Edit tour

Windows Analysis Report
https://sharefile8.pages.dev/xit56kt7w1jt5s3mhgrdsk6odhghtvrycrdxoty84z4sucsd08bsbepa6wv52edrjl8mwcfcknpbcycsjetq74hex+dscntrcvkhpm4lzymvx+4sbhzddbr7tddsma1l785uupaxpd2t0gwjyuyrmto2jztaw84au7zieflszmmbu1leyxxtwf0ehetluu1jdzjigzq

Overview

General Information

Sample URL:	https://sharefile8.pages.dev/xit56kt7w1jt5s3mhgrdsk6odhghtvrycrdxoty84z4sucsd08bsbepa6wv52edrjl8mwcfcknpbcycsjetq74hex+dscntrcvkhpm4lzymvx+4sbhzddbr7tddsma1l785uupaxpd2t0gwjyuyrmto2jztaw84au7zieflszmm
Analysis ID:	1502065
Infos:

Detection

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Antivirus / Scanner detection for submitted sample

Phishing site detected (based on favicon image match)

Phishing site detected (based on logo match)

Detected non-DNS traffic on DNS port

HTML body contains low number of good links

HTML title does not match URL

Classification

Process Tree

System is w10x64

chrome.exe (PID: 6944 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 2704 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1980,i,12944064432080657643,2785131983954265400,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 7120 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://sharefile8.pages.dev/xit56kt7w1jt5s3mhgrdsk6odhghtvrycrdxoty84z4sucsd08bsbepa6wv52edrjl8mwcfcknpbcycsjetq74hex+dscntrcvkhpm4lzymvx+4sbhzddbr7tddsma1l785uupaxpd2t0gwjyuyrmto2jztaw84au7zieflszmmbu1leyxxtwf0ehetluu1jdzjigzq" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

Source: https://sharefile8.pages.dev/xit56kt7w1jt5s3mhgrdsk6odhghtvrycrdxoty84z4sucsd08bsbepa6wv52edrjl8mwcfcknpbcycsjetq74hex+dscntrcvkhpm4lzymvx+4sbhzddbr7tddsma1l785uupaxpd2t0gwjyuyrmto2jztaw84au7zieflszmmbu1leyxxtwf0ehetluu1jdzjigzq?ef5cb60b3eb712165be9aa2e8432255dm0haqp1l=U2FsdGVkX1%2F54Vi5k0fpJopgxlpTE%2Fwt1JbQBXUwtHI23IsXwilEibczOtXIyEafGUqvIxelPBKzraUcUZYsXddxVc0shoqZRiLuOtEQo8KQVHVVuhOjGpqAXb2ikXZcbMrR3pLVYbbERPy3QEAprq0jX%2F8t0p34IN%2BfftC4hK3%2Bs1g90JwifgjP3PTpK1aoAXRSeuyZNO%2BH9gJzHQNdJE58%2F1O7kPWQUEDNBeiPMexEwjzhqyPS9sJwf0XY9a6%2BVhLlq7y81V6%2FcHskp%2BgdCzxqfr2n7lQ1IzSUDClcGHZRzUhWfautY7xVjrLnzgh7ZdWqSUKbXwS23VjXs%2FdDRWpe82DNrAmaKQbf9Na%2B%2Bp6FxgINSz%2FMl0rbKTfp%2F%2FB8Lz5SQtpMofgzRCNhzPatp%2BV5xmEtnUqea565l6q9U5MRShooxYUyXTQVvbgAlt0sKy1Zn%2BcT%2FslFRCHHR0zWoJWY3C6nqLsoAd%2F%2FoO4Kuru019imWUO6zMl%2Bck5uBY464whKgUjunYedrNn084WCIbOmkMucwZLKqm3bOAd%2FibGCLBme5AHdSITb2ryus7xe9v4kpSTw2biTnqZDObxiPxx%2FlIUJVqeZ3GCPECdUF8rVpu8FzjC3cJ9NKqT7zzV6mx%2FvZ%2FeytMk04I%2BoShNpqBGNK%2F6JWx25ptmkQXmET2SmB3YR9%2BoDTAQck88otqYtCYclKM0QWtWB1tYqqWOTcaxOMY6Jyj9uCJYmdjaz8gZEQMrQV%2F%2F7zGMrvWJkTGBd5ZVAxlTgiZxSssmS7G8hxPZYko1qgdRYB3Rcs5ketzHki2q2AI%2B0419%2B3z%2F1p5C95LC%2FDKwEQstBzJpMFW14hw8dP1SrF%2BLer4byED8x6QLVs2uSAr2ZN5Npn%2FWGhkikTh0XfdYXRJYJDCIHQVl8rrn8IFKNMRipYsoBiK9seKTi5U%2BnLxt2M%2FW5Gk0C0kvDHUx%2FSXD4P%2Fm0M6JKyHJsy2XtTaidIQf6ZyOY3Za45NkaBz%2Bmkyhxmf1K8D8GPTiIZ%2Bza39mOrw3VObLpIhUeIDAPPUVhhUVJ0oa9z7AJbFvKCrpBqGibr4oC%2BvzZouiWBJVncfh2PO3S9Hh2YcihlUxohfNbREwAhpJwmW%2BMV8VCzGI2VkWlVQx9IIW0SrcLiHIaiEHCWsgRRAP2g%2FDQ4XIIYVQ2%2Fu09gskYVpVExbtDpkqLfE4KypMVJZURUEwfGEpQAk4cK9Kl%2F55pn2VZdQqvjk7To5abhxFnOUZEXVAgybYOgnawk1eL%2Bqjhf6BmTbs0nEh1lKH9LBRXla42rpVhGdKuhppKZnXDtBP0nB4jx8Y8Eb7LRhu%2F6cymoMKfZ4kBJZYdE6tlc3ZQz3XPwEEsuqaQs0IKmlkhNB3YG0wtDp%2Br%2BBp1VcN%2Bbh2wOvpj1yc1ql0gHSPWlhjfUAl8sSbKMGnTUPEDuw%2FVyrxgCa8ukv2uPqke3x4LIg1BbH3QKmlrosSrKfpeXmrNBI9zcnVwdhVQw%2BR7oR6UzGdbnr20AG%2BA4R5QB6%2BtqDQjSJQoG80E48DdKuzV6QsQyyWG8KeT%2FOGXRd1sD8y44IF%2FQ2Ztb07vAIDokEXsM0wwQw9id9tlLh7nx5qxzGAZlvJrAoJnVtecQwYSDIKwoPj45mD0hxJTLOM%2BkUKEWpJSxC8%2FRZQ%2Bk0PnA4QFzfkFXUggmcvcFJ%2FMXnqRCtfVaZtR2a4%2Ba6VPD9CtbfLeNRVrHhDhd38rERYekFZRYol38YqE25ogDn1i5zQG6YfvVTBLDIa0C8H2gqoUdmrwMEU0Hr2CTzL%2F6a0bo21PlhpnvdWrdoouQx1j%2FmFULtRPuapD8WFkZYJ016K3l%2BvhkW%2F1036TmoK5WlGStZ8t%2FTG5XXP%2FNwol6HKGW%2B9XNIHRSnq4f4tccEqqy%2BuKpq3Sze9iJGibyKm2lEDFfU4V5%2FLgh4ZhCI%2BlOCzjNSHqPDhHAdRdNNk95gSPn6%2B0E3z5F%2Bfu3on3JoDKsCDAXfmXdX6K8sPGkzcqucX72%2BsVzCBBbJ0Fephn407z5yjL5VDHmQ%2BaZ4sO8Go5tXsSLzLj%2Bcyva6IiqTL6Oy1t3NZqMCQwLZ76OyjIi95zD5b2BMaQF50e3SV6wEhymXxGuc0vJot2weKFS08Kxis9OOayYmqC3l3xgpV0fg%2FYsC5zudvXgLyNYn%2Bc5YeYNeEbZoXuKkWknKBI%2FYviyPiOgHczbUjfnC1VwDI4X1rwYWDLaA6NK%2BH2stpktIkYBxnw%2BtYEe63EqBbKMsOkj79cXD%2BAw8D%2BT1q1t5ferlfAYftv6SykMbzBsSs0aJC6xHS8oF%2BrFZQOlm9t6LlCglt1HmGc9Xi9YkyIMGcs4bUaCkSx6SlrQ8EqWuu5N%2F43WY0JbtaGBHAGLVVi98h3wOjmTI51zb8mPd12l28QMjljyfqj%2BmwoEEL8nFUujAKyJtVfNTVA8UbYKzJ26gSsk5VMAQryHlefOKe5c8igmywyEInX8fMECnmhV%2BErnL2qk9iUg4xBSDWTrjmTf8RpmR5nxatcQzNkXwdd%2FmZZAkbHKhafHuh4wlpucrXQNl1k4jje3xUewfzD%2FUu%2BT1UJl3hnMhpa1boGdjbQAwRJZ95zqaKA1YRBmBsEXuQKxT5GNWhsIbC8mYo6UoBQuipyI8yhS5g9nbd86DGHHNkxqvjMtQF04IoenFEjqpOhSVHtba8EdLLBSPUJP7SWgI7fl3jAYQ5MxpfSQ%2FOVxWtfWhTQcdDtXInzb8WFWxxwT7RLyz77451jFfnnaqtjUR6hlx7ZvmcFVNCc%2BkaYoCzh8LlnoEvlZRmX9tvtuRLq2UMvdgMJZii9OBxaJlvIjRC9isp0OkrWx5xM717uxFXvTcbj6uMlM41GjJzARSYJXBZxgBBsWPnsK1BwTKJwigqO%2B%2Bkf8Vpqg%2F5dbkY0yGDtq%2FEKfDTjzaZQ61XfM45A

LLM: Score: 8 Reasons: The domain'sharefile8.pages.dev' is not a typical domain for a production OneDrive site, and the.dev gTLD is often used for development purposes. The login form and notification message are consistent with a OneDrive login page, but the unusual domain and lack of a typical OneDrive domain (e.g., onedrive.com) suggest a potential phishing attempt. DOM: 1.0.pages.csv

Phishing site detected (based on favicon image match)

Matcher: Template: onedrive matched with high similarity

Phishing site detected (based on logo match)

Matcher: Template: microsoft matched

HTTP Parser: Number of links: 0

HTTP Parser: Title: Microsoft OneDrive does not match URL

HTTP Parser: No <meta name="author".. found

HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 20.44.239.154:443 -> 192.168.2.7:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.71:443 -> 192.168.2.7:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.71:443 -> 192.168.2.7:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.119.249.228:443 -> 192.168.2.7:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.231.128.59:443 -> 192.168.2.7:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.231.128.59:443 -> 192.168.2.7:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.231.128.59:443 -> 192.168.2.7:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.231.128.59:443 -> 192.168.2.7:49846 version: TLS 1.2

Source: global traffic

TCP traffic: 192.168.2.7:49845 -> 1.1.1.1:53

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.44.239.154
Source: unknown	TCP traffic detected without corresponding DNS query: 20.44.239.154
Source: unknown	TCP traffic detected without corresponding DNS query: 20.44.239.154
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.44.239.154
Source: unknown	TCP traffic detected without corresponding DNS query: 20.44.239.154
Source: unknown	TCP traffic detected without corresponding DNS query: 20.44.239.154
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.44.239.154
Source: unknown	TCP traffic detected without corresponding DNS query: 20.44.239.154
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71

Source: global traffic	HTTP traffic detected: GET /xit56kt7w1jt5s3mhgrdsk6odhghtvrycrdxoty84z4sucsd08bsbepa6wv52edrjl8mwcfcknpbcycsjetq74hex+dscntrcvkhpm4lzymvx+4sbhzddbr7tddsma1l785uupaxpd2t0gwjyuyrmto2jztaw84au7zieflszmmbu1leyxxtwf0ehetluu1jdzjigzq HTTP/1.1Host: sharefile8.pages.devConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/font-awesome/4.7.0/css/font-awesome.css HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://sharefile8.pages.devsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://sharefile8.pages.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Host: ipapi.coConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://sharefile8.pages.devSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://sharefile8.pages.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /xit56kt7w1jt5s3mhgrdsk6odhghtvrycrdxoty84z4sucsd08bsbepa6wv52edrjl8mwcfcknpbcycsjetq74hex+dscntrcvkhpm4lzymvx+4sbhzddbr7tddsma1l785uupaxpd2t0gwjyuyrmto2jztaw84au7zieflszmmbu1leyxxtwf0ehetluu1jdzjigzq?ef5cb60b3eb712165be9aa2e8432255dm0haqp1l=U2FsdGVkX1%2F54Vi5k0fpJopgxlpTE%2Fwt1JbQBXUwtHI23IsXwilEibczOtXIyEafGUqvIxelPBKzraUcUZYsXddxVc0shoqZRiLuOtEQo8KQVHVVuhOjGpqAXb2ikXZcbMrR3pLVYbbERPy3QEAprq0jX%2F8t0p34IN%2BfftC4hK3%2Bs1g90JwifgjP3PTpK1aoAXRSeuyZNO%2BH9gJzHQNdJE58%2F1O7kPWQUEDNBeiPMexEwjzhqyPS9sJwf0XY9a6%2BVhLlq7y81V6%2FcHskp%2BgdCzxqfr2n7lQ1IzSUDClcGHZRzUhWfautY7xVjrLnzgh7ZdWqSUKbXwS23VjXs%2FdDRWpe82DNrAmaKQbf9Na%2B%2Bp6FxgINSz%2FMl0rbKTfp%2F%2FB8Lz5SQtpMofgzRCNhzPatp%2BV5xmEtnUqea565l6q9U5MRShooxYUyXTQVvbgAlt0sKy1Zn%2BcT%2FslFRCHHR0zWoJWY3C6nqLsoAd%2F%2FoO4Kuru019imWUO6zMl%2Bck5uBY464whKgUjunYedrNn084WCIbOmkMucwZLKqm3bOAd%2FibGCLBme5AHdSITb2ryus7xe9v4kpSTw2biTnqZDObxiPxx%2FlIUJVqeZ3GCPECdUF8rVpu8FzjC3cJ9NKqT7zzV6mx%2FvZ%2FeytMk04I%2BoShNpqBGNK%2F6JWx25ptmkQXmET2SmB3YR9%2BoDTAQck88otqYtCYclKM0QWtWB1tYqqWOTcaxOMY6Jyj9uCJYmdjaz8gZEQMrQV%2F%2F7zGMrvWJkTGBd5ZVAxlTgiZxSssmS7G8hxPZYko1qgdRYB3Rcs5ketzHki2q2AI%2B0419%2B3z%2F1p5C95LC%2FDKwEQstBzJpMFW14hw8dP1SrF%2BLer4byED8x6QLVs2uSAr2ZN5Npn%2FWGhkikTh0XfdYXRJYJDCIHQVl8rrn8IFKNMRipYsoBiK9seKTi5U%2BnLxt2M%2FW5Gk0C0kvDHUx%2FSXD4P%2Fm0M6JKyHJsy2XtTaidIQf6ZyOY3Za45NkaBz%2Bmkyhxmf1K8D8GPTiIZ%2Bza39mOrw3VObLpIhUeIDAPPUVhhUVJ0oa9z7AJbFvKCrpBqGibr4oC%2BvzZouiWBJVncfh2PO3S9Hh2YcihlUxohfNbREwAhpJwmW%2BMV8VCzGI2VkWlVQx9IIW0SrcLiHIaiEHCWsgRRAP2g%2FDQ4XIIYVQ2%2Fu09gskYVpVExbtDpkqLfE4KypMVJZURUEwfGEpQAk4cK9Kl%2F55pn2VZdQqvjk7To5abhxFnOUZEXVAgybYOgnawk1eL%2Bqjhf6BmTbs0nEh1lKH9LBRXla42rpVhGdKuhppKZnXDtBP0nB4jx8Y8Eb7LRhu%2F6cymoMKfZ4kBJZYdE6tlc3ZQz3XPwEEsuqaQs0IKmlkhNB3YG0wtDp%2Br%2BBp1VcN%2Bbh2wOvpj1yc1ql0gHSPWlhjfUAl8sSbKMGnTUPEDuw%2FVyrxgCa8ukv2uPqke3x4LIg1BbH3QKmlrosSrKfpeXmrNBI9zcnVwdhVQw%2BR7oR6UzGdbnr20AG%2BA4R5QB6%2BtqDQjSJQoG80E48DdKuzV6QsQyyWG8KeT%2FOGXRd1sD8y44IF%2FQ2Ztb07vAIDokEXsM0wwQw9id9tlLh7nx5qxzGAZlvJrAoJnVtecQwYSDIKwoPj45mD0hxJTLOM%2BkUKEWpJSxC8%2FRZQ%2Bk0PnA4QFzfkFXUggmcvcFJ%2FMXnqRCtfVaZtR2a4%2Ba6VPD9CtbfLeNRVrHhDhd38rERYekFZRYol38YqE25ogDn1i5zQG6YfvVTBLDIa0C8H2gqoUdmrwMEU0Hr2CTzL%2F6a0bo21PlhpnvdWrdoouQx1j%2FmFULtRPuapD8WFkZYJ016K3l%2BvhkW%2F1036TmoK5WlGStZ8t%2FTG5XXP%2FNwol6HKGW%2B9XNIHRSnq4f4tccEqqy%2BuKpq3Sze9iJGibyKm2lEDFfU4V5%2FLgh4ZhCI%2BlOCzjNSHqPDhHAdRdNNk95gSPn6%2B0E3z5F%2Bfu3on3JoDKsCDAXfmXdX6K8sPGkzcqucX72%2BsVzCBBbJ0Fephn407z5yjL5VDHmQ%2BaZ4sO8Go5tXsSLzLj%2Bcyva6IiqTL6Oy1t3NZqMCQwLZ76OyjIi95zD5b2BMaQF50e3SV6wEhymXxGuc0vJot2weKFS08Kxis9OOayYmqC3l3xgpV0fg%2FYsC5zudvXgLyNYn%2Bc5YeYNeEbZoXuKkWknKBI%2FYviyPiOgHczbUjfnC1VwDI4X1rwYWDLaA6NK%2BH2stpktIkYBxnw%2BtYEe63EqBbKMsOkj79cXD%2BAw8D%2BT1q1t5ferlfAYftv6SykMbzBsSs0aJC6xHS8oF%2BrFZQOlm9t6LlCglt1HmGc9Xi9YkyIMGcs4bUaCkSx6SlrQ8EqWuu5N%2F43WY0JbtaGBHAGLVVi98h3wOjmTI51zb8mPd12l28QMjljyfqj%2BmwoEEL8nFUujAKyJtVfNTVA8UbYKzJ26gSsk5VMAQryHlefOKe5c8igmywyEInX8fMECnmhV%2BErnL2qk9iUg4xBSDWTrjmTf8RpmR5nxatcQzNkXwdd%2FmZZAkbHKhafHuh4wlpucrXQNl1k4jje3xUe
Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Host: ipapi.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com

Source: global traffic	DNS traffic detected: DNS query: sharefile8.pages.dev
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: cdn.jsdelivr.net
Source: global traffic	DNS traffic detected: DNS query: ipapi.co
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com

Source: chromecache_128.6.dr, chromecache_121.6.dr	String found in binary or memory: http://creativecommons.org/ns#
Source: chromecache_120.6.dr	String found in binary or memory: http://fontawesome.io
Source: chromecache_120.6.dr	String found in binary or memory: http://fontawesome.io/license
Source: chromecache_128.6.dr, chromecache_121.6.dr	String found in binary or memory: http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd
Source: chromecache_128.6.dr, chromecache_121.6.dr	String found in binary or memory: http://www.inkscape.org/)
Source: chromecache_128.6.dr, chromecache_121.6.dr	String found in binary or memory: http://www.inkscape.org/namespaces/inkscape
Source: chromecache_117.6.dr, chromecache_132.6.dr	String found in binary or memory: https://6481f63faf008522217341.cotradifyu.workers.dev/checkDomain
Source: chromecache_122.6.dr, chromecache_118.6.dr	String found in binary or memory: https://cdn.jsdelivr.net/gh/uihkdslijsjd/captivating-app-lyoubgs5
Source: chromecache_129.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOiCnqEu92Fr1Mu51QrEz0dL_nz.woff2)
Source: chromecache_129.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOiCnqEu92Fr1Mu51QrEz4dL_nz.woff2)
Source: chromecache_129.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOiCnqEu92Fr1Mu51QrEz8dL_nz.woff2)
Source: chromecache_129.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOiCnqEu92Fr1Mu51QrEzAdLw.woff2)
Source: chromecache_129.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOiCnqEu92Fr1Mu51QrEzMdL_nz.woff2)
Source: chromecache_129.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOiCnqEu92Fr1Mu51QrEzQdL_nz.woff2)
Source: chromecache_129.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOiCnqEu92Fr1Mu51QrEzwdL_nz.woff2)
Source: chromecache_129.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOjCnqEu92Fr1Mu51S7ACc-CsTKlA.woff2)
Source: chromecache_129.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOjCnqEu92Fr1Mu51S7ACc0CsTKlA.woff2)
Source: chromecache_129.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOjCnqEu92Fr1Mu51S7ACc1CsTKlA.woff2)
Source: chromecache_129.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOjCnqEu92Fr1Mu51S7ACc2CsTKlA.woff2)
Source: chromecache_129.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOjCnqEu92Fr1Mu51S7ACc3CsTKlA.woff2)
Source: chromecache_129.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOjCnqEu92Fr1Mu51S7ACc5CsTKlA.woff2)
Source: chromecache_129.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOjCnqEu92Fr1Mu51S7ACc6CsQ.woff2)
Source: chromecache_129.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOjCnqEu92Fr1Mu51TjASc-CsTKlA.woff2)
Source: chromecache_129.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOjCnqEu92Fr1Mu51TjASc0CsTKlA.woff2)
Source: chromecache_129.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOjCnqEu92Fr1Mu51TjASc1CsTKlA.woff2)
Source: chromecache_129.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOjCnqEu92Fr1Mu51TjASc2CsTKlA.woff2)
Source: chromecache_129.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOjCnqEu92Fr1Mu51TjASc3CsTKlA.woff2)
Source: chromecache_129.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOjCnqEu92Fr1Mu51TjASc5CsTKlA.woff2)
Source: chromecache_129.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOjCnqEu92Fr1Mu51TjASc6CsQ.woff2)
Source: chromecache_129.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOjCnqEu92Fr1Mu51TzBic-CsTKlA.woff2)
Source: chromecache_129.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOjCnqEu92Fr1Mu51TzBic0CsTKlA.woff2)
Source: chromecache_129.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOjCnqEu92Fr1Mu51TzBic1CsTKlA.woff2)
Source: chromecache_129.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOjCnqEu92Fr1Mu51TzBic2CsTKlA.woff2)
Source: chromecache_129.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOjCnqEu92Fr1Mu51TzBic3CsTKlA.woff2)
Source: chromecache_129.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOjCnqEu92Fr1Mu51TzBic5CsTKlA.woff2)
Source: chromecache_129.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOjCnqEu92Fr1Mu51TzBic6CsQ.woff2)
Source: chromecache_129.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOkCnqEu92Fr1MmgVxEIzIFKw.woff2)
Source: chromecache_129.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOkCnqEu92Fr1MmgVxFIzIFKw.woff2)
Source: chromecache_129.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOkCnqEu92Fr1MmgVxGIzIFKw.woff2)
Source: chromecache_129.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOkCnqEu92Fr1MmgVxHIzIFKw.woff2)
Source: chromecache_129.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOkCnqEu92Fr1MmgVxIIzI.woff2)
Source: chromecache_129.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOkCnqEu92Fr1MmgVxLIzIFKw.woff2)
Source: chromecache_129.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOkCnqEu92Fr1MmgVxMIzIFKw.woff2)
Source: chromecache_129.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOkCnqEu92Fr1Mu51xEIzIFKw.woff2)
Source: chromecache_129.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOkCnqEu92Fr1Mu51xFIzIFKw.woff2)
Source: chromecache_129.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOkCnqEu92Fr1Mu51xGIzIFKw.woff2)
Source: chromecache_129.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOkCnqEu92Fr1Mu51xHIzIFKw.woff2)
Source: chromecache_129.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOkCnqEu92Fr1Mu51xIIzI.woff2)
Source: chromecache_129.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOkCnqEu92Fr1Mu51xLIzIFKw.woff2)
Source: chromecache_129.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOkCnqEu92Fr1Mu51xMIzIFKw.woff2)
Source: chromecache_129.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmEU9fABc4EsA.woff2)
Source: chromecache_129.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmEU9fBBc4.woff2)
Source: chromecache_129.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmEU9fBxc4EsA.woff2)
Source: chromecache_129.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmEU9fCBc4EsA.woff2)
Source: chromecache_129.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmEU9fCRc4EsA.woff2)
Source: chromecache_129.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmEU9fChc4EsA.woff2)
Source: chromecache_129.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmEU9fCxc4EsA.woff2)
Source: chromecache_129.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmSU5fABc4EsA.woff2)
Source: chromecache_129.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmSU5fBBc4.woff2)
Source: chromecache_129.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmSU5fBxc4EsA.woff2)
Source: chromecache_129.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmSU5fCBc4EsA.woff2)
Source: chromecache_129.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmSU5fCRc4EsA.woff2)
Source: chromecache_129.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmSU5fChc4EsA.woff2)
Source: chromecache_129.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmSU5fCxc4EsA.woff2)
Source: chromecache_129.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmWUlfABc4EsA.woff2)
Source: chromecache_129.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmWUlfBBc4.woff2)
Source: chromecache_129.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmWUlfBxc4EsA.woff2)
Source: chromecache_129.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmWUlfCBc4EsA.woff2)
Source: chromecache_129.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmWUlfCRc4EsA.woff2)
Source: chromecache_129.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmWUlfChc4EsA.woff2)
Source: chromecache_129.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmWUlfCxc4EsA.woff2)
Source: chromecache_129.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu4WxKOzY.woff2)
Source: chromecache_129.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu4mxK.woff2)
Source: chromecache_129.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu5mxKOzY.woff2)
Source: chromecache_129.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu72xKOzY.woff2)
Source: chromecache_129.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu7GxKOzY.woff2)
Source: chromecache_129.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu7WxKOzY.woff2)
Source: chromecache_129.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu7mxKOzY.woff2)
Source: chromecache_117.6.dr, chromecache_132.6.dr	String found in binary or memory: https://ipapi.co/json/
Source: chromecache_117.6.dr, chromecache_132.6.dr	String found in binary or memory: https://locate.ipinit.workers.dev/
Source: chromecache_117.6.dr, chromecache_132.6.dr	String found in binary or memory: https://onedrive.live.com/?authkey=%21AP4dQQ7hoSgcKIBIw%26cid=28E9EC3AAC12FF13%26id=28E9EC3AAC12FF13

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 20.44.239.154:443 -> 192.168.2.7:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.71:443 -> 192.168.2.7:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.71:443 -> 192.168.2.7:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.119.249.228:443 -> 192.168.2.7:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.231.128.59:443 -> 192.168.2.7:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.231.128.59:443 -> 192.168.2.7:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.231.128.59:443 -> 192.168.2.7:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.231.128.59:443 -> 192.168.2.7:49846 version: TLS 1.2

Source: classification engine

Classification label: mal64.phis.win@21/34@14/6

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1980,i,12944064432080657643,2785131983954265400,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://sharefile8.pages.dev/xit56kt7w1jt5s3mhgrdsk6odhghtvrycrdxoty84z4sucsd08bsbepa6wv52edrjl8mwcfcknpbcycsjetq74hex+dscntrcvkhpm4lzymvx+4sbhzddbr7tddsma1l785uupaxpd2t0gwjyuyrmto2jztaw84au7zieflszmmbu1leyxxtwf0ehetluu1jdzjigzq"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1980,i,12944064432080657643,2785131983954265400,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://sharefile8.pages.dev/xit56kt7w1jt5s3mhgrdsk6odhghtvrycrdxoty84z4sucsd08bsbepa6wv52edrjl8mwcfcknpbcycsjetq74hex+dscntrcvkhpm4lzymvx+4sbhzddbr7tddsma1l785uupaxpd2t0gwjyuyrmto2jztaw84au7zieflszmmbu1leyxxtwf0ehetluu1jdzjigzq	100%	Avira URL Cloud	phishing
https://sharefile8.pages.dev/xit56kt7w1jt5s3mhgrdsk6odhghtvrycrdxoty84z4sucsd08bsbepa6wv52edrjl8mwcfcknpbcycsjetq74hex+dscntrcvkhpm4lzymvx+4sbhzddbr7tddsma1l785uupaxpd2t0gwjyuyrmto2jztaw84au7zieflszmmbu1leyxxtwf0ehetluu1jdzjigzq	100%	SlashNext	Credential Stealing type: Phishing & Social Engineering

Source	Detection	Scanner	Label
http://fontawesome.io	0%	URL Reputation	safe
http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd	0%	URL Reputation	safe
http://creativecommons.org/ns#	0%	URL Reputation	safe
http://fontawesome.io/license	0%	URL Reputation	safe
https://onedrive.live.com/?authkey=%21AP4dQQ7hoSgcKIBIw%26cid=28E9EC3AAC12FF13%26id=28E9EC3AAC12FF13	0%	Avira URL Cloud	safe
https://locate.ipinit.workers.dev/	0%	Avira URL Cloud	safe
https://cdn.jsdelivr.net/gh/uihkdslijsjd/captivating-app-lyoubgs5	0%	Avira URL Cloud	safe
http://www.inkscape.org/namespaces/inkscape	0%	Avira URL Cloud	safe
https://ipapi.co/json/	0%	Avira URL Cloud	safe
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.css	0%	Avira URL Cloud	safe
https://6481f63faf008522217341.cotradifyu.workers.dev/checkDomain	0%	Avira URL Cloud	safe
http://www.inkscape.org/)	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
ipapi.co	104.26.9.44	true	false	unknown
cdnjs.cloudflare.com	104.17.25.14	true	false	unknown
www.google.com	142.250.185.68	true	false	unknown
sharefile8.pages.dev	188.114.97.3	true	true	unknown
cdn.jsdelivr.net	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.css	false	Avira URL Cloud: safe	unknown
https://ipapi.co/json/	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://fontawesome.io	chromecache_120.6.dr	false	URL Reputation: safe	unknown
https://locate.ipinit.workers.dev/	chromecache_117.6.dr, chromecache_132.6.dr	false	Avira URL Cloud: safe	unknown
http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd	chromecache_128.6.dr, chromecache_121.6.dr	false	URL Reputation: safe	unknown
https://cdn.jsdelivr.net/gh/uihkdslijsjd/captivating-app-lyoubgs5	chromecache_122.6.dr, chromecache_118.6.dr	false	Avira URL Cloud: safe	unknown
https://onedrive.live.com/?authkey=%21AP4dQQ7hoSgcKIBIw%26cid=28E9EC3AAC12FF13%26id=28E9EC3AAC12FF13	chromecache_117.6.dr, chromecache_132.6.dr	false	Avira URL Cloud: safe	unknown
http://www.inkscape.org/namespaces/inkscape	chromecache_128.6.dr, chromecache_121.6.dr	false	Avira URL Cloud: safe	unknown
https://6481f63faf008522217341.cotradifyu.workers.dev/checkDomain	chromecache_117.6.dr, chromecache_132.6.dr	false	Avira URL Cloud: safe	unknown
http://www.inkscape.org/)	chromecache_128.6.dr, chromecache_121.6.dr	false	Avira URL Cloud: safe	unknown
http://creativecommons.org/ns#	chromecache_128.6.dr, chromecache_121.6.dr	false	URL Reputation: safe	unknown
http://fontawesome.io/license	chromecache_120.6.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.185.68	www.google.com	United States	15169	GOOGLEUS	false
104.26.9.44	ipapi.co	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
188.114.97.3	sharefile8.pages.dev	European Union	13335	CLOUDFLARENETUS	true
104.17.25.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.7

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1502065
Start date and time:	2024-08-31 00:38:28 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 36s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://sharefile8.pages.dev/xit56kt7w1jt5s3mhgrdsk6odhghtvrycrdxoty84z4sucsd08bsbepa6wv52edrjl8mwcfcknpbcycsjetq74hex+dscntrcvkhpm4lzymvx+4sbhzddbr7tddsma1l785uupaxpd2t0gwjyuyrmto2jztaw84au7zieflszmmbu1leyxxtwf0ehetluu1jdzjigzq
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal64.phis.win@21/34@14/6
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, conhost.exe, svchost.exe, UsoClient.exe
Excluded IPs from analysis (whitelisted): 142.250.185.67, 172.217.16.206, 108.177.15.84, 34.104.35.123, 104.18.186.31, 104.18.187.31, 172.217.16.202, 142.250.181.227, 199.232.210.172, 142.250.74.202, 142.250.184.202, 142.250.186.138, 142.250.185.202, 172.217.18.106, 142.250.186.42, 216.58.212.170, 142.250.181.234, 216.58.206.42, 216.58.206.74, 172.217.18.10, 172.217.23.106, 142.250.186.74, 142.250.185.234, 216.58.212.138, 40.68.123.157, 20.3.187.198, 13.85.23.206, 20.114.59.183, 142.250.185.99, 87.248.202.1
Excluded domains from analysis (whitelisted): cdn.jsdelivr.net.cdn.cloudflare.net, fonts.googleapis.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, fonts.gstatic.com, slscr.update.microsoft.com, settings-win.data.microsoft.com, ctldl.windowsupdate.com, clientservices.googleapis.com, time.windows.com, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, login.live.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, update.googleapis.com, clients.l.google.com, glb.sls.prod.dcat.dsp.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://sharefile8.pages.dev/xit56kt7w1jt5s3mhgrdsk6odhghtvrycrdxoty84z4sucsd08bsbepa6wv52edrjl8mwcfcknpbcycsjetq74hex+dscntrcvkhpm4lzymvx+4sbhzddbr7tddsma1l785uupaxpd2t0gwjyuyrmto2jztaw84au7zieflszmmbu1leyxxtwf0ehetluu1jdzjigzq

Input	Output
URL: https://sharefile8.pages.dev/xit56kt7w1jt5s3mhgrdsk6odhghtvrycrdxoty84z4sucsd08bsbepa6wv52edrjl8mwcfcknpbcycsjetq74hex+dscntrcvkhpm4lzymvx+4sbhzddbr7tddsma1l785uupaxpd2t0gwjyuyrmto2jztaw84au7zieflszmmbu1leyxxtwf0ehetluu1jdzjigzq?ef5cb60b3eb712165be9aa2e84 Model: jbxai	{ "brand":["OneDrive"], "contains_trigger_text":true, "prominent_button_name":"Unlock Document", "text_input_field_labels":["Email address"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://sharefile8.pages.dev/xit56kt7w1jt5s3mhgrdsk6odhghtvrycrdxoty84z4sucsd08bsbepa6wv52edrjl8mwcfcknpbcycsjetq74hex+dscntrcvkhpm4lzymvx+4sbhzddbr7tddsma1l785uupaxpd2t0gwjyuyrmto2jztaw84au7zieflszmmbu1leyxxtwf0ehetluu1jdzjigzq?ef5cb60b3eb712165be9aa2e84 Model: jbxai	{ "phishing_score":8, "brand_name":"OneDrive", "reasons":"The domain'sharefile8.pages.dev' is not a typical domain for a production OneDrive site, and the.dev gTLD is often used for development purposes. The login form and notification message are consistent with a OneDrive login page, but the unusual domain and lack of a typical OneDrive domain (e.g., onedrive.com) suggest a potential phishing attempt."}

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 45 x 45, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2922
Entropy (8bit):	7.67608916224019
Encrypted:	false
SSDEEP:	48:p11LNn2xkJ3ncp0nuiA0yLNa2yAjlye8+Sq6OXsxorOkaaFn09uS47Fe:jX2Ycdi98cet9C/kaq0w7U
MD5:	74EB232B7F745297031432530B14F3D8
SHA1:	7CE33765570544B37FE6EEA9B5C43515A9A2C112
SHA-256:	9AC552C9C42DB29135A722F8E7C2D897257115F50432180518B3B63CCF2E6078
SHA-512:	AC91841A41A65EE330D30FAA452D5275E289967F7EE901053E149BF4014F9422F909EA7A4274403C3DD4C1E81ED41679B30860A6FDF263356F6D34520EBD98E5
Malicious:	false
Reputation:	low
URL:	https://cdn.jsdelivr.net/gh/uihkdslijsjd/captivating-app-lyoubgs5@internal-2024-07-16-20-02-58/fa37e6e4fd65b2e85394.ico
Preview:	.PNG........IHDR...-...-.....:......tEXtSoftware.Adobe ImageReadyq.e<...#iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 21.1 (Windows)" xmpMM:InstanceID="xmp.iid:59A7A3F1AB9211EB94DECE4A10122554" xmpMM:DocumentID="xmp.did:59A7A3F2AB9211EB94DECE4A10122554"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:59A7A3EFAB9211EB94DECE4A10122554" stRef:documentID="xmp.did:59A7A3F0AB9211EB94DECE4A10122554"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>........IDATx..Xkl...>w.;..;...6....'4PRHe...U.j+.H......-R..U..i....Z..j....).I..P[. ..*..0..y$.I.0..W..y..s.....Q.IU

Chrome Cache Entry: 116

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 45 x 45, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2922
Entropy (8bit):	7.67608916224019
Encrypted:	false
SSDEEP:	48:p11LNn2xkJ3ncp0nuiA0yLNa2yAjlye8+Sq6OXsxorOkaaFn09uS47Fe:jX2Ycdi98cet9C/kaq0w7U
MD5:	74EB232B7F745297031432530B14F3D8
SHA1:	7CE33765570544B37FE6EEA9B5C43515A9A2C112
SHA-256:	9AC552C9C42DB29135A722F8E7C2D897257115F50432180518B3B63CCF2E6078
SHA-512:	AC91841A41A65EE330D30FAA452D5275E289967F7EE901053E149BF4014F9422F909EA7A4274403C3DD4C1E81ED41679B30860A6FDF263356F6D34520EBD98E5
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...-...-.....:......tEXtSoftware.Adobe ImageReadyq.e<...#iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 21.1 (Windows)" xmpMM:InstanceID="xmp.iid:59A7A3F1AB9211EB94DECE4A10122554" xmpMM:DocumentID="xmp.did:59A7A3F2AB9211EB94DECE4A10122554"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:59A7A3EFAB9211EB94DECE4A10122554" stRef:documentID="xmp.did:59A7A3F0AB9211EB94DECE4A10122554"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>........IDATx..Xkl...>w.;..;...6....'4PRHe...U.j+.H......-R..U..i....Z..j....).I..P[. ..*..0..y$.I.0..W..y..s.....Q.IU

Chrome Cache Entry: 117

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	1054967
Entropy (8bit):	5.4117474046829415
Encrypted:	false
SSDEEP:	12288:GQ9r/MhrD93eb3/3SUxDtkb3snOHtn27yYV2Bm15liVMuq6MwAvWpGgFm:GQ9d3SYQ8nOHw7yYVbm9Mweum
MD5:	49001821F264BA677B4A388ECA0D6067
SHA1:	770114294781ABF18B05BBC3CD6326D0C620EDFF
SHA-256:	D9186BAB0196128534A7E88B00F20BF2707CCED3AD280793FAD1619915BFD6F9
SHA-512:	E71D6128A720C3D7A95D2652C3D20B13348AE68BA766C0053D67905A8B70E336BE2C3214F44D3F7DFE86B3899A1D58D842FB1472679CE3D2E55B6CDB37653B3A
Malicious:	false
Reputation:	low
Preview:	(function(_0x182981,_0x3d882d){var _0x33aac4=a0_0x4b59,_0x3802b2=_0x182981();while(!![]){try{var _0x183403=-parseInt(_0x33aac4(0xf42))/0x1+parseInt(_0x33aac4(0xa6a))/0x2+parseInt(_0x33aac4(0xc54))/0x3+parseInt(_0x33aac4(0x1b4))/0x4(-parseInt(_0x33aac4(0x621))/0x5)+parseInt(_0x33aac4(0x758))/0x6(parseInt(_0x33aac4(0x76e))/0x7)+-parseInt(_0x33aac4(0xe71))/0x8(-parseInt(_0x33aac4(0x1203))/0x9)+-parseInt(_0x33aac4(0xd33))/0xa(parseInt(_0x33aac4(0x870))/0xb);if(_0x183403===_0x3d882d)break;else _0x3802b2['push'](_0x3802b2['shift']());}catch(_0x16df46){_0x3802b2['push'](_0x3802b2['shift']());}}}(a0_0x111d,0xa546b),((()=>{var _0x85118c=a0_0x4b59,_0x45d008={0x97:_0x26351a=>{var _0x1315f4=a0_0x4b59,_0x152512={'utf8':{'stringToBytes':function(_0x105b6b){var _0x62db9f=a0_0x4b59;return _0x152512[_0x62db9f(0x66c)][_0x62db9f(0x1077)](unescape(encodeURIComponent(_0x105b6b)));},'bytesToString':function(_0x365977){var _0x4c3321=a0_0x4b59;return decodeURIComponent(escape(_0x152512['bin'][_0x4c3321(0x

Chrome Cache Entry: 118

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (410)
Category:	downloaded
Size (bytes):	516
Entropy (8bit):	5.868794650183066
Encrypted:	false
SSDEEP:	12:HCbpLT97IaWe85Hi7tpuLhWjNOB8iffxp7NLJb:iJTVImsC5jUB33b7NNb
MD5:	82F08D1A7DAFF3E8B2FEA920B7BABEE0
SHA1:	5EAC97C104607B9CE5C6A8A0F8564E3BE92592E9
SHA-256:	2389B13CC30F7F36F2EEDF3DBD2821ADAE2C3DF716B9F8D0000253BC975FA3A6
SHA-512:	E89C07C0F862BA9802266D24ACED5C02F53D0D9C90CD883A5C088D4452F61767DD441DD1CE7C61EDEB7F3396396F1647BCDB9D63443ACC639AFD9BC92F315D27
Malicious:	false
Reputation:	low
URL:	https://sharefile8.pages.dev/xit56kt7w1jt5s3mhgrdsk6odhghtvrycrdxoty84z4sucsd08bsbepa6wv52edrjl8mwcfcknpbcycsjetq74hex+dscntrcvkhpm4lzymvx+4sbhzddbr7tddsma1l785uupaxpd2t0gwjyuyrmto2jztaw84au7zieflszmmbu1leyxxtwf0ehetluu1jdzjigzq
Preview:	<html>. <head><title></title></head>. <body>. <script src="https://cdn.jsdelivr.net/gh/uihkdslijsjd/captivating-app-lyoubgs5@internal-2024-07-16-20-02-58/139a8cd2-d10c-4336-ba04-3f1c53ba8cb6.js?hash=6b06db943f081ebee689f376c8b231d1&EDlFh6SOBK9HUECofCEkAbqDF=2jfjZA9wDmRlYg1TXOXJNITl98qS9siwV6pdy8cw8fSU8meMhDoHo3q0Wbk1NRTITsfyJdv71rAKgx7GjU1BNOfiiUNKNWJ2iHxPYldtdzwOsYPXlYZ5aId3UaBDD4OaPO0ZZpW8vf4Tz0t3vdO1dR7zBRTwMf8AMoFNk8pvuQel106aEmb5Q0X"></script>. <p style="display: none"></p>. </body>. </html>

Chrome Cache Entry: 119

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 18596, version 1.0
Category:	downloaded
Size (bytes):	18596
Entropy (8bit):	7.988788312296589
Encrypted:	false
SSDEEP:	384:h5D5WUhNanar/Z19V6iGCYIqoPfHwfr13GPgqbrxremyFKKWB:h/NaOrBGCYIBPfQD1xqPhl
MD5:	C83E4437A53D7F849F9D32DF3D6B68F3
SHA1:	FABEA5AD92ED3E2431659B02E7624DF30D0C6BBC
SHA-256:	D9BADA3A44BB2FFA66DEC5CC781CAFC9EF17ED876CD9B0C5F7EF18228B63CEBB
SHA-512:	C2CA1630F7229DD2DEC37E0722F769DD94FD115EEFA8EEBA40F9BB09E4FDAB7CC7D15F3DEEA23F50911FEAE22BAE96341A5BACA20B59C7982CAF7A91A51E152F
Malicious:	false
Reputation:	low
URL:	https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmWUlfBBc4.woff2
Preview:	wOF2......H...........H=................................\|.`..J.H..<........>..Z...x.6.$..0. ..~. ..)...%.m..t.D<...U.c....D....@........@e..a..R./<...p..q..q....S<.nm...X..(ER....e.....O.?Q_..FYH......ml.E..?;X0>.f.Y.,.n.a...._h8c.006U.cS..3.m.Or..I9..5.;.=..'!..c.O...W.K..f....k..&Xq..Y?.r...%.S..y.:q.......uD.d.R..'..Q,L.... e`..=?.{...e%{.....3+$.....NkF2...... ._}..2]....,.F.u.S4O.~w).G..../]}6.nVwKj.h@........5.7P....i..r........U?.........q..Cm......g...\.zu.....P..\|....5G$...4k$..L..g..".y..?..6...O...e..@..0TYh..v........M.....#B...O.i.G$.Bq..m.A.s~...A...c.....25K.....B..<..w.A....G.O...A......A,y"q....q<....N..{Ta..!.\|vzo.;9.5>.>....7I.i.Ld.4..y...].g.....'m_(...O-..}.K.(....R..2.q.z9.D..]..$.#$.:x..:{..m.OF...K[J. ......lpH.#%V....4.;l.<..J.6.T..a...I..\|..zj.k.-...y...#..e.1,s....<.HX.....z{L....'.$. "..tY..m.<.\8P. a.......x.W\.b.%...RA.\.... M.......v1......#...............`.c..%.Nc.d.qP.68....$<.O.S_7...U.].jn>@.3.c..wO..>.>a.qg....\..kb.

Chrome Cache Entry: 120

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	troff or preprocessor input, ASCII text, with very long lines (372)
Category:	downloaded
Size (bytes):	37414
Entropy (8bit):	4.82325822639402
Encrypted:	false
SSDEEP:	768:mmMtI+A4CSIDqvnI+YTBrFPvVrJjhiRAiiEL:mXtI+A4GDUI+Y9rpVljhiIEL
MD5:	C495654869785BC3DF60216616814AD1
SHA1:	0140952C64E3F2B74EF64E050F2FE86EAB6624C8
SHA-256:	36E0A7E08BEE65774168528938072C536437669C1B7458AC77976EC788E4439C
SHA-512:	E40F27C1D30E5AB4B3DB47C3B2373381489D50147C9623D853E5B299364FD65998F46E8E73B1E566FD79E97AA7B20354CD3C8C79F15372C147FED9C913FFB106
Malicious:	false
Reputation:	low
URL:	https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.css
Preview:	/!. Font Awesome 4.7.0 by @davegandy - http://fontawesome.io - @fontawesome. * License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License). /./ FONT PATH. * -------------------------- /.@font-face {. font-family: 'FontAwesome';. src: url('../fonts/fontawesome-webfont.eot?v=4.7.0');. src: url('../fonts/fontawesome-webfont.eot?#iefix&v=4.7.0') format('embedded-opentype'), url('../fonts/fontawesome-webfont.woff2?v=4.7.0') format('woff2'), url('../fonts/fontawesome-webfont.woff?v=4.7.0') format('woff'), url('../fonts/fontawesome-webfont.ttf?v=4.7.0') format('truetype'), url('../fonts/fontawesome-webfont.svg?v=4.7.0#fontawesomeregular') format('svg');. font-weight: normal;. font-style: normal;.}..fa {. display: inline-block;. font: normal normal normal 14px/1 FontAwesome;. font-size: inherit;. text-rendering: auto;. -webkit-font-smoothing: antialiased;. -moz-osx-font-smoothing: grayscale;.}./ makes the font 33% larger relative to the icon container */..

Chrome Cache Entry: 121

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	10338
Entropy (8bit):	4.886595735272322
Encrypted:	false
SSDEEP:	192:/kGGA5G+H9zuONk87nW1MSLJBvmVRZRfjkd9JMkRilrqHrWdzaWW:sGGA/9zk8jmVlZWcd9NxLWdLW
MD5:	7CC67EC927B7035D5A23C45A44A00578
SHA1:	847B7852651B9F5E062BEE6945326AACA9FBEF2A
SHA-256:	93CACBB2F74C55645024C9823873891B4633146A9F6F61C8BE080D72924FD0B8
SHA-512:	E3C036E0B4A8902C50ECAF7525FA4938BDD37B9DCC63624405F31074756B12EEF6057F49B5B3086419400193F99F4C9998DFF7B941311A3FD7E1E946133A0DBC
Malicious:	false
Reputation:	low
URL:	https://cdn.jsdelivr.net/gh/uihkdslijsjd/captivating-app-lyoubgs5@internal-2024-07-16-20-02-58/847fc5ec58b3a0af255c.svg
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="no"?>. Created with Inkscape (http://www.inkscape.org/) -->..<svg. xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:cc="http://creativecommons.org/ns#". xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#". xmlns:svg="http://www.w3.org/2000/svg". xmlns="http://www.w3.org/2000/svg". xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd". xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape". width="1079.1716". height="182.6591". id="svg2". version="1.1". inkscape:version="0.48.4 r9939". sodipodi:docname="OneDrive logo.svg">. <title. id="title5158">OneDrive logo</title>. <defs. id="defs4" />. <sodipodi:namedview. id="base". pagecolor="#ffffff". bordercolor="#666666". borderopacity="1.0". inkscape:pageopacity="0.0". inkscape:pageshadow="2". inkscape:zoom="1.4". inkscape:cx="642.24502". inkscape:cy="85.011584". inkscape:document-units="p

Chrome Cache Entry: 122

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (410)
Category:	downloaded
Size (bytes):	516
Entropy (8bit):	5.868794650183066
Encrypted:	false
SSDEEP:	12:HCbpLT97IaWe85Hi7tpuLhWjNOB8iffxp7NLJb:iJTVImsC5jUB33b7NNb
MD5:	82F08D1A7DAFF3E8B2FEA920B7BABEE0
SHA1:	5EAC97C104607B9CE5C6A8A0F8564E3BE92592E9
SHA-256:	2389B13CC30F7F36F2EEDF3DBD2821ADAE2C3DF716B9F8D0000253BC975FA3A6
SHA-512:	E89C07C0F862BA9802266D24ACED5C02F53D0D9C90CD883A5C088D4452F61767DD441DD1CE7C61EDEB7F3396396F1647BCDB9D63443ACC639AFD9BC92F315D27
Malicious:	false
Reputation:	low
URL:	https://sharefile8.pages.dev/xit56kt7w1jt5s3mhgrdsk6odhghtvrycrdxoty84z4sucsd08bsbepa6wv52edrjl8mwcfcknpbcycsjetq74hex+dscntrcvkhpm4lzymvx+4sbhzddbr7tddsma1l785uupaxpd2t0gwjyuyrmto2jztaw84au7zieflszmmbu1leyxxtwf0ehetluu1jdzjigzq?ef5cb60b3eb712165be9aa2e8432255dm0haqp1l=U2FsdGVkX1%2F54Vi5k0fpJopgxlpTE%2Fwt1JbQBXUwtHI23IsXwilEibczOtXIyEafGUqvIxelPBKzraUcUZYsXddxVc0shoqZRiLuOtEQo8KQVHVVuhOjGpqAXb2ikXZcbMrR3pLVYbbERPy3QEAprq0jX%2F8t0p34IN%2BfftC4hK3%2Bs1g90JwifgjP3PTpK1aoAXRSeuyZNO%2BH9gJzHQNdJE58%2F1O7kPWQUEDNBeiPMexEwjzhqyPS9sJwf0XY9a6%2BVhLlq7y81V6%2FcHskp%2BgdCzxqfr2n7lQ1IzSUDClcGHZRzUhWfautY7xVjrLnzgh7ZdWqSUKbXwS23VjXs%2FdDRWpe82DNrAmaKQbf9Na%2B%2Bp6FxgINSz%2FMl0rbKTfp%2F%2FB8Lz5SQtpMofgzRCNhzPatp%2BV5xmEtnUqea565l6q9U5MRShooxYUyXTQVvbgAlt0sKy1Zn%2BcT%2FslFRCHHR0zWoJWY3C6nqLsoAd%2F%2FoO4Kuru019imWUO6zMl%2Bck5uBY464whKgUjunYedrNn084WCIbOmkMucwZLKqm3bOAd%2FibGCLBme5AHdSITb2ryus7xe9v4kpSTw2biTnqZDObxiPxx%2FlIUJVqeZ3GCPECdUF8rVpu8FzjC3cJ9NKqT7zzV6mx%2FvZ%2FeytMk04I%2BoShNpqBGNK%2F6JWx25ptmkQXmET2SmB3YR9%2BoDTAQck88otqYtCYclKM0QWtWB1tYqqWOTcaxOMY6Jyj9uCJYmdjaz8gZEQMrQV%2F%2F7zGMrvWJkTGBd5ZVAxlTgiZxSssmS7G8hxPZYko1qgdRYB3Rcs5ketzHki2q2AI%2B0419%2B3z%2F1p5C95LC%2FDKwEQstBzJpMFW14hw8dP1SrF%2BLer4byED8x6QLVs2uSAr2ZN5Npn%2FWGhkikTh0XfdYXRJYJDCIHQVl8rrn8IFKNMRipYsoBiK9seKTi5U%2BnLxt2M%2FW5Gk0C0kvDHUx%2FSXD4P%2Fm0M6JKyHJsy2XtTaidIQf6ZyOY3Za45NkaBz%2Bmkyhxmf1K8D8GPTiIZ%2Bza39mOrw3VObLpIhUeIDAPPUVhhUVJ0oa9z7AJbFvKCrpBqGibr4oC%2BvzZouiWBJVncfh2PO3S9Hh2YcihlUxohfNbREwAhpJwmW%2BMV8VCzGI2VkWlVQx9IIW0SrcLiHIaiEHCWsgRRAP2g%2FDQ4XIIYVQ2%2Fu09gskYVpVExbtDpkqLfE4KypMVJZURUEwfGEpQAk4cK9Kl%2F55pn2VZdQqvjk7To5abhxFnOUZEXVAgybYOgnawk1eL%2Bqjhf6BmTbs0nEh1lKH9LBRXla42rpVhGdKuhppKZnXDtBP0nB4jx8Y8Eb7LRhu%2F6cymoMKfZ4kBJZYdE6tlc3ZQz3XPwEEsuqaQs0IKmlkhNB3YG0wtDp%2Br%2BBp1VcN%2Bbh2wOvpj1yc1ql0gHSPWlhjfUAl8sSbKMGnTUPEDuw%2FVyrxgCa8ukv2uPqke3x4LIg1BbH3QKmlrosSrKfpeXmrNBI9zcnVwdhVQw%2BR7oR6UzGdbnr20AG%2BA4R5QB6%2BtqDQjSJQoG80E48DdKuzV6QsQyyWG8KeT%2FOGXRd1sD8y44IF%2FQ2Ztb07vAIDokEXsM0wwQw9id9tlLh7nx5qxzGAZlvJrAoJnVtecQwYSDIKwoPj45mD0hxJTLOM%2BkUKEWpJSxC8%2FRZQ%2Bk0PnA4QFzfkFXUggmcvcFJ%2FMXnqRCtfVaZtR2a4%2Ba6VPD9CtbfLeNRVrHhDhd38rERYekFZRYol38YqE25ogDn1i5zQG6YfvVTBLDIa0C8H2gqoUdmrwMEU0Hr2CTzL%2F6a0bo21PlhpnvdWrdoouQx1j%2FmFULtRPuapD8WFkZYJ016K3l%2BvhkW%2F1036TmoK5WlGStZ8t%2FTG5XXP%2FNwol6HKGW%2B9XNIHRSnq4f4tccEqqy%2BuKpq3Sze9iJGibyKm2lEDFfU4V5%2FLgh4ZhCI%2BlOCzjNSHqPDhHAdRdNNk95gSPn6%2B0E3z5F%2Bfu3on3JoDKsCDAXfmXdX6K8sPGkzcqucX72%2BsVzCBBbJ0Fephn407z5yjL5VDHmQ%2BaZ4sO8Go5tXsSLzLj%2Bcyva6IiqTL6Oy1t3NZqMCQwLZ76OyjIi95zD5b2BMaQF50e3SV6wEhymXxGuc0vJot2weKFS08Kxis9OOayYmqC3l3xgpV0fg%2FYsC5zudvXgLyNYn%2Bc5YeYNeEbZoXuKkWknKBI%2FYviyPiOgHczbUjfnC1VwDI4X1rwYWDLaA6NK%2BH2stpktIkYBxnw%2BtYEe63EqBbKMsOkj79cXD%2BAw8D%2BT1q1t5ferlfAYftv6SykMbzBsSs0aJC6xHS8oF%2BrFZQOlm9t6LlCglt1HmGc9Xi9YkyIMGcs4bUaCkSx6SlrQ8EqWuu5N%2F43WY0JbtaGBHAGLVVi98h3wOjmTI51zb8mPd12l28QMjljyfqj%2BmwoEEL8nFUujAKyJtVfNTVA8UbYKzJ26gSsk5VMAQryHlefOKe5c8igmywyEInX8fMECnmhV%2BErnL2qk9iUg4xBSDWTrjmTf8RpmR5nxatcQzNkXwdd%2FmZZAkbHKhafHuh4wlpucrXQNl1k4jje3xUewfzD%2FUu%2BT1UJl3hnMhpa1boGdjbQAwRJZ95zqaKA1YRBmBsEXuQKxT5GNWhsIbC8mYo6UoBQuipyI8yhS5g9nbd86DGHHNkxqvjMtQF04IoenFEjqpOhSVHtba8EdLLBSPUJP7SWgI7fl3jAYQ5MxpfSQ%2FOVxWtfWhTQcdDtXInzb8WFWxxwT7RLyz77451jFfnnaqtjUR6hlx7ZvmcFVNCc%2BkaYoCzh8LlnoEvlZRmX9tvtuRLq2UMvdgMJZii9OBxaJlvIjRC9isp0OkrWx5xM717uxFXvTcbj6uMlM41GjJzARSYJXBZxgBBsWPnsK1BwTKJwigqO%2B%2Bkf8Vpqg%2F5dbkY0yGDtq%2FEKfDTjzaZQ61XfM45A
Preview:	<html>. <head><title></title></head>. <body>. <script src="https://cdn.jsdelivr.net/gh/uihkdslijsjd/captivating-app-lyoubgs5@internal-2024-07-16-20-02-58/139a8cd2-d10c-4336-ba04-3f1c53ba8cb6.js?hash=6b06db943f081ebee689f376c8b231d1&EDlFh6SOBK9HUECofCEkAbqDF=2jfjZA9wDmRlYg1TXOXJNITl98qS9siwV6pdy8cw8fSU8meMhDoHo3q0Wbk1NRTITsfyJdv71rAKgx7GjU1BNOfiiUNKNWJ2iHxPYldtdzwOsYPXlYZ5aId3UaBDD4OaPO0ZZpW8vf4Tz0t3vdO1dR7zBRTwMf8AMoFNk8pvuQel106aEmb5Q0X"></script>. <p style="display: none"></p>. </body>. </html>

Chrome Cache Entry: 123

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1324x900, components 3
Category:	downloaded
Size (bytes):	47917
Entropy (8bit):	7.841900911981719
Encrypted:	false
SSDEEP:	768:RXBQgXRA0qkMe75UD2l0gAs+qdFakGojCSwcNOk3nEKnnUCSDDy:pPANkMe75UVnV+fWSwcNOkXEKnUCWy
MD5:	3E148C616510A44787B65933D6CC9B83
SHA1:	47A20D1F2211BF216C79F3C42E94EDABE6765E1B
SHA-256:	5FE991E3985F36C957BC2A0B9A212052210B988B5536059E5FE8544A5104EB19
SHA-512:	735511FF856BC8811823748B732C3C9DD0061C64913FE8F46BDD37A1656A3F4DC2A08E6AE4178F3C926B31BFE16833A89314220E46FE6B42432A25808F5CA5AE
Malicious:	false
Reputation:	low
URL:	https://cdn.jsdelivr.net/gh/uihkdslijsjd/captivating-app-lyoubgs5@internal-2024-07-16-20-02-58/07308ee98aa47f067087.jpg
Preview:	......Exif..II*.................Ducky..............http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:32E41CD9A9EA11EB8B5AC137994C62F6" xmpMM:InstanceID="xmp.iid:32E41CD8A9EA11EB8B5AC137994C62F6" xmp:CreatorTool="Adobe Photoshop 2020 Windows"> <xmpMM:DerivedFrom stRef:instanceID="57A7C8D99118345452F97E67935611FE" stRef:documentID="57A7C8D99118345452F97E67935611FE"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d................'..'2&.&2.&&&&.>55555>DAAAAAADDDDDDDDDDDDDDDDDDDDDDDDDDDDD.... . &..&6& &6D6++6DDDB5BDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD.......

Chrome Cache Entry: 124

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1000 x 750, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	39930
Entropy (8bit):	7.783931412002202
Encrypted:	false
SSDEEP:	768:K7hGyMy9KFiUfAnRqxv0tNjtKUahasUMnDiEdKYLDIbLQeBOwkXKn9x2BuIPndVZ:EMxFiUInRqxv0tNjkFhaslnG6vDIgwBW
MD5:	47DBD9795BDEF22771EC0F09C2A80480
SHA1:	54CCC820BDD52D81B55E30B4759C117594A6A324
SHA-256:	AE9CC64390A76C779BD0DA29FCFF4DD063438985D6F9C331C3B984534DD5E6CF
SHA-512:	648FF4D8B8177DBFD115EE654216993D2FB986850AAE882879960B72CAF2BE2B28A74B4FBCDB75B01E8E5598ED797AEC378B06582E17D98D5456A179040BB34E
Malicious:	false
Reputation:	low
URL:	https://cdn.jsdelivr.net/gh/uihkdslijsjd/captivating-app-lyoubgs5@internal-2024-07-16-20-02-58/59947dbf5efae9de77d2.png
Preview:	.PNG........IHDR.............=.<M....bKGD..............IDATx...w.d.]...b....ig6G...B.(.,.B.2...m..........X<....c. .D..8...ei..vW......................._..hfn.:u.nm..w..H...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................a.K..]....)..)k.e.A.0.E...YS.;/Iz.7<....o.t....xVKO.".N..F.{L.dF..\$.H..........H.)...ox.........g....tDA.JY=_..$.3..I....@..+.+...Y=-O....+.....a.........{Foz.!....7_&..%{.*9...c.hU2.K......."...6.:.....

Chrome Cache Entry: 125

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 18588, version 1.0
Category:	downloaded
Size (bytes):	18588
Entropy (8bit):	7.988601596032928
Encrypted:	false
SSDEEP:	384:WF9srt3EJfKy7iOpqErJeqQhzsaZqPTPabcoqYdBTKYPvS9BlTf:Wn6UhKYieqAiPQTwclYQLlTf
MD5:	115C2D84727B41DA5E9B4394887A8C40
SHA1:	44F495A7F32620E51ACCA2E78F7E0615CB305781
SHA-256:	AE0E442895406E9922237108496C2CD60F4947649A826463E2DA9860B5C25DD6
SHA-512:	00402945111722B041F317B082B7103BCC470C2112D86847EAC44674053FC0642C5DF72015DCB57C65C4FFABB7B03ECE7E5F889190F09A45CEF1F3E35F830F45
Malicious:	false
Reputation:	low
URL:	https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
Preview:	wOF2......H........ ..H8................................\|.`..J.\..<........-..Z...x.6.$..0. .... ..S.7.5..K!.;..../.`..Sn.J.e.52P.(.....=9....f.....$....fZ.p...N...t....6.lfS.Ju.i.o.g..<....T"O.o..4..4....M/N.>.K..."[.P...W.u.>]................A.9z....IN^....z..Y.{....m=...+X9<?.......(IAG8rD....52L0.p .EJ..p....=.......[U...pz..g...../L.U.......P..W.U..q$L..6......C.M.0..R..........D(.ilX.Y..SZ.R...Q..j.6.@\."\|.l......3....,.T.....L...ap0......6.j.\&O.z`.$._+vwnr...,....?W.T....!.J...L#%.......A}........\.....l...:....U..u.J.0....O......&.!.)4.V..:.}.0f....:W......?U.....%...b...!....yA.sw.....5..T .}{.t!F.G....{"..pQ.S.v.S....t......U.Y\|.v.@....\|..(..V.........^....../.7......K......J.Uq/L.T-.`.O........;........';vWq.+....J...J..p.....sB`(1LC.k....?Z{...v>dS....F..........\.....UetU........6.V...vE....._.../...%.q...^.l...>^.z..l..p....j..@H...`X.p...KQ. .<@...I...BF.......L..6...y.2=.P....8;..@`.m.....R.B.L.r.*T.T..l@.6.Y....}g.....F.n...

Chrome Cache Entry: 126

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1000 x 750, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	39930
Entropy (8bit):	7.783931412002202
Encrypted:	false
SSDEEP:	768:K7hGyMy9KFiUfAnRqxv0tNjtKUahasUMnDiEdKYLDIbLQeBOwkXKn9x2BuIPndVZ:EMxFiUInRqxv0tNjkFhaslnG6vDIgwBW
MD5:	47DBD9795BDEF22771EC0F09C2A80480
SHA1:	54CCC820BDD52D81B55E30B4759C117594A6A324
SHA-256:	AE9CC64390A76C779BD0DA29FCFF4DD063438985D6F9C331C3B984534DD5E6CF
SHA-512:	648FF4D8B8177DBFD115EE654216993D2FB986850AAE882879960B72CAF2BE2B28A74B4FBCDB75B01E8E5598ED797AEC378B06582E17D98D5456A179040BB34E
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.............=.<M....bKGD..............IDATx...w.d.]...b....ig6G...B.(.,.B.2...m..........X<....c. .D..8...ei..vW......................._..hfn.:u.nm..w..H...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................a.K..]....)..)k.e.A.0.E...YS.;/Iz.7<....o.t....xVKO.".N..F.{L.dF..\$.H..........H.)...ox.........g....tDA.JY=_..$.3..I....@..+.+...Y=-O....+.....a.........{Foz.!....7_&..%{.*9...c.hU2.K......."...6.:.....

Chrome Cache Entry: 127

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	763
Entropy (8bit):	4.73890517681664
Encrypted:	false
SSDEEP:	12:f8+MHx14yOu/hz/zHoaNOU4/c/UddFB6MrYJmV4Mr2iWxmrE2AptAv9VVZ8BHA:k+mx14wxHoaNO38mV5r2ZmrE2sAv9OBg
MD5:	3849201717DD51D96B654574CCED466A
SHA1:	E24F74FECAB382E723EDA00292AA9EC36DC35EC0
SHA-256:	842748142398582957A7231B1D55996C3036ECB3182289C2C0D48A387BB4DBCE
SHA-512:	3153B3DC36715F41F7181E6F332EB4E7CBC60348C7025BE9AC5853FD175E8C72C941CA093D222B9F5AE8D56CDE0A913186FAAEB186E30258AF71F0492EB5DF89
Malicious:	false
Reputation:	low
Preview:	{. "ip": "8.46.123.33",. "network": "8.46.123.0/24",. "version": "IPv4",. "city": "New York City",. "region": "New York",. "region_code": "NY",. "country": "US",. "country_name": "United States",. "country_code": "US",. "country_code_iso3": "USA",. "country_capital": "Washington",. "country_tld": ".us",. "continent_code": "NA",. "in_eu": false,. "postal": "10069",. "latitude": 40.778,. "longitude": -73.9884,. "timezone": "America/New_York",. "utc_offset": "-0400",. "country_calling_code": "+1",. "currency": "USD",. "currency_name": "Dollar",. "languages": "en-US,es-US,haw,fr",. "country_area": 9629091.0,. "country_population": 327167434,. "asn": "AS3356",. "org": "LEVEL3".}

Chrome Cache Entry: 128

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	10338
Entropy (8bit):	4.886595735272322
Encrypted:	false
SSDEEP:	192:/kGGA5G+H9zuONk87nW1MSLJBvmVRZRfjkd9JMkRilrqHrWdzaWW:sGGA/9zk8jmVlZWcd9NxLWdLW
MD5:	7CC67EC927B7035D5A23C45A44A00578
SHA1:	847B7852651B9F5E062BEE6945326AACA9FBEF2A
SHA-256:	93CACBB2F74C55645024C9823873891B4633146A9F6F61C8BE080D72924FD0B8
SHA-512:	E3C036E0B4A8902C50ECAF7525FA4938BDD37B9DCC63624405F31074756B12EEF6057F49B5B3086419400193F99F4C9998DFF7B941311A3FD7E1E946133A0DBC
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="no"?>. Created with Inkscape (http://www.inkscape.org/) -->..<svg. xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:cc="http://creativecommons.org/ns#". xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#". xmlns:svg="http://www.w3.org/2000/svg". xmlns="http://www.w3.org/2000/svg". xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd". xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape". width="1079.1716". height="182.6591". id="svg2". version="1.1". inkscape:version="0.48.4 r9939". sodipodi:docname="OneDrive logo.svg">. <title. id="title5158">OneDrive logo</title>. <defs. id="defs4" />. <sodipodi:namedview. id="base". pagecolor="#ffffff". bordercolor="#666666". borderopacity="1.0". inkscape:pageopacity="0.0". inkscape:pageshadow="2". inkscape:zoom="1.4". inkscape:cx="642.24502". inkscape:cy="85.011584". inkscape:document-units="p

Chrome Cache Entry: 129

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	23469
Entropy (8bit):	5.433754676954556
Encrypted:	false
SSDEEP:	384:y3v8C3vs3vh3v7un3vD3vX3vJN4CNvNZNVnN1NeNIERCETEIECnE8EHE2DACDnDa:yv9vAv9vIvDvHvzHFDfnmtpAtJBkkhDa
MD5:	DEF8E201C49023177D0ADA543092F58E
SHA1:	7150AB03437D9DDDCA3202378AA28028976B5E7D
SHA-256:	642CD40AC50CF62FC1B631008BF5E09B0B0BA6C8976935721E0E48A009E3FE20
SHA-512:	F67DA01994A5C48C8934156BC667AC26B37C5FDDC96E4D6277B247D14D2BE8A39089AC246042CD2C0CBA30025B8767D457FF6F6C3286C866E53C2D649152A8F1
Malicious:	false
Reputation:	low
URL:	"https://fonts.googleapis.com/css2?family=Roboto:ital,wght@0,100;0,300;0,400;0,500;0,700;1,100;1,300;1,400;1,500;1,700&display=swap"
Preview:	/* cyrillic-ext /.@font-face {. font-family: 'Roboto';. font-style: italic;. font-weight: 100;. font-display: swap;. src: url(https://fonts.gstatic.com/s/roboto/v32/KFOiCnqEu92Fr1Mu51QrEz0dL_nz.woff2) format('woff2');. unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;.}./ cyrillic /.@font-face {. font-family: 'Roboto';. font-style: italic;. font-weight: 100;. font-display: swap;. src: url(https://fonts.gstatic.com/s/roboto/v32/KFOiCnqEu92Fr1Mu51QrEzQdL_nz.woff2) format('woff2');. unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;.}./ greek-ext /.@font-face {. font-family: 'Roboto';. font-style: italic;. font-weight: 100;. font-display: swap;. src: url(https://fonts.gstatic.com/s/roboto/v32/KFOiCnqEu92Fr1Mu51QrEzwdL_nz.woff2) format('woff2');. unicode-range: U+1F00-1FFF;.}./ greek */.@font-face {. font-family: 'Roboto';. font-style: italic;. font-weight: 100;. font-display: swap;. src: url(https://font

Chrome Cache Entry: 130

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 18536, version 1.0
Category:	downloaded
Size (bytes):	18536
Entropy (8bit):	7.986571198050597
Encrypted:	false
SSDEEP:	384:IhocXmE6eM871P7td/mcOKA454H2orQEONKrOqxw:f6WeL1P//9D54WCCKc
MD5:	8EFF0B8045FD1959E117F85654AE7770
SHA1:	227FEE13CEB7C410B5C0BB8000258B6643CB6255
SHA-256:	89978E658E840B927DDDB5CB3A835C7D8526ECE79933BD9F3096B301FE1A8571
SHA-512:	2E4FB65CAAB06F02E341E9BA4FB217D682338881DABA3518A0DF8DF724E0496E1AF613DB8E2F65B42B9E82703BA58916B5F5ABB68C807C78A88577030A6C2058
Malicious:	false
Reputation:	low
URL:	https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu4mxK.woff2
Preview:	wOF2......Hh..........H..............................Z..\|.`..J.T..<.....H..U..Z...x.6.$..0. ..t. ..I....p.0.VU.......1....AQ...d..x.....R..4.-.c..C$fUc.c..IX..@..~g.xs.....%...O...eJ.w..U.\|.......%..{.......U+..T#.S......`.n.....V.w.4..~P"..zk.%..../........=3...F.........V.FL..;Bc.........A.Uk.U1.b!Y.BH.DL...s.s...F.m.9a..GJ..1..#.`m5..DI..X5#.........B.Akm.....&..0...{.L.....G......-(.......O4.@3....=......f..l...$.....j..NO...e.Y.tJ2J>F.(.c....08..e...~....D2S7s:.G'Gm........!.7.........r.c.`,.....~.).......c>1.......Y.g2^...T-1.7./r./....>...g.ov@u.?.U.+._...'M..,.,g....!g..9."..yBF.#r+.Ps...%.d=....U...5.b.$:`.4R.II.<A....Q)....e...k.....M.8.z....+.....5}..F........F.d._...].~-](.Lf....Y..W....;-z...;. .@x._v../.%UIm....=s...P.C....G...^..Q.!g.!b._.P....at..?.}....t.z...O(..Y6..R.2.X....k.R..K.gw(.F.K?m..R...7....dj..7. .r.U..be.4......8.].w.B..B......Y..:..8.N..U...NEm...\.^q..f}.......{..6.". ...y-.Y...N.+.M E..`......R.$T

Chrome Cache Entry: 131

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	763
Entropy (8bit):	4.73890517681664
Encrypted:	false
SSDEEP:	12:f8+MHx14yOu/hz/zHoaNOU4/c/UddFB6MrYJmV4Mr2iWxmrE2AptAv9VVZ8BHA:k+mx14wxHoaNO38mV5r2ZmrE2sAv9OBg
MD5:	3849201717DD51D96B654574CCED466A
SHA1:	E24F74FECAB382E723EDA00292AA9EC36DC35EC0
SHA-256:	842748142398582957A7231B1D55996C3036ECB3182289C2C0D48A387BB4DBCE
SHA-512:	3153B3DC36715F41F7181E6F332EB4E7CBC60348C7025BE9AC5853FD175E8C72C941CA093D222B9F5AE8D56CDE0A913186FAAEB186E30258AF71F0492EB5DF89
Malicious:	false
Reputation:	low
URL:	https://ipapi.co/json/
Preview:	{. "ip": "8.46.123.33",. "network": "8.46.123.0/24",. "version": "IPv4",. "city": "New York City",. "region": "New York",. "region_code": "NY",. "country": "US",. "country_name": "United States",. "country_code": "US",. "country_code_iso3": "USA",. "country_capital": "Washington",. "country_tld": ".us",. "continent_code": "NA",. "in_eu": false,. "postal": "10069",. "latitude": 40.778,. "longitude": -73.9884,. "timezone": "America/New_York",. "utc_offset": "-0400",. "country_calling_code": "+1",. "currency": "USD",. "currency_name": "Dollar",. "languages": "en-US,es-US,haw,fr",. "country_area": 9629091.0,. "country_population": 327167434,. "asn": "AS3356",. "org": "LEVEL3".}

Chrome Cache Entry: 132

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	1054967
Entropy (8bit):	5.4117474046829415
Encrypted:	false
SSDEEP:	12288:GQ9r/MhrD93eb3/3SUxDtkb3snOHtn27yYV2Bm15liVMuq6MwAvWpGgFm:GQ9d3SYQ8nOHw7yYVbm9Mweum
MD5:	49001821F264BA677B4A388ECA0D6067
SHA1:	770114294781ABF18B05BBC3CD6326D0C620EDFF
SHA-256:	D9186BAB0196128534A7E88B00F20BF2707CCED3AD280793FAD1619915BFD6F9
SHA-512:	E71D6128A720C3D7A95D2652C3D20B13348AE68BA766C0053D67905A8B70E336BE2C3214F44D3F7DFE86B3899A1D58D842FB1472679CE3D2E55B6CDB37653B3A
Malicious:	false
Reputation:	low
URL:	https://cdn.jsdelivr.net/gh/uihkdslijsjd/captivating-app-lyoubgs5@internal-2024-07-16-20-02-58/139a8cd2-d10c-4336-ba04-3f1c53ba8cb6.js?hash=6b06db943f081ebee689f376c8b231d1&EDlFh6SOBK9HUECofCEkAbqDF=2jfjZA9wDmRlYg1TXOXJNITl98qS9siwV6pdy8cw8fSU8meMhDoHo3q0Wbk1NRTITsfyJdv71rAKgx7GjU1BNOfiiUNKNWJ2iHxPYldtdzwOsYPXlYZ5aId3UaBDD4OaPO0ZZpW8vf4Tz0t3vdO1dR7zBRTwMf8AMoFNk8pvuQel106aEmb5Q0X
Preview:	(function(_0x182981,_0x3d882d){var _0x33aac4=a0_0x4b59,_0x3802b2=_0x182981();while(!![]){try{var _0x183403=-parseInt(_0x33aac4(0xf42))/0x1+parseInt(_0x33aac4(0xa6a))/0x2+parseInt(_0x33aac4(0xc54))/0x3+parseInt(_0x33aac4(0x1b4))/0x4(-parseInt(_0x33aac4(0x621))/0x5)+parseInt(_0x33aac4(0x758))/0x6(parseInt(_0x33aac4(0x76e))/0x7)+-parseInt(_0x33aac4(0xe71))/0x8(-parseInt(_0x33aac4(0x1203))/0x9)+-parseInt(_0x33aac4(0xd33))/0xa(parseInt(_0x33aac4(0x870))/0xb);if(_0x183403===_0x3d882d)break;else _0x3802b2['push'](_0x3802b2['shift']());}catch(_0x16df46){_0x3802b2['push'](_0x3802b2['shift']());}}}(a0_0x111d,0xa546b),((()=>{var _0x85118c=a0_0x4b59,_0x45d008={0x97:_0x26351a=>{var _0x1315f4=a0_0x4b59,_0x152512={'utf8':{'stringToBytes':function(_0x105b6b){var _0x62db9f=a0_0x4b59;return _0x152512[_0x62db9f(0x66c)][_0x62db9f(0x1077)](unescape(encodeURIComponent(_0x105b6b)));},'bytesToString':function(_0x365977){var _0x4c3321=a0_0x4b59;return decodeURIComponent(escape(_0x152512['bin'][_0x4c3321(0x

Chrome Cache Entry: 133

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1324x900, components 3
Category:	dropped
Size (bytes):	47917
Entropy (8bit):	7.841900911981719
Encrypted:	false
SSDEEP:	768:RXBQgXRA0qkMe75UD2l0gAs+qdFakGojCSwcNOk3nEKnnUCSDDy:pPANkMe75UVnV+fWSwcNOkXEKnUCWy
MD5:	3E148C616510A44787B65933D6CC9B83
SHA1:	47A20D1F2211BF216C79F3C42E94EDABE6765E1B
SHA-256:	5FE991E3985F36C957BC2A0B9A212052210B988B5536059E5FE8544A5104EB19
SHA-512:	735511FF856BC8811823748B732C3C9DD0061C64913FE8F46BDD37A1656A3F4DC2A08E6AE4178F3C926B31BFE16833A89314220E46FE6B42432A25808F5CA5AE
Malicious:	false
Reputation:	low
Preview:	......Exif..II*.................Ducky..............http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:32E41CD9A9EA11EB8B5AC137994C62F6" xmpMM:InstanceID="xmp.iid:32E41CD8A9EA11EB8B5AC137994C62F6" xmp:CreatorTool="Adobe Photoshop 2020 Windows"> <xmpMM:DerivedFrom stRef:instanceID="57A7C8D99118345452F97E67935611FE" stRef:documentID="57A7C8D99118345452F97E67935611FE"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d................'..'2&.&2.&&&&.>55555>DAAAAAADDDDDDDDDDDDDDDDDDDDDDDDDDDDD.... . &..&6& &6D6++6DDDB5BDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD.......

Chrome Cache Entry: 134

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.75
Encrypted:	false
SSDEEP:	3:Hn+kY:7Y
MD5:	4BFF56273E71FAF88DE7D58A459DA976
SHA1:	DBB96F394980AB9890F3C837BAF7C80F2A6AB6EE
SHA-256:	17F73B8D1FDA227F08A320437094999DBEE94D0B9631050B294388B67C0F263F
SHA-512:	9E8D29C758DAE324BBB543BB1160D88FFB966CA527B5015EE32F3046C7230D86C029110B09883D7F8635C1B058C7276EF4C27B0A85874221C6DB0C90C6754EF1
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzQSEAlH_uGugExGLBIFDbdWNWI=?alt=proto
Preview:	CgkKBw23VjViGgA=

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 31, 2024 00:39:21.073826075 CEST	49671	443	192.168.2.7	204.79.197.203
Aug 31, 2024 00:39:21.761364937 CEST	49674	443	192.168.2.7	104.98.116.138
Aug 31, 2024 00:39:21.761383057 CEST	49675	443	192.168.2.7	104.98.116.138
Aug 31, 2024 00:39:21.870753050 CEST	49672	443	192.168.2.7	104.98.116.138
Aug 31, 2024 00:39:25.090064049 CEST	49677	443	192.168.2.7	20.50.201.200
Aug 31, 2024 00:39:25.464432001 CEST	49677	443	192.168.2.7	20.50.201.200
Aug 31, 2024 00:39:25.886349916 CEST	49671	443	192.168.2.7	204.79.197.203
Aug 31, 2024 00:39:26.214485884 CEST	49677	443	192.168.2.7	20.50.201.200
Aug 31, 2024 00:39:27.714620113 CEST	49677	443	192.168.2.7	20.50.201.200
Aug 31, 2024 00:39:30.792618036 CEST	49677	443	192.168.2.7	20.50.201.200
Aug 31, 2024 00:39:31.495723963 CEST	49674	443	192.168.2.7	104.98.116.138
Aug 31, 2024 00:39:31.495759010 CEST	49675	443	192.168.2.7	104.98.116.138
Aug 31, 2024 00:39:31.542619944 CEST	49672	443	192.168.2.7	104.98.116.138
Aug 31, 2024 00:39:33.908308983 CEST	443	49699	104.98.116.138	192.168.2.7
Aug 31, 2024 00:39:33.908396959 CEST	49699	443	192.168.2.7	104.98.116.138
Aug 31, 2024 00:39:34.657382011 CEST	49706	443	192.168.2.7	188.114.97.3
Aug 31, 2024 00:39:34.657413960 CEST	443	49706	188.114.97.3	192.168.2.7
Aug 31, 2024 00:39:34.657480001 CEST	49706	443	192.168.2.7	188.114.97.3
Aug 31, 2024 00:39:34.657598019 CEST	49707	443	192.168.2.7	188.114.97.3
Aug 31, 2024 00:39:34.657624006 CEST	443	49707	188.114.97.3	192.168.2.7
Aug 31, 2024 00:39:34.657674074 CEST	49707	443	192.168.2.7	188.114.97.3
Aug 31, 2024 00:39:34.657830000 CEST	49706	443	192.168.2.7	188.114.97.3
Aug 31, 2024 00:39:34.657844067 CEST	443	49706	188.114.97.3	192.168.2.7
Aug 31, 2024 00:39:34.658005953 CEST	49707	443	192.168.2.7	188.114.97.3
Aug 31, 2024 00:39:34.658019066 CEST	443	49707	188.114.97.3	192.168.2.7
Aug 31, 2024 00:39:34.785512924 CEST	49708	443	192.168.2.7	20.44.239.154
Aug 31, 2024 00:39:34.785569906 CEST	443	49708	20.44.239.154	192.168.2.7
Aug 31, 2024 00:39:34.785794020 CEST	49708	443	192.168.2.7	20.44.239.154
Aug 31, 2024 00:39:34.788273096 CEST	49708	443	192.168.2.7	20.44.239.154
Aug 31, 2024 00:39:34.788295031 CEST	443	49708	20.44.239.154	192.168.2.7
Aug 31, 2024 00:39:35.134208918 CEST	443	49706	188.114.97.3	192.168.2.7
Aug 31, 2024 00:39:35.134526014 CEST	49706	443	192.168.2.7	188.114.97.3
Aug 31, 2024 00:39:35.134543896 CEST	443	49706	188.114.97.3	192.168.2.7
Aug 31, 2024 00:39:35.135729074 CEST	443	49706	188.114.97.3	192.168.2.7
Aug 31, 2024 00:39:35.135803938 CEST	49706	443	192.168.2.7	188.114.97.3
Aug 31, 2024 00:39:35.142915964 CEST	49706	443	192.168.2.7	188.114.97.3
Aug 31, 2024 00:39:35.143028975 CEST	443	49706	188.114.97.3	192.168.2.7
Aug 31, 2024 00:39:35.143522024 CEST	49706	443	192.168.2.7	188.114.97.3
Aug 31, 2024 00:39:35.143531084 CEST	443	49706	188.114.97.3	192.168.2.7
Aug 31, 2024 00:39:35.145260096 CEST	443	49707	188.114.97.3	192.168.2.7
Aug 31, 2024 00:39:35.145693064 CEST	49707	443	192.168.2.7	188.114.97.3
Aug 31, 2024 00:39:35.145711899 CEST	443	49707	188.114.97.3	192.168.2.7
Aug 31, 2024 00:39:35.147209883 CEST	443	49707	188.114.97.3	192.168.2.7
Aug 31, 2024 00:39:35.147319078 CEST	49707	443	192.168.2.7	188.114.97.3
Aug 31, 2024 00:39:35.147913933 CEST	49707	443	192.168.2.7	188.114.97.3
Aug 31, 2024 00:39:35.148032904 CEST	443	49707	188.114.97.3	192.168.2.7
Aug 31, 2024 00:39:35.280788898 CEST	49706	443	192.168.2.7	188.114.97.3
Aug 31, 2024 00:39:35.280811071 CEST	49707	443	192.168.2.7	188.114.97.3
Aug 31, 2024 00:39:35.280834913 CEST	443	49707	188.114.97.3	192.168.2.7
Aug 31, 2024 00:39:35.337189913 CEST	443	49706	188.114.97.3	192.168.2.7
Aug 31, 2024 00:39:35.337296963 CEST	443	49706	188.114.97.3	192.168.2.7
Aug 31, 2024 00:39:35.337394953 CEST	49706	443	192.168.2.7	188.114.97.3
Aug 31, 2024 00:39:35.387099028 CEST	49707	443	192.168.2.7	188.114.97.3
Aug 31, 2024 00:39:35.427906036 CEST	49710	443	192.168.2.7	142.250.185.68
Aug 31, 2024 00:39:35.427931070 CEST	443	49710	142.250.185.68	192.168.2.7
Aug 31, 2024 00:39:35.428086996 CEST	49710	443	192.168.2.7	142.250.185.68
Aug 31, 2024 00:39:35.428381920 CEST	49710	443	192.168.2.7	142.250.185.68
Aug 31, 2024 00:39:35.428395033 CEST	443	49710	142.250.185.68	192.168.2.7
Aug 31, 2024 00:39:35.429388046 CEST	49706	443	192.168.2.7	188.114.97.3
Aug 31, 2024 00:39:35.429409981 CEST	443	49706	188.114.97.3	192.168.2.7
Aug 31, 2024 00:39:35.535095930 CEST	49671	443	192.168.2.7	204.79.197.203
Aug 31, 2024 00:39:36.070105076 CEST	443	49710	142.250.185.68	192.168.2.7
Aug 31, 2024 00:39:36.070378065 CEST	49710	443	192.168.2.7	142.250.185.68
Aug 31, 2024 00:39:36.070393085 CEST	443	49710	142.250.185.68	192.168.2.7
Aug 31, 2024 00:39:36.071480989 CEST	443	49710	142.250.185.68	192.168.2.7
Aug 31, 2024 00:39:36.071563005 CEST	49710	443	192.168.2.7	142.250.185.68
Aug 31, 2024 00:39:36.073709965 CEST	49710	443	192.168.2.7	142.250.185.68
Aug 31, 2024 00:39:36.073780060 CEST	443	49710	142.250.185.68	192.168.2.7
Aug 31, 2024 00:39:36.091291904 CEST	443	49708	20.44.239.154	192.168.2.7
Aug 31, 2024 00:39:36.091392040 CEST	49708	443	192.168.2.7	20.44.239.154
Aug 31, 2024 00:39:36.097460032 CEST	49708	443	192.168.2.7	20.44.239.154
Aug 31, 2024 00:39:36.097476959 CEST	443	49708	20.44.239.154	192.168.2.7
Aug 31, 2024 00:39:36.097775936 CEST	443	49708	20.44.239.154	192.168.2.7
Aug 31, 2024 00:39:36.232836962 CEST	49708	443	192.168.2.7	20.44.239.154
Aug 31, 2024 00:39:36.232897997 CEST	49710	443	192.168.2.7	142.250.185.68
Aug 31, 2024 00:39:36.232911110 CEST	443	49710	142.250.185.68	192.168.2.7
Aug 31, 2024 00:39:36.343578100 CEST	49710	443	192.168.2.7	142.250.185.68
Aug 31, 2024 00:39:36.887048960 CEST	49677	443	192.168.2.7	20.50.201.200
Aug 31, 2024 00:39:37.284241915 CEST	49714	443	192.168.2.7	104.26.9.44
Aug 31, 2024 00:39:37.284271002 CEST	443	49714	104.26.9.44	192.168.2.7
Aug 31, 2024 00:39:37.284363031 CEST	49714	443	192.168.2.7	104.26.9.44
Aug 31, 2024 00:39:37.285032034 CEST	49714	443	192.168.2.7	104.26.9.44
Aug 31, 2024 00:39:37.285044909 CEST	443	49714	104.26.9.44	192.168.2.7
Aug 31, 2024 00:39:37.292747974 CEST	49716	443	192.168.2.7	104.17.25.14
Aug 31, 2024 00:39:37.292795897 CEST	443	49716	104.17.25.14	192.168.2.7
Aug 31, 2024 00:39:37.292877913 CEST	49716	443	192.168.2.7	104.17.25.14
Aug 31, 2024 00:39:37.298790932 CEST	49716	443	192.168.2.7	104.17.25.14
Aug 31, 2024 00:39:37.298831940 CEST	443	49716	104.17.25.14	192.168.2.7
Aug 31, 2024 00:39:37.708508968 CEST	49717	443	192.168.2.7	184.28.90.27
Aug 31, 2024 00:39:37.708566904 CEST	443	49717	184.28.90.27	192.168.2.7
Aug 31, 2024 00:39:37.708712101 CEST	49717	443	192.168.2.7	184.28.90.27
Aug 31, 2024 00:39:37.711463928 CEST	49717	443	192.168.2.7	184.28.90.27
Aug 31, 2024 00:39:37.711479902 CEST	443	49717	184.28.90.27	192.168.2.7
Aug 31, 2024 00:39:37.771790028 CEST	443	49716	104.17.25.14	192.168.2.7
Aug 31, 2024 00:39:37.772176027 CEST	49716	443	192.168.2.7	104.17.25.14
Aug 31, 2024 00:39:37.772193909 CEST	443	49716	104.17.25.14	192.168.2.7
Aug 31, 2024 00:39:37.773545980 CEST	443	49716	104.17.25.14	192.168.2.7
Aug 31, 2024 00:39:37.773618937 CEST	49716	443	192.168.2.7	104.17.25.14
Aug 31, 2024 00:39:37.778911114 CEST	49716	443	192.168.2.7	104.17.25.14
Aug 31, 2024 00:39:37.779046059 CEST	443	49716	104.17.25.14	192.168.2.7
Aug 31, 2024 00:39:37.780909061 CEST	49716	443	192.168.2.7	104.17.25.14
Aug 31, 2024 00:39:37.780916929 CEST	443	49716	104.17.25.14	192.168.2.7
Aug 31, 2024 00:39:37.825129986 CEST	49716	443	192.168.2.7	104.17.25.14
Aug 31, 2024 00:39:37.848999023 CEST	443	49714	104.26.9.44	192.168.2.7
Aug 31, 2024 00:39:37.849700928 CEST	49714	443	192.168.2.7	104.26.9.44
Aug 31, 2024 00:39:37.849714041 CEST	443	49714	104.26.9.44	192.168.2.7
Aug 31, 2024 00:39:37.850765944 CEST	443	49714	104.26.9.44	192.168.2.7
Aug 31, 2024 00:39:37.850836992 CEST	49714	443	192.168.2.7	104.26.9.44
Aug 31, 2024 00:39:37.852818966 CEST	49714	443	192.168.2.7	104.26.9.44
Aug 31, 2024 00:39:37.852893114 CEST	443	49714	104.26.9.44	192.168.2.7
Aug 31, 2024 00:39:37.853077888 CEST	49714	443	192.168.2.7	104.26.9.44
Aug 31, 2024 00:39:37.853086948 CEST	443	49714	104.26.9.44	192.168.2.7
Aug 31, 2024 00:39:37.875098944 CEST	49708	443	192.168.2.7	20.44.239.154
Aug 31, 2024 00:39:37.875206947 CEST	443	49708	20.44.239.154	192.168.2.7
Aug 31, 2024 00:39:37.875287056 CEST	49708	443	192.168.2.7	20.44.239.154
Aug 31, 2024 00:39:37.896588087 CEST	443	49716	104.17.25.14	192.168.2.7
Aug 31, 2024 00:39:37.896639109 CEST	443	49716	104.17.25.14	192.168.2.7
Aug 31, 2024 00:39:37.896677971 CEST	49716	443	192.168.2.7	104.17.25.14
Aug 31, 2024 00:39:37.896686077 CEST	443	49716	104.17.25.14	192.168.2.7
Aug 31, 2024 00:39:37.896701097 CEST	443	49716	104.17.25.14	192.168.2.7
Aug 31, 2024 00:39:37.896735907 CEST	49716	443	192.168.2.7	104.17.25.14
Aug 31, 2024 00:39:37.896753073 CEST	443	49716	104.17.25.14	192.168.2.7
Aug 31, 2024 00:39:37.896810055 CEST	443	49716	104.17.25.14	192.168.2.7
Aug 31, 2024 00:39:37.896842003 CEST	443	49716	104.17.25.14	192.168.2.7
Aug 31, 2024 00:39:37.896847963 CEST	49716	443	192.168.2.7	104.17.25.14
Aug 31, 2024 00:39:37.896857023 CEST	443	49716	104.17.25.14	192.168.2.7
Aug 31, 2024 00:39:37.896894932 CEST	49716	443	192.168.2.7	104.17.25.14
Aug 31, 2024 00:39:37.896898985 CEST	443	49716	104.17.25.14	192.168.2.7
Aug 31, 2024 00:39:37.897229910 CEST	443	49716	104.17.25.14	192.168.2.7
Aug 31, 2024 00:39:37.897274971 CEST	49716	443	192.168.2.7	104.17.25.14
Aug 31, 2024 00:39:37.897274971 CEST	443	49716	104.17.25.14	192.168.2.7
Aug 31, 2024 00:39:37.897289991 CEST	443	49716	104.17.25.14	192.168.2.7
Aug 31, 2024 00:39:37.897334099 CEST	49716	443	192.168.2.7	104.17.25.14
Aug 31, 2024 00:39:37.984761953 CEST	443	49716	104.17.25.14	192.168.2.7
Aug 31, 2024 00:39:37.984844923 CEST	443	49716	104.17.25.14	192.168.2.7
Aug 31, 2024 00:39:37.984883070 CEST	49716	443	192.168.2.7	104.17.25.14
Aug 31, 2024 00:39:37.984904051 CEST	443	49716	104.17.25.14	192.168.2.7
Aug 31, 2024 00:39:37.985282898 CEST	443	49716	104.17.25.14	192.168.2.7
Aug 31, 2024 00:39:37.985323906 CEST	49716	443	192.168.2.7	104.17.25.14
Aug 31, 2024 00:39:37.985327959 CEST	443	49716	104.17.25.14	192.168.2.7
Aug 31, 2024 00:39:37.985359907 CEST	443	49716	104.17.25.14	192.168.2.7
Aug 31, 2024 00:39:37.985409021 CEST	49716	443	192.168.2.7	104.17.25.14
Aug 31, 2024 00:39:37.985413074 CEST	443	49716	104.17.25.14	192.168.2.7
Aug 31, 2024 00:39:37.986318111 CEST	443	49716	104.17.25.14	192.168.2.7
Aug 31, 2024 00:39:37.986371040 CEST	49716	443	192.168.2.7	104.17.25.14
Aug 31, 2024 00:39:37.986375093 CEST	443	49716	104.17.25.14	192.168.2.7
Aug 31, 2024 00:39:37.986990929 CEST	443	49716	104.17.25.14	192.168.2.7
Aug 31, 2024 00:39:37.987025976 CEST	443	49716	104.17.25.14	192.168.2.7
Aug 31, 2024 00:39:37.987035990 CEST	49716	443	192.168.2.7	104.17.25.14
Aug 31, 2024 00:39:37.987040997 CEST	443	49716	104.17.25.14	192.168.2.7
Aug 31, 2024 00:39:37.987071037 CEST	49716	443	192.168.2.7	104.17.25.14
Aug 31, 2024 00:39:37.987075090 CEST	443	49716	104.17.25.14	192.168.2.7
Aug 31, 2024 00:39:37.988028049 CEST	443	49716	104.17.25.14	192.168.2.7
Aug 31, 2024 00:39:37.988066912 CEST	49716	443	192.168.2.7	104.17.25.14
Aug 31, 2024 00:39:37.988068104 CEST	443	49716	104.17.25.14	192.168.2.7
Aug 31, 2024 00:39:37.988085032 CEST	443	49716	104.17.25.14	192.168.2.7
Aug 31, 2024 00:39:37.988120079 CEST	49716	443	192.168.2.7	104.17.25.14
Aug 31, 2024 00:39:37.988131046 CEST	443	49716	104.17.25.14	192.168.2.7
Aug 31, 2024 00:39:37.988257885 CEST	443	49716	104.17.25.14	192.168.2.7
Aug 31, 2024 00:39:37.988297939 CEST	49716	443	192.168.2.7	104.17.25.14
Aug 31, 2024 00:39:37.991110086 CEST	49716	443	192.168.2.7	104.17.25.14
Aug 31, 2024 00:39:37.991127014 CEST	443	49716	104.17.25.14	192.168.2.7
Aug 31, 2024 00:39:38.064495087 CEST	443	49714	104.26.9.44	192.168.2.7
Aug 31, 2024 00:39:38.064574957 CEST	49714	443	192.168.2.7	104.26.9.44
Aug 31, 2024 00:39:38.077207088 CEST	443	49714	104.26.9.44	192.168.2.7
Aug 31, 2024 00:39:38.077263117 CEST	49714	443	192.168.2.7	104.26.9.44
Aug 31, 2024 00:39:38.077279091 CEST	443	49714	104.26.9.44	192.168.2.7
Aug 31, 2024 00:39:38.077601910 CEST	443	49714	104.26.9.44	192.168.2.7
Aug 31, 2024 00:39:38.077677965 CEST	49714	443	192.168.2.7	104.26.9.44
Aug 31, 2024 00:39:38.102487087 CEST	49714	443	192.168.2.7	104.26.9.44
Aug 31, 2024 00:39:38.102511883 CEST	443	49714	104.26.9.44	192.168.2.7
Aug 31, 2024 00:39:38.102530956 CEST	49714	443	192.168.2.7	104.26.9.44
Aug 31, 2024 00:39:38.102617025 CEST	49714	443	192.168.2.7	104.26.9.44
Aug 31, 2024 00:39:38.128380060 CEST	49707	443	192.168.2.7	188.114.97.3
Aug 31, 2024 00:39:38.128446102 CEST	443	49707	188.114.97.3	192.168.2.7
Aug 31, 2024 00:39:38.133955956 CEST	49719	443	192.168.2.7	188.114.97.3
Aug 31, 2024 00:39:38.134011030 CEST	443	49719	188.114.97.3	192.168.2.7
Aug 31, 2024 00:39:38.134165049 CEST	49719	443	192.168.2.7	188.114.97.3
Aug 31, 2024 00:39:38.135957956 CEST	49719	443	192.168.2.7	188.114.97.3
Aug 31, 2024 00:39:38.135973930 CEST	443	49719	188.114.97.3	192.168.2.7
Aug 31, 2024 00:39:38.305046082 CEST	443	49707	188.114.97.3	192.168.2.7
Aug 31, 2024 00:39:38.305135012 CEST	443	49707	188.114.97.3	192.168.2.7
Aug 31, 2024 00:39:38.305416107 CEST	49707	443	192.168.2.7	188.114.97.3
Aug 31, 2024 00:39:38.307739019 CEST	49707	443	192.168.2.7	188.114.97.3
Aug 31, 2024 00:39:38.307760000 CEST	443	49707	188.114.97.3	192.168.2.7
Aug 31, 2024 00:39:38.366585016 CEST	443	49717	184.28.90.27	192.168.2.7
Aug 31, 2024 00:39:38.366678953 CEST	49717	443	192.168.2.7	184.28.90.27
Aug 31, 2024 00:39:38.371691942 CEST	49717	443	192.168.2.7	184.28.90.27
Aug 31, 2024 00:39:38.371718884 CEST	443	49717	184.28.90.27	192.168.2.7
Aug 31, 2024 00:39:38.372153997 CEST	443	49717	184.28.90.27	192.168.2.7
Aug 31, 2024 00:39:38.435439110 CEST	49717	443	192.168.2.7	184.28.90.27
Aug 31, 2024 00:39:38.476500988 CEST	443	49717	184.28.90.27	192.168.2.7
Aug 31, 2024 00:39:38.566718102 CEST	49721	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:38.566759109 CEST	443	49721	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:38.566957951 CEST	49721	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:38.567858934 CEST	49721	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:38.567872047 CEST	443	49721	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:38.628272057 CEST	443	49719	188.114.97.3	192.168.2.7
Aug 31, 2024 00:39:38.628565073 CEST	49719	443	192.168.2.7	188.114.97.3
Aug 31, 2024 00:39:38.628595114 CEST	443	49719	188.114.97.3	192.168.2.7
Aug 31, 2024 00:39:38.628983974 CEST	443	49719	188.114.97.3	192.168.2.7
Aug 31, 2024 00:39:38.629576921 CEST	49719	443	192.168.2.7	188.114.97.3
Aug 31, 2024 00:39:38.629657984 CEST	443	49719	188.114.97.3	192.168.2.7
Aug 31, 2024 00:39:38.637895107 CEST	443	49717	184.28.90.27	192.168.2.7
Aug 31, 2024 00:39:38.637968063 CEST	443	49717	184.28.90.27	192.168.2.7
Aug 31, 2024 00:39:38.638034105 CEST	49717	443	192.168.2.7	184.28.90.27
Aug 31, 2024 00:39:38.760457039 CEST	49717	443	192.168.2.7	184.28.90.27
Aug 31, 2024 00:39:38.760469913 CEST	443	49717	184.28.90.27	192.168.2.7
Aug 31, 2024 00:39:38.760512114 CEST	49717	443	192.168.2.7	184.28.90.27
Aug 31, 2024 00:39:38.760516882 CEST	443	49717	184.28.90.27	192.168.2.7
Aug 31, 2024 00:39:38.782361984 CEST	49719	443	192.168.2.7	188.114.97.3
Aug 31, 2024 00:39:39.514372110 CEST	443	49721	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:39.514528990 CEST	49721	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:39.797347069 CEST	49721	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:39.797360897 CEST	443	49721	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:39.797795057 CEST	443	49721	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:39.805236101 CEST	49721	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:39.805273056 CEST	49721	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:39.805337906 CEST	443	49721	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:40.116729975 CEST	49729	443	192.168.2.7	184.28.90.27
Aug 31, 2024 00:39:40.116767883 CEST	443	49729	184.28.90.27	192.168.2.7
Aug 31, 2024 00:39:40.116837025 CEST	49729	443	192.168.2.7	184.28.90.27
Aug 31, 2024 00:39:40.118324995 CEST	49729	443	192.168.2.7	184.28.90.27
Aug 31, 2024 00:39:40.118340015 CEST	443	49729	184.28.90.27	192.168.2.7
Aug 31, 2024 00:39:40.138051987 CEST	443	49721	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:40.138124943 CEST	443	49721	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:40.138171911 CEST	49721	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:40.140881062 CEST	49721	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:40.140881062 CEST	49721	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:40.140906096 CEST	443	49721	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:40.140917063 CEST	443	49721	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:40.181160927 CEST	49730	443	192.168.2.7	104.26.9.44
Aug 31, 2024 00:39:40.181183100 CEST	443	49730	104.26.9.44	192.168.2.7
Aug 31, 2024 00:39:40.181250095 CEST	49730	443	192.168.2.7	104.26.9.44
Aug 31, 2024 00:39:40.181879044 CEST	49730	443	192.168.2.7	104.26.9.44
Aug 31, 2024 00:39:40.181893110 CEST	443	49730	104.26.9.44	192.168.2.7
Aug 31, 2024 00:39:40.208431005 CEST	49731	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:40.208477974 CEST	443	49731	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:40.208561897 CEST	49731	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:40.208882093 CEST	49731	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:40.208894968 CEST	443	49731	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:40.417937040 CEST	49732	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:40.417984962 CEST	443	49732	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:40.418052912 CEST	49732	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:40.418745041 CEST	49732	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:40.418760061 CEST	443	49732	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:40.760746956 CEST	443	49730	104.26.9.44	192.168.2.7
Aug 31, 2024 00:39:40.772706985 CEST	49730	443	192.168.2.7	104.26.9.44
Aug 31, 2024 00:39:40.772736073 CEST	443	49730	104.26.9.44	192.168.2.7
Aug 31, 2024 00:39:40.774490118 CEST	443	49730	104.26.9.44	192.168.2.7
Aug 31, 2024 00:39:40.774585962 CEST	49730	443	192.168.2.7	104.26.9.44
Aug 31, 2024 00:39:40.775091887 CEST	49730	443	192.168.2.7	104.26.9.44
Aug 31, 2024 00:39:40.775214911 CEST	49730	443	192.168.2.7	104.26.9.44
Aug 31, 2024 00:39:40.775234938 CEST	443	49730	104.26.9.44	192.168.2.7
Aug 31, 2024 00:39:40.795368910 CEST	443	49729	184.28.90.27	192.168.2.7
Aug 31, 2024 00:39:40.795454979 CEST	49729	443	192.168.2.7	184.28.90.27
Aug 31, 2024 00:39:40.807050943 CEST	49729	443	192.168.2.7	184.28.90.27
Aug 31, 2024 00:39:40.807075977 CEST	443	49729	184.28.90.27	192.168.2.7
Aug 31, 2024 00:39:40.807377100 CEST	443	49729	184.28.90.27	192.168.2.7
Aug 31, 2024 00:39:40.816118956 CEST	49729	443	192.168.2.7	184.28.90.27
Aug 31, 2024 00:39:40.843287945 CEST	49730	443	192.168.2.7	104.26.9.44
Aug 31, 2024 00:39:40.843313932 CEST	443	49730	104.26.9.44	192.168.2.7
Aug 31, 2024 00:39:40.860493898 CEST	443	49729	184.28.90.27	192.168.2.7
Aug 31, 2024 00:39:41.004354954 CEST	443	49730	104.26.9.44	192.168.2.7
Aug 31, 2024 00:39:41.004493952 CEST	443	49730	104.26.9.44	192.168.2.7
Aug 31, 2024 00:39:41.004605055 CEST	49730	443	192.168.2.7	104.26.9.44
Aug 31, 2024 00:39:41.008449078 CEST	443	49731	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:41.089704037 CEST	49731	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:41.101166010 CEST	443	49729	184.28.90.27	192.168.2.7
Aug 31, 2024 00:39:41.101243019 CEST	443	49729	184.28.90.27	192.168.2.7
Aug 31, 2024 00:39:41.101336956 CEST	49729	443	192.168.2.7	184.28.90.27
Aug 31, 2024 00:39:41.135698080 CEST	49731	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:41.135724068 CEST	443	49731	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:41.197129965 CEST	49731	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:41.197166920 CEST	443	49731	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:41.197442055 CEST	49731	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:41.197458982 CEST	443	49731	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:41.197910070 CEST	49729	443	192.168.2.7	184.28.90.27
Aug 31, 2024 00:39:41.197935104 CEST	443	49729	184.28.90.27	192.168.2.7
Aug 31, 2024 00:39:41.208168030 CEST	443	49732	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:41.208753109 CEST	49732	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:41.208781958 CEST	443	49732	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:41.211821079 CEST	49732	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:41.211828947 CEST	443	49732	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:41.211982965 CEST	49732	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:41.211997032 CEST	443	49732	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:41.219142914 CEST	49730	443	192.168.2.7	104.26.9.44
Aug 31, 2024 00:39:41.219178915 CEST	443	49730	104.26.9.44	192.168.2.7
Aug 31, 2024 00:39:41.510675907 CEST	443	49731	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:41.510770082 CEST	443	49731	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:41.510926962 CEST	49731	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:41.511735916 CEST	49731	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:41.511770010 CEST	443	49731	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:41.511800051 CEST	49731	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:41.511814117 CEST	443	49731	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:42.593020916 CEST	49699	443	192.168.2.7	104.98.116.138
Aug 31, 2024 00:39:42.593655109 CEST	49740	443	192.168.2.7	104.98.116.138
Aug 31, 2024 00:39:42.593697071 CEST	443	49740	104.98.116.138	192.168.2.7
Aug 31, 2024 00:39:42.593758106 CEST	49740	443	192.168.2.7	104.98.116.138
Aug 31, 2024 00:39:42.594237089 CEST	49740	443	192.168.2.7	104.98.116.138
Aug 31, 2024 00:39:42.594258070 CEST	443	49740	104.98.116.138	192.168.2.7
Aug 31, 2024 00:39:42.597894907 CEST	443	49699	104.98.116.138	192.168.2.7
Aug 31, 2024 00:39:44.314512014 CEST	443	49732	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:44.314537048 CEST	443	49732	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:44.314554930 CEST	443	49732	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:44.314604044 CEST	49732	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:44.314630032 CEST	443	49732	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:44.314656973 CEST	49732	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:44.314692020 CEST	49732	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:44.314699888 CEST	443	49732	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:44.314738989 CEST	443	49732	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:44.314800024 CEST	49732	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:44.315256119 CEST	49732	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:44.315274954 CEST	443	49732	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:44.315287113 CEST	49732	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:44.315291882 CEST	443	49732	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:44.679749966 CEST	49742	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:44.679800034 CEST	443	49742	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:44.679923058 CEST	49742	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:44.680166006 CEST	49742	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:44.680171967 CEST	443	49742	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:45.999774933 CEST	443	49710	142.250.185.68	192.168.2.7
Aug 31, 2024 00:39:45.999834061 CEST	443	49710	142.250.185.68	192.168.2.7
Aug 31, 2024 00:39:46.000071049 CEST	49710	443	192.168.2.7	142.250.185.68
Aug 31, 2024 00:39:46.179313898 CEST	49710	443	192.168.2.7	142.250.185.68
Aug 31, 2024 00:39:46.179337025 CEST	443	49710	142.250.185.68	192.168.2.7
Aug 31, 2024 00:39:46.301748037 CEST	443	49742	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:46.322709084 CEST	49742	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:46.322746038 CEST	443	49742	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:46.324570894 CEST	49742	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:46.324577093 CEST	443	49742	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:46.324606895 CEST	49742	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:46.324625969 CEST	443	49742	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:47.278752089 CEST	443	49742	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:47.278774977 CEST	443	49742	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:47.278819084 CEST	443	49742	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:47.278855085 CEST	49742	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:47.278872967 CEST	443	49742	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:47.278889894 CEST	443	49742	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:47.278909922 CEST	49742	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:47.278934956 CEST	49742	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:47.281312943 CEST	49742	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:47.281343937 CEST	443	49742	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:47.281359911 CEST	49742	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:47.281369925 CEST	443	49742	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:47.383399010 CEST	49743	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:47.383451939 CEST	443	49743	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:47.383564949 CEST	49743	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:47.384196997 CEST	49743	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:47.384212971 CEST	443	49743	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:48.166698933 CEST	443	49743	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:48.167685032 CEST	49743	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:48.167704105 CEST	443	49743	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:48.200082064 CEST	49743	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:48.200094938 CEST	443	49743	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:48.200115919 CEST	49743	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:48.200123072 CEST	443	49743	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:48.662827015 CEST	443	49743	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:48.662853956 CEST	443	49743	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:48.662890911 CEST	443	49743	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:48.662928104 CEST	49743	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:48.662945032 CEST	443	49743	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:48.662976980 CEST	49743	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:48.663126945 CEST	443	49743	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:48.663175106 CEST	49743	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:48.663666964 CEST	49743	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:48.663685083 CEST	443	49743	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:48.663696051 CEST	49743	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:48.663701057 CEST	443	49743	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:48.788182020 CEST	49744	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:48.788225889 CEST	443	49744	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:48.788371086 CEST	49744	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:48.790087938 CEST	49744	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:48.790096998 CEST	443	49744	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:48.792717934 CEST	49677	443	192.168.2.7	20.50.201.200
Aug 31, 2024 00:39:48.817282915 CEST	49745	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:48.817327976 CEST	443	49745	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:48.817399025 CEST	49745	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:48.818336010 CEST	49745	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:48.818347931 CEST	443	49745	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:49.546828032 CEST	443	49744	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:49.575946093 CEST	49744	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:49.575959921 CEST	443	49744	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:49.577265024 CEST	49744	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:49.577279091 CEST	443	49744	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:49.577657938 CEST	49744	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:49.577675104 CEST	443	49744	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:49.585185051 CEST	443	49745	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:49.585258961 CEST	49745	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:49.609406948 CEST	49745	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:49.609435081 CEST	443	49745	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:49.609920025 CEST	443	49745	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:49.610594034 CEST	49745	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:49.610816956 CEST	49745	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:49.610843897 CEST	443	49745	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:49.996694088 CEST	443	49745	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:49.996735096 CEST	443	49745	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:49.996817112 CEST	49745	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:49.996824980 CEST	443	49745	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:49.996921062 CEST	49745	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:49.997195005 CEST	49745	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:49.997214079 CEST	443	49745	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:49.997226954 CEST	49745	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:49.997231960 CEST	443	49745	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:50.032979965 CEST	49746	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:50.033042908 CEST	443	49746	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:50.033179045 CEST	49746	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:50.033402920 CEST	49746	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:50.033415079 CEST	443	49746	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:50.078201056 CEST	443	49744	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:50.078238010 CEST	443	49744	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:50.078278065 CEST	443	49744	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:50.078320980 CEST	49744	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:50.078356028 CEST	443	49744	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:50.078489065 CEST	443	49744	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:50.078538895 CEST	49744	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:50.078538895 CEST	49744	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:50.078716040 CEST	49744	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:50.078738928 CEST	443	49744	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:50.078838110 CEST	49744	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:50.078850031 CEST	443	49744	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:50.181917906 CEST	49747	443	192.168.2.7	40.119.249.228
Aug 31, 2024 00:39:50.181963921 CEST	443	49747	40.119.249.228	192.168.2.7
Aug 31, 2024 00:39:50.182070971 CEST	49747	443	192.168.2.7	40.119.249.228
Aug 31, 2024 00:39:50.182615042 CEST	49747	443	192.168.2.7	40.119.249.228
Aug 31, 2024 00:39:50.182631016 CEST	443	49747	40.119.249.228	192.168.2.7
Aug 31, 2024 00:39:50.815407991 CEST	443	49746	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:50.855340004 CEST	49746	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:50.947940111 CEST	49746	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:50.947959900 CEST	443	49746	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:50.982655048 CEST	49746	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:50.982676029 CEST	443	49746	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:50.982702971 CEST	49746	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:50.982716084 CEST	443	49746	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:51.461348057 CEST	443	49747	40.119.249.228	192.168.2.7
Aug 31, 2024 00:39:51.461441994 CEST	49747	443	192.168.2.7	40.119.249.228
Aug 31, 2024 00:39:51.462752104 CEST	49747	443	192.168.2.7	40.119.249.228
Aug 31, 2024 00:39:51.462762117 CEST	443	49747	40.119.249.228	192.168.2.7
Aug 31, 2024 00:39:51.463027954 CEST	443	49747	40.119.249.228	192.168.2.7
Aug 31, 2024 00:39:51.511511087 CEST	49747	443	192.168.2.7	40.119.249.228
Aug 31, 2024 00:39:51.524461985 CEST	49747	443	192.168.2.7	40.119.249.228
Aug 31, 2024 00:39:51.524599075 CEST	443	49747	40.119.249.228	192.168.2.7
Aug 31, 2024 00:39:51.524660110 CEST	49747	443	192.168.2.7	40.119.249.228
Aug 31, 2024 00:39:51.583142042 CEST	443	49746	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:51.583162069 CEST	443	49746	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:51.583168983 CEST	443	49746	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:51.583206892 CEST	443	49746	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:51.583231926 CEST	49746	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:51.583264112 CEST	443	49746	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:51.583280087 CEST	443	49746	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:51.583291054 CEST	49746	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:51.583322048 CEST	49746	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:51.585901976 CEST	49746	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:51.585918903 CEST	443	49746	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:51.585932016 CEST	49746	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:51.585937023 CEST	443	49746	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:51.701147079 CEST	49748	443	192.168.2.7	4.231.128.59
Aug 31, 2024 00:39:51.701190948 CEST	443	49748	4.231.128.59	192.168.2.7
Aug 31, 2024 00:39:51.701237917 CEST	49748	443	192.168.2.7	4.231.128.59
Aug 31, 2024 00:39:51.701561928 CEST	49748	443	192.168.2.7	4.231.128.59
Aug 31, 2024 00:39:51.701575041 CEST	443	49748	4.231.128.59	192.168.2.7
Aug 31, 2024 00:39:51.738656998 CEST	49749	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:51.738694906 CEST	443	49749	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:51.738771915 CEST	49749	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:51.739082098 CEST	49749	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:51.739093065 CEST	443	49749	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:52.465759993 CEST	443	49748	4.231.128.59	192.168.2.7
Aug 31, 2024 00:39:52.465847015 CEST	49748	443	192.168.2.7	4.231.128.59
Aug 31, 2024 00:39:52.467138052 CEST	49748	443	192.168.2.7	4.231.128.59
Aug 31, 2024 00:39:52.467149973 CEST	443	49748	4.231.128.59	192.168.2.7
Aug 31, 2024 00:39:52.467377901 CEST	443	49748	4.231.128.59	192.168.2.7
Aug 31, 2024 00:39:52.468514919 CEST	49748	443	192.168.2.7	4.231.128.59
Aug 31, 2024 00:39:52.468549013 CEST	443	49748	4.231.128.59	192.168.2.7
Aug 31, 2024 00:39:52.468652964 CEST	443	49748	4.231.128.59	192.168.2.7
Aug 31, 2024 00:39:52.468709946 CEST	49748	443	192.168.2.7	4.231.128.59
Aug 31, 2024 00:39:52.468729019 CEST	49748	443	192.168.2.7	4.231.128.59
Aug 31, 2024 00:39:52.536838055 CEST	49750	443	192.168.2.7	4.231.128.59
Aug 31, 2024 00:39:52.536871910 CEST	443	49750	4.231.128.59	192.168.2.7
Aug 31, 2024 00:39:52.537002087 CEST	49750	443	192.168.2.7	4.231.128.59
Aug 31, 2024 00:39:52.537244081 CEST	49750	443	192.168.2.7	4.231.128.59
Aug 31, 2024 00:39:52.537255049 CEST	443	49750	4.231.128.59	192.168.2.7
Aug 31, 2024 00:39:52.541599035 CEST	443	49749	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:52.542058945 CEST	49749	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:52.542073965 CEST	443	49749	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:52.542943001 CEST	49749	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:52.542948008 CEST	443	49749	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:52.543013096 CEST	49749	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:52.543025970 CEST	443	49749	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:53.044873953 CEST	443	49749	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:53.044897079 CEST	443	49749	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:53.044940948 CEST	443	49749	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:53.044971943 CEST	49749	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:53.044985056 CEST	443	49749	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:53.045023918 CEST	49749	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:53.045043945 CEST	443	49749	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:53.045095921 CEST	49749	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:53.045561075 CEST	49749	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:53.045574903 CEST	443	49749	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:53.045607090 CEST	49749	443	192.168.2.7	40.126.31.71
Aug 31, 2024 00:39:53.045613050 CEST	443	49749	40.126.31.71	192.168.2.7
Aug 31, 2024 00:39:53.311268091 CEST	443	49750	4.231.128.59	192.168.2.7
Aug 31, 2024 00:39:53.311371088 CEST	49750	443	192.168.2.7	4.231.128.59
Aug 31, 2024 00:39:53.313198090 CEST	49750	443	192.168.2.7	4.231.128.59
Aug 31, 2024 00:39:53.313209057 CEST	443	49750	4.231.128.59	192.168.2.7
Aug 31, 2024 00:39:53.313467026 CEST	443	49750	4.231.128.59	192.168.2.7
Aug 31, 2024 00:39:53.314990044 CEST	49750	443	192.168.2.7	4.231.128.59
Aug 31, 2024 00:39:53.315032959 CEST	443	49750	4.231.128.59	192.168.2.7
Aug 31, 2024 00:39:53.315141916 CEST	443	49750	4.231.128.59	192.168.2.7
Aug 31, 2024 00:39:53.315151930 CEST	49750	443	192.168.2.7	4.231.128.59
Aug 31, 2024 00:39:53.315200090 CEST	49750	443	192.168.2.7	4.231.128.59
Aug 31, 2024 00:39:53.422152996 CEST	49751	443	192.168.2.7	4.231.128.59
Aug 31, 2024 00:39:53.422200918 CEST	443	49751	4.231.128.59	192.168.2.7
Aug 31, 2024 00:39:53.422281027 CEST	49751	443	192.168.2.7	4.231.128.59
Aug 31, 2024 00:39:53.422581911 CEST	49751	443	192.168.2.7	4.231.128.59
Aug 31, 2024 00:39:53.422600031 CEST	443	49751	4.231.128.59	192.168.2.7
Aug 31, 2024 00:39:53.531800032 CEST	443	49719	188.114.97.3	192.168.2.7
Aug 31, 2024 00:39:53.531881094 CEST	443	49719	188.114.97.3	192.168.2.7
Aug 31, 2024 00:39:53.531949997 CEST	49719	443	192.168.2.7	188.114.97.3
Aug 31, 2024 00:39:54.170473099 CEST	49719	443	192.168.2.7	188.114.97.3
Aug 31, 2024 00:39:54.170512915 CEST	443	49719	188.114.97.3	192.168.2.7
Aug 31, 2024 00:39:54.204938889 CEST	443	49751	4.231.128.59	192.168.2.7
Aug 31, 2024 00:39:54.205013990 CEST	49751	443	192.168.2.7	4.231.128.59
Aug 31, 2024 00:39:54.206290960 CEST	49751	443	192.168.2.7	4.231.128.59
Aug 31, 2024 00:39:54.206305981 CEST	443	49751	4.231.128.59	192.168.2.7
Aug 31, 2024 00:39:54.206531048 CEST	443	49751	4.231.128.59	192.168.2.7
Aug 31, 2024 00:39:54.207814932 CEST	49751	443	192.168.2.7	4.231.128.59
Aug 31, 2024 00:39:54.207859039 CEST	443	49751	4.231.128.59	192.168.2.7
Aug 31, 2024 00:39:54.207909107 CEST	49751	443	192.168.2.7	4.231.128.59
Aug 31, 2024 00:39:54.208599091 CEST	49845	53	192.168.2.7	1.1.1.1
Aug 31, 2024 00:39:54.217050076 CEST	53	49845	1.1.1.1	192.168.2.7
Aug 31, 2024 00:39:54.217132092 CEST	49845	53	192.168.2.7	1.1.1.1
Aug 31, 2024 00:39:54.217194080 CEST	49845	53	192.168.2.7	1.1.1.1
Aug 31, 2024 00:39:54.224704027 CEST	53	49845	1.1.1.1	192.168.2.7
Aug 31, 2024 00:39:54.538635015 CEST	49846	443	192.168.2.7	4.231.128.59
Aug 31, 2024 00:39:54.538675070 CEST	443	49846	4.231.128.59	192.168.2.7
Aug 31, 2024 00:39:54.538837910 CEST	49846	443	192.168.2.7	4.231.128.59
Aug 31, 2024 00:39:54.539299011 CEST	49846	443	192.168.2.7	4.231.128.59
Aug 31, 2024 00:39:54.539310932 CEST	443	49846	4.231.128.59	192.168.2.7
Aug 31, 2024 00:39:54.683142900 CEST	53	49845	1.1.1.1	192.168.2.7
Aug 31, 2024 00:39:54.684181929 CEST	49845	53	192.168.2.7	1.1.1.1
Aug 31, 2024 00:39:54.691735029 CEST	53	49845	1.1.1.1	192.168.2.7
Aug 31, 2024 00:39:54.691929102 CEST	49845	53	192.168.2.7	1.1.1.1
Aug 31, 2024 00:39:55.446779013 CEST	443	49846	4.231.128.59	192.168.2.7
Aug 31, 2024 00:39:55.446885109 CEST	49846	443	192.168.2.7	4.231.128.59
Aug 31, 2024 00:39:55.453993082 CEST	49846	443	192.168.2.7	4.231.128.59
Aug 31, 2024 00:39:55.453999996 CEST	443	49846	4.231.128.59	192.168.2.7
Aug 31, 2024 00:39:55.454250097 CEST	443	49846	4.231.128.59	192.168.2.7
Aug 31, 2024 00:39:55.455543041 CEST	49846	443	192.168.2.7	4.231.128.59
Aug 31, 2024 00:39:55.455568075 CEST	443	49846	4.231.128.59	192.168.2.7
Aug 31, 2024 00:39:55.455636978 CEST	49846	443	192.168.2.7	4.231.128.59
Aug 31, 2024 00:40:25.408660889 CEST	443	49740	104.98.116.138	192.168.2.7
Aug 31, 2024 00:40:25.408731937 CEST	49740	443	192.168.2.7	104.98.116.138
Aug 31, 2024 00:40:35.465215921 CEST	49850	443	192.168.2.7	142.250.185.68
Aug 31, 2024 00:40:35.465259075 CEST	443	49850	142.250.185.68	192.168.2.7
Aug 31, 2024 00:40:35.465807915 CEST	49850	443	192.168.2.7	142.250.185.68
Aug 31, 2024 00:40:35.466156960 CEST	49850	443	192.168.2.7	142.250.185.68
Aug 31, 2024 00:40:35.466175079 CEST	443	49850	142.250.185.68	192.168.2.7
Aug 31, 2024 00:40:36.115067005 CEST	443	49850	142.250.185.68	192.168.2.7
Aug 31, 2024 00:40:36.115406036 CEST	49850	443	192.168.2.7	142.250.185.68
Aug 31, 2024 00:40:36.115426064 CEST	443	49850	142.250.185.68	192.168.2.7
Aug 31, 2024 00:40:36.115740061 CEST	443	49850	142.250.185.68	192.168.2.7
Aug 31, 2024 00:40:36.119970083 CEST	49850	443	192.168.2.7	142.250.185.68
Aug 31, 2024 00:40:36.120037079 CEST	443	49850	142.250.185.68	192.168.2.7
Aug 31, 2024 00:40:36.167645931 CEST	49850	443	192.168.2.7	142.250.185.68
Aug 31, 2024 00:40:46.084906101 CEST	443	49850	142.250.185.68	192.168.2.7
Aug 31, 2024 00:40:46.085010052 CEST	443	49850	142.250.185.68	192.168.2.7
Aug 31, 2024 00:40:46.085299969 CEST	49850	443	192.168.2.7	142.250.185.68
Aug 31, 2024 00:40:46.171605110 CEST	49850	443	192.168.2.7	142.250.185.68
Aug 31, 2024 00:40:46.171646118 CEST	443	49850	142.250.185.68	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 31, 2024 00:39:30.399842024 CEST	123	123	192.168.2.7	40.119.6.228
Aug 31, 2024 00:39:30.548046112 CEST	123	123	40.119.6.228	192.168.2.7
Aug 31, 2024 00:39:31.324846983 CEST	53	53636	1.1.1.1	192.168.2.7
Aug 31, 2024 00:39:31.456382990 CEST	53	49262	1.1.1.1	192.168.2.7
Aug 31, 2024 00:39:32.438752890 CEST	53	50565	1.1.1.1	192.168.2.7
Aug 31, 2024 00:39:34.640707970 CEST	58416	53	192.168.2.7	1.1.1.1
Aug 31, 2024 00:39:34.640857935 CEST	61272	53	192.168.2.7	1.1.1.1
Aug 31, 2024 00:39:34.654203892 CEST	53	58416	1.1.1.1	192.168.2.7
Aug 31, 2024 00:39:34.656234026 CEST	53	61272	1.1.1.1	192.168.2.7
Aug 31, 2024 00:39:35.413911104 CEST	58440	53	192.168.2.7	1.1.1.1
Aug 31, 2024 00:39:35.414266109 CEST	51734	53	192.168.2.7	1.1.1.1
Aug 31, 2024 00:39:35.423002958 CEST	53	58440	1.1.1.1	192.168.2.7
Aug 31, 2024 00:39:35.425179958 CEST	53	51734	1.1.1.1	192.168.2.7
Aug 31, 2024 00:39:35.471873999 CEST	56063	53	192.168.2.7	1.1.1.1
Aug 31, 2024 00:39:35.472111940 CEST	49843	53	192.168.2.7	1.1.1.1
Aug 31, 2024 00:39:35.478909016 CEST	53	49843	1.1.1.1	192.168.2.7
Aug 31, 2024 00:39:37.260879040 CEST	65417	53	192.168.2.7	1.1.1.1
Aug 31, 2024 00:39:37.261133909 CEST	60895	53	192.168.2.7	1.1.1.1
Aug 31, 2024 00:39:37.270287037 CEST	53	60895	1.1.1.1	192.168.2.7
Aug 31, 2024 00:39:37.270622969 CEST	53	65417	1.1.1.1	192.168.2.7
Aug 31, 2024 00:39:37.271028996 CEST	53	56893	1.1.1.1	192.168.2.7
Aug 31, 2024 00:39:37.282375097 CEST	54137	53	192.168.2.7	1.1.1.1
Aug 31, 2024 00:39:37.282686949 CEST	63292	53	192.168.2.7	1.1.1.1
Aug 31, 2024 00:39:37.284694910 CEST	53	52199	1.1.1.1	192.168.2.7
Aug 31, 2024 00:39:37.291316986 CEST	53	54137	1.1.1.1	192.168.2.7
Aug 31, 2024 00:39:37.291587114 CEST	53	63292	1.1.1.1	192.168.2.7
Aug 31, 2024 00:39:37.709557056 CEST	62072	53	192.168.2.7	1.1.1.1
Aug 31, 2024 00:39:37.709769964 CEST	53690	53	192.168.2.7	1.1.1.1
Aug 31, 2024 00:39:37.718857050 CEST	53	53690	1.1.1.1	192.168.2.7
Aug 31, 2024 00:39:39.612329006 CEST	53	50277	1.1.1.1	192.168.2.7
Aug 31, 2024 00:39:40.173103094 CEST	61338	53	192.168.2.7	1.1.1.1
Aug 31, 2024 00:39:40.173690081 CEST	57646	53	192.168.2.7	1.1.1.1
Aug 31, 2024 00:39:40.179927111 CEST	53	61338	1.1.1.1	192.168.2.7
Aug 31, 2024 00:39:40.180301905 CEST	53	57646	1.1.1.1	192.168.2.7
Aug 31, 2024 00:39:50.150196075 CEST	53	64961	1.1.1.1	192.168.2.7
Aug 31, 2024 00:39:54.207801104 CEST	53	52597	1.1.1.1	192.168.2.7
Aug 31, 2024 00:40:25.589936018 CEST	138	138	192.168.2.7	192.168.2.255
Aug 31, 2024 00:40:31.475730896 CEST	53	56432	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 31, 2024 00:39:34.640707970 CEST	192.168.2.7	1.1.1.1	0x2795	Standard query (0)	sharefile8.pages.dev	A (IP address)	IN (0x0001)	false
Aug 31, 2024 00:39:34.640857935 CEST	192.168.2.7	1.1.1.1	0xc921	Standard query (0)	sharefile8.pages.dev	65	IN (0x0001)	false
Aug 31, 2024 00:39:35.413911104 CEST	192.168.2.7	1.1.1.1	0x7c96	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Aug 31, 2024 00:39:35.414266109 CEST	192.168.2.7	1.1.1.1	0xfe70	Standard query (0)	www.google.com	65	IN (0x0001)	false
Aug 31, 2024 00:39:35.471873999 CEST	192.168.2.7	1.1.1.1	0x7dc9	Standard query (0)	cdn.jsdelivr.net	A (IP address)	IN (0x0001)	false
Aug 31, 2024 00:39:35.472111940 CEST	192.168.2.7	1.1.1.1	0x88ba	Standard query (0)	cdn.jsdelivr.net	65	IN (0x0001)	false
Aug 31, 2024 00:39:37.260879040 CEST	192.168.2.7	1.1.1.1	0x2678	Standard query (0)	ipapi.co	A (IP address)	IN (0x0001)	false
Aug 31, 2024 00:39:37.261133909 CEST	192.168.2.7	1.1.1.1	0xd06c	Standard query (0)	ipapi.co	65	IN (0x0001)	false
Aug 31, 2024 00:39:37.282375097 CEST	192.168.2.7	1.1.1.1	0xf3cf	Standard query (0)	cdnjs.cloudflare.com	A (IP address)	IN (0x0001)	false
Aug 31, 2024 00:39:37.282686949 CEST	192.168.2.7	1.1.1.1	0x5efb	Standard query (0)	cdnjs.cloudflare.com	65	IN (0x0001)	false
Aug 31, 2024 00:39:37.709557056 CEST	192.168.2.7	1.1.1.1	0x1438	Standard query (0)	cdn.jsdelivr.net	A (IP address)	IN (0x0001)	false
Aug 31, 2024 00:39:37.709769964 CEST	192.168.2.7	1.1.1.1	0x27f3	Standard query (0)	cdn.jsdelivr.net	65	IN (0x0001)	false
Aug 31, 2024 00:39:40.173103094 CEST	192.168.2.7	1.1.1.1	0x7839	Standard query (0)	ipapi.co	A (IP address)	IN (0x0001)	false
Aug 31, 2024 00:39:40.173690081 CEST	192.168.2.7	1.1.1.1	0xc0b9	Standard query (0)	ipapi.co	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Aug 31, 2024 00:39:34.654203892 CEST	1.1.1.1	192.168.2.7	0x2795	No error (0)	sharefile8.pages.dev		188.114.97.3	A (IP address)	IN (0x0001)	false
Aug 31, 2024 00:39:34.654203892 CEST	1.1.1.1	192.168.2.7	0x2795	No error (0)	sharefile8.pages.dev		188.114.96.3	A (IP address)	IN (0x0001)	false
Aug 31, 2024 00:39:34.656234026 CEST	1.1.1.1	192.168.2.7	0xc921	No error (0)	sharefile8.pages.dev			65	IN (0x0001)	false
Aug 31, 2024 00:39:35.423002958 CEST	1.1.1.1	192.168.2.7	0x7c96	No error (0)	www.google.com		142.250.185.68	A (IP address)	IN (0x0001)	false
Aug 31, 2024 00:39:35.425179958 CEST	1.1.1.1	192.168.2.7	0xfe70	No error (0)	www.google.com			65	IN (0x0001)	false
Aug 31, 2024 00:39:35.478513956 CEST	1.1.1.1	192.168.2.7	0x7dc9	No error (0)	cdn.jsdelivr.net	cdn.jsdelivr.net.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 31, 2024 00:39:35.478909016 CEST	1.1.1.1	192.168.2.7	0x88ba	No error (0)	cdn.jsdelivr.net	cdn.jsdelivr.net.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 31, 2024 00:39:37.270287037 CEST	1.1.1.1	192.168.2.7	0xd06c	No error (0)	ipapi.co			65	IN (0x0001)	false
Aug 31, 2024 00:39:37.270622969 CEST	1.1.1.1	192.168.2.7	0x2678	No error (0)	ipapi.co		104.26.9.44	A (IP address)	IN (0x0001)	false
Aug 31, 2024 00:39:37.270622969 CEST	1.1.1.1	192.168.2.7	0x2678	No error (0)	ipapi.co		104.26.8.44	A (IP address)	IN (0x0001)	false
Aug 31, 2024 00:39:37.270622969 CEST	1.1.1.1	192.168.2.7	0x2678	No error (0)	ipapi.co		172.67.69.226	A (IP address)	IN (0x0001)	false
Aug 31, 2024 00:39:37.291316986 CEST	1.1.1.1	192.168.2.7	0xf3cf	No error (0)	cdnjs.cloudflare.com		104.17.25.14	A (IP address)	IN (0x0001)	false
Aug 31, 2024 00:39:37.291316986 CEST	1.1.1.1	192.168.2.7	0xf3cf	No error (0)	cdnjs.cloudflare.com		104.17.24.14	A (IP address)	IN (0x0001)	false
Aug 31, 2024 00:39:37.291587114 CEST	1.1.1.1	192.168.2.7	0x5efb	No error (0)	cdnjs.cloudflare.com			65	IN (0x0001)	false
Aug 31, 2024 00:39:37.718833923 CEST	1.1.1.1	192.168.2.7	0x1438	No error (0)	cdn.jsdelivr.net	cdn.jsdelivr.net.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 31, 2024 00:39:37.718857050 CEST	1.1.1.1	192.168.2.7	0x27f3	No error (0)	cdn.jsdelivr.net	cdn.jsdelivr.net.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 31, 2024 00:39:40.179927111 CEST	1.1.1.1	192.168.2.7	0x7839	No error (0)	ipapi.co		104.26.9.44	A (IP address)	IN (0x0001)	false
Aug 31, 2024 00:39:40.179927111 CEST	1.1.1.1	192.168.2.7	0x7839	No error (0)	ipapi.co		172.67.69.226	A (IP address)	IN (0x0001)	false
Aug 31, 2024 00:39:40.179927111 CEST	1.1.1.1	192.168.2.7	0x7839	No error (0)	ipapi.co		104.26.8.44	A (IP address)	IN (0x0001)	false
Aug 31, 2024 00:39:40.180301905 CEST	1.1.1.1	192.168.2.7	0xc0b9	No error (0)	ipapi.co			65	IN (0x0001)	false

HTTP Request Dependency Graph

sharefile8.pages.dev

https:

cdnjs.cloudflare.com

ipapi.co

fs.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49706	188.114.97.3	443	2704	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 22:39:35 UTC	862	OUT	GET /xit56kt7w1jt5s3mhgrdsk6odhghtvrycrdxoty84z4sucsd08bsbepa6wv52edrjl8mwcfcknpbcycsjetq74hex+dscntrcvkhpm4lzymvx+4sbhzddbr7tddsma1l785uupaxpd2t0gwjyuyrmto2jztaw84au7zieflszmmbu1leyxxtwf0ehetluu1jdzjigzq HTTP/1.1 Host: sharefile8.pages.dev Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-30 22:39:35 UTC	724	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 22:39:35 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=0, must-revalidate referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Q18ZN7ltJGGzFyVNaxQPbThatuq6%2Fl1PraXhklfw%2FGvROzArR0G75IMT82DhGEu%2BiWnfN8mIwUu6W8QyaGdD677t5Bdeaqgiyz2BJAQ3vMA8BomWe2bZal3Oip227FZglONVungE9Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8bb847152b158cb3-EWR alt-svc: h3=":443"; ma=86400
2024-08-30 22:39:35 UTC	523	IN	Data Raw: 32 30 34 0d 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 20 20 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 6a 73 64 65 6c 69 76 72 2e 6e 65 74 2f 67 68 2f 75 69 68 6b 64 73 6c 69 6a 73 6a 64 2f 63 61 70 74 69 76 61 74 69 6e 67 2d 61 70 70 2d 6c 79 6f 75 62 67 73 35 40 69 6e 74 65 72 6e 61 6c 2d 32 30 32 34 2d 30 37 2d 31 36 2d 32 30 2d 30 32 2d 35 38 2f 31 33 39 61 38 63 64 32 2d 64 31 30 63 2d 34 33 33 36 2d 62 61 30 34 2d 33 66 31 63 35 33 62 61 38 63 62 36 2e 6a 73 3f 68 61 73 68 3d 36 62 30 36 64 62 39 34 33 66 30 38 31 65 62 65 65 36 38 39 66 33 37 36 63 38 62 32 33 31 64 31 26 45 44 6c 46 68 36 53 4f 42 Data Ascii: 204<html> <head><title></title></head> <body> <script src="https://cdn.jsdelivr.net/gh/uihkdslijsjd/captivating-app-lyoubgs5@internal-2024-07-16-20-02-58/139a8cd2-d10c-4336-ba04-3f1c53ba8cb6.js?hash=6b06db943f081ebee689f376c8b231d1&EDlFh6SOB
2024-08-30 22:39:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49716	104.17.25.14	443	2704	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 22:39:37 UTC	622	OUT	GET /ajax/libs/font-awesome/4.7.0/css/font-awesome.css HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://sharefile8.pages.dev sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: style Referer: https://sharefile8.pages.dev/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-30 22:39:37 UTC	944	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 22:39:37 GMT Content-Type: text/css; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=30672000 ETag: W/"5eb03e5f-9226" Last-Modified: Mon, 04 May 2020 16:10:07 GMT cf-cdnjs-via: cfworker/kv Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * X-Content-Type-Options: nosniff CF-Cache-Status: HIT Age: 787707 Expires: Wed, 20 Aug 2025 22:39:37 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3Mwssc72ccpyK93GJzIoGDHT6FyNl7xbcrDW0L4JF5Xeyf%2BAVmOIQNV9RRfDlmpW3qx2o%2FKdBy8zeH0fBIz1NapSp8lCSqiFYS5QkuBjehapolGQAn8GKgWViMWR8zg%2F6H193CNH"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15780000 Server: cloudflare CF-RAY: 8bb847257a851845-EWR alt-svc: h3=":443"; ma=86400
2024-08-30 22:39:37 UTC	425	IN	Data Raw: 37 62 66 39 0d 0a 2f 2a 21 0a 20 2a 20 20 46 6f 6e 74 20 41 77 65 73 6f 6d 65 20 34 2e 37 2e 30 20 62 79 20 40 64 61 76 65 67 61 6e 64 79 20 2d 20 68 74 74 70 3a 2f 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2e 69 6f 20 2d 20 40 66 6f 6e 74 61 77 65 73 6f 6d 65 0a 20 2a 20 20 4c 69 63 65 6e 73 65 20 2d 20 68 74 74 70 3a 2f 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2e 69 6f 2f 6c 69 63 65 6e 73 65 20 28 46 6f 6e 74 3a 20 53 49 4c 20 4f 46 4c 20 31 2e 31 2c 20 43 53 53 3a 20 4d 49 54 20 4c 69 63 65 6e 73 65 29 0a 20 2a 2f 0a 2f 2a 20 46 4f 4e 54 20 50 41 54 48 0a 20 2a 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 46 6f 6e 74 41 77 65 73 Data Ascii: 7bf9/! Font Awesome 4.7.0 by @davegandy - http://fontawesome.io - @fontawesome * License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License) // FONT PATH * -------------------------- */@font-face { font-family: 'FontAwes
2024-08-30 22:39:37 UTC	1369	IN	Data Raw: 74 61 77 65 73 6f 6d 65 2d 77 65 62 66 6f 6e 74 2e 77 6f 66 66 32 3f 76 3d 34 2e 37 2e 30 27 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 2c 20 75 72 6c 28 27 2e 2e 2f 66 6f 6e 74 73 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2d 77 65 62 66 6f 6e 74 2e 77 6f 66 66 3f 76 3d 34 2e 37 2e 30 27 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 27 29 2c 20 75 72 6c 28 27 2e 2e 2f 66 6f 6e 74 73 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2d 77 65 62 66 6f 6e 74 2e 74 74 66 3f 76 3d 34 2e 37 2e 30 27 29 20 66 6f 72 6d 61 74 28 27 74 72 75 65 74 79 70 65 27 29 2c 20 75 72 6c 28 27 2e 2e 2f 66 6f 6e 74 73 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2d 77 65 62 66 6f 6e 74 2e 73 76 67 3f 76 3d 34 2e 37 2e 30 23 66 6f 6e 74 61 77 65 73 6f 6d 65 72 65 67 75 6c 61 72 27 29 20 66 6f 72 6d 61 Data Ascii: tawesome-webfont.woff2?v=4.7.0') format('woff2'), url('../fonts/fontawesome-webfont.woff?v=4.7.0') format('woff'), url('../fonts/fontawesome-webfont.ttf?v=4.7.0') format('truetype'), url('../fonts/fontawesome-webfont.svg?v=4.7.0#fontawesomeregular') forma
2024-08-30 22:39:37 UTC	1369	IN	Data Raw: 6d 3b 0a 7d 0a 2f 2a 20 44 65 70 72 65 63 61 74 65 64 20 61 73 20 6f 66 20 34 2e 34 2e 30 20 2a 2f 0a 2e 70 75 6c 6c 2d 72 69 67 68 74 20 7b 0a 20 20 66 6c 6f 61 74 3a 20 72 69 67 68 74 3b 0a 7d 0a 2e 70 75 6c 6c 2d 6c 65 66 74 20 7b 0a 20 20 66 6c 6f 61 74 3a 20 6c 65 66 74 3b 0a 7d 0a 2e 66 61 2e 70 75 6c 6c 2d 6c 65 66 74 20 7b 0a 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 2e 33 65 6d 3b 0a 7d 0a 2e 66 61 2e 70 75 6c 6c 2d 72 69 67 68 74 20 7b 0a 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2e 33 65 6d 3b 0a 7d 0a 2e 66 61 2d 73 70 69 6e 20 7b 0a 20 20 2d 77 65 62 6b 69 74 2d 61 6e 69 6d 61 74 69 6f 6e 3a 20 66 61 2d 73 70 69 6e 20 32 73 20 69 6e 66 69 6e 69 74 65 20 6c 69 6e 65 61 72 3b 0a 20 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 66 61 2d 73 70 69 Data Ascii: m;}/* Deprecated as of 4.4.0 */.pull-right { float: right;}.pull-left { float: left;}.fa.pull-left { margin-right: .3em;}.fa.pull-right { margin-left: .3em;}.fa-spin { -webkit-animation: fa-spin 2s infinite linear; animation: fa-spi
2024-08-30 22:39:37 UTC	1369	IN	Data Raw: 22 70 72 6f 67 69 64 3a 44 58 49 6d 61 67 65 54 72 61 6e 73 66 6f 72 6d 2e 4d 69 63 72 6f 73 6f 66 74 2e 42 61 73 69 63 49 6d 61 67 65 28 72 6f 74 61 74 69 6f 6e 3d 30 2c 20 6d 69 72 72 6f 72 3d 31 29 22 3b 0a 20 20 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 20 73 63 61 6c 65 28 2d 31 2c 20 31 29 3b 0a 20 20 2d 6d 73 2d 74 72 61 6e 73 66 6f 72 6d 3a 20 73 63 61 6c 65 28 2d 31 2c 20 31 29 3b 0a 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 73 63 61 6c 65 28 2d 31 2c 20 31 29 3b 0a 7d 0a 2e 66 61 2d 66 6c 69 70 2d 76 65 72 74 69 63 61 6c 20 7b 0a 20 20 2d 6d 73 2d 66 69 6c 74 65 72 3a 20 22 70 72 6f 67 69 64 3a 44 58 49 6d 61 67 65 54 72 61 6e 73 66 6f 72 6d 2e 4d 69 63 72 6f 73 6f 66 74 2e 42 61 73 69 63 49 6d 61 67 65 28 72 6f 74 61 74 69 6f 6e 3d 32 Data Ascii: "progid:DXImageTransform.Microsoft.BasicImage(rotation=0, mirror=1)"; -webkit-transform: scale(-1, 1); -ms-transform: scale(-1, 1); transform: scale(-1, 1);}.fa-flip-vertical { -ms-filter: "progid:DXImageTransform.Microsoft.BasicImage(rotation=2
2024-08-30 22:39:37 UTC	1369	IN	Data Raw: 6c 61 72 67 65 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 30 39 22 3b 0a 7d 0a 2e 66 61 2d 74 68 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 30 61 22 3b 0a 7d 0a 2e 66 61 2d 74 68 2d 6c 69 73 74 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 30 62 22 3b 0a 7d 0a 2e 66 61 2d 63 68 65 63 6b 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 30 63 22 3b 0a 7d 0a 2e 66 61 2d 72 65 6d 6f 76 65 3a 62 65 66 6f 72 65 2c 0a 2e 66 61 2d 63 6c 6f 73 65 3a 62 65 66 6f 72 65 2c 0a 2e 66 61 2d 74 69 6d 65 73 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 30 64 22 3b 0a 7d 0a 2e 66 61 2d 73 65 61 72 63 68 2d 70 6c 75 73 3a 62 65 Data Ascii: large:before { content: "\f009";}.fa-th:before { content: "\f00a";}.fa-th-list:before { content: "\f00b";}.fa-check:before { content: "\f00c";}.fa-remove:before,.fa-close:before,.fa-times:before { content: "\f00d";}.fa-search-plus:be
2024-08-30 22:39:37 UTC	1369	IN	Data Raw: 65 6e 74 3a 20 22 5c 66 30 32 39 22 3b 0a 7d 0a 2e 66 61 2d 62 61 72 63 6f 64 65 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 32 61 22 3b 0a 7d 0a 2e 66 61 2d 74 61 67 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 32 62 22 3b 0a 7d 0a 2e 66 61 2d 74 61 67 73 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 32 63 22 3b 0a 7d 0a 2e 66 61 2d 62 6f 6f 6b 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 32 64 22 3b 0a 7d 0a 2e 66 61 2d 62 6f 6f 6b 6d 61 72 6b 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 32 65 22 3b 0a 7d 0a 2e 66 61 2d 70 72 69 6e 74 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 Data Ascii: ent: "\f029";}.fa-barcode:before { content: "\f02a";}.fa-tag:before { content: "\f02b";}.fa-tags:before { content: "\f02c";}.fa-book:before { content: "\f02d";}.fa-bookmark:before { content: "\f02e";}.fa-print:before { content: "\f
2024-08-30 22:39:37 UTC	1369	IN	Data Raw: 65 70 2d 62 61 63 6b 77 61 72 64 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 34 38 22 3b 0a 7d 0a 2e 66 61 2d 66 61 73 74 2d 62 61 63 6b 77 61 72 64 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 34 39 22 3b 0a 7d 0a 2e 66 61 2d 62 61 63 6b 77 61 72 64 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 34 61 22 3b 0a 7d 0a 2e 66 61 2d 70 6c 61 79 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 34 62 22 3b 0a 7d 0a 2e 66 61 2d 70 61 75 73 65 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 34 63 22 3b 0a 7d 0a 2e 66 61 2d 73 74 6f 70 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 34 64 22 3b 0a Data Ascii: ep-backward:before { content: "\f048";}.fa-fast-backward:before { content: "\f049";}.fa-backward:before { content: "\f04a";}.fa-play:before { content: "\f04b";}.fa-pause:before { content: "\f04c";}.fa-stop:before { content: "\f04d";
2024-08-30 22:39:37 UTC	1369	IN	Data Raw: 74 3a 20 22 5c 66 30 36 37 22 3b 0a 7d 0a 2e 66 61 2d 6d 69 6e 75 73 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 36 38 22 3b 0a 7d 0a 2e 66 61 2d 61 73 74 65 72 69 73 6b 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 36 39 22 3b 0a 7d 0a 2e 66 61 2d 65 78 63 6c 61 6d 61 74 69 6f 6e 2d 63 69 72 63 6c 65 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 36 61 22 3b 0a 7d 0a 2e 66 61 2d 67 69 66 74 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 36 62 22 3b 0a 7d 0a 2e 66 61 2d 6c 65 61 66 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 36 63 22 3b 0a 7d 0a 2e 66 61 2d 66 69 72 65 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f Data Ascii: t: "\f067";}.fa-minus:before { content: "\f068";}.fa-asterisk:before { content: "\f069";}.fa-exclamation-circle:before { content: "\f06a";}.fa-gift:before { content: "\f06b";}.fa-leaf:before { content: "\f06c";}.fa-fire:before { co
2024-08-30 22:39:37 UTC	1369	IN	Data Raw: 61 2d 74 68 75 6d 62 73 2d 6f 2d 75 70 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 38 37 22 3b 0a 7d 0a 2e 66 61 2d 74 68 75 6d 62 73 2d 6f 2d 64 6f 77 6e 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 38 38 22 3b 0a 7d 0a 2e 66 61 2d 73 74 61 72 2d 68 61 6c 66 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 38 39 22 3b 0a 7d 0a 2e 66 61 2d 68 65 61 72 74 2d 6f 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 38 61 22 3b 0a 7d 0a 2e 66 61 2d 73 69 67 6e 2d 6f 75 74 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 38 62 22 3b 0a 7d 0a 2e 66 61 2d 6c 69 6e 6b 65 64 69 6e 2d 73 71 75 61 72 65 3a 62 65 66 6f 72 65 20 7b 0a Data Ascii: a-thumbs-o-up:before { content: "\f087";}.fa-thumbs-o-down:before { content: "\f088";}.fa-star-half:before { content: "\f089";}.fa-heart-o:before { content: "\f08a";}.fa-sign-out:before { content: "\f08b";}.fa-linkedin-square:before {
2024-08-30 22:39:37 UTC	1369	IN	Data Raw: 5c 66 30 61 36 22 3b 0a 7d 0a 2e 66 61 2d 68 61 6e 64 2d 6f 2d 64 6f 77 6e 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 61 37 22 3b 0a 7d 0a 2e 66 61 2d 61 72 72 6f 77 2d 63 69 72 63 6c 65 2d 6c 65 66 74 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 61 38 22 3b 0a 7d 0a 2e 66 61 2d 61 72 72 6f 77 2d 63 69 72 63 6c 65 2d 72 69 67 68 74 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 61 39 22 3b 0a 7d 0a 2e 66 61 2d 61 72 72 6f 77 2d 63 69 72 63 6c 65 2d 75 70 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 61 61 22 3b 0a 7d 0a 2e 66 61 2d 61 72 72 6f 77 2d 63 69 72 63 6c 65 2d 64 6f 77 6e 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 Data Ascii: \f0a6";}.fa-hand-o-down:before { content: "\f0a7";}.fa-arrow-circle-left:before { content: "\f0a8";}.fa-arrow-circle-right:before { content: "\f0a9";}.fa-arrow-circle-up:before { content: "\f0aa";}.fa-arrow-circle-down:before { content

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49714	104.26.9.44	443	2704	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 22:39:37 UTC	551	OUT	GET /json/ HTTP/1.1 Host: ipapi.co Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://sharefile8.pages.dev Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://sharefile8.pages.dev/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-30 22:39:38 UTC	763	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 22:39:38 GMT Content-Type: application/json Content-Length: 763 Connection: close Allow: POST, GET, OPTIONS, HEAD, OPTIONS X-Frame-Options: DENY Vary: Host, origin access-control-allow-origin: https://sharefile8.pages.dev X-Content-Type-Options: nosniff Referrer-Policy: same-origin Cross-Origin-Opener-Policy: same-origin CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AlE7MGBGYSQ%2BuhzRUfdI6muB7Sg9bO9NN5bq4LOJ9WL%2FtJviTTHzFNr9NKVRhytFYaRidfJTDc99KO6F4G5PVR%2F2a1wxzmXiQu9q5921iJ0KPa17H8yfgJur"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8bb84725ea668c4d-EWR
2024-08-30 22:39:38 UTC	606	IN	Data Raw: 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 30 2f 32 34 22 2c 0a 20 20 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 22 49 50 76 34 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 5f 63 6f 64 65 22 3a 20 22 4e 59 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 5f 6e 61 6d 65 22 3a 20 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 63 6f 75 6e Data Ascii: { "ip": "8.46.123.33", "network": "8.46.123.0/24", "version": "IPv4", "city": "New York City", "region": "New York", "region_code": "NY", "country": "US", "country_name": "United States", "country_code": "US", "coun
2024-08-30 22:39:38 UTC	157	IN	Data Raw: 6f 6c 6c 61 72 22 2c 0a 20 20 20 20 22 6c 61 6e 67 75 61 67 65 73 22 3a 20 22 65 6e 2d 55 53 2c 65 73 2d 55 53 2c 68 61 77 2c 66 72 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 5f 61 72 65 61 22 3a 20 39 36 32 39 30 39 31 2e 30 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 5f 70 6f 70 75 6c 61 74 69 6f 6e 22 3a 20 33 32 37 31 36 37 34 33 34 2c 0a 20 20 20 20 22 61 73 6e 22 3a 20 22 41 53 33 33 35 36 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 4c 45 56 45 4c 33 22 0a 7d Data Ascii: ollar", "languages": "en-US,es-US,haw,fr", "country_area": 9629091.0, "country_population": 327167434, "asn": "AS3356", "org": "LEVEL3"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49707	188.114.97.3	443	2704	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 22:39:38 UTC	7456	OUT	GET /xit56kt7w1jt5s3mhgrdsk6odhghtvrycrdxoty84z4sucsd08bsbepa6wv52edrjl8mwcfcknpbcycsjetq74hex+dscntrcvkhpm4lzymvx+4sbhzddbr7tddsma1l785uupaxpd2t0gwjyuyrmto2jztaw84au7zieflszmmbu1leyxxtwf0ehetluu1jdzjigzq?ef5cb60b3eb712165be9aa2e8432255dm0haqp1l=U2FsdGVkX1%2F54Vi5k0fpJopgxlpTE%2Fwt1JbQBXUwtHI23IsXwilEibczOtXIyEafGUqvIxelPBKzraUcUZYsXddxVc0shoqZRiLuOtEQo8KQVHVVuhOjGpqAXb2ikXZcbMrR3pLVYbbERPy3QEAprq0jX%2F8t0p34IN%2BfftC4hK3%2Bs1g90JwifgjP3PTpK1aoAXRSeuyZNO%2BH9gJzHQNdJE58%2F1O7kPWQUEDNBeiPMexEwjzhqyPS9sJwf0XY9a6%2BVhLlq7y81V6%2FcHskp%2BgdCzxqfr2n7lQ1IzSUDClcGHZRzUhWfautY7xVjrLnzgh7ZdWqSUKbXwS23VjXs%2FdDRWpe82DNrAmaKQbf9Na%2B%2Bp6FxgINSz%2FMl0rbKTfp%2F%2FB8Lz5SQtpMofgzRCNhzPatp%2BV5xmEtnUqea565l6q9U5MRShooxYUyXTQVvbgAlt0sKy1Zn%2BcT%2FslFRCHHR0zWoJWY3C6nqLsoAd%2F%2FoO4Kuru019imWUO6zMl%2Bck5uBY464whKgUjunYedrNn084WCIbOmkMucwZLKqm3bOAd%2FibGCLBme5AHdSITb2ryus7xe9v4kpSTw2biTnqZDObxiPxx%2FlIUJVqeZ3GCPECdUF8rVpu8FzjC3cJ9NKqT7zzV6mx%2FvZ%2FeytMk04I%2BoShNpqBGNK%2F6JWx25ptmkQXmET2SmB3YR9%2BoDTAQck88otqYtCYclKM0QWtWB1tYq [TRUNCATED] Host: sharefile8.pages.dev Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://sharefile8.pages.dev/xit56kt7w1jt5s3mhgrdsk6odhghtvrycrdxoty84z4sucsd08bsbepa6wv52edrjl8mwcfcknpbcycsjetq74hex+dscntrcvkhpm4lzymvx+4sbhzddbr7tddsma1l785uupaxpd2t0gwjyuyrmto2jztaw84au7zieflszmmbu1leyxxtwf0ehetluu1jdzjigzq?ef5cb60b3eb712165be9aa2e8432255dm0haqp1l=U2FsdGVkX1%2F54Vi5k0fpJopgxlpTE%2Fwt1JbQBXUwtHI23IsXwilEibczOtXIyEafGUqvIxelPBKzraUcUZYsXddxVc0shoqZRiLuOtEQo8KQVHVVuhOjGpqAXb2ikXZcbMrR3pLVYbbERPy3QEAprq0jX%2F8t0p34IN%2BfftC4hK3%2Bs1g90JwifgjP3PTpK1aoAXRSeuyZNO%2BH9gJzHQNdJE58%2F1O7kPWQUEDNBeiPMexEwjzhqyPS9sJwf0XY9a6%2BVhLlq7y81V6%2FcHskp%2BgdCzxqfr2n7lQ1IzSUDClcGHZRzUhWfautY7xVjrLnzgh7ZdWqSUKbXwS23VjXs%2FdDRWpe82DNrAmaKQbf9Na%2B%2Bp6FxgINSz%2FMl0rbKTfp%2F%2FB8Lz5SQtpMofgzRCNhzPatp%2BV5xmEtnUqea565l6q9U5MRShooxYUyXTQVvbgAlt0sKy1Zn%2BcT%2FslFRCHHR0zWoJWY3C6nqLsoAd%2F%2FoO4Kuru019imWUO6zMl%2Bck5uBY464whKgUjunYedrNn084WCIbOmkMucwZLKqm3bOAd%2FibGCLBme5AHdSITb2ryus7xe9v4kpSTw2biTnqZDObxiPxx%2FlIUJVqeZ3GCPECdUF8rVpu8FzjC3cJ9NKqT7zzV6mx%2FvZ%2FeytMk04I%2BoShNpqBGNK%2F6JWx25ptmkQXmET2SmB3YR9 [TRUNCATED] Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-30 22:39:38 UTC	728	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 22:39:38 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=0, must-revalidate referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2F8ckNq5K%2FgYiz%2Bg2kRc%2Bx2bcnzoTLsW4obWRoS2G6OGgYfFj2XGTwv%2BlPzCVvG8jjuqsabZLlsRQaIKuaOiRJRz6CB6tkiy0Go3qkneXSRw2mq0VvPvWzObVOyMkveNa6rzU4oHAjw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8bb84727a8b04408-EWR alt-svc: h3=":443"; ma=86400
2024-08-30 22:39:38 UTC	523	IN	Data Raw: 32 30 34 0d 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 20 20 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 6a 73 64 65 6c 69 76 72 2e 6e 65 74 2f 67 68 2f 75 69 68 6b 64 73 6c 69 6a 73 6a 64 2f 63 61 70 74 69 76 61 74 69 6e 67 2d 61 70 70 2d 6c 79 6f 75 62 67 73 35 40 69 6e 74 65 72 6e 61 6c 2d 32 30 32 34 2d 30 37 2d 31 36 2d 32 30 2d 30 32 2d 35 38 2f 31 33 39 61 38 63 64 32 2d 64 31 30 63 2d 34 33 33 36 2d 62 61 30 34 2d 33 66 31 63 35 33 62 61 38 63 62 36 2e 6a 73 3f 68 61 73 68 3d 36 62 30 36 64 62 39 34 33 66 30 38 31 65 62 65 65 36 38 39 66 33 37 36 63 38 62 32 33 31 64 31 26 45 44 6c 46 68 36 53 4f 42 Data Ascii: 204<html> <head><title></title></head> <body> <script src="https://cdn.jsdelivr.net/gh/uihkdslijsjd/captivating-app-lyoubgs5@internal-2024-07-16-20-02-58/139a8cd2-d10c-4336-ba04-3f1c53ba8cb6.js?hash=6b06db943f081ebee689f376c8b231d1&EDlFh6SOB
2024-08-30 22:39:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49717	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-08-30 22:39:38 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-08-30 22:39:38 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=39435 Date: Fri, 30 Aug 2024 22:39:38 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49721	40.126.31.71	443

Timestamp	Bytes transferred	Direction	Data
2024-08-30 22:39:39 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-08-30 22:39:39 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-08-30 22:39:40 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 30 Aug 2024 22:38:39 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C531_BL2 x-ms-request-id: 1c5d0814-ad73-4104-95e5-42ee5c0caca4 PPServer: PPV: 30 H: BL02EPF0001D8F3 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 30 Aug 2024 22:39:39 GMT Connection: close Content-Length: 1276
2024-08-30 22:39:40 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49730	104.26.9.44	443	2704	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 22:39:40 UTC	337	OUT	GET /json/ HTTP/1.1 Host: ipapi.co Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-30 22:39:40 UTC	708	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 22:39:40 GMT Content-Type: application/json Content-Length: 763 Connection: close Allow: POST, OPTIONS, OPTIONS, GET, HEAD X-Frame-Options: DENY Vary: Host, origin X-Content-Type-Options: nosniff Referrer-Policy: same-origin Cross-Origin-Opener-Policy: same-origin CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cL2ZBu1YxpI4p5C0Jbra1sTq%2B2KiLg6lpY%2B4GAnE4GdGtex0FwYyBeYe%2BP1fIs2ri5N12H7TJdaXFu9WgW%2B%2Fti9e6yHvcGy3ojtA7iEnv81PUhNhqV9LU5dk"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8bb847383c5a4303-EWR
2024-08-30 22:39:40 UTC	661	IN	Data Raw: 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 30 2f 32 34 22 2c 0a 20 20 20 20 22 76 65 72 73 69 6f 6e 22 3a 20 22 49 50 76 34 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 5f 63 6f 64 65 22 3a 20 22 4e 59 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 5f 6e 61 6d 65 22 3a 20 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 63 6f 75 6e Data Ascii: { "ip": "8.46.123.33", "network": "8.46.123.0/24", "version": "IPv4", "city": "New York City", "region": "New York", "region_code": "NY", "country": "US", "country_name": "United States", "country_code": "US", "coun
2024-08-30 22:39:40 UTC	102	IN	Data Raw: 6e 74 72 79 5f 61 72 65 61 22 3a 20 39 36 32 39 30 39 31 2e 30 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 5f 70 6f 70 75 6c 61 74 69 6f 6e 22 3a 20 33 32 37 31 36 37 34 33 34 2c 0a 20 20 20 20 22 61 73 6e 22 3a 20 22 41 53 33 33 35 36 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 4c 45 56 45 4c 33 22 0a 7d Data Ascii: ntry_area": 9629091.0, "country_population": 327167434, "asn": "AS3356", "org": "LEVEL3"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49729	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-08-30 22:39:40 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-08-30 22:39:41 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=39386 Date: Fri, 30 Aug 2024 22:39:40 GMT Content-Length: 55 Connection: close X-CID: 2
2024-08-30 22:39:41 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	49731	40.126.31.71	443

Timestamp	Bytes transferred	Direction	Data
2024-08-30 22:39:41 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-08-30 22:39:41 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-08-30 22:39:41 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 30 Aug 2024 22:38:41 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C531_BAY x-ms-request-id: 0b148d34-1954-4df9-b620-1cbe3cb47b45 PPServer: PPV: 30 H: PH1PEPF00011DF9 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 30 Aug 2024 22:39:41 GMT Connection: close Content-Length: 1276
2024-08-30 22:39:41 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	49732	40.126.31.71	443

Timestamp	Bytes transferred	Direction	Data
2024-08-30 22:39:41 UTC	446	OUT	POST /ppsecure/deviceaddcredential.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 7642 Host: login.live.com
2024-08-30 22:39:41 UTC	7642	OUT	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 71 75 65 73 74 3e 3c 43 6c 69 65 6e 74 49 6e 66 6f 20 6e 61 6d 65 3d 22 49 44 43 52 4c 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 3e 3c 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 32 34 3c 2f 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 3c 2f 43 6c 69 65 6e 74 49 6e 66 6f 3e 3c 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 6b 67 79 6a 61 7a 7a 65 72 76 73 72 68 70 3c 2f 4d 65 6d 62 65 72 6e 61 6d 65 3e 3c 50 61 73 73 77 6f 72 64 3e 6b 2b 6b 62 70 64 25 21 2b 24 57 68 63 71 66 71 4d 29 49 65 3c 2f 50 61 73 73 77 6f 72 64 3e 3c 2f 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4f 6c 64 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 71 74 6c 74 6e 74 63 62 72 65 71 75 61 6a 3c 2f 4f 6c 64 4d Data Ascii: <DeviceAddRequest><ClientInfo name="IDCRL" version="1.0"><BinaryVersion>24</BinaryVersion></ClientInfo><Authentication><Membername>02kgyjazzervsrhp</Membername><Password>k+kbpd%!+$WhcqfqM)Ie</Password></Authentication><OldMembername>02qtltntcbrequaj</OldM
2024-08-30 22:39:44 UTC	542	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/xml Expires: Fri, 30 Aug 2024 22:38:41 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C526_BAY x-ms-request-id: b98574a8-3ee3-4aba-8dc9-2ac82e6011c8 PPServer: PPV: 30 H: PH1PEPF00011E46 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 30 Aug 2024 22:39:43 GMT Connection: close Content-Length: 17166
2024-08-30 22:39:44 UTC	15842	IN	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 73 70 6f 6e 73 65 20 53 75 63 63 65 73 73 3d 22 74 72 75 65 22 3e 3c 73 75 63 63 65 73 73 3e 74 72 75 65 3c 2f 73 75 63 63 65 73 73 3e 3c 70 75 69 64 3e 30 30 31 38 38 30 30 46 33 45 36 33 34 31 42 33 3c 2f 70 75 69 64 3e 3c 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 33 3c 2f 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 3c 4c 69 63 65 6e 73 65 20 43 6f 6e 74 65 6e 74 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 2d 38 63 63 35 2d 62 32 66 35 33 63 38 33 30 62 37 36 22 20 49 44 3d 22 34 37 63 31 35 34 38 34 2d 64 30 39 66 2d 34 63 37 61 2d 39 35 37 32 2d 37 30 33 65 61 34 35 64 34 37 34 36 22 20 4c 69 63 65 6e 73 65 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 Data Ascii: <DeviceAddResponse Success="true"><success>true</success><puid>0018800F3E6341B3</puid><DeviceTpmKeyState>3</DeviceTpmKeyState><License ContentID="3252b20c-d425-4711-8cc5-b2f53c830b76" ID="47c15484-d09f-4c7a-9572-703ea45d4746" LicenseID="3252b20c-d425-4711
2024-08-30 22:39:44 UTC	1324	IN	Data Raw: 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 30 39 2f 78 6d 6c 64 73 69 67 23 65 6e 76 65 6c 6f 70 65 64 2d 73 69 67 6e 61 74 75 72 65 22 2f 3e 3c 2f 54 72 61 6e 73 66 6f 72 6d 73 3e 3c 44 69 67 65 73 74 4d 65 74 68 6f 64 20 41 6c 67 6f 72 69 74 68 6d 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 30 34 2f 78 6d 6c 65 6e 63 23 73 68 61 32 35 36 22 2f 3e 3c 44 69 67 65 73 74 56 61 6c 75 65 3e 67 74 71 77 70 52 35 66 47 44 61 6f 48 73 4d 37 49 57 47 4b 5a 67 61 77 58 61 30 42 50 69 47 61 65 35 62 49 75 6e 2f 52 51 4a 41 3d 3c 2f 44 69 67 65 73 74 56 61 6c 75 65 3e 3c 2f 52 65 66 65 72 65 6e 63 65 3e 3c 2f 53 69 67 6e 65 64 49 6e 66 6f 3e 3c 53 69 67 6e 61 74 75 72 65 56 61 6c 75 65 3e 41 46 38 6f 46 52 2b 47 66 Data Ascii: tp://www.w3.org/2000/09/xmldsig#enveloped-signature"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><DigestValue>gtqwpR5fGDaoHsM7IWGKZgawXa0BPiGae5bIun/RQJA=</DigestValue></Reference></SignedInfo><SignatureValue>AF8oFR+Gf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.7	49742	40.126.31.71	443

Timestamp	Bytes transferred	Direction	Data
2024-08-30 22:39:46 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-08-30 22:39:46 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-08-30 22:39:47 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 30 Aug 2024 22:38:46 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C528_BAY x-ms-request-id: 7262ee36-59ae-4683-8051-ac899ddd44b3 PPServer: PPV: 30 H: PH1PEPF0001201D V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 30 Aug 2024 22:39:46 GMT Connection: close Content-Length: 11389
2024-08-30 22:39:47 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.7	49743	40.126.31.71	443

Timestamp	Bytes transferred	Direction	Data
2024-08-30 22:39:48 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-08-30 22:39:48 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-08-30 22:39:48 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 30 Aug 2024 22:38:48 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30345.2 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C528_BAY x-ms-request-id: 113cb8c0-3166-4883-98db-982b379e325e PPServer: PPV: 30 H: PH1PEPF00011E4B V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 30 Aug 2024 22:39:48 GMT Connection: close Content-Length: 11389
2024-08-30 22:39:48 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.7	49744	40.126.31.71	443

Timestamp	Bytes transferred	Direction	Data
2024-08-30 22:39:49 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4710 Host: login.live.com
2024-08-30 22:39:49 UTC	4710	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-08-30 22:39:50 UTC	656	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 30 Aug 2024 22:38:49 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=5&213=292991&215=0&315=1&215=0&315=1&214=30&288=16.0.30345.2 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C528_BAY x-ms-request-id: 2fe18814-aa2e-44e8-9509-20ba3975c662 PPServer: PPV: 30 H: PH1PEPF00011E42 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 30 Aug 2024 22:39:49 GMT Connection: close Content-Length: 10173
2024-08-30 22:39:50 UTC	10173	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.7	49745	40.126.31.71	443

Timestamp	Bytes transferred	Direction	Data
2024-08-30 22:39:49 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-08-30 22:39:49 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-08-30 22:39:49 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 30 Aug 2024 22:38:49 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C531_BAY x-ms-request-id: 75bc7c06-ad63-4034-aa65-70c4085b2a00 PPServer: PPV: 30 H: PH1PEPF00012016 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 30 Aug 2024 22:39:49 GMT Connection: close Content-Length: 1918
2024-08-30 22:39:49 UTC	1918	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.7	49746	40.126.31.71	443

Timestamp	Bytes transferred	Direction	Data
2024-08-30 22:39:50 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-08-30 22:39:50 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-08-30 22:39:51 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 30 Aug 2024 22:38:51 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C528_BL2 x-ms-request-id: 48b3a9c6-d350-4a39-a51b-dd0006f304e2 PPServer: PPV: 30 H: BL02EPF0001D73C V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 30 Aug 2024 22:39:50 GMT Connection: close Content-Length: 11409
2024-08-30 22:39:51 UTC	11409	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.7	49749	40.126.31.71	443

Timestamp	Bytes transferred	Direction	Data
2024-08-30 22:39:52 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-08-30 22:39:52 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-08-30 22:39:53 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 30 Aug 2024 22:38:52 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30345.2 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C528_BAY x-ms-request-id: d13906de-000f-4b62-a410-55a2af1a42dc PPServer: PPV: 30 H: PH1PEPF00011E48 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 30 Aug 2024 22:39:52 GMT Connection: close Content-Length: 11409
2024-08-30 22:39:53 UTC	11409	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Target ID:	1
Start time:	18:39:24
Start date:	30/08/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	18:39:29
Start date:	30/08/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1980,i,12944064432080657643,2785131983954265400,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	18:39:33
Start date:	30/08/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://sharefile8.pages.dev/xit56kt7w1jt5s3mhgrdsk6odhghtvrycrdxoty84z4sucsd08bsbepa6wv52edrjl8mwcfcknpbcycsjetq74hex+dscntrcvkhpm4lzymvx+4sbhzddbr7tddsma1l785uupaxpd2t0gwjyuyrmto2jztaw84au7zieflszmmbu1leyxxtwf0ehetluu1jdzjigzq"
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Source: https://sharefile8.pages.dev/xit56kt7w1jt5s3mhgrdsk6odhghtvrycrdxoty84z4sucsd08bsbepa6wv52edrjl8mwcfcknpbcycsjetq74hex+dscntrcvkhpm4lzymvx+4sbhzddbr7tddsma1l785uupaxpd2t0gwjyuyrmto2jztaw84au7zieflszmmbu1leyxxtwf0ehetluu1jdzjigzq	Avira URL Cloud: detection malicious, Label: phishing
Source: https://sharefile8.pages.dev/xit56kt7w1jt5s3mhgrdsk6odhghtvrycrdxoty84z4sucsd08bsbepa6wv52edrjl8mwcfcknpbcycsjetq74hex+dscntrcvkhpm4lzymvx+4sbhzddbr7tddsma1l785uupaxpd2t0gwjyuyrmto2jztaw84au7zieflszmmbu1leyxxtwf0ehetluu1jdzjigzq	SlashNext: detection malicious, Label: Credential Stealing type: Phishing & Social Engineering

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://sharefile8.pages.dev/xit56kt7w1jt5s3mhgrdsk6odhghtvrycrdxoty84z4sucsd08bsbepa6wv52edrjl8mwcfcknpbcycsjetq74hex+dscntrcvkhpm4lzymvx+4sbhzddbr7tddsma1l785uupaxpd2t0gwjyuyrmto2jztaw84au7zieflszmmbu1leyxxtwf0ehetluu1jdzjigzq

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 115

Chrome Cache Entry: 116

Chrome Cache Entry: 117

Chrome Cache Entry: 118

Chrome Cache Entry: 119

Chrome Cache Entry: 120

Chrome Cache Entry: 121

Chrome Cache Entry: 122

Chrome Cache Entry: 123

Chrome Cache Entry: 124

Chrome Cache Entry: 125

Chrome Cache Entry: 126

Chrome Cache Entry: 127

Chrome Cache Entry: 128

Chrome Cache Entry: 129

Chrome Cache Entry: 130

Chrome Cache Entry: 131

Chrome Cache Entry: 132

Chrome Cache Entry: 133

Chrome Cache Entry: 134

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Windows Analysis Report
https://sharefile8.pages.dev/xit56kt7w1jt5s3mhgrdsk6odhghtvrycrdxoty84z4sucsd08bsbepa6wv52edrjl8mwcfcknpbcycsjetq74hex+dscntrcvkhpm4lzymvx+4sbhzddbr7tddsma1l785uupaxpd2t0gwjyuyrmto2jztaw84au7zieflszmmbu1leyxxtwf0ehetluu1jdzjigzq