 77 65 73 Data Ascii: 7c01/! Font Awesome 4.7.0 by @davegandy - http://fontawesome.io - @fontawesome * License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License) // FONT PATH * -------------------------- */@font-face { font-family: 'FontAwes
2024-08-30 22:37:29 UTC	1369	IN	Data Raw: 74 61 77 65 73 6f 6d 65 2d 77 65 62 66 6f 6e 74 2e 77 6f 66 66 32 3f 76 3d 34 2e 37 2e 30 27 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 2c 20 75 72 6c 28 27 2e 2e 2f 66 6f 6e 74 73 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2d 77 65 62 66 6f 6e 74 2e 77 6f 66 66 3f 76 3d 34 2e 37 2e 30 27 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 27 29 2c 20 75 72 6c 28 27 2e 2e 2f 66 6f 6e 74 73 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2d 77 65 62 66 6f 6e 74 2e 74 74 66 3f 76 3d 34 2e 37 2e 30 27 29 20 66 6f 72 6d 61 74 28 27 74 72 75 65 74 79 70 65 27 29 2c 20 75 72 6c 28 27 2e 2e 2f 66 6f 6e 74 73 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2d 77 65 62 66 6f 6e 74 2e 73 76 67 3f 76 3d 34 2e 37 2e 30 23 66 6f 6e 74 61 77 65 73 6f 6d 65 72 65 67 75 6c 61 72 27 29 20 66 6f 72 6d 61 Data Ascii: tawesome-webfont.woff2?v=4.7.0') format('woff2'), url('../fonts/fontawesome-webfont.woff?v=4.7.0') format('woff'), url('../fonts/fontawesome-webfont.ttf?v=4.7.0') format('truetype'), url('../fonts/fontawesome-webfont.svg?v=4.7.0#fontawesomeregular') forma
2024-08-30 22:37:29 UTC	1369	IN	Data Raw: 6d 3b 0a 7d 0a 2f 2a 20 44 65 70 72 65 63 61 74 65 64 20 61 73 20 6f 66 20 34 2e 34 2e 30 20 2a 2f 0a 2e 70 75 6c 6c 2d 72 69 67 68 74 20 7b 0a 20 20 66 6c 6f 61 74 3a 20 72 69 67 68 74 3b 0a 7d 0a 2e 70 75 6c 6c 2d 6c 65 66 74 20 7b 0a 20 20 66 6c 6f 61 74 3a 20 6c 65 66 74 3b 0a 7d 0a 2e 66 61 2e 70 75 6c 6c 2d 6c 65 66 74 20 7b 0a 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 2e 33 65 6d 3b 0a 7d 0a 2e 66 61 2e 70 75 6c 6c 2d 72 69 67 68 74 20 7b 0a 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2e 33 65 6d 3b 0a 7d 0a 2e 66 61 2d 73 70 69 6e 20 7b 0a 20 20 2d 77 65 62 6b 69 74 2d 61 6e 69 6d 61 74 69 6f 6e 3a 20 66 61 2d 73 70 69 6e 20 32 73 20 69 6e 66 69 6e 69 74 65 20 6c 69 6e 65 61 72 3b 0a 20 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 66 61 2d 73 70 69 Data Ascii: m;}/* Deprecated as of 4.4.0 */.pull-right { float: right;}.pull-left { float: left;}.fa.pull-left { margin-right: .3em;}.fa.pull-right { margin-left: .3em;}.fa-spin { -webkit-animation: fa-spin 2s infinite linear; animation: fa-spi
2024-08-30 22:37:29 UTC	1369	IN	Data Raw: 22 70 72 6f 67 69 64 3a 44 58 49 6d 61 67 65 54 72 61 6e 73 66 6f 72 6d 2e 4d 69 63 72 6f 73 6f 66 74 2e 42 61 73 69 63 49 6d 61 67 65 28 72 6f 74 61 74 69 6f 6e 3d 30 2c 20 6d 69 72 72 6f 72 3d 31 29 22 3b 0a 20 20 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 20 73 63 61 6c 65 28 2d 31 2c 20 31 29 3b 0a 20 20 2d 6d 73 2d 74 72 61 6e 73 66 6f 72 6d 3a 20 73 63 61 6c 65 28 2d 31 2c 20 31 29 3b 0a 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 73 63 61 6c 65 28 2d 31 2c 20 31 29 3b 0a 7d 0a 2e 66 61 2d 66 6c 69 70 2d 76 65 72 74 69 63 61 6c 20 7b 0a 20 20 2d 6d 73 2d 66 69 6c 74 65 72 3a 20 22 70 72 6f 67 69 64 3a 44 58 49 6d 61 67 65 54 72 61 6e 73 66 6f 72 6d 2e 4d 69 63 72 6f 73 6f 66 74 2e 42 61 73 69 63 49 6d 61 67 65 28 72 6f 74 61 74 69 6f 6e 3d 32 Data Ascii: "progid:DXImageTransform.Microsoft.BasicImage(rotation=0, mirror=1)"; -webkit-transform: scale(-1, 1); -ms-transform: scale(-1, 1); transform: scale(-1, 1);}.fa-flip-vertical { -ms-filter: "progid:DXImageTransform.Microsoft.BasicImage(rotation=2
2024-08-30 22:37:29 UTC	1369	IN	Data Raw: 6c 61 72 67 65 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 30 39 22 3b 0a 7d 0a 2e 66 61 2d 74 68 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 30 61 22 3b 0a 7d 0a 2e 66 61 2d 74 68 2d 6c 69 73 74 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 30 62 22 3b 0a 7d 0a 2e 66 61 2d 63 68 65 63 6b 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 30 63 22 3b 0a 7d 0a 2e 66 61 2d 72 65 6d 6f 76 65 3a 62 65 66 6f 72 65 2c 0a 2e 66 61 2d 63 6c 6f 73 65 3a 62 65 66 6f 72 65 2c 0a 2e 66 61 2d 74 69 6d 65 73 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 30 64 22 3b 0a 7d 0a 2e 66 61 2d 73 65 61 72 63 68 2d 70 6c 75 73 3a 62 65 Data Ascii: large:before { content: "\f009";}.fa-th:before { content: "\f00a";}.fa-th-list:before { content: "\f00b";}.fa-check:before { content: "\f00c";}.fa-remove:before,.fa-close:before,.fa-times:before { content: "\f00d";}.fa-search-plus:be
2024-08-30 22:37:29 UTC	1369	IN	Data Raw: 65 6e 74 3a 20 22 5c 66 30 32 39 22 3b 0a 7d 0a 2e 66 61 2d 62 61 72 63 6f 64 65 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 32 61 22 3b 0a 7d 0a 2e 66 61 2d 74 61 67 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 32 62 22 3b 0a 7d 0a 2e 66 61 2d 74 61 67 73 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 32 63 22 3b 0a 7d 0a 2e 66 61 2d 62 6f 6f 6b 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 32 64 22 3b 0a 7d 0a 2e 66 61 2d 62 6f 6f 6b 6d 61 72 6b 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 32 65 22 3b 0a 7d 0a 2e 66 61 2d 70 72 69 6e 74 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 Data Ascii: ent: "\f029";}.fa-barcode:before { content: "\f02a";}.fa-tag:before { content: "\f02b";}.fa-tags:before { content: "\f02c";}.fa-book:before { content: "\f02d";}.fa-bookmark:before { content: "\f02e";}.fa-print:before { content: "\f
2024-08-30 22:37:29 UTC	1369	IN	Data Raw: 65 70 2d 62 61 63 6b 77 61 72 64 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 34 38 22 3b 0a 7d 0a 2e 66 61 2d 66 61 73 74 2d 62 61 63 6b 77 61 72 64 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 34 39 22 3b 0a 7d 0a 2e 66 61 2d 62 61 63 6b 77 61 72 64 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 34 61 22 3b 0a 7d 0a 2e 66 61 2d 70 6c 61 79 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 34 62 22 3b 0a 7d 0a 2e 66 61 2d 70 61 75 73 65 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 34 63 22 3b 0a 7d 0a 2e 66 61 2d 73 74 6f 70 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 34 64 22 3b 0a Data Ascii: ep-backward:before { content: "\f048";}.fa-fast-backward:before { content: "\f049";}.fa-backward:before { content: "\f04a";}.fa-play:before { content: "\f04b";}.fa-pause:before { content: "\f04c";}.fa-stop:before { content: "\f04d";
2024-08-30 22:37:29 UTC	1369	IN	Data Raw: 74 3a 20 22 5c 66 30 36 37 22 3b 0a 7d 0a 2e 66 61 2d 6d 69 6e 75 73 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 36 38 22 3b 0a 7d 0a 2e 66 61 2d 61 73 74 65 72 69 73 6b 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 36 39 22 3b 0a 7d 0a 2e 66 61 2d 65 78 63 6c 61 6d 61 74 69 6f 6e 2d 63 69 72 63 6c 65 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 36 61 22 3b 0a 7d 0a 2e 66 61 2d 67 69 66 74 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 36 62 22 3b 0a 7d 0a 2e 66 61 2d 6c 65 61 66 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 36 63 22 3b 0a 7d 0a 2e 66 61 2d 66 69 72 65 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f Data Ascii: t: "\f067";}.fa-minus:before { content: "\f068";}.fa-asterisk:before { content: "\f069";}.fa-exclamation-circle:before { content: "\f06a";}.fa-gift:before { content: "\f06b";}.fa-leaf:before { content: "\f06c";}.fa-fire:before { co
2024-08-30 22:37:29 UTC	1369	IN	Data Raw: 61 2d 74 68 75 6d 62 73 2d 6f 2d 75 70 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 38 37 22 3b 0a 7d 0a 2e 66 61 2d 74 68 75 6d 62 73 2d 6f 2d 64 6f 77 6e 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 38 38 22 3b 0a 7d 0a 2e 66 61 2d 73 74 61 72 2d 68 61 6c 66 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 38 39 22 3b 0a 7d 0a 2e 66 61 2d 68 65 61 72 74 2d 6f 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 38 61 22 3b 0a 7d 0a 2e 66 61 2d 73 69 67 6e 2d 6f 75 74 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 38 62 22 3b 0a 7d 0a 2e 66 61 2d 6c 69 6e 6b 65 64 69 6e 2d 73 71 75 61 72 65 3a 62 65 66 6f 72 65 20 7b 0a Data Ascii: a-thumbs-o-up:before { content: "\f087";}.fa-thumbs-o-down:before { content: "\f088";}.fa-star-half:before { content: "\f089";}.fa-heart-o:before { content: "\f08a";}.fa-sign-out:before { content: "\f08b";}.fa-linkedin-square:before {
2024-08-30 22:37:29 UTC	1369	IN	Data Raw: 5c 66 30 61 36 22 3b 0a 7d 0a 2e 66 61 2d 68 61 6e 64 2d 6f 2d 64 6f 77 6e 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 61 37 22 3b 0a 7d 0a 2e 66 61 2d 61 72 72 6f 77 2d 63 69 72 63 6c 65 2d 6c 65 66 74 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 61 38 22 3b 0a 7d 0a 2e 66 61 2d 61 72 72 6f 77 2d 63 69 72 63 6c 65 2d 72 69 67 68 74 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 61 39 22 3b 0a 7d 0a 2e 66 61 2d 61 72 72 6f 77 2d 63 69 72 63 6c 65 2d 75 70 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 61 61 22 3b 0a 7d 0a 2e 66 61 2d 61 72 72 6f 77 2d 63 69 72 63 6c 65 2d 64 6f 77 6e 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 Data Ascii: \f0a6";}.fa-hand-o-down:before { content: "\f0a7";}.fa-arrow-circle-left:before { content: "\f0a8";}.fa-arrow-circle-right:before { content: "\f0a9";}.fa-arrow-circle-up:before { content: "\f0aa";}.fa-arrow-circle-down:before { content

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49717	104.26.9.44	443	880	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 22:37:29 UTC	551	OUT	GET /json/ HTTP/1.1 Host: ipapi.co Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://sharefile8.pages.dev Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://sharefile8.pages.dev/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-30 22:37:29 UTC	763	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 22:37:29 GMT Content-Type: application/json Content-Length: 763 Connection: close Allow: OPTIONS, POST, OPTIONS, HEAD, GET X-Frame-Options: DENY Vary: Host, origin access-control-allow-origin: https://sharefile8.pages.dev X-Content-Type-Options: nosniff Referrer-Policy: same-origin Cross-Origin-Opener-Policy: same-origin CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yQG78JNYNWEtlG6Yw8uv2ySOd8qq8W0Ji8gJr7Q7KA7LLeMd29Zp5Qw0yGBoEr680GGxMRdpN6ShtQgYyMCg%2BO3vN30pp6BNKyuhB2qCQJNIXz%2FHY7R0%2Bj6h"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8bb84403b97243c5-EWR
2024-08-30 22:37:29 UTC	606	IN	Data Raw: 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 30 2f 32 34 22 2c 0a 20 20 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 22 49 50 76 34 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 5f 63 6f 64 65 22 3a 20 22 4e 59 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 5f 6e 61 6d 65 22 3a 20 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 63 6f 75 6e Data Ascii: { "ip": "8.46.123.33", "network": "8.46.123.0/24", "version": "IPv4", "city": "New York City", "region": "New York", "region_code": "NY", "country": "US", "country_name": "United States", "country_code": "US", "coun
2024-08-30 22:37:29 UTC	157	IN	Data Raw: 6f 6c 6c 61 72 22 2c 0a 20 20 20 20 22 6c 61 6e 67 75 61 67 65 73 22 3a 20 22 65 6e 2d 55 53 2c 65 73 2d 55 53 2c 68 61 77 2c 66 72 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 5f 61 72 65 61 22 3a 20 39 36 32 39 30 39 31 2e 30 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 5f 70 6f 70 75 6c 61 74 69 6f 6e 22 3a 20 33 32 37 31 36 37 34 33 34 2c 0a 20 20 20 20 22 61 73 6e 22 3a 20 22 41 53 33 33 35 36 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 4c 45 56 45 4c 33 22 0a 7d Data Ascii: ollar", "languages": "en-US,es-US,haw,fr", "country_area": 9629091.0, "country_population": 327167434, "asn": "AS3356", "org": "LEVEL3"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49710	188.114.96.3	443	880	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 22:37:30 UTC	5672	OUT	GET /qvuv+pyrqwzcz6xaxlnoqwjmehzvhi7wuk+tdmwkgv96kzea82mtrq3s+h+nlysnemgyfcvtuhozuighqob+lce9yippttt6fi1kubdsdbqmwx5kxujjxwu5crv4iqguxis5l5bqjc2sd56vkdj?8c17e643600ec20fef4f6911ec4e48e7m0hanxc8=U2FsdGVkX1%2BCd7%2FhtiLMTnMBdpVwMmJ1KSyDrJ7KzEDSzbmdM%2BK6Tvtld6HHT92c1qgm7oreWjv5Cnz%2Fm8DY12gjkyk1dTaxJoP0hcT2jb5uWGaaTFriv%2F0MfsU%2FcnV4I3oFJmdjC0pWwBVCgYQhwAhU5EmscQU4wflljPHYfjZlY9ZaUOFxfmhvl2vlgvh4Go0gQHzNWQR5SgXefEaLV9OkQk9gBk4c44TDZrE1RqypEYZ4og7DiQOLh2FxHuIRSXXLRAxuo%2ByuNsy604Cf7hBMYrxq47spI8x3nSLnF%2FJQqEpgpBvF8P%2Bp3yneKAfoQYC5M0QIHjOcNPa3dnUZ2JohrO6tqas4kBMqWAVYWAdNv4CykAnDac%2FIIvSaKTZ3dd940GO6i1Z1OLWWjQEpl%2F1AfOZ507isTPp4%2FhF13ZhnPsZUFo%2FmTQAFkx4Du%2FjWvM4AtpSo7C0m6YBuWll%2F5M7OqWl8yTimYCbou7r9IJcWLUfo1HhwA2GKeWqF5r6GfC6K2VQ9Eh6TtmRu4MCo484KHNp3OA%2BQ7nTZpwUnGq8roJWW0L6icuBAscTU%2B2jfVDblCZ%2BKKbkWWEE0oDeAzyNwjKk5%2B6azk9AmMtdzygm4HYIq0SsbZ8rVbiC%2FjjlcECR3k3llDILBIFfTfA82Sgs1YrRYzpZ2VIiJyewnPxn82KwYBap26TJ1wElBovKL0dUR9QXIV0fsk39dsnmXkNcV%2BAZ2%2FMV%2B%2F%2FOdxYAUtZAYi5F51VJjktkNUZqhsirAF6%2BQWE8Ckr [TRUNCATED] Host: sharefile8.pages.dev Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://sharefile8.pages.dev/qvuv+pyrqwzcz6xaxlnoqwjmehzvhi7wuk+tdmwkgv96kzea82mtrq3s+h+nlysnemgyfcvtuhozuighqob+lce9yippttt6fi1kubdsdbqmwx5kxujjxwu5crv4iqguxis5l5bqjc2sd56vkdj?8c17e643600ec20fef4f6911ec4e48e7m0hanxc8=U2FsdGVkX1%2BCd7%2FhtiLMTnMBdpVwMmJ1KSyDrJ7KzEDSzbmdM%2BK6Tvtld6HHT92c1qgm7oreWjv5Cnz%2Fm8DY12gjkyk1dTaxJoP0hcT2jb5uWGaaTFriv%2F0MfsU%2FcnV4I3oFJmdjC0pWwBVCgYQhwAhU5EmscQU4wflljPHYfjZlY9ZaUOFxfmhvl2vlgvh4Go0gQHzNWQR5SgXefEaLV9OkQk9gBk4c44TDZrE1RqypEYZ4og7DiQOLh2FxHuIRSXXLRAxuo%2ByuNsy604Cf7hBMYrxq47spI8x3nSLnF%2FJQqEpgpBvF8P%2Bp3yneKAfoQYC5M0QIHjOcNPa3dnUZ2JohrO6tqas4kBMqWAVYWAdNv4CykAnDac%2FIIvSaKTZ3dd940GO6i1Z1OLWWjQEpl%2F1AfOZ507isTPp4%2FhF13ZhnPsZUFo%2FmTQAFkx4Du%2FjWvM4AtpSo7C0m6YBuWll%2F5M7OqWl8yTimYCbou7r9IJcWLUfo1HhwA2GKeWqF5r6GfC6K2VQ9Eh6TtmRu4MCo484KHNp3OA%2BQ7nTZpwUnGq8roJWW0L6icuBAscTU%2B2jfVDblCZ%2BKKbkWWEE0oDeAzyNwjKk5%2B6azk9AmMtdzygm4HYIq0SsbZ8rVbiC%2FjjlcECR3k3llDILBIFfTfA82Sgs1YrRYzpZ2VIiJyewnPxn82KwYBap26TJ1wElBovKL0dUR9QXIV0fsk39dsnmXkNcV%2BAZ2%2FMV%2B%2F%2FOdxYAUtZA [TRUNCATED] Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-30 22:37:30 UTC	720	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 22:37:30 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=0, must-revalidate referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=esLwcnM1EaLKkkSDSq6KwfT64q34RFgbyHjKQyEQX%2BIi275juLp45zx6VfgfRRy2TteJh5QmO4FWCbY1HjBCa1S9Ig7GFq762joWwBGyzOroaEYBDyRwXNwgePxej474Lu8nC7LQKQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8bb84407d99b41cd-EWR alt-svc: h3=":443"; ma=86400
2024-08-30 22:37:30 UTC	523	IN	Data Raw: 32 30 34 0d 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 20 20 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 6a 73 64 65 6c 69 76 72 2e 6e 65 74 2f 67 68 2f 75 69 68 6b 64 73 6c 69 6a 73 6a 64 2f 63 61 70 74 69 76 61 74 69 6e 67 2d 61 70 70 2d 6c 79 6f 75 62 67 73 35 40 69 6e 74 65 72 6e 61 6c 2d 32 30 32 34 2d 30 37 2d 31 36 2d 32 30 2d 30 32 2d 35 38 2f 31 33 39 61 38 63 64 32 2d 64 31 30 63 2d 34 33 33 36 2d 62 61 30 34 2d 33 66 31 63 35 33 62 61 38 63 62 36 2e 6a 73 3f 68 61 73 68 3d 36 62 30 36 64 62 39 34 33 66 30 38 31 65 62 65 65 36 38 39 66 33 37 36 63 38 62 32 33 31 64 31 26 45 44 6c 46 68 36 53 4f 42 Data Ascii: 204<html> <head><title></title></head> <body> <script src="https://cdn.jsdelivr.net/gh/uihkdslijsjd/captivating-app-lyoubgs5@internal-2024-07-16-20-02-58/139a8cd2-d10c-4336-ba04-3f1c53ba8cb6.js?hash=6b06db943f081ebee689f376c8b231d1&EDlFh6SOB
2024-08-30 22:37:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49723	151.101.129.229	443	880	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 22:37:30 UTC	697	OUT	GET /gh/uihkdslijsjd/captivating-app-lyoubgs5@internal-2024-07-16-20-02-58/139a8cd2-d10c-4336-ba04-3f1c53ba8cb6.js?hash=6b06db943f081ebee689f376c8b231d1&EDlFh6SOBK9HUECofCEkAbqDF=2jfjZA9wDmRlYg1TXOXJNITl98qS9siwV6pdy8cw8fSU8meMhDoHo3q0Wbk1NRTITsfyJdv71rAKgx7GjU1BNOfiiUNKNWJ2iHxPYldtdzwOsYPXlYZ5aId3UaBDD4OaPO0ZZpW8vf4Tz0t3vdO1dR7zBRTwMf8AMoFNk8pvuQel106aEmb5Q0X HTTP/1.1 Host: cdn.jsdelivr.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-30 22:37:30 UTC	783	IN	HTTP/1.1 200 OK Connection: close Content-Length: 1054967 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: * Timing-Allow-Origin: * Cache-Control: public, max-age=604800, s-maxage=43200 Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Content-Type: application/javascript; charset=utf-8 X-JSD-Version: internal-2024-07-16-20-02-58 X-JSD-Version-Type: branch ETag: W/"1018f7-dwEUKUeBq/GLBbvDzWMm0MYg7f8" Accept-Ranges: bytes Age: 40011 Date: Fri, 30 Aug 2024 22:37:30 GMT X-Served-By: cache-fra-etou8220139-FRA, cache-ewr-kewr1740044-EWR X-Cache: HIT, HIT Vary: Accept-Encoding alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
2024-08-30 22:37:30 UTC	1378	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 5f 30 78 31 38 32 39 38 31 2c 5f 30 78 33 64 38 38 32 64 29 7b 76 61 72 20 5f 30 78 33 33 61 61 63 34 3d 61 30 5f 30 78 34 62 35 39 2c 5f 30 78 33 38 30 32 62 32 3d 5f 30 78 31 38 32 39 38 31 28 29 3b 77 68 69 6c 65 28 21 21 5b 5d 29 7b 74 72 79 7b 76 61 72 20 5f 30 78 31 38 33 34 30 33 3d 2d 70 61 72 73 65 49 6e 74 28 5f 30 78 33 33 61 61 63 34 28 30 78 66 34 32 29 29 2f 30 78 31 2b 70 61 72 73 65 49 6e 74 28 5f 30 78 33 33 61 61 63 34 28 30 78 61 36 61 29 29 2f 30 78 32 2b 70 61 72 73 65 49 6e 74 28 5f 30 78 33 33 61 61 63 34 28 30 78 63 35 34 29 29 2f 30 78 33 2b 70 61 72 73 65 49 6e 74 28 5f 30 78 33 33 61 61 63 34 28 30 78 31 62 34 29 29 2f 30 78 34 2a 28 2d 70 61 72 73 65 49 6e 74 28 5f 30 78 33 33 61 61 63 34 28 30 78 Data Ascii: (function(_0x182981,_0x3d882d){var _0x33aac4=a0_0x4b59,_0x3802b2=_0x182981();while(!![]){try{var _0x183403=-parseInt(_0x33aac4(0xf42))/0x1+parseInt(_0x33aac4(0xa6a))/0x2+parseInt(_0x33aac4(0xc54))/0x3+parseInt(_0x33aac4(0x1b4))/0x4*(-parseInt(_0x33aac4(0x
2024-08-30 22:37:30 UTC	1378	IN	Data Raw: 29 5d 3b 5f 30 78 31 34 62 30 38 37 2b 2b 29 5f 30 78 33 33 63 39 66 37 5b 5f 30 78 37 32 32 35 61 64 28 30 78 61 65 39 29 5d 28 53 74 72 69 6e 67 5b 5f 30 78 37 32 32 35 61 64 28 30 78 61 30 34 29 5d 28 5f 30 78 31 36 62 61 32 36 5b 5f 30 78 31 34 62 30 38 37 5d 29 29 3b 72 65 74 75 72 6e 20 5f 30 78 33 33 63 39 66 37 5b 5f 30 78 37 32 32 35 61 64 28 30 78 31 64 35 29 5d 28 27 27 29 3b 7d 7d 7d 3b 5f 30 78 32 36 33 35 31 61 5b 5f 30 78 31 33 31 35 66 34 28 30 78 35 64 61 29 5d 3d 5f 30 78 31 35 32 35 31 32 3b 7d 2c 30 78 33 61 62 3a 5f 30 78 34 36 38 36 64 36 3d 3e 7b 76 61 72 20 5f 30 78 31 65 61 34 66 30 3d 61 30 5f 30 78 34 62 35 39 2c 5f 30 78 33 33 36 61 31 34 2c 5f 30 78 31 38 66 36 38 38 3b 5f 30 78 33 33 36 61 31 34 3d 5f 30 78 31 65 61 34 66 30 Data Ascii: )];_0x14b087++)_0x33c9f7[_0x7225ad(0xae9)](String[_0x7225ad(0xa04)](_0x16ba26[_0x14b087]));return _0x33c9f7[_0x7225ad(0x1d5)]('');}}};_0x26351a[_0x1315f4(0x5da)]=_0x152512;},0x3ab:_0x4686d6=>{var _0x1ea4f0=a0_0x4b59,_0x336a14,_0x18f688;_0x336a14=_0x1ea4f0
2024-08-30 22:37:30 UTC	1378	IN	Data Raw: 5f 30 78 31 61 66 31 66 64 2b 3d 30 78 38 29 5f 30 78 35 36 31 38 66 30 5b 27 70 75 73 68 27 5d 28 5f 30 78 35 34 31 64 63 33 5b 5f 30 78 31 61 66 31 66 64 3e 3e 3e 30 78 35 5d 3e 3e 3e 30 78 31 38 2d 5f 30 78 31 61 66 31 66 64 25 30 78 32 30 26 30 78 66 66 29 3b 72 65 74 75 72 6e 20 5f 30 78 35 36 31 38 66 30 3b 7d 2c 27 62 79 74 65 73 54 6f 48 65 78 27 3a 66 75 6e 63 74 69 6f 6e 28 5f 30 78 31 33 62 31 32 35 29 7b 76 61 72 20 5f 30 78 31 66 31 66 65 30 3d 5f 30 78 31 65 61 34 66 30 3b 66 6f 72 28 76 61 72 20 5f 30 78 35 61 66 36 33 35 3d 5b 5d 2c 5f 30 78 61 62 65 39 33 66 3d 30 78 30 3b 5f 30 78 61 62 65 39 33 66 3c 5f 30 78 31 33 62 31 32 35 5b 5f 30 78 31 66 31 66 65 30 28 30 78 39 35 38 29 5d 3b 5f 30 78 61 62 65 39 33 66 2b 2b 29 5f 30 78 35 61 66 Data Ascii: _0x1af1fd+=0x8)_0x5618f0['push'](_0x541dc3[_0x1af1fd>>>0x5]>>>0x18-_0x1af1fd%0x20&0xff);return _0x5618f0;},'bytesToHex':function(_0x13b125){var _0x1f1fe0=_0x1ea4f0;for(var _0x5af635=[],_0xabe93f=0x0;_0xabe93f<_0x13b125[_0x1f1fe0(0x958)];_0xabe93f++)_0x5af
2024-08-30 22:37:30 UTC	1378	IN	Data Raw: 78 34 34 63 31 65 65 28 30 78 39 35 38 29 5d 3b 5f 30 78 34 38 30 35 39 62 3d 2b 2b 5f 30 78 35 62 39 35 62 38 25 30 78 34 29 30 78 30 21 3d 5f 30 78 34 38 30 35 39 62 26 26 5f 30 78 32 32 65 32 63 32 5b 27 70 75 73 68 27 5d 28 28 5f 30 78 33 33 36 61 31 34 5b 5f 30 78 34 34 63 31 65 65 28 30 78 62 65 32 29 5d 28 5f 30 78 35 38 39 32 38 66 5b 5f 30 78 34 34 63 31 65 65 28 30 78 31 30 62 61 29 5d 28 5f 30 78 35 62 39 35 62 38 2d 30 78 31 29 29 26 4d 61 74 68 5b 5f 30 78 34 34 63 31 65 65 28 30 78 33 63 32 29 5d 28 30 78 32 2c 2d 30 78 32 2a 5f 30 78 34 38 30 35 39 62 2b 30 78 38 29 2d 30 78 31 29 3c 3c 30 78 32 2a 5f 30 78 34 38 30 35 39 62 7c 5f 30 78 33 33 36 61 31 34 5b 5f 30 78 34 34 63 31 65 65 28 30 78 62 65 32 29 5d 28 5f 30 78 35 38 39 32 38 66 5b Data Ascii: x44c1ee(0x958)];_0x48059b=++_0x5b95b8%0x4)0x0!=_0x48059b&&_0x22e2c2['push']((_0x336a14[_0x44c1ee(0xbe2)](_0x58928f[_0x44c1ee(0x10ba)](_0x5b95b8-0x1))&Math[_0x44c1ee(0x3c2)](0x2,-0x2_0x48059b+0x8)-0x1)<<0x2_0x48059b\|_0x336a14[_0x44c1ee(0xbe2)](_0x58928f[
2024-08-30 22:37:30 UTC	1378	IN	Data Raw: 2a 5f 30 78 34 36 63 31 61 30 5b 5f 30 78 33 33 31 61 34 65 5d 5e 30 78 31 30 31 30 31 30 30 2a 5f 30 78 33 33 31 61 34 65 3b 5f 30 78 31 39 30 38 30 36 5b 5f 30 78 31 66 65 34 39 63 5d 3d 5f 30 78 39 32 66 35 64 62 3c 3c 30 78 31 38 7c 5f 30 78 39 32 66 35 64 62 3e 3e 3e 30 78 38 2c 5f 30 78 32 39 63 38 63 33 5b 5f 30 78 31 66 65 34 39 63 5d 3d 5f 30 78 39 32 66 35 64 62 3c 3c 30 78 31 30 7c 5f 30 78 39 32 66 35 64 62 3e 3e 3e 30 78 31 30 2c 5f 30 78 61 33 64 38 35 30 5b 5f 30 78 31 66 65 34 39 63 5d 3d 5f 30 78 39 32 66 35 64 62 3c 3c 30 78 38 7c 5f 30 78 39 32 66 35 64 62 3e 3e 3e 30 78 31 38 2c 5f 30 78 35 61 33 33 39 64 5b 5f 30 78 31 66 65 34 39 63 5d 3d 5f 30 78 39 32 66 35 64 62 2c 5f 30 78 39 32 66 35 64 62 3d 30 78 31 30 31 30 31 30 31 2a 5f 30 Data Ascii: _0x46c1a0[_0x331a4e]^0x1010100_0x331a4e;_0x190806[_0x1fe49c]=_0x92f5db<<0x18\|_0x92f5db>>>0x8,_0x29c8c3[_0x1fe49c]=_0x92f5db<<0x10\|_0x92f5db>>>0x10,_0xa3d850[_0x1fe49c]=_0x92f5db<<0x8\|_0x92f5db>>>0x18,_0x5a339d[_0x1fe49c]=_0x92f5db,_0x92f5db=0x1010101*_0
2024-08-30 22:37:30 UTC	1378	IN	Data Raw: 62 34 34 3e 3e 3e 30 78 31 38 5d 3c 3c 30 78 31 38 7c 5f 30 78 35 39 38 35 39 66 5b 5f 30 78 35 61 65 62 34 34 3e 3e 3e 30 78 31 30 26 30 78 66 66 5d 3c 3c 30 78 31 30 7c 5f 30 78 35 39 38 35 39 66 5b 5f 30 78 35 61 65 62 34 34 3e 3e 3e 30 78 38 26 30 78 66 66 5d 3c 3c 30 78 38 7c 5f 30 78 35 39 38 35 39 66 5b 30 78 66 66 26 5f 30 78 35 61 65 62 34 34 5d 29 3a 28 5f 30 78 35 61 65 62 34 34 3d 5f 30 78 35 39 38 35 39 66 5b 28 5f 30 78 35 61 65 62 34 34 3d 5f 30 78 35 61 65 62 34 34 3c 3c 30 78 38 7c 5f 30 78 35 61 65 62 34 34 3e 3e 3e 30 78 31 38 29 3e 3e 3e 30 78 31 38 5d 3c 3c 30 78 31 38 7c 5f 30 78 35 39 38 35 39 66 5b 5f 30 78 35 61 65 62 34 34 3e 3e 3e 30 78 31 30 26 30 78 66 66 5d 3c 3c 30 78 31 30 7c 5f 30 78 35 39 38 35 39 66 5b 5f 30 78 35 61 65 Data Ascii: b44>>>0x18]<<0x18\|_0x59859f[_0x5aeb44>>>0x10&0xff]<<0x10\|_0x59859f[_0x5aeb44>>>0x8&0xff]<<0x8\|_0x59859f[0xff&_0x5aeb44]):(_0x5aeb44=_0x59859f[(_0x5aeb44=_0x5aeb44<<0x8\|_0x5aeb44>>>0x18)>>>0x18]<<0x18\|_0x59859f[_0x5aeb44>>>0x10&0xff]<<0x10\|_0x59859f[_0x5ae
2024-08-30 22:37:30 UTC	1378	IN	Data Raw: 64 64 63 36 2b 30 78 31 5d 2c 5f 30 78 33 38 36 38 66 31 5b 5f 30 78 34 66 64 64 63 36 2b 30 78 31 5d 3d 5f 30 78 33 38 36 38 66 31 5b 5f 30 78 34 66 64 64 63 36 2b 30 78 33 5d 2c 5f 30 78 33 38 36 38 66 31 5b 5f 30 78 34 66 64 64 63 36 2b 30 78 33 5d 3d 5f 30 78 34 63 30 34 61 63 3b 7d 2c 27 5f 64 6f 43 72 79 70 74 42 6c 6f 63 6b 27 3a 66 75 6e 63 74 69 6f 6e 28 5f 30 78 32 61 66 36 38 39 2c 5f 30 78 34 61 39 36 30 31 2c 5f 30 78 33 63 64 39 35 33 2c 5f 30 78 31 38 33 39 39 36 2c 5f 30 78 61 62 64 36 31 33 2c 5f 30 78 33 31 38 65 35 39 2c 5f 30 78 34 38 61 31 32 33 2c 5f 30 78 32 37 33 35 65 63 29 7b 76 61 72 20 5f 30 78 34 38 33 32 34 34 3d 5f 30 78 35 63 65 31 32 65 3b 66 6f 72 28 76 61 72 20 5f 30 78 32 34 39 34 66 39 3d 74 68 69 73 5b 5f 30 78 34 38 Data Ascii: ddc6+0x1],_0x3868f1[_0x4fddc6+0x1]=_0x3868f1[_0x4fddc6+0x3],_0x3868f1[_0x4fddc6+0x3]=_0x4c04ac;},'_doCryptBlock':function(_0x2af689,_0x4a9601,_0x3cd953,_0x183996,_0xabd613,_0x318e59,_0x48a123,_0x2735ec){var _0x483244=_0x5ce12e;for(var _0x2494f9=this[_0x48
2024-08-30 22:37:30 UTC	1378	IN	Data Raw: 78 31 65 35 62 66 31 2b 2b 5d 2c 5f 30 78 34 36 36 65 31 35 3d 28 5f 30 78 32 37 33 35 65 63 5b 5f 30 78 34 31 61 36 61 62 3e 3e 3e 30 78 31 38 5d 3c 3c 30 78 31 38 7c 5f 30 78 32 37 33 35 65 63 5b 5f 30 78 34 34 30 62 31 62 3e 3e 3e 30 78 31 30 26 30 78 66 66 5d 3c 3c 30 78 31 30 7c 5f 30 78 32 37 33 35 65 63 5b 5f 30 78 31 65 36 65 33 36 3e 3e 3e 30 78 38 26 30 78 66 66 5d 3c 3c 30 78 38 7c 5f 30 78 32 37 33 35 65 63 5b 30 78 66 66 26 5f 30 78 32 31 32 61 32 65 5d 29 5e 5f 30 78 33 63 64 39 35 33 5b 5f 30 78 31 65 35 62 66 31 2b 2b 5d 2c 5f 30 78 33 61 33 65 30 32 3d 28 5f 30 78 32 37 33 35 65 63 5b 5f 30 78 34 34 30 62 31 62 3e 3e 3e 30 78 31 38 5d 3c 3c 30 78 31 38 7c 5f 30 78 32 37 33 35 65 63 5b 5f 30 78 31 65 36 65 33 36 3e 3e 3e 30 78 31 30 26 30 Data Ascii: x1e5bf1++],_0x466e15=(_0x2735ec[_0x41a6ab>>>0x18]<<0x18\|_0x2735ec[_0x440b1b>>>0x10&0xff]<<0x10\|_0x2735ec[_0x1e6e36>>>0x8&0xff]<<0x8\|_0x2735ec[0xff&_0x212a2e])^_0x3cd953[_0x1e5bf1++],_0x3a3e02=(_0x2735ec[_0x440b1b>>>0x18]<<0x18\|_0x2735ec[_0x1e6e36>>>0x10&0
2024-08-30 22:37:30 UTC	1378	IN	Data Raw: 30 78 35 65 32 29 5d 2c 5f 30 78 33 65 37 31 62 32 3d 5f 30 78 33 64 62 34 65 61 5b 27 61 6c 67 6f 27 5d 5b 5f 30 78 34 36 66 36 32 34 28 30 78 36 39 30 29 5d 2c 5f 30 78 32 35 31 34 63 32 3d 5f 30 78 36 35 66 62 39 5b 5f 30 78 34 36 66 36 32 34 28 30 78 36 39 37 29 5d 3d 5f 30 78 35 65 32 34 36 35 5b 5f 30 78 34 36 66 36 32 34 28 30 78 64 31 30 29 5d 28 7b 27 63 66 67 27 3a 5f 30 78 35 35 66 61 39 37 5b 27 65 78 74 65 6e 64 27 5d 28 29 2c 27 63 72 65 61 74 65 45 6e 63 72 79 70 74 6f 72 27 3a 66 75 6e 63 74 69 6f 6e 28 5f 30 78 34 63 36 38 64 31 2c 5f 30 78 33 33 33 38 63 63 29 7b 76 61 72 20 5f 30 78 31 39 64 61 31 39 3d 5f 30 78 34 36 66 36 32 34 3b 72 65 74 75 72 6e 20 74 68 69 73 5b 5f 30 78 31 39 64 61 31 39 28 30 78 31 31 33 32 29 5d 28 74 68 69 73 Data Ascii: 0x5e2)],_0x3e71b2=_0x3db4ea['algo'][_0x46f624(0x690)],_0x2514c2=_0x65fb9[_0x46f624(0x697)]=_0x5e2465[_0x46f624(0xd10)]({'cfg':_0x55fa97['extend'](),'createEncryptor':function(_0x4c68d1,_0x3338cc){var _0x19da19=_0x46f624;return this[_0x19da19(0x1132)](this
2024-08-30 22:37:30 UTC	1378	IN	Data Raw: 39 65 2c 5f 30 78 31 32 65 31 61 30 2c 5f 30 78 63 64 31 64 33 34 2c 5f 30 78 33 30 65 39 39 32 29 3b 7d 2c 27 64 65 63 72 79 70 74 27 3a 66 75 6e 63 74 69 6f 6e 28 5f 30 78 62 36 36 39 32 33 2c 5f 30 78 35 64 62 34 34 65 2c 5f 30 78 31 36 33 61 62 38 29 7b 72 65 74 75 72 6e 20 5f 30 78 31 33 66 35 30 64 28 5f 30 78 35 64 62 34 34 65 29 5b 27 64 65 63 72 79 70 74 27 5d 28 5f 30 78 31 64 61 35 39 65 2c 5f 30 78 62 36 36 39 32 33 2c 5f 30 78 35 64 62 34 34 65 2c 5f 30 78 31 36 33 61 62 38 29 3b 7d 7d 3b 7d 3b 7d 28 29 29 7d 29 2c 5f 30 78 36 35 66 62 39 5b 27 53 74 72 65 61 6d 43 69 70 68 65 72 27 5d 3d 5f 30 78 32 35 31 34 63 32 5b 5f 30 78 34 36 66 36 32 34 28 30 78 64 31 30 29 5d 28 7b 27 5f 64 6f 46 69 6e 61 6c 69 7a 65 27 3a 66 75 6e 63 74 69 6f 6e 28 Data Ascii: 9e,_0x12e1a0,_0xcd1d34,_0x30e992);},'decrypt':function(_0xb66923,_0x5db44e,_0x163ab8){return _0x13f50d(_0x5db44e)['decrypt'](_0x1da59e,_0xb66923,_0x5db44e,_0x163ab8);}};};}())}),_0x65fb9['StreamCipher']=_0x2514c2[_0x46f624(0xd10)]({'_doFinalize':function(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49720	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-08-30 22:37:30 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-08-30 22:37:31 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=39562 Date: Fri, 30 Aug 2024 22:37:31 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49730	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-08-30 22:37:31 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-08-30 22:37:32 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=39514 Date: Fri, 30 Aug 2024 22:37:32 GMT Content-Length: 55 Connection: close X-CID: 2
2024-08-30 22:37:32 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49734	151.101.129.229	443	880	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 22:37:33 UTC	434	OUT	GET /gh/uihkdslijsjd/captivating-app-lyoubgs5@internal-2024-07-16-20-02-58/847fc5ec58b3a0af255c.svg HTTP/1.1 Host: cdn.jsdelivr.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-30 22:37:33 UTC	755	IN	HTTP/1.1 200 OK Connection: close Content-Length: 10338 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: * Timing-Allow-Origin: * Cache-Control: public, max-age=604800, s-maxage=43200 Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Content-Type: image/svg+xml X-JSD-Version: internal-2024-07-16-20-02-58 X-JSD-Version-Type: branch ETag: W/"2862-hHt4UmUbn14GK+5pRTJqrKn77yo" Accept-Ranges: bytes Date: Fri, 30 Aug 2024 22:37:33 GMT Age: 1518 X-Served-By: cache-fra-eddf8230032-FRA, cache-ewr-kewr1740020-EWR X-Cache: MISS, HIT Vary: Accept-Encoding alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
2024-08-30 22:37:33 UTC	1378	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 20 73 74 61 6e 64 61 6c 6f 6e 65 3d 22 6e 6f 22 3f 3e 0a 3c 21 2d 2d 20 43 72 65 61 74 65 64 20 77 69 74 68 20 49 6e 6b 73 63 61 70 65 20 28 68 74 74 70 3a 2f 2f 77 77 77 2e 69 6e 6b 73 63 61 70 65 2e 6f 72 67 2f 29 20 2d 2d 3e 0a 0a 3c 73 76 67 0a 20 20 20 78 6d 6c 6e 73 3a 64 63 3d 22 68 74 74 70 3a 2f 2f 70 75 72 6c 2e 6f 72 67 2f 64 63 2f 65 6c 65 6d 65 6e 74 73 2f 31 2e 31 2f 22 0a 20 20 20 78 6d 6c 6e 73 3a 63 63 3d 22 68 74 74 70 3a 2f 2f 63 72 65 61 74 69 76 65 63 6f 6d 6d 6f 6e 73 2e 6f 72 67 2f 6e 73 23 22 0a 20 20 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 Data Ascii: <?xml version="1.0" encoding="UTF-8" standalone="no"?>... Created with Inkscape (http://www.inkscape.org/) --><svg xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:cc="http://creativecommons.org/ns#" xmlns:rdf="http://www.w3.org/1999/02/22-r
2024-08-30 22:37:33 UTC	1378	IN	Data Raw: 3c 63 63 3a 57 6f 72 6b 0a 20 20 20 20 20 20 20 20 20 72 64 66 3a 61 62 6f 75 74 3d 22 22 3e 0a 20 20 20 20 20 20 20 20 3c 64 63 3a 66 6f 72 6d 61 74 3e 69 6d 61 67 65 2f 73 76 67 2b 78 6d 6c 3c 2f 64 63 3a 66 6f 72 6d 61 74 3e 0a 20 20 20 20 20 20 20 20 3c 64 63 3a 74 79 70 65 0a 20 20 20 20 20 20 20 20 20 20 20 72 64 66 3a 72 65 73 6f 75 72 63 65 3d 22 68 74 74 70 3a 2f 2f 70 75 72 6c 2e 6f 72 67 2f 64 63 2f 64 63 6d 69 74 79 70 65 2f 53 74 69 6c 6c 49 6d 61 67 65 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 64 63 3a 74 69 74 6c 65 3e 4f 6e 65 44 72 69 76 65 20 6c 6f 67 6f 3c 2f 64 63 3a 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 3c 2f 63 63 3a 57 6f 72 6b 3e 0a 20 20 20 20 3c 2f 72 64 66 3a 52 44 46 3e 0a 20 20 3c 2f 6d 65 74 61 64 61 74 61 3e 0a 20 20 3c 67 Data Ascii: <cc:Work rdf:about=""> <dc:format>image/svg+xml</dc:format> <dc:type rdf:resource="http://purl.org/dc/dcmitype/StillImage" /> <dc:title>OneDrive logo</dc:title> </cc:Work> </rdf:RDF> </metadata> <g
2024-08-30 22:37:33 UTC	1378	IN	Data Raw: 61 74 75 72 65 3d 22 30 22 0a 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 23 30 39 34 61 62 31 3b 66 69 6c 6c 2d 6f 70 61 63 69 74 79 3a 31 22 0a 20 20 20 20 20 20 20 20 20 64 3d 22 6d 20 2d 34 38 37 2e 37 31 38 35 33 2c 33 35 33 2e 33 36 34 30 33 20 63 20 2d 31 30 2e 37 38 38 30 33 2c 2d 32 2e 35 36 33 38 34 20 2d 32 32 2e 32 31 39 30 33 2c 2d 31 32 2e 30 39 32 32 32 20 2d 32 37 2e 35 37 39 33 2c 2d 32 32 2e 39 38 38 39 20 2d 33 2e 30 34 30 36 33 2c 2d 36 2e 31 38 31 31 37 20 2d 33 2e 32 30 32 31 33 2c 2d 37 2e 30 39 30 32 39 20 2d 33 2e 32 30 32 31 33 2c 2d 31 38 2e 30 32 35 34 37 20 30 2c 2d 31 30 2e 34 30 31 30 31 20 30 2e 32 35 39 34 39 2c 2d 31 32 2e 30 36 39 36 33 20 32 2e 36 38 30 30 36 2c 2d 31 37 2e 32 33 34 30 37 20 35 2e 31 Data Ascii: ature="0" style="fill:#094ab1;fill-opacity:1" d="m -487.71853,353.36403 c -10.78803,-2.56384 -22.21903,-12.09222 -27.5793,-22.9889 -3.04063,-6.18117 -3.20213,-7.09029 -3.20213,-18.02547 0,-10.40101 0.25949,-12.06963 2.68006,-17.23407 5.1
2024-08-30 22:37:33 UTC	1378	IN	Data Raw: 6e 74 2d 73 74 72 65 74 63 68 3a 6e 6f 72 6d 61 6c 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 73 74 61 72 74 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 30 70 78 3b 77 6f 72 64 2d 73 70 61 63 69 6e 67 3a 30 70 78 3b 77 72 69 74 69 6e 67 2d 6d 6f 64 65 3a 6c 72 2d 74 62 3b 74 65 78 74 2d 61 6e 63 68 6f 72 3a 73 74 61 72 74 3b 66 69 6c 6c 3a 23 33 32 36 36 62 62 3b 66 69 6c 6c 2d 6f 70 61 63 69 74 79 3a 31 3b 73 74 72 6f 6b 65 3a 6e 6f 6e 65 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 53 65 67 6f 65 20 55 49 20 4c 69 67 68 74 3b 2d 69 6e 6b 73 63 61 70 65 2d 66 6f 6e 74 2d 73 70 65 63 69 66 69 63 61 74 69 6f 6e 3a 27 53 65 67 6f 65 20 55 49 20 4c 69 67 68 74 2c 20 4c 69 67 68 74 27 22 0a 20 20 20 20 20 20 20 20 20 Data Ascii: nt-stretch:normal;text-align:start;line-height:100%;letter-spacing:0px;word-spacing:0px;writing-mode:lr-tb;text-anchor:start;fill:#3266bb;fill-opacity:1;stroke:none;font-family:Segoe UI Light;-inkscape-font-specification:'Segoe UI Light, Light'"
2024-08-30 22:37:33 UTC	1378	IN	Data Raw: 32 31 2e 36 35 30 33 34 20 31 31 2e 39 35 33 31 32 35 2c 2d 33 37 2e 38 38 30 38 36 20 2d 31 2e 31 32 65 2d 34 2c 2d 31 36 2e 36 34 30 35 35 20 2d 33 2e 38 36 37 32 39 35 2c 2d 32 39 2e 35 30 31 38 36 20 2d 31 31 2e 36 30 31 35 36 32 2c 2d 33 38 2e 35 38 33 39 38 20 2d 37 2e 37 33 34 34 36 38 2c 2d 39 2e 30 38 31 39 33 20 2d 31 38 2e 33 39 38 35 32 2c 2d 31 33 2e 36 32 32 39 34 20 2d 33 31 2e 39 39 32 31 38 37 2c 2d 31 33 2e 36 32 33 30 35 20 7a 22 0a 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 53 65 67 6f 65 20 55 49 3b 2d 69 6e 6b 73 63 61 70 65 2d 66 6f 6e 74 2d 73 70 65 63 69 66 69 63 61 74 69 6f 6e 3a 53 65 67 6f 65 20 55 49 22 0a 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 70 61 74 68 33 30 31 30 22 20 Data Ascii: 21.65034 11.953125,-37.88086 -1.12e-4,-16.64055 -3.867295,-29.50186 -11.601562,-38.58398 -7.734468,-9.08193 -18.39852,-13.62294 -31.992187,-13.62305 z" style="font-family:Segoe UI;-inkscape-font-specification:Segoe UI" id="path3010"
2024-08-30 22:37:33 UTC	1378	IN	Data Raw: 2c 33 2e 38 30 38 36 38 20 32 37 2e 33 33 33 39 38 2c 31 31 2e 34 32 35 37 38 20 36 2e 34 34 35 32 33 2c 37 2e 36 31 37 32 36 20 39 2e 36 36 37 38 38 2c 31 38 2e 31 39 33 34 32 20 39 2e 36 36 37 39 37 2c 33 31 2e 37 32 38 35 32 20 7a 20 6d 20 2d 31 34 2e 37 36 35 36 32 2c 2d 31 32 2e 32 31 36 38 20 63 20 2d 30 2e 30 35 38 37 2c 2d 38 2e 33 32 30 32 35 20 2d 32 2e 30 36 35 35 2c 2d 31 34 2e 37 39 34 38 35 20 2d 36 2e 30 32 30 35 31 2c 2d 31 39 2e 34 32 33 38 32 20 2d 33 2e 39 35 35 31 34 2c 2d 34 2e 36 32 38 38 33 20 2d 39 2e 34 34 38 33 2c 2d 36 2e 39 34 33 32 38 20 2d 31 36 2e 34 37 39 34 39 2c 2d 36 2e 39 34 33 33 36 20 2d 36 2e 37 39 36 39 32 2c 38 65 2d 35 20 2d 31 32 2e 35 36 38 34 2c 32 2e 34 33 31 37 31 20 2d 31 37 2e 33 31 34 34 35 37 2c 37 2e 32 Data Ascii: ,3.80868 27.33398,11.42578 6.44523,7.61726 9.66788,18.19342 9.66797,31.72852 z m -14.76562,-12.2168 c -0.0587,-8.32025 -2.0655,-14.79485 -6.02051,-19.42382 -3.95514,-4.62883 -9.4483,-6.94328 -16.47949,-6.94336 -6.79692,8e-5 -12.5684,2.43171 -17.314457,7.2
2024-08-30 22:37:33 UTC	1378	IN	Data Raw: 2e 34 31 30 32 35 20 38 2e 36 31 33 32 38 2c 31 2e 32 33 30 34 37 20 7a 22 0a 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 53 65 67 6f 65 20 55 49 3b 2d 69 6e 6b 73 63 61 70 65 2d 66 6f 6e 74 2d 73 70 65 63 69 66 69 63 61 74 69 6f 6e 3a 53 65 67 6f 65 20 55 49 22 0a 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 70 61 74 68 33 30 31 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 6d 20 33 36 33 2e 39 39 33 39 31 2c 32 33 33 2e 31 35 30 35 31 20 63 20 2d 32 2e 35 37 38 31 34 2c 31 2e 32 65 2d 34 20 2d 34 2e 37 37 35 34 31 2c 2d 30 2e 38 37 38 37 39 20 2d 36 2e 35 39 31 38 2c 2d 32 2e 36 33 36 37 32 20 2d 31 2e 38 31 36 34 31 2c 2d 31 2e 37 35 37 36 39 20 2d 32 Data Ascii: .41025 8.61328,1.23047 z" style="font-family:Segoe UI;-inkscape-font-specification:Segoe UI" id="path3018" /> <path d="m 363.99391,233.15051 c -2.57814,1.2e-4 -4.77541,-0.87879 -6.5918,-2.63672 -1.81641,-1.75769 -2
2024-08-30 22:37:33 UTC	692	IN	Data Raw: 2d 31 32 2e 37 31 34 38 38 2c 30 20 2d 32 32 2e 37 30 35 31 31 2c 2d 34 2e 30 38 36 39 31 20 2d 32 39 2e 39 37 30 37 2c 2d 31 32 2e 32 36 30 37 34 20 2d 37 2e 32 36 35 36 34 2c 2d 38 2e 31 37 33 38 31 20 2d 31 30 2e 38 39 38 34 35 2c 2d 31 39 2e 36 37 32 38 32 20 2d 31 30 2e 38 39 38 34 34 2c 2d 33 34 2e 34 39 37 30 37 20 2d 31 30 65 2d 36 2c 2d 31 34 2e 30 30 33 38 35 20 33 2e 39 36 39 37 31 2c 2d 32 35 2e 34 31 34 39 37 20 31 31 2e 39 30 39 31 38 2c 2d 33 34 2e 32 33 33 34 20 37 2e 39 33 39 34 32 2c 2d 38 2e 38 31 38 32 37 20 31 37 2e 37 39 37 38 31 2c 2d 31 33 2e 32 32 37 34 35 20 32 39 2e 35 37 35 31 39 2c 2d 31 33 2e 32 32 37 35 34 20 31 31 2e 37 37 37 32 39 2c 39 65 2d 35 20 32 30 2e 38 38 38 36 2c 33 2e 38 30 38 36 38 20 32 37 2e 33 33 33 39 39 2c Data Ascii: -12.71488,0 -22.70511,-4.08691 -29.9707,-12.26074 -7.26564,-8.17381 -10.89845,-19.67282 -10.89844,-34.49707 -10e-6,-14.00385 3.96971,-25.41497 11.90918,-34.2334 7.93942,-8.81827 17.79781,-13.22745 29.57519,-13.22754 11.77729,9e-5 20.8886,3.80868 27.33399,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	49733	151.101.129.229	443	880	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 22:37:33 UTC	434	OUT	GET /gh/uihkdslijsjd/captivating-app-lyoubgs5@internal-2024-07-16-20-02-58/07308ee98aa47f067087.jpg HTTP/1.1 Host: cdn.jsdelivr.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-30 22:37:33 UTC	752	IN	HTTP/1.1 200 OK Connection: close Content-Length: 47917 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: * Timing-Allow-Origin: * Cache-Control: public, max-age=604800, s-maxage=43200 Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Content-Type: image/jpeg X-JSD-Version: internal-2024-07-16-20-02-58 X-JSD-Version-Type: branch ETag: W/"bb2d-R6INHyIRvyFsefPELpTtq+Z2Xhs" Accept-Ranges: bytes Date: Fri, 30 Aug 2024 22:37:33 GMT Age: 1518 X-Served-By: cache-fra-etou8220027-FRA, cache-ewr-kewr1740021-EWR X-Cache: MISS, HIT Vary: Accept-Encoding alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
2024-08-30 22:37:33 UTC	1378	IN	Data Raw: ff d8 ff e1 00 18 45 78 69 66 00 00 49 49 2a 00 08 00 00 00 00 00 00 00 00 00 00 00 ff ec 00 11 44 75 63 6b 79 00 01 00 04 00 00 00 0a 00 00 ff e1 03 1a 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 38 20 37 39 2e 31 36 34 30 33 36 2c 20 32 30 31 39 2f 30 38 2f 31 33 2d 30 31 3a 30 36 3a 35 37 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d Data Ascii: ExifII*Duckyhttp://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57 "> <rdf:RDF xm
2024-08-30 22:37:33 UTC	1378	IN	Data Raw: 00 00 00 62 18 50 20 00 18 00 10 00 00 00 02 18 08 ea e2 d3 71 ca 74 f1 b2 2a 3d 45 1d ef 02 66 76 e2 9a 2e 4d 59 6b 2a 66 55 c5 6e 2a 31 b7 17 c1 ea ca 60 ea 98 d3 1e 45 70 59 33 bf 16 36 96 a8 de b8 d4 9d 0a 9a 0d 31 c5 75 08 f3 73 75 3d bc 98 e5 1e 5e 7c 1a e8 58 57 10 16 f1 34 43 4d 1a 64 00 00 08 60 00 3a f5 3d 0c 08 e0 c7 d4 f4 30 a2 55 8d 6d d0 f3 f3 33 be fd 0f 3f 33 d4 90 ac 40 40 69 00 0c 40 30 10 c0 d7 12 96 77 e3 50 71 60 47 a1 55 a1 9a b0 dd e0 55 cb a9 8e 77 07 32 cb a8 57 b7 8b 29 d2 96 e3 c7 c3 94 f4 70 66 86 41 bd f8 c9 ad 4f 27 9b ed ee 37 d3 af 83 e8 7a a3 1c 94 35 19 7c 70 1d de e3 c7 f4 ef be bd 19 c2 50 08 62 01 88 00 00 06 20 01 88 60 00 21 80 86 00 02 00 18 08 60 20 01 88 00 00 00 00 00 00 00 00 00 00 00 00 00 0d 71 1d d8 8e 1c 5d Data Ascii: bP qt=Efv.MYkfUn*1`EpY361usu=^\|XW4CMd`:=0Um3?3@@i@0wPq`GUUw2W)pfAO'7z5\|pPb `!` q]
2024-08-30 22:37:33 UTC	1378	IN	Data Raw: 5b 62 bb ab d1 ad 19 ce d4 33 51 8a 04 31 15 00 00 00 00 00 00 00 01 55 ea 76 e2 67 0d 7a 9d 78 99 9a d4 77 d1 9d 14 39 31 b3 a6 8c cb 6d 59 32 53 e8 66 c3 51 7b 87 bc c6 45 b8 cb 71 57 b1 85 d9 76 66 4d 85 65 63 1b 23 7b 18 d8 d4 62 b1 64 96 c9 66 98 21 0c 41 00 00 00 00 00 42 01 81 42 01 88 20 00 00 01 0c 00 40 00 00 00 00 00 00 10 00 00 00 00 00 08 62 00 00 02 87 43 b2 9d 0e 2a f5 3b 31 f4 25 22 72 23 99 9d 79 16 87 2d ba 92 09 10 c4 69 00 86 00 00 80 10 1d 78 4d 2c 67 84 da dd 0c b4 e2 c8 66 6b 90 c8 ac 80 00 86 50 01 4a 8d 94 b0 d9 81 9a 3a f0 99 d7 8e ce ec 3c 74 89 56 22 cb 43 8f 2a 3d 5b 52 ab ac 2f b4 c2 f8 e8 ff 00 55 7e 68 ce ab cb 86 3d 8c ee d9 8d 7e a5 f3 2a 70 af d4 8d 6a 63 85 62 b0 d6 16 76 ef c2 bf 57 e0 c7 eb 61 5d df c8 9a 63 8d 71 d9 Data Ascii: [b3Q1Uvgzxw91mY2SfQ{EqWvfMec#{bdf!ABB @bC;1%"r#y-ixM,gfkPJ:<tV"C=[R/U~h=~*pjcbvWa]cq
2024-08-30 22:37:33 UTC	1378	IN	Data Raw: 00 2b 73 f2 29 62 00 18 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d7 06 0b e7 ba c7 8d 4d 99 9f 5d 0f a3 e3 d2 bc 1c 51 5f ce ff 00 3b fe de 0c db 8d 71 e3 ed 55 c6 f6 4c 18 16 ee 43 f5 2f fc ab 4a af f1 3d 1a f2 31 e1 5b 31 a5 5a ff 00 a5 1e 26 4e 5b 7d cc 5e 76 63 ad 7a 27 09 1e be 7f 71 7d 2b a2 38 df 2a cf 49 3c f7 91 b0 de 31 7a 47 a4 f9 51 0b c2 83 2c 79 a5 58 e1 77 0c 77 d5 8c 35 e9 d3 36 d5 b9 f6 e8 8e 8c 19 a3 57 ad bc 9e 4b b9 78 b2 f5 26 23 db 59 fd 4e 9a f6 2d df 62 9b 3d 4f 39 e5 f4 52 5d cd 15 f6 63 dc fa d8 89 8e 8f 56 5e d9 f8 89 e4 83 8e b9 27 56 4d ec fb 05 c7 67 af f1 66 f5 ae 3e 4d 5e 3c ab 75 7e 2b 53 ca 56 3a b8 d9 ad ba 1a 94 cb 13 94 e8 f3 b9 dc 1b 71 68 eb 33 49 9a 9e 55 fa 1f 5b cb c2 b3 62 b6 25 Data Ascii: +s)bM]Q_;qULC/J=1[1Z&N[}^vcz'q}+8*I<1zGQ,yXww56WKx&#YN-b=O9R]cV^'VMgf>M^<u~+SV:qh3IU[b%
2024-08-30 22:37:33 UTC	1378	IN	Data Raw: ca 01 f5 eb da b8 ab fe 35 f3 65 2f 6e e3 2e 98 ea 30 7c 70 1f 68 b8 5c 75 d3 1d 7e 45 ae 3e 25 d2 95 ff 00 b5 0c 1f 13 03 54 b3 e8 99 f7 0a b5 5d 12 5f 70 f4 18 3e 21 61 c8 fa 55 fc 99 6b 87 9e dd 31 db fe d6 7d ac 84 8c 1f 1c bd bb 92 ff 00 e3 b7 c8 a5 ed 5c a7 ff 00 1b fc 0f ae 90 90 8f 94 5e cd ca 7f a3 f1 45 af 63 e5 3e d5 5f ee 3e a2 42 40 f9 a5 ec 3c 8e ee bf 32 d7 f4 fe 6e f7 af e2 7d 14 84 81 e0 2f e9 eb f7 c8 be 45 af e9 e5 df 27 ff 00 c9 ed c8 48 1e 3a fe 9f c7 df 23 f9 22 d7 b0 60 5d 6d 67 f2 3d 59 09 03 cd 5e c5 c6 5d 77 3f bc a5 ec bc 55 fa 5b ff 00 73 3d 09 09 03 89 7b 47 11 7e 8f c5 96 bd b3 8a bf e3 47 54 84 81 82 e1 71 d7 4c 75 f9 16 b8 d8 57 4a 57 fe d4 5c 84 94 0b 15 17 4a af 92 29 42 e8 4c 84 81 52 12 4c 80 15 21 24 c3 f0 3d b6 f0 c0 Data Ascii: 5e/n.0\|ph\u~E>%T]_p>!aUk1}\^Ec>_>B@<2n}/E'H:#"`]mg=Y^]w?U[s={G~GTqLuWJW\J)BLRL!$=
2024-08-30 22:37:34 UTC	1378	IN	Data Raw: c5 b6 0b 6d ba 8f 8f 93 93 d3 d6 0f 6b 37 b9 d3 2a db 6c 72 be 2c f2 f2 d6 b6 73 45 b7 e0 d9 3f 3e 5e 17 f4 e3 e5 cd 6c 6d 68 43 47 43 dc 4b 69 f5 5a 98 bc 6c ef 1b 9c a5 ed 58 6a 52 bb aa d0 b7 55 d8 6e 89 ad 09 8d fb 32 b5 f7 f5 33 34 75 82 20 2e e8 29 54 4b 42 a4 82 58 95 a0 a7 a9 16 45 1e fd dc a4 25 55 d0 58 de e5 5f 8a 47 56 1a 3f cc fe e3 9b 7a 8b 57 d3 5f ea 7d 8e 4b a7 f6 1e 8e 4a cc c6 af b9 c9 92 bf 7c 77 7d 02 c7 0d b5 fb 05 3a eb d0 d7 27 e1 fc 48 55 4b ae a1 5e 8f 03 33 e9 5a a6 e2 0e 9e 46 0a f2 d2 c7 9f f4 eb 15 d0 e2 c0 e5 c3 50 be 1d 4e fc d7 5e 9c e3 ac 25 e7 a9 5c ec ea e7 7e d5 c3 aa d6 92 fe 2d 93 6f 6c e1 3f f8 e3 fd cc 85 c9 b3 25 e4 ee 67 da b5 e9 19 72 7f a7 f1 e4 53 c5 b6 db 7f 25 de 8f ec 67 81 9f 05 f8 f7 78 f2 a7 5b 2e a9 9f Data Ascii: mk7*lr,sE?>^lmhCGCKiZlXjRUn234u .)TKBXE%UX_GV?zW_}KJ\|w}:'HUK^3ZFPN^%\~-ol?%grS%gx[.
2024-08-30 22:37:34 UTC	1378	IN	Data Raw: b1 c3 6a d9 b9 ea c9 da d6 ac e9 b5 d7 47 a2 f0 4a c8 93 d2 12 0a 8c 36 b2 b2 69 fc 94 9e bd ff 00 f3 63 b2 99 d3 fb 68 79 aa c9 eb 3f 74 c1 df c5 7b d6 b8 e3 e2 58 cf 27 95 bb 77 4d 0a 4f 43 7e 66 0d 96 7a 44 f4 6b a3 39 ab 35 d1 e8 c9 5b 97 5a 52 ca af 56 d1 eb f1 6c da 8f cd 57 e3 aa 3c 89 67 6f 13 25 66 34 9f 93 11 9e 73 63 c3 f7 ce 1b c3 c8 76 af e5 bf d5 f7 f7 3c cf 4d 9f 69 ee 7c 4f dc e2 57 ef 5d 64 f0 7f 6d 07 4b cb 1c 67 1d 79 3e 9b 1f a5 63 d4 fd b8 d6 04 67 dd af 47 95 e9 58 97 56 ba 9e cf ed d3 32 c9 c4 d0 7b a5 e0 f2 80 d7 2e 17 46 62 74 ee e7 d9 d1 8d 9d 78 99 c3 46 75 e3 64 6a 3b f1 b3 46 61 8d 9b a2 37 18 dd 18 5d 1d 17 39 ee 46 a3 16 49 4c 82 34 72 32 50 c2 99 2c 62 60 a8 64 32 d9 2c ac 52 00 02 b2 06 00 00 00 30 24 45 08 21 00 c0 09 01 Data Ascii: jGJ6ichy?t{X'wMOC~fzDk95[ZRVlW<go%f4scv<Mi\|OW]dmKgy>cgGXV2{.FbtxFudj;Fa7]9FIL4r2P,b`d2,R0$E!
2024-08-30 22:37:34 UTC	1378	IN	Data Raw: b1 9b 34 b1 9b 0a 43 24 64 53 13 09 13 60 26 48 d8 8a c1 00 01 50 c0 00 06 00 04 08 06 22 84 00 01 08 00 00 40 30 08 40 00 50 08 62 08 00 00 00 00 00 40 31 01 d9 5e 3f c0 da b8 19 db 4c 68 db 6d 51 cf d9 af 57 15 71 b4 53 a3 3a 74 ec 1b 24 9a be ae 17 46 4b 6d 1d af 14 92 f0 21 ec 7a b8 2d 92 dd 88 77 bb e8 7a 0b 8e 8d 2b c6 45 f6 3d 5e 3b 79 08 75 bb 3d cf da a0 fd aa 1e c7 ab c3 58 ef 26 d4 c5 63 d6 fd aa 29 71 d2 1e c7 a3 c7 b6 36 8c 2d 89 9e ed f0 23 99 e0 42 72 3d 1e 4f a4 c3 d1 67 ac b0 21 fe dd 17 d9 3d 1e 47 a2 c7 e8 b3 d7 f4 10 9e 14 3d 8f 47 93 e8 31 ba 3a 25 3e 59 ea 7a 48 c3 9b 48 c6 9a ec cb 39 69 eb 8f 3c 1f 40 19 a6 50 c4 36 22 b2 f5 f1 b9 aa 7f 03 ad d6 ab 58 af e9 7f 9b e7 fe 7e 0e 1e 2b 9c 68 e9 f5 5c 46 9d 36 f4 3d 93 ac 8f 2d e9 69 5d Data Ascii: 4C$dS`&HP"@0@Pb@1^?LhmQWqS:t$FKm!z-wz+E=^;yu=X&c)q6-#Br=Og!=G=G1:%>YzHH9i<@P6"X~+h\F6=-i]
2024-08-30 22:37:34 UTC	1378	IN	Data Raw: 6c e3 af d3 f8 b2 3f fa 32 f6 aa ea fe 21 6e 5d e7 72 4b 4d d3 5e fa 7f 79 3d b9 79 6b d6 78 6a b8 1c 75 fa 11 6b 89 85 74 a5 7e 44 65 e4 64 ae 45 4a d6 53 52 63 6e 4f 21 bf a6 90 9a 95 a3 27 b5 f2 64 76 2c 18 d7 4a af 91 4a 95 5d 12 38 33 7a f9 66 a9 e9 5f a5 ed 8d 65 3d 7f 81 4a 9c 89 4a 74 d3 ea d2 63 4f f3 26 ab ba 06 70 62 be 65 96 b5 c8 db 7f ab c4 47 f8 9d e0 00 00 04 80 d8 80 97 78 b2 ab ef 3f 81 39 72 d7 0d 1d ed d1 78 26 fc 7a d9 a7 0b 47 a9 77 c5 5b d1 d3 a2 7e 0a 33 fd de 2e f6 4b 58 fe df 32 e9 9a 97 7b 6a e5 98 ae 0e 2d db e3 59 9f ed f2 34 c5 c6 c7 85 b7 45 0d 90 57 ad 59 db de 62 3b 9a 0a 14 cf 71 81 cf 77 65 95 44 ed 7f 12 f3 e4 78 ea ac ba 4a dd f6 49 a3 aa 6d 37 d5 0c b4 79 ef 9b 67 ba 8a 27 5d b6 f3 ab 4a 3c c0 df 36 fb 5b 55 d7 b7 5f Data Ascii: l?2!n]rKM^y=ykxjukt~DedEJSRcnO!'dv,JJ]83zf_e=JJtcO&pbeGx?9rx&zGw[~3.KX2{j-Y4EWYb;qweDxJIm7yg']J<6[U_
2024-08-30 22:37:34 UTC	1378	IN	Data Raw: 70 ab 69 58 f3 5d 64 35 0f 1d a1 a6 7d 06 37 f4 a6 94 7c 1f 43 c1 c6 be 47 b3 c3 b5 6d 48 7a b0 5e c7 cd e3 2c 36 df 5f cb 6f c1 f8 ff 00 03 99 33 d7 cf 4f 5b 0d ab fa 92 fe 1d 0f 05 5e 4c f2 89 c6 eb 69 29 33 14 cb ab 32 db 46 24 c2 48 6e 18 1b 6d 31 c9 8d 59 1a e3 72 85 75 06 a3 2e 18 da e0 2c cd 72 d6 75 31 6c e8 cb 2b 19 58 d2 c6 76 22 b2 62 1b 11 42 10 c0 21 08 a1 15 00 00 00 00 01 00 00 00 00 00 00 20 02 a0 10 c4 00 21 80 08 06 20 84 03 10 00 00 8a 00 00 08 00 00 0f a3 92 93 14 04 1c 1d 8d 82 61 00 aa 05 03 64 b4 4b 60 69 25 23 19 2b 70 1b 48 da 93 9e 59 ad 6d a0 03 44 b1 bb 12 04 b4 34 0c 10 11 7a 98 ed d4 ea b2 31 65 13 02 91 b2 10 46 89 88 10 30 3c ae 6a 8c cf e3 0c e7 3a fd c1 7d 75 7e 51 c8 75 9d 9c ef 72 64 32 ec 4b ea 56 6b 4e 3d f6 65 ad bc Data Ascii: piX]d5}7\|CGmHz^,6_o3O[^Li)32F$Hnm1Yru.,ru1l+Xv"bB! ! adK`i%#+pHYmD4z1eF0<j:}u~Qurd2KVkN=e

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.8	49732	151.101.129.229	443	880	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 22:37:33 UTC	434	OUT	GET /gh/uihkdslijsjd/captivating-app-lyoubgs5@internal-2024-07-16-20-02-58/59947dbf5efae9de77d2.png HTTP/1.1 Host: cdn.jsdelivr.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-30 22:37:33 UTC	751	IN	HTTP/1.1 200 OK Connection: close Content-Length: 39930 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: * Timing-Allow-Origin: * Cache-Control: public, max-age=604800, s-maxage=43200 Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Content-Type: image/png X-JSD-Version: internal-2024-07-16-20-02-58 X-JSD-Version-Type: branch ETag: W/"9bfa-VMzIIL3VLYG1XjC0dZwRdZSmoyQ" Accept-Ranges: bytes Age: 1518 Date: Fri, 30 Aug 2024 22:37:33 GMT X-Served-By: cache-fra-etou8220128-FRA, cache-ewr-kewr1740046-EWR X-Cache: MISS, HIT Vary: Accept-Encoding alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
2024-08-30 22:37:34 UTC	1378	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 03 e8 00 00 02 ee 08 06 00 00 00 3d 8d 3c 4d 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 80 00 49 44 41 54 78 da ec dd 77 9c 64 d9 5d df fd ef b9 b7 62 e7 ee e9 c9 69 67 36 47 ad b4 ca 42 99 28 82 2c 01 42 c2 32 98 f0 80 6d b2 03 c1 8f b1 84 09 02 03 c6 58 3c 18 f4 02 0b 63 10 20 09 44 90 c1 38 80 11 08 65 69 a5 95 76 57 bb ab 0d b3 da c9 d3 d3 b9 ab ab ee bd e7 f9 e3 dc ea ae ee ae d4 dd 15 ee ad fa bc 5f af d1 68 66 6e df 3a 75 ab 6e 6d 7f fb 77 ce ef 48 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: PNGIHDR=<MbKGDIDATxwd]big6GB(,B2mX<c D8eivW_hfn:unmwH
2024-08-30 22:37:34 UTC	1378	IN	Data Raw: 72 00 d8 2b 02 3a 00 d4 8a f4 03 92 3d 2d f7 cd 16 00 00 ed f2 25 7d 89 3c ef ab f5 55 7f 9e e7 72 00 d8 0b 02 3a 00 54 bd f1 3d af 96 d1 f3 25 8f 6f ac 00 00 7b 60 c6 25 bd 42 63 a5 e7 71 2d 00 ec 05 01 1d 00 aa ac f7 9d 92 3d 2e 59 aa e7 00 80 bd 30 92 7d 9e 32 e1 8b b9 14 00 f6 82 80 0e 00 92 f4 0d ef 79 b1 14 3d 5b 52 81 8b 01 00 d8 87 31 45 f6 45 fa a6 3f ba 8b 4b 01 60 b7 08 e8 00 20 49 be 7d 99 a4 19 2e 04 00 60 ff cc 6d 52 78 3b d7 01 c0 6e 11 d0 01 40 92 8c 79 99 64 a6 b9 10 00 80 0e b8 4d 56 f7 d2 2c 0e c0 6e 11 d0 01 e0 1b df 7d af ac 4e 48 36 c3 c5 00 00 74 84 d1 59 4d 94 4e 73 21 00 ec 06 01 1d 00 7c ff 5e c9 4c 71 21 00 00 9d 63 6f 90 8d 4e 71 1d 00 ec 06 01 1d 00 14 9d 95 b1 23 5c 07 00 40 e7 98 a3 32 f6 30 d7 01 c0 6e 10 d0 01 20 d2 a4 ac Data Ascii: r+:=-%}<Ur:T=%o{`%Bcq-=.Y0}2y=[R1EE?K` I}.`mRx;n@ydMV,n}NH6tYMNs!\|^Lq!coNq#\@20n
2024-08-30 22:37:34 UTC	1378	IN	Data Raw: 59 6f 42 39 ef 94 ac 1d 49 df 13 6a 23 74 44 09 bf 33 d3 36 bb b7 dd cc 7d e4 c6 b3 0a 2a 5c cb 34 be d1 b6 1f 1a 85 52 58 76 21 ba 52 8e ff 7f 1c aa c3 55 49 f1 34 76 3f bb 59 25 f7 ac 54 0e 5c d8 f6 73 9b 61 5d 92 2a a1 0b ea d9 9c 3b 5e 92 2a 15 29 0c dd 71 be 4f 48 07 00 00 1d 43 40 47 b2 bc f5 fc 88 b2 cb b7 c8 7a 67 64 f5 6c 19 3d 4f d2 1d b2 f6 94 a4 9a 1e 4d 7b f8 86 b8 af 81 c8 8a 06 53 3d be dc 2d df 26 35 6f 88 b1 99 de 8f 2d 2d d7 30 c9 0f de ce 61 c1 ba b4 b6 24 95 96 a5 f5 65 69 7d 45 2a af 4a e5 15 57 01 cf 54 03 79 d6 55 cf 83 75 17 ea 33 85 38 c4 67 5d e5 bc 52 92 6c 56 8a b2 ee bc 51 24 55 d6 dd df 65 b2 84 74 00 00 d0 11 04 74 24 c3 af 9f 1f d1 95 d2 5d f2 d6 5f 28 eb 7f a5 8c 5e 2e 69 c4 4d 51 dd a7 34 04 8d be 8f 33 c5 63 db d3 38 6d Data Ascii: YoB9Ij#tD36}\4RXv!RUI4v?Y%T\sa];^)qOHC@Gzgdl=OM{S=-&5o--0a$ei}EJWTyUu38g]RlVQ$Uett$]_(^.iMQ43c8m
2024-08-30 22:37:34 UTC	1378	IN	Data Raw: 57 6a a6 b9 6f 6b 0e c7 34 77 00 00 d0 26 02 3a ba c3 da e7 c8 ea 54 fd 7f eb eb c0 da 3f 8c aa 79 8f c6 48 30 ef c4 5b b6 ef 0f 3e e8 3f e4 30 92 26 0e d6 9c cf d6 34 87 53 bc ef 79 b8 f9 6f 36 da 7c 40 2b a6 b8 03 00 80 b6 10 d0 d1 79 3f f5 d8 49 49 b7 4a 1a db f2 f7 ac 9b ed d9 d3 48 c4 38 93 fc 64 d2 92 95 a8 9a 27 e8 9e 31 d2 d8 ec d6 f3 d6 4e 6b af ee 7b be f1 47 5b 53 35 b7 04 74 00 00 d0 16 02 3a 3a cf 9a 5b 25 9d 90 ab 39 b1 6e b6 c7 4f 23 1d e3 b4 fd 1d e3 c0 5c c7 3e 3f f0 b0 dd 33 99 ac 94 1f df 7c 80 da 69 ec d6 6e 5b 77 6e b7 4e 6b b7 84 74 00 00 d0 1a 01 1d dd 78 57 9d 92 cc 2c eb 66 3b f8 54 d2 20 0d 55 73 d6 9a 77 e6 81 87 f6 9e 31 52 61 bc e6 71 6a aa e6 b6 4e 05 7d 4b 63 38 4b a3 38 00 00 d0 52 86 4b 80 ce f3 c6 25 5b e8 df e3 0f 48 a7 Data Ascii: Wjok4w&:T?yH0[>?0&4Syo6\|@+y?IIJH8d'1Nk{G[S5t::[%9nO#\>?3\|in[wnNktxW,f;T Usw1RaqjN}Kc8K8RK%[H
2024-08-30 22:37:34 UTC	1378	IN	Data Raw: 8d 31 d5 7f 6a 3c 44 6b 65 ed e6 39 6c ed b0 93 f0 f2 d2 04 6e b8 ae 23 00 00 40 1b 08 e8 18 0e ac 9b 4d ee 18 8d e4 19 23 df 48 be 91 3c 23 19 cf 48 93 59 69 c2 d7 44 d6 e8 8d c7 0b 1b 87 4f 64 8d ee 9d cd 6a 3c eb 35 3d ed f9 95 50 9f 9f 0f b4 1a b8 41 3f 5d 0a f5 b1 f9 8a ae ae 47 d2 d5 8a b4 12 2a b2 56 91 95 22 2b 05 d5 40 6f 53 7a 1d fb 32 46 ee 17 00 00 80 4e 22 a0 63 f0 11 34 92 33 4e 23 f9 9e 51 d6 93 b2 9e 51 c6 48 3a 59 d0 7d d3 59 3d 7b 32 a3 af 3a 55 d4 4d 93 19 9d 9c e8 cd 47 d3 03 57 cb 7a e0 6a 45 8f cc 57 f4 07 cf 94 74 e9 c2 ba a2 e5 50 61 68 55 8e ac 2a 91 64 23 9b ac 6b c8 fd c2 7d 0a 00 00 06 16 01 1d 83 8d 75 b3 fd 1f a7 6f 54 f4 8d 46 32 46 99 89 8c ee 3a 51 d0 2b 0f e7 f5 e5 27 0b 7a ce a1 9c 7c af 7f 4f ed ee d9 9c ee 9e cd 49 92 Data Ascii: 1j<Dke9ln#@M#H<#HYiDOdj<5=PA?]GV"+@oSz2FN"c43N#QQH:Y}Y={2:UMGWzjEWtPahUd#k}uoTF2F:Q+'z\|OI
2024-08-30 22:37:34 UTC	1378	IN	Data Raw: bd f0 c6 11 7d d9 b3 c6 f5 2f 6f 1d 55 21 63 78 3f f6 49 d6 33 7a fd 0d 45 dd 3c 9e d1 6f 8e 67 f4 de cf 2e e9 99 f9 60 e7 94 77 ee 97 3d 3e 2e c1 1c 00 00 a4 07 01 1d fd c1 b6 69 7d 1b 63 3e ef e9 75 b7 8d ea 7b 5e 30 a5 2f 61 4a 7b 62 dc 7d 20 ab 1f 7c fe a4 8e 8e fb fa 8d 4f 2c ea b1 cb e5 cd 90 ce fd b2 c7 c7 25 9c 03 00 80 74 21 a0 a3 b7 a8 02 f6 75 8c b9 bc a7 ef 7c ee a4 be e7 be 09 dd 3e 93 e5 fd 98 30 37 4c 66 f4 dd cf 9e d0 58 d6 d3 7f fc f8 82 1e bb b8 2e 05 ed bc e0 54 cd f7 34 30 82 39 00 00 48 18 02 3a ba 8f 50 9e 88 b1 66 26 32 fa ee 7b c6 f5 ff be 68 4a 87 59 6f 9e 58 53 79 4f ff f0 ae 31 8d 8d 7a fa b9 0f cd eb a1 73 a5 06 21 9d 50 be a7 83 08 e5 00 00 20 c1 08 e8 e8 2e c2 79 22 c6 68 c6 33 fa 37 2f 9b d1 3f b9 63 54 87 47 08 e7 49 37 95 Data Ascii: }/oU!cx?I3zE<og.`w=>.i}c>u{^0/aJ{b} \|O,%t!u\|>07LfX.T409H:Pf&2{hJYoXSyO1zs!P .y"h37/?cTGI7
2024-08-30 22:37:34 UTC	1378	IN	Data Raw: ff e6 2f af ea fe f3 25 2d af 6d 0b e7 49 7a ad 23 ab ab cb a1 3e ff f0 8a be f3 bd 17 f5 4f ff 7a 4e 17 57 82 44 bf 15 b3 9e d1 cf bc 6c 46 c5 e9 ac 7a fe 66 48 d2 b6 69 4d cf b3 8b 07 60 87 35 00 00 d0 27 04 74 24 13 c1 bc f9 03 67 8d fe ed f3 27 75 f7 81 5c a2 a7 b6 af 54 22 bd fe ef ae eb f5 7f 74 49 7f ff f9 65 cd 2d 05 5b 97 49 27 39 08 05 56 97 96 02 bd eb c3 f3 7a ee ef 5c d0 c7 2e ac 27 fa 6d 79 a0 e0 e9 1d 5f 79 50 b9 5e be 21 da 0a e6 b6 03 e7 d9 cf 78 76 f9 26 23 98 03 00 80 3e 22 a0 23 59 d2 50 b9 ea 67 30 8f 1f f8 1b ee 1c d3 8b 8e 27 bb eb f8 13 0b 81 be f1 fd 57 f4 fe bf bb ae cb d7 ca 0a 82 3e ad 33 df e7 25 5f 5b 8f f4 cc 33 25 7d d5 6f 3d a3 df 7c 60 39 d1 c3 7d dd 4d 23 f2 4f 15 13 70 0f ec 22 98 77 ad 6a be 87 60 4e 38 07 00 00 7d 46 Data Ascii: /%-mIz#>OzNWDlFzfHiM`5't$g'u\T"tIe-[I'9Vz\.'my_yP^!xv&#>"#YPg0'W>3%_[3%}o=\|`9}M#Op"wj`N8}F
2024-08-30 22:37:34 UTC	1378	IN	Data Raw: 63 94 da 75 e6 9d 08 e7 fb fd c0 20 cb 03 00 80 2e 23 a0 63 70 d8 14 3c f0 2e 0e 7d f5 b1 82 9e 33 9b 8c e9 ed 0f 5e af e8 6f 1f 5f 95 92 b0 cf 77 92 83 79 cd 43 3f b1 18 e8 1d 9f 5d 4a c4 5a 74 df 93 6e 9a c9 69 e2 40 b6 37 97 6d 10 d7 99 13 cc 01 00 40 0f 10 d0 91 7e 7d cb 62 5d 5c 37 9b 31 ba e3 50 4e 67 12 30 bd 3d 88 a4 bf bf b0 ae f7 3f 91 80 35 d5 29 08 e6 1b ca 91 2e 3d 53 d2 07 2f 24 a3 8a 5e c8 18 bd e2 86 91 ee 5e b6 41 5c 67 4e d5 1c 00 00 f4 10 01 1d e9 95 86 60 ae bd 8d f1 f0 4c 56 67 0e 26 63 7a fb b9 e5 40 9f 7a ba d4 df ea 79 02 d7 99 b7 f3 d0 4f 2c 06 fa 83 47 56 15 24 60 63 f4 b1 ac d1 9b 6f 1e ed de 65 4b ca 3a f3 ba e7 d8 e3 87 05 c1 1c 00 00 f4 18 01 1d e9 93 a6 60 be c7 71 be e4 70 5e cf 3e d0 ff bd cf 23 2b 7d fc d2 ba fe f4 0b 7d Data Ascii: cu .#cp<.}3^o_wyC?]JZtni@7m@~}b]\71PNg0=?5).=S/$^^A\gN`LVg&cz@zyO,GV$`coeK:`qp^>#+}}
2024-08-30 22:37:34 UTC	1378	IN	Data Raw: fc 2f 0f 71 21 00 b4 8b 80 8e 94 19 8c e9 ec 3b c6 e7 99 fa 61 a9 c7 2e 96 23 fd 65 ed 36 60 04 f3 3d 3e 6e e3 03 2e af 47 7a 62 b5 ff 01 7d 3c 6b 74 df 54 b6 b3 d7 32 15 55 f3 94 bc c7 00 0c 86 c7 1f 7e a3 a2 ca af e9 05 df ff 1a dd f7 5d 23 5c 10 00 ad 10 d0 91 12 03 34 9d bd ce f8 6e 19 cb e8 59 09 e8 e0 5e 0e ad 16 d6 c2 cd 71 26 f5 62 27 36 98 b7 be 70 57 d6 23 3d b1 12 f6 fd b5 2e 78 46 27 8a 1e d3 d9 d3 fa 39 02 20 1d 2a 95 83 92 be 4a c6 fc 9a b2 c5 9f d7 8b 7f f0 5e dd f7 5d 59 2e 0c 80 46 08 e8 48 b8 c1 0e e6 55 45 5f 1a 49 40 05 5d 65 2b 5d 0f 92 dd a1 3d d1 eb cc 5b 0f 2e a8 58 55 ca fd 5f 83 6e d4 81 49 1b 89 0f e6 12 c1 1c 40 02 14 24 9d 94 f4 2d 0a ed ef 2b 5b 7c ab 5e fc 3d a7 b9 2c 00 ea 21 a0 23 a1 06 70 9d 79 13 79 df 68 24 93 80 80 1e Data Ascii: /q!;a.#e6`=>n.Gzb}<ktT2U~]#\4nY^q&b'6pW#=.xF'9 *J^]Y.FHUE_I@]e+]=[.XU_nI@$-+[\|^=,!#pyyh$
2024-08-30 22:37:34 UTC	1378	IN	Data Raw: f0 8d f5 f5 52 a4 cb 6b fd 6f e3 5e cc 78 3a 3a e6 d7 bf 86 4c 67 df d5 3a f3 46 f2 79 4f 23 23 09 f8 e8 0d ac b4 10 74 2e 10 77 e2 c6 4b da 3a 73 82 39 80 b4 31 ca c8 f7 d9 13 1d 48 31 02 3a 06 57 1a be b9 8e c7 b8 54 89 b4 50 ee 7f 40 9f cd 19 bd 68 26 9b 8c 6b 98 f2 75 e6 8d ce 71 30 e7 e9 86 d1 fe 56 d0 ad 95 2a 15 2b ad 85 5d b8 2e 03 32 9d 9d 60 0e 20 8d bc 8c 34 7b 94 eb 00 a4 58 02 e6 59 02 1d 96 96 6f ac 6b c6 79 3d b0 ba 5c e9 ff c0 8b 19 4f 47 47 32 fd bf 86 9d 58 67 9e 84 71 d4 39 ec 50 c1 d3 99 b1 fe 76 70 2f 47 56 17 97 83 0e 5f 97 a4 54 cc 87 e4 f3 03 00 ea f1 7c e9 f0 69 ae 03 90 62 04 74 0c 8e 14 06 f3 aa a7 4b 91 be b0 1a f6 7d 68 13 39 a3 db 67 b2 09 7d 0d 6d 07 ce d1 89 b1 d8 7d 9d 63 b6 e8 eb f4 78 7f 3f 7a 4b 81 d5 23 d7 2b 1d ba 2e Data Ascii: Rko^x::Lg:FyO##t.wK:s91H1:WTP@h&kuq0V*+].2` 4{XYoky=\OGG2Xgq9Pvp/GV_T\|ibtK}h9g}m}cx?zK#+.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.8	49739	151.101.129.229	443	880	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 22:37:34 UTC	434	OUT	GET /gh/uihkdslijsjd/captivating-app-lyoubgs5@internal-2024-07-16-20-02-58/fa37e6e4fd65b2e85394.ico HTTP/1.1 Host: cdn.jsdelivr.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-30 22:37:34 UTC	763	IN	HTTP/1.1 200 OK Connection: close Content-Length: 2922 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: * Timing-Allow-Origin: * Cache-Control: public, max-age=604800, s-maxage=43200 Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Content-Type: image/vnd.microsoft.icon X-JSD-Version: internal-2024-07-16-20-02-58 X-JSD-Version-Type: branch ETag: W/"b6a-fOM3ZVcFRLN/5u6ptcQ1FamiwRI" Accept-Ranges: bytes Age: 1519 Date: Fri, 30 Aug 2024 22:37:34 GMT X-Served-By: cache-fra-eddf8230068-FRA, cache-ewr-kewr1740044-EWR X-Cache: HIT, HIT Vary: Accept-Encoding alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
2024-08-30 22:37:34 UTC	1378	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 2d 00 00 00 2d 08 06 00 00 00 3a 1a e2 9a 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 23 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 38 20 37 39 2e 31 36 34 30 33 36 2c 20 32 30 31 39 2f 30 38 2f 31 33 2d 30 31 3a 30 36 3a 35 37 20 20 Data Ascii: PNGIHDR--:tEXtSoftwareAdobe ImageReadyqe<#iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57
2024-08-30 22:37:34 UTC	1378	IN	Data Raw: f8 e2 1d 4f bf 53 b8 fe c4 82 33 54 b2 99 48 b1 a4 26 09 16 39 60 c7 a9 42 b5 5c 04 17 b7 02 04 81 28 b3 cb 81 ad 5d 0f 6e e1 1a bf 62 d0 9a f8 c7 fd 63 9f d1 14 a9 7a d6 a0 71 d2 f2 4f 0f cc 6e fb d9 81 b9 ad 33 45 2f 95 50 30 d1 30 d9 04 9b 11 16 89 58 19 a3 50 ad 94 a0 52 3c 8d ac 39 78 86 b4 80 5b 0e 6c b0 c3 37 b4 ec c0 a3 df ba 62 cb 4d 63 7d 8f 9c 15 e8 92 43 13 77 3e 39 b5 fb b1 d7 97 36 a7 91 51 a5 3e 7e 73 72 85 f3 8a 21 4c 09 28 f5 a0 52 5a 42 e6 97 80 51 56 03 1f 66 9b b5 38 49 7d 22 94 0a b6 3f 77 69 fe c5 bf de bf ee ea 33 4e 44 94 96 fc cd 27 a7 7e fb d8 c1 a5 cd 39 dd 07 cc 84 c7 c6 00 ae 25 5a 70 8d 52 2a 5e 65 a4 b2 60 5a dd 68 81 09 11 01 1e 36 9e 74 ac 0e b8 26 7c ea 87 94 a1 c4 f8 4a 14 05 14 cb 84 f1 ff 78 9f dd fb f6 e2 a6 e9 a2 d7 Data Ascii: OS3TH&9`B\(]nbczqOn3E/P00XPR<9x[l7bMc}Cw>96Q>~sr!L(RZBQVf8I}"?wi3ND'~9%ZpR*^e`Zh6t&\|Jx
2024-08-30 22:37:34 UTC	166	IN	Data Raw: 64 df 14 db f2 d4 9c 79 f7 91 8a b1 a6 48 a5 90 cf 36 f9 6d 73 d3 c4 96 91 46 ec 3d fe 75 12 6d 2a c5 b1 a5 b8 74 2c 5b da b3 65 45 75 db da 15 f9 83 56 d7 85 58 f6 b5 f8 6f 44 7e 5c 2e 95 c0 2e 2c c2 52 b9 22 4f 16 a5 2b 8f 94 b5 f5 d3 8e 3a 5a 65 52 8a 84 0b 4f 73 21 81 b8 36 a0 f5 37 10 d6 74 2d bc 68 12 2b f6 e9 f6 c4 a7 32 ce 73 83 96 f4 9a 91 32 21 61 62 d3 a5 2a e7 e6 67 b1 f6 4f bd 6d d0 6d d0 6d d0 6d d0 e7 7d f9 af 00 03 00 c1 49 0c 37 2e a0 31 20 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: dyH6msF=umt,[eEuVXoD~\..,R"O+:ZeROs!67t-h+2s2!abgOmmmm}I7.1 IENDB`

Target ID:	0
Start time:	18:37:17
Start date:	30/08/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff678760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	18:37:21
Start date:	30/08/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1900,i,388128914800657721,16740972578459867677,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff678760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	18:37:24
Start date:	30/08/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://sharefile8.pages.dev/qvuv+pyrqwzcz6xaxlnoqwjmehzvhi7wuk+tdmwkgv96kzea82mtrq3s+h+nlysnemgyfcvtuhozuighqob+lce9yippttt6fi1kubdsdbqmwx5kxujjxwu5crv4iqguxis5l5bqjc2sd56vkdj"
Imagebase:	0x7ff678760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Source: https://sharefile8.pages.dev/qvuv+pyrqwzcz6xaxlnoqwjmehzvhi7wuk+tdmwkgv96kzea82mtrq3s+h+nlysnemgyfcvtuhozuighqob+lce9yippttt6fi1kubdsdbqmwx5kxujjxwu5crv4iqguxis5l5bqjc2sd56vkdj	Avira URL Cloud: detection malicious, Label: phishing
Source: https://sharefile8.pages.dev/qvuv+pyrqwzcz6xaxlnoqwjmehzvhi7wuk+tdmwkgv96kzea82mtrq3s+h+nlysnemgyfcvtuhozuighqob+lce9yippttt6fi1kubdsdbqmwx5kxujjxwu5crv4iqguxis5l5bqjc2sd56vkdj	SlashNext: detection malicious, Label: Credential Stealing type: Phishing & Social Engineering

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://sharefile8.pages.dev/qvuv+pyrqwzcz6xaxlnoqwjmehzvhi7wuk+tdmwkgv96kzea82mtrq3s+h+nlysnemgyfcvtuhozuighqob+lce9yippttt6fi1kubdsdbqmwx5kxujjxwu5crv4iqguxis5l5bqjc2sd56vkdj

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 66

Chrome Cache Entry: 67

Chrome Cache Entry: 68

Chrome Cache Entry: 69

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Chrome Cache Entry: 76

Chrome Cache Entry: 77

Chrome Cache Entry: 78

Chrome Cache Entry: 79

Chrome Cache Entry: 80

Chrome Cache Entry: 81

Chrome Cache Entry: 82

Chrome Cache Entry: 83

Chrome Cache Entry: 84

Static File Info

Windows Analysis Report
https://sharefile8.pages.dev/qvuv+pyrqwzcz6xaxlnoqwjmehzvhi7wuk+tdmwkgv96kzea82mtrq3s+h+nlysnemgyfcvtuhozuighqob+lce9yippttt6fi1kubdsdbqmwx5kxujjxwu5crv4iqguxis5l5bqjc2sd56vkdj