Edit tour

Windows Analysis Report
https://uopheldlognxo.godaddysites.com/

Overview

General Information

Sample URL:	https://uopheldlognxo.godaddysites.com/
Analysis ID:	1521136
Infos:

Detection

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

HTML body contains low number of good links

HTML title does not match URL

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

chrome.exe (PID: 4136 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 764 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1960 --field-trial-handle=1712,i,10613786820341075908,2899989241652874171,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 3820 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://uopheldlognxo.godaddysites.com/" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://uopheldlognxo.godaddysites.com/

SlashNext: detection malicious, Label: Fraudulent Website type: Phishing & Social usering

Multi AV Scanner detection for domain / URL

Source: uopheldlognxo.godaddysites.com

Virustotal: Detection: 8%

Perma Link

Multi AV Scanner detection for submitted file

Source: https://uopheldlognxo.godaddysites.com/

Virustotal: Detection: 7%

Perma Link

Source: https://uopheldlognxo.godaddysites.com/

HTTP Parser: Number of links: 0

Source: https://uopheldlognxo.godaddysites.com/

HTTP Parser: Title: phold Loin | Sign In does not match URL

Source: https://uopheldlognxo.godaddysites.com/

HTTP Parser: No <meta name="copyright".. found

Source: unknown

HTTPS traffic detected: 173.222.162.64:443 -> 192.168.2.6:49791 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49793 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49795 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49800 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49802 version: TLS 1.2

Source: unknown

HTTPS traffic detected: 173.222.162.64:443 -> 192.168.2.6:49791 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: uopheldlognxo.godaddysites.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /sw.js HTTP/1.1Host: uopheldlognxo.godaddysites.comConnection: keep-aliveCache-Control: max-age=0Accept: /Service-Worker: scriptSec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: serviceworkerReferer: https://uopheldlognxo.godaddysites.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: dps_site_id=us-east-1
Source: global traffic	HTTP traffic detected: GET /manifest.webmanifest HTTP/1.1Host: uopheldlognxo.godaddysites.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: manifestReferer: https://uopheldlognxo.godaddysites.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: uopheldlognxo.godaddysites.comConnection: keep-alivePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://uopheldlognxo.godaddysites.com/sw.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: dps_site_id=us-east-1

Source: global traffic	DNS traffic detected: DNS query: uopheldlognxo.godaddysites.com
Source: global traffic	DNS traffic detected: DNS query: img1.wsimg.com
Source: global traffic	DNS traffic detected: DNS query: isteam.wsimg.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: chromecache_86.2.dr, chromecache_82.2.dr, chromecache_112.2.dr, chromecache_74.2.dr	String found in binary or memory: http://jedwatson.github.io/classnames
Source: chromecache_85.2.dr	String found in binary or memory: http://scripts.sil.org/OFL
Source: chromecache_92.2.dr	String found in binary or memory: https://img1.wsimg.com/blobby/go/font/LeagueSpartan/LeagueSpartan.woff)
Source: chromecache_92.2.dr	String found in binary or memory: https://img1.wsimg.com/blobby/go/font/LeagueSpartan/LeagueSpartan.woff2)
Source: chromecache_85.2.dr	String found in binary or memory: https://img1.wsimg.com/poly/v3/polyfill.min.js?rum=0&unknown=polyfill&flags=gated&features=Intl.~loc
Source: chromecache_85.2.dr	String found in binary or memory: https://uopheldlognxo.godaddysites.com/
Source: chromecache_85.2.dr	String found in binary or memory: https://www.fontsquirrel.com/license/league-spartan

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800

Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49793 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49795 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49800 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49802 version: TLS 1.2

Source: classification engine

Classification label: mal64.win@16/83@10/6

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1960 --field-trial-handle=1712,i,10613786820341075908,2899989241652874171,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://uopheldlognxo.godaddysites.com/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1960 --field-trial-handle=1712,i,10613786820341075908,2899989241652874171,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
https://uopheldlognxo.godaddysites.com/	7%	Virustotal		Browse
https://uopheldlognxo.godaddysites.com/	100%	SlashNext	Fraudulent Website type: Phishing & Social usering

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
isteam.wsimg.com	0%	Virustotal	Browse
img1.wsimg.com	0%	Virustotal	Browse
fp2e7a.wpc.phicdn.net	0%	Virustotal	Browse
www.google.com	0%	Virustotal	Browse
bg.microsoft.map.fastly.net	0%	Virustotal	Browse
uopheldlognxo.godaddysites.com	8%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://scripts.sil.org/OFL	0%	URL Reputation	safe
http://jedwatson.github.io/classnames	0%	URL Reputation	safe
https://img1.wsimg.com/poly/v3/polyfill.min.js?rum=0&unknown=polyfill&flags=gated&features=Intl.~loc	0%	Virustotal		Browse
https://www.fontsquirrel.com/license/league-spartan	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	0%, Virustotal, Browse	unknown
uopheldlognxo.godaddysites.com	13.248.243.5	true	false	8%, Virustotal, Browse	unknown
www.google.com	142.250.186.100	true	false	0%, Virustotal, Browse	unknown
isteam.wsimg.com	35.157.66.55	true	false	0%, Virustotal, Browse	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	0%, Virustotal, Browse	unknown
img1.wsimg.com	unknown	unknown	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Reputation
https://uopheldlognxo.godaddysites.com/	true	unknown
https://uopheldlognxo.godaddysites.com/manifest.webmanifest	true	unknown
https://uopheldlognxo.godaddysites.com/sw.js	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://img1.wsimg.com/blobby/go/font/LeagueSpartan/LeagueSpartan.woff)	chromecache_92.2.dr	false		unknown
http://scripts.sil.org/OFL	chromecache_85.2.dr	false	URL Reputation: safe	unknown
https://img1.wsimg.com/poly/v3/polyfill.min.js?rum=0&unknown=polyfill&flags=gated&features=Intl.~loc	chromecache_85.2.dr	false	0%, Virustotal, Browse	unknown
https://img1.wsimg.com/blobby/go/font/LeagueSpartan/LeagueSpartan.woff2)	chromecache_92.2.dr	false		unknown
http://jedwatson.github.io/classnames	chromecache_86.2.dr, chromecache_82.2.dr, chromecache_112.2.dr, chromecache_74.2.dr	false	URL Reputation: safe	unknown
https://www.fontsquirrel.com/license/league-spartan	chromecache_85.2.dr	false	0%, Virustotal, Browse	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.248.243.5	uopheldlognxo.godaddysites.com	United States	16509	AMAZON-02US	false
35.157.66.55	isteam.wsimg.com	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.186.100	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.4
192.168.2.6

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1521136
Start date and time:	2024-09-28 04:50:53 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 18s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://uopheldlognxo.godaddysites.com/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal64.win@16/83@10/6
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.184.195, 142.250.184.238, 74.125.71.84, 34.104.35.123, 142.250.74.202, 142.250.185.195, 23.38.98.114, 23.38.98.78, 20.12.23.50, 192.229.221.95, 20.3.187.198, 93.184.221.240, 40.69.42.241
Excluded domains from analysis (whitelisted): e40258.g.akamaiedge.net, slscr.update.microsoft.com, clientservices.googleapis.com, wu.azureedge.net, clients2.google.com, ocsp.digicert.com, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, sls.update.microsoft.com, hlb.apr-52dd2-0.edgecastdns.net, update.googleapis.com, global-wildcard.wsimg.com.sni-only.edgekey.net, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net, client.wns.windows.com, fonts.googleapis.com, fs.microsoft.com, accounts.google.com, fonts.gstatic.com, ctldl.windowsupdate.com.delivery.microsoft.com, wu.ec.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, edgedl.me.gvt1.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

⊘No simulations

LLM Input / Output

Input	Output
URL: https://uopheldlognxo.godaddysites.com/ Model: jbxai	{ "brand":["Uphold"], "contains_trigger_text":true, "trigger_text":"Get Started", "prominent_button_name":"Get Started", "text_input_field_labels":["From", "To"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

Input

Output

URL: https://uopheldlognxo.godaddysites.com/ Model: jbxai

{
"brand":["Uphold"],
"contains_trigger_text":true,
"trigger_text":"Get Started",
"prominent_button_name":"Get Started",
"text_input_field_labels":["From",
"To"],
"pdf_icon_visible":false,
"has_visible_captcha":false,
"has_urgent_text":false,
"has_visible_qrcode":false}

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

Chrome Cache Entry: 100

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3043)
Category:	dropped
Size (bytes):	3092
Entropy (8bit):	5.221416224205306
Encrypted:	false
SSDEEP:	96:/NSXU/vuELNSXtiF7ANSXTJrrBNSXt7X5wqh:VcKncc7ycd3cd5w8
MD5:	852CBC5322260E00B44F2C682F88B2C7
SHA1:	BCAF229E6134F43EB5F974C9891E4D16FAF1D344
SHA-256:	BAE437DBEFE58377D88C9D579DB7C59F4202F3FBF88866D0005FB375BE6B2CD7
SHA-512:	F031B43F7FA0DA001F71DDCFFE5E322A94C5F1F52F7C4D67D34880243D9D361AC55C0E5001DD004390867CB31E5DEF5D4D9282E6E2ECB9AEC0E880AA5B786BA3
Malicious:	false
Reputation:	low
Preview:	define("@widget/LAYOUT/c/bs-loaders-fffeeba5.js",["exports","~/c/bs-index3"],(function(e,a){"use strict";e.B=function(e){const{SVG:c}=(global.Core\|\|guac["@wsb/guac-widget-core"]).UX2.Element;return this.merge({tag:"div",children:(global.React\|\|guac.react).createElement((global.React\|\|guac.react).Fragment,null,(global.React\|\|guac.react).createElement(c,{viewBox:"0 0 44 44",width:"3em",height:"3em",fill:"currentColor"},(global.React\|\|guac.react).createElement("path",{fillRule:"evenodd",d:"M31.968 23H12.032c-.57 0-1.032-.448-1.032-1 0-.553.462-1 1.032-1h19.936c.57 0 1.032.447 1.032 1 0 .552-.462 1-1.032 1"})),(global.React\|\|guac.react).createElement((global.Core\|\|guac["@wsb/guac-widget-core"]).UX.Style,null,a.k.loaderBalance)),style:{"> svg":{animation:"balance 1s infinite cubic-bezier(.62,.06,.33,.79);",transformOrigin:"center"}}},e)},e.C=function(e){const{SVG:c}=(global.Core\|\|guac["@wsb/guac-widget-core"]).UX2.Element;return this.merge({tag:"div",children:(global.React\|\|guac.react).crea

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32950), with no line terminators
Category:	downloaded
Size (bytes):	32950
Entropy (8bit):	5.234138841698361
Encrypted:	false
SSDEEP:	768:8QMz7Xi7utc79QusIPgexnKnPxPC7JWU/VHeLNsiQk/c4ur2McV2xdnGYeCjWQT0:si79wq0xPCFWsHuCleZ0j/TsmUr
MD5:	13E5EB81B382492659903C3717DD1CE5
SHA1:	2AF41BA323923E86466EFEDC27B3F059FC79252C
SHA-256:	883EDE9D632BEE381BA377009476882EDFF5AB6F3A712DBE7B1678C05F2D62FA
SHA-512:	16E1314393E6AA825876A292A93C4D8C874CA33CF78B408782E501CF48AC568C711D50CE1E9DB51D1431D3BC8B08052917A8B0B5AF1782FFFEEA504AC4E12ED9
Malicious:	false
Reputation:	low
URL:	https://uopheldlognxo.godaddysites.com/sw.js
Preview:	(()=>{"use strict";var e={895:()=>{try{self["workbox:cacheable-response:6.4.1"]&&_()}catch(e){}},259:(e,t,s)=>{s.d(t,{B:()=>a}),s(913);class a{constructor(){this.promise=new Promise(((e,t)=>{this.resolve=e,this.reject=t}))}}},125:(e,t,s)=>{s.d(t,{V:()=>a}),s(913);class a extends Error{constructor(e,t){super(((e,...t)=>{let s=e;return t.length>0&&(s+=` :: ${JSON.stringify(t)}`),s})(e,t)),this.name=e,this.details=t}}},524:(e,t,s)=>{s.d(t,{h:()=>a}),s(125),s(913);const a=null},594:(e,t,s)=>{function a(e,t){const s=new URL(e);for(const e of t)s.searchParams.delete(e);return s.href}async function n(e,t,s,n){const r=a(t.url,s);if(t.url===r)return e.match(t,n);const i=Object.assign(Object.assign({},n),{ignoreSearch:!0}),c=await e.keys(t,i);for(const t of c)if(r===a(t.url,s))return e.match(t,n)}s.d(t,{F:()=>n}),s(913)},536:(e,t,s)=>{s.d(t,{x:()=>r}),s(913);const a={googleAnalytics:"googleAnalytics",precache:"precache-v2",prefix:"workbox",runtime:"runtime",suffix:"undefined"!=typeof registratio

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (330)
Category:	dropped
Size (bytes):	390
Entropy (8bit):	5.206764812811324
Encrypted:	false
SSDEEP:	6:F9o8fAX7s4Bszv4yA5FKJyR8aBzzNWLc3oqcqAdfFwC6emGHr9EJiKWayfAX7A:HGs4Bkv4yA5sy+go9Hf+eTHr+pWOA
MD5:	C86B7F8224FA45FB1682AC94D8F75AC6
SHA1:	9561F67AAE74B14702DB79C22F9C7F9E6F3B3239
SHA-256:	010083B88E95F18CEFDB90796ACCE02073E91FC8DFEFB27A7F5F3F75529E4906
SHA-512:	B239BAC43D973D0076F4E0C0720906560B0AED76472F50202841B2EABB66C5AD5774E35449007AA2DC3E6A096330AB14D1AA9374645136C89A20B45E4BBDBC52
Malicious:	false
Reputation:	low
Preview:	define("@wsb/guac-widget-shared/c/interopRequireDefault-c83974f7.js",["exports","~/c/_commonjsHelpers"],(function(e,o){"use strict";var t=o.c((function(e){e.exports=function(e){return e&&e.__esModule?e:{default:e}},e.exports.__esModule=!0,e.exports.default=e.exports}));e.i=t})),"undefined"!=typeof window&&(window.global=window);.//# sourceMappingURL=interopRequireDefault-c83974f7.js.map.

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (786)
Category:	dropped
Size (bytes):	842
Entropy (8bit):	5.258991916821592
Encrypted:	false
SSDEEP:	24:caBL+qMLVRGqawadlH0rVRrkAeT25Z2HrIY/:jKqSVMqzarH0brkAeq5ZSrI+
MD5:	31B521136207C11FF1F9985264424E8A
SHA1:	9EAF6B9717979CAEB5C7E846E17B2A89A08DC266
SHA-256:	C818B56446AE5A8D0466FC9C51D85104584E36F6D8B1C77E08A2D354E845E2CD
SHA-512:	DB2A8825F8C67B6361B86F5BB1DEE38089DD57E5E74ECBA335EF7D82D9D5E5AD3F64C07195FCDF700415F6F09B11BDB6A20410462ABAEC443335F19ACF8265B1
Malicious:	false
Reputation:	low
Preview:	define("@widget/LAYOUT/c/bs-themeOverrides-e736c017.js",["exports"],(function(e){"use strict";(global.Core\|\|guac["@wsb/guac-widget-core"]).constants;e.a=e=>{let{sectionHeadingHR:t}=e;return t?{sectionHeadingHR:t}:{}},e.b=e=>{let{sectionHeadingColor:t}=e;return{HIGHLIGHT:{style:{color:"highlight"}},HIGH_CONTRAST:{style:{color:"highContrast"}}}[t]\|\|{}},e.c=e=>{let{sectionHeadingSize:t}=e;return t?{style:{fontSize:t}}:{}},e.s=e=>{let{sectionHeadingAlignment:t}=e;return{LEFT:{style:{textAlign:"left","@md":{textAlign:"left"}},alignmentOption:"left"},CENTER:{style:{textAlign:"center","@md":{textAlign:"center"}},alignmentOption:"center"},RIGHT:{style:{textAlign:"right","@md":{textAlign:"right"}},alignmentOption:"right"}}[t]\|\|{}}})),"undefined"!=typeof window&&(window.global=window);.//# sourceMappingURL=bs-themeOverrides-e736c017.js.map.

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3043)
Category:	downloaded
Size (bytes):	3092
Entropy (8bit):	5.221416224205306
Encrypted:	false
SSDEEP:	96:/NSXU/vuELNSXtiF7ANSXTJrrBNSXt7X5wqh:VcKncc7ycd3cd5w8
MD5:	852CBC5322260E00B44F2C682F88B2C7
SHA1:	BCAF229E6134F43EB5F974C9891E4D16FAF1D344
SHA-256:	BAE437DBEFE58377D88C9D579DB7C59F4202F3FBF88866D0005FB375BE6B2CD7
SHA-512:	F031B43F7FA0DA001F71DDCFFE5E322A94C5F1F52F7C4D67D34880243D9D361AC55C0E5001DD004390867CB31E5DEF5D4D9282E6E2ECB9AEC0E880AA5B786BA3
Malicious:	false
Reputation:	low
URL:	https://img1.wsimg.com/blobby/go/static/radpack/@widget/LAYOUT/c/bs-loaders-fffeeba5.js
Preview:	define("@widget/LAYOUT/c/bs-loaders-fffeeba5.js",["exports","~/c/bs-index3"],(function(e,a){"use strict";e.B=function(e){const{SVG:c}=(global.Core\|\|guac["@wsb/guac-widget-core"]).UX2.Element;return this.merge({tag:"div",children:(global.React\|\|guac.react).createElement((global.React\|\|guac.react).Fragment,null,(global.React\|\|guac.react).createElement(c,{viewBox:"0 0 44 44",width:"3em",height:"3em",fill:"currentColor"},(global.React\|\|guac.react).createElement("path",{fillRule:"evenodd",d:"M31.968 23H12.032c-.57 0-1.032-.448-1.032-1 0-.553.462-1 1.032-1h19.936c.57 0 1.032.447 1.032 1 0 .552-.462 1-1.032 1"})),(global.React\|\|guac.react).createElement((global.Core\|\|guac["@wsb/guac-widget-core"]).UX.Style,null,a.k.loaderBalance)),style:{"> svg":{animation:"balance 1s infinite cubic-bezier(.62,.06,.33,.79);",transformOrigin:"center"}}},e)},e.C=function(e){const{SVG:c}=(global.Core\|\|guac["@wsb/guac-widget-core"]).UX2.Element;return this.merge({tag:"div",children:(global.React\|\|guac.react).crea

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	242081
Entropy (8bit):	5.517740449222352
Encrypted:	false
SSDEEP:	3072:Eu8xUu8gpdmSOvTdTK4Tn9TnatTn9TnApfeVH0pdmSO3iTIT7JlDnDQj3jPGIXST:382/6bbCx0FMKhd
MD5:	EE94D93E4A0EB3D2C41B8C7EE1BB25F6
SHA1:	3C52577F309D7C76DE7EA4E0A40CBB358886A1B4
SHA-256:	22F0A029FD70E639CC74C49BE1071F7710AE42E70CA2AD71C08EB6075B53D4BC
SHA-512:	6605DB1B03094066E506775B6E5B88B72EB928993FC1268F08250F13D66EEABC656FF1203D51527C19D64D6A2358BFF7358E2AC2E5AE474A3C71A53E5535A255
Malicious:	false
Reputation:	low
Preview:	define("@widget/LAYOUT/c/bs-index3-6c39b3c7.js",["radpack","exports","~/c/bs-_rollupPluginBabelHelpers","~/c/bs-overlayTypes","~/c/bs-index2","~/c/bs-index","~/c/bs-dataAids","@wsb/guac-widget-shared@^1/lib/components/ColorSwatch","@wsb/guac-widget-shared@^1/lib/components/Carousel","~/c/bs-navigationDrawer","~/c/bs-searchFormLocations"],(function(e,t,a,r,o,l,n,i,c,s,g){"use strict";class p extends((global.Core\|\|guac["@wsb/guac-widget-core"]).UX2.utils.createElement("Background")){}a._(p,"propTypes",{className:(global.PropTypes\|\|guac["prop-types"]).string,backgroundSize:(global.PropTypes\|\|guac["prop-types"]).string,backgroundPosition:(global.PropTypes\|\|guac["prop-types"]).string,style:(global.PropTypes\|\|guac["prop-types"]).object,imageData:(global.PropTypes\|\|guac["prop-types"]).object,mobileWidthMultiplier:(global.PropTypes\|\|guac["prop-types"]).number,desktopWidthMultiplier:(global.PropTypes\|\|guac["prop-types"]).number,blur:(global.PropTypes\|\|guac["prop-types"]).bool}),a._(p,"defaultPr

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	221
Entropy (8bit):	5.32955468303281
Encrypted:	false
SSDEEP:	6:FSPD8WUDDSBSyFbNemGHr9EJiKWaEwI8WUDDn:c5UDGBSyCTHr+pWTwGUDr
MD5:	8F12765EB30FBDCFCDC116D13F7FC272
SHA1:	506E45B7D3930756EACCE0DAD449A3C8CDB3EAC6
SHA-256:	265995EB76326E95613750F6F6570B850F5C22280D262DE9B9632A16CEB98B9B
SHA-512:	7AA2F396B105BCCF2B943FD2AC60929D8BF3A0EB8574B77451CB29816DF8ACDCD07694B526D7E4585F849DFDA3A0FE6E95661179E13F682DBF54098D98154BFB
Malicious:	false
Reputation:	low
Preview:	define("@widget/LAYOUT/c/bs-navigationDrawer-27f5f1f5.js",["exports"],(function(i){"use strict";i.N="-249vw"})),"undefined"!=typeof window&&(window.global=window);.//# sourceMappingURL=bs-navigationDrawer-27f5f1f5.js.map.

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (51862)
Category:	dropped
Size (bytes):	60644
Entropy (8bit):	5.35123857982882
Encrypted:	false
SSDEEP:	768:RfLoCGFoLE8vvw4xUC/ib7V/Kc5syj14RYX/ly2IxKoTGEOumJ66KzkpzfI2XHmR:zQ14RYtyPKoqumJ66Kzw7I2XHmOi
MD5:	E4C69FDA4325AF7D4DA6FCE08D57F0C9
SHA1:	CDA49402084362675452A4108D8732F0A8505AC9
SHA-256:	BC3A178CEB6D5B9F2ED53D5779D0456C8D383F660D8E1E7172CE3B68A60336A3
SHA-512:	92AD844D5451706CE2A0A2339C86FE28295670063040A0DE3494C2ECFE40DEC4055FDDF98472C4D4B077A47D6798074FB295A4A32BAF38FBD5228E5E00A55CFD
Malicious:	false
Reputation:	low
Preview:	navigator&&navigator.connection&&(window.networkInfo=navigator.connection,navigator.connection.addEventListener&&navigator.connection.addEventListener("change",({target:n})=>window.networkInfo=n));.const imageObserver=new IntersectionObserver((e,r)=>{var a=e=>{if(e.hasAttribute("data-lazyimg")){var t=e.getAttribute("data-srclazy");let o=e.getAttribute("data-srcsetlazy")\|\|"";if(t&&(e.src=t),o&&window.networkInfo){var n=window.networkInfo.downlink;const r=[{min:0,max:5,regex:/(.?(?=, ))/,qMod:!0},{min:5,max:8,regex:/(.2x)/}];r.forEach(({min:e,max:t,regex:r,qMod:a})=>{e<=n&&n<t&&(r=o.match(r),o=(r&&r.length?r[0]:o)+(a?"/qt=q:"+Math.round((n-e)/(t-e)*100):""))})}e.srcset=o,e.removeAttribute("sizes"),e.removeAttribute("data-lazyimg"),e.removeAttribute("data-srclazy"),e.removeAttribute("data-srcsetlazy")}};e.forEach(e=>{if(e.isIntersecting){const t=e.target;window.networkInfo&&0===window.networkInfo.downlink\|\|([t].concat(Array.from(t.querySelectorAll("[data-lazyimg]"))).forEach(a),r.unobse

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	7.7740342467587595
Encrypted:	false
SSDEEP:	24:2gAeCtZZMla0mrgKxg8rPyNqdRCxGQ4GUeGVWor6y+W8c:2gAeDr+gKxnrPykRoPUevo0W8c
MD5:	AB941AE49D7A60AC7D18653D97A298F0
SHA1:	10FA64E8481B0030402BD9E13EC1A7D5FE7D8162
SHA-256:	C2B6BDCF3D1F58907AB62DC86D60868929C70BE4E9D13680D7D198B3E317F932
SHA-512:	086BB129CDA94883ECBD391A9E61AF3969F3320139D283AA2EE709C252EDBBCDF11F2BB30F0FE747214F5966775FE59A579F095EC8C8847C4D6EA1869F700A4A
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR... ... .....szz.....pHYs..........{Rk....IDATX..V}h.U...VTS......>..>.6,.v.y.....m..e......9.EQ&..!A....Q...aA ..k{....f64.>.O.P.....v...u#.~..9.y..\|?.I$........![.......#..Yb&...K.I.T...;C..K.s.i...>.b..8N...H.;S.<..ef........D....wR.oP...!;N...Jk..]v.%.F....H.. .t.6-...Yzf..._.2.(.\|yZ.?>.t.OUZ.q....f@..N...@..:.\.;.m6........o.$..............9..b....3..1.s4.s.......).C.......nxN..9../.....z.C.vU..3.[.......S.{?.[;..-^wc..5...+...wU..\|..x1Z..../.....C.....c.=<........L...HhK.PZ......4.......\...oM.n.z...wE.C.M.._..-.r..^......A...Hse\|...V...Q.o.4..5..g{h.....e.x`x.;q.K.b.$./.j........3E...db.o.ii.]H}.^...Ti.K....^..'.@.....z.`.)...g.o.\|?..>..z...8'>..(S...\|.......\|4N..G........pO..0i....X-.~a....>..D.R<:.Td..I..q.{...&..p.I.Z.f.ZM./..i.1...;.7#5..&...h.I/..@.C..K...J.s...N..<......~.&Z4.UZ."oL>..X.Isx9.>LA.b . .\|w..UiU...Q.T.!0<g9..:.......5......-^w..Q8*qa..S.ui..+"..b..Yk(...e.}A...)6[..,\k.~...+z#.!.O.........7..#:..

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1211)
Category:	downloaded
Size (bytes):	1261
Entropy (8bit):	5.340315611373646
Encrypted:	false
SSDEEP:	24:/BLEQuC0F6lq5lEYwy5WqogVeESgVeId4PXsHrIW:Z4jFYq5lpwW7vdd4PXgrIW
MD5:	CB9BFA0FBDD957FBE7F4841B70341DB2
SHA1:	9CAD12A3580D3E4D340CB867E88B687C75564C5A
SHA-256:	513864FD4EBD1926F3E1E78B436A90C2BC3A5D16835B50415E7B318D7DEEC2A2
SHA-512:	DF98C3262F64DA4EA9CACF75FF7CB685D71B69142D89F726AB3E13CF6F25432DC395D7C0950E1632F0E519F135B02FDA0753739189E51F1C9210ACA6692551DD
Malicious:	false
Reputation:	low
URL:	https://img1.wsimg.com/blobby/go/static/radpack/@wsb/guac-widget-shared/lib/components/ColorSwatch-4196a0a9.js
Preview:	define("@wsb/guac-widget-shared/lib/components/ColorSwatch-4196a0a9.js",["exports"],(function(e){"use strict";const o=e=>{let{color:o,isActive:t,inStock:r,isSmall:l}=e;const a=r\|\|void 0===r,c=l?"24px":"38px",n=l?"20px":"32px",i={borderRadius:"50%",borderWidth:"1px",borderStyle:"solid"},s={outer:{...i,display:"flex",alignItems:"center",justifyContent:"center",width:c,height:c,borderColor:t?"lowContrast":"transparent"},inner:{...i,borderColor:"ultraLowContrast",color:"ultraLowContrast",width:n,height:n,background:a?o:`linear-gradient(to left top, ${o} calc(50% - 1px), currentColor, ${o} calc(50% + 1px) )`}};return(global.React\|\|guac.react).createElement((global.Core\|\|guac["@wsb/guac-widget-core"]).UX2.Element.Block,{style:s.outer},(global.React\|\|guac.react).createElement((global.Core\|\|guac["@wsb/guac-widget-core"]).UX2.Element.Block,{style:s.inner}))};o.propTypes={color:(global.PropTypes\|\|guac["prop-types"]).string.isRequired,isActive:(global.PropTypes\|\|guac["prop-types"]).bool,inStock:(

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (829)
Category:	dropped
Size (bytes):	876
Entropy (8bit):	5.561256771975726
Encrypted:	false
SSDEEP:	24:cEBLv5pqMIuHMnH7cmo17Jv0ySaUKdei9hJQE2HrIYpb:f75pqaowmWJcySaUKdTfcrIC
MD5:	9219CF782ED219BD3929A51E99503BC2
SHA1:	6AAC399854EC0405949566FAFDCA8C121F0CDA58
SHA-256:	89388608D7BCECED5AD74231681FFCE822AD580ACB9FD7E492970176E3E38347
SHA-512:	D421851026422D46E1561FA852084CE7B41E32C7451DCF85900838265D330F09389DA18F4D8A5FAF3E0A4076508BA7E93EA9C5F8B5B32ACF32205C9B6E65E709
Malicious:	false
Reputation:	low
Preview:	define("@widget/LAYOUT/c/bs-index-4e26cd6b.js",["exports"],(function(o){"use strict";const{widgetTypes:e,colorPackCategories:t,themeConstants:n,buttons:l}=(global.Core\|\|guac["@wsb/guac-widget-core"]).constants,s=(global.keyMirror\|\|guac.keymirror)({NONE:null,SMALL_UNDERLINE:null,FULL_UNDERLINE:null,INLINE:null}),i=24,r=n.DEFAULT_OVERLAY_TEXT_SHADOW,a={about4:i,introduction5:i,content5:i,ordering1:i,payment2:i,zillow1:i,reviews1:i,rss1:i,subscribe3:i,mlsSearch1:i,contact10:i,countdown1:i,quote1:i},c={spotlight:{fill:l.fills.SOLID},external:{fill:l.fills.NONE,decoration:l.decorations.NONE,shadow:l.shadows.NONE}};o.A="365px",o.B="24px",o.C=c,o.D=25,o.I=28,o.M=40,o.O="0px 2px 10px rgba(0, 0, 0, 0.3)",o.S=40,o.W={about1:!0},o.a=r,o.b="18px",o.c=a,o.d="600px",o.e=t,o.s=s})),"undefined"!=typeof window&&(window.global=window);.//# sourceMappingURL=bs-index-4e26cd6b.js.map.

Chrome Cache Entry: 111

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (23126)
Category:	dropped
Size (bytes):	23189
Entropy (8bit):	4.539345073526186
Encrypted:	false
SSDEEP:	384:7UuK/6kvTqLYddu4bV/yiAhSs1hiAhAiSeG3dvBRU+SMkc6e:QuJ5wI45/c1+ipG3TJSMkU
MD5:	3D092EF4ABA019B14F01C40747E40554
SHA1:	1C26145272FCF4CA91AF501288CCE84B1BFFD38B
SHA-256:	B4C48B77BBE6BBACF7D16BDAA81F5509FB8EA0FBFDDFBF2D12307F7A88518846
SHA-512:	F7180D3D98CF17556E27D62EF719DD9E35041679BAB74BD49BD898EB0FB62018EF6C6B64D06E9E0CAC4A646154DB93A1D35096B098DDCFF7B02CD6889A29DA0A
Malicious:	false
Reputation:	low
Preview:	define("@widget/LAYOUT/c/bs-defaultSocialIconPack-91835b99.js",["exports"],(function(a){"use strict";const e=(global.React\|\|guac.react).createElement("path",{d:"M12 2C6.477 2 2 6.477 2 12s4.477 10 10 10 10-4.477 10-10A10 10 0 0 0 12 2zM7.055 13.745a.97.97 0 0 1-.073-.509l.182-2.072a.687.687 0 0 1 .29-.364c.182-.11.582.036.582.036l2.619 1.31s.4.181.4.509c-.037.436-.219.436-.364.509l-3.055.654s-.436.146-.581-.073zm4.945.473l-.036 3.018s.036.437-.219.51c-.144.02-.291.02-.436 0l-2.036-.655a.6.6 0 0 1-.291-.364c-.073-.218.182-.545.182-.545l2.036-2.255s.327-.29.582-.145c.254.145.254.436.218.436zm-.364-3.236a.687.687 0 0 1-.581-.182l-2.51-3.418s-.363-.4-.181-.691a.64.64 0 0 1 .363-.291l2.4-.873c.11-.036.218-.145.582.073.255.145.291.655.291.655l.036 4.145s-.072.51-.4.582zm1.419.582l1.636-2.582s.145-.364.436-.327c.152.002.29.085.364.218l1.382 1.636a.676.676 0 0 1 .072.473c-.072.218-.472.363-.472.363l-2.91.837s-.4.073-.545-.182c-.145-.255 0-.51.037-.436zm3.781 3.309L15.6 16.655a.815.815 0 0 1-.4

Chrome Cache Entry: 112

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (20947)
Category:	dropped
Size (bytes):	24399
Entropy (8bit):	5.2375624098374
Encrypted:	false
SSDEEP:	384:UNoz5VHqeg0VzpiyiwffnnPacVorjFtteVT36FCLCpKe9plq2D:ME5qeg0Rp8wffnPVEjFtteEFiSbbl3D
MD5:	753CB19EE1A756E46FAA0F118B1B4E01
SHA1:	248885E3BFE7E71989BA9FFFB33B6EFF18166FEC
SHA-256:	ED9FFA2FBA5ECC75AF2F99E6EBADD5B927086F258037C2A848E94449CC579991
SHA-512:	4482C4D5F2F93DE8E095C549994A7783FA55CD1A6C4C9CC5E697CC2E2F00C98B04D5CB958CC1ADC4D0EF67F300BE014E112AE1D992487F40EB25BC93E8B47AAA
Malicious:	false
Reputation:	low
Preview:	define("@wsb/guac-widget-shared/lib/components/Carousel-3d82957b.js",["exports","~/c/_rollupPluginBabelHelpers","~/c/_commonjsHelpers","~/c/interopRequireDefault","~/c/_react_commonjs-external"],(function(e,t,n,i,r){"use strict";var s=n.c((function(e){function t(n){return e.exports=t="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},e.exports.__esModule=!0,e.exports.default=e.exports,t(n)}e.exports=t,e.exports.__esModule=!0,e.exports.default=e.exports})),o=n.c((function(e){var t=s.default;function n(e){if("function"!=typeof WeakMap)return null;var t=new WeakMap,i=new WeakMap;return(n=function(e){return e?i:t})(e)}e.exports=function(e,i){if(!i&&e&&e.__esModule)return e;if(null===e\|\|"object"!==t(e)&&"function"!=typeof e)return{default:e};var r=n(i);if(r&&r.has(e))return r.get(e);var s={},o=Object.defineProperty&&Object.getOwnPropertyDescr

Chrome Cache Entry: 113

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (522)
Category:	downloaded
Size (bytes):	586
Entropy (8bit):	5.2378887904744955
Encrypted:	false
SSDEEP:	12:H/QL7ANBSyTUXaPXAbDTc/NeL2QiTj+RVngQ2ofXgYhMYTHr+pWgL7AO:cANBLTUXaPXAPTc/tTj+HngQ2CQY/HrQ
MD5:	FADB3719FFA2A9E96CDC64FFEA0220FA
SHA1:	B9B00833E59E99ECE036B518D8429AF5EFEC1163
SHA-256:	E8A5463FF98210D3017DEEE55D5A287AD01AAA11DBE7DEB7D07F7D15D7F609F2
SHA-512:	C6E3581F7676B3204BC0FC8D4DCCF5A383FDE6F17A27D2F855EBEE3D205459BD9866A219808EAB1D4D4B37676D13B516AF546C7125C3FFA22CA74B995A180644
Malicious:	false
Reputation:	low
URL:	https://img1.wsimg.com/blobby/go/static/radpack/@wsb/guac-widget-shared/c/_rollupPluginBabelHelpers-8ce54c82.js
Preview:	define("@wsb/guac-widget-shared/c/_rollupPluginBabelHelpers-8ce54c82.js",["exports"],(function(e){"use strict";function n(){return n=Object.assign?Object.assign.bind():function(e){for(var n=1;n<arguments.length;n++){var r=arguments[n];for(var t in r)Object.prototype.hasOwnProperty.call(r,t)&&(e[t]=r[t])}return e},n.apply(this,arguments)}e._=n,e.a=function(e,n,r){return n in e?Object.defineProperty(e,n,{value:r,enumerable:!0,configurable:!0,writable:!0}):e[n]=r,e}})),"undefined"!=typeof window&&(window.global=window);.//# sourceMappingURL=_rollupPluginBabelHelpers-8ce54c82.js.map.

Chrome Cache Entry: 114

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (6969)
Category:	dropped
Size (bytes):	7039
Entropy (8bit):	5.2361798012427245
Encrypted:	false
SSDEEP:	192:oLb1MP+fzUiru5feyeCVL+izwhVQ9iPzmHFnYJsvIFO/Esh:oLxmCUiru5fneCVL+izwhVQ9ibmHFnYK
MD5:	DAD318033A09F6ABA68D6EE66F1CDACE
SHA1:	F538D0C3973677A6CDF14E9223AFB432FCF1CF8C
SHA-256:	E8FCFB1552D918B5D9FD715F711255465D6DD4348B4DCEDD362CB00DF9D3DBEF
SHA-512:	6024483003089661D9799000202895EC4ACA6CDEC816BDBC786F6800536AA8E6B93D8B8CA81E1EB6B8122C72CD14172C94C6C49953FFA536E49D71DD7F47499F
Malicious:	false
Reputation:	low
Preview:	define("@widget/LAYOUT/bs-layout13-Theme-publish-Theme-7252afe2.js",["exports","~/c/bs-_rollupPluginBabelHelpers","~/c/bs-index3","~/c/bs-themeOverrides","~/c/bs-legacyOverrides","~/c/bs-humanisticFilled","~/c/bs-defaultSocialIconPack","~/c/bs-loaders","~/c/bs-index","~/c/bs-overlayTypes"],(function(e,t,r,o,a,n,i,s,l,g){"use strict";const{colorPackCategories:d,buttons:c}=(global.Core\|\|guac["@wsb/guac-widget-core"]).constants,{LIGHT:u,LIGHT_ALT:m,LIGHT_COLORFUL:h,DARK:p,DARK_ALT:y,DARK_COLORFUL:f,COLORFUL:b,MVP:x}=(global.Core\|\|guac["@wsb/guac-widget-core"]).constants.paintJobs,I={[g.F]:"category-overlay",[g.b]:"category-overlay",[g.I]:"category-solid",[g.B]:"category-overlay",[g.L]:"category-overlay"},S={defaultHeaderTreatment:g.F,imageTreatments:I,heroContentItems:["tagline","tagline2","cta"],nonHeroContentItems:["phone"]};var C={id:"layout13",name:"modern",packs:{color:"005",font:"league-spartan"},logo:{font:"primary"},packCategories:{color:d.ACCENT},headerProperties:{alignmentOption

Chrome Cache Entry: 115

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (12251)
Category:	downloaded
Size (bytes):	12309
Entropy (8bit):	4.691953487987274
Encrypted:	false
SSDEEP:	192:Y9hgK/4PoduPprRZ14Iwh0DyTDE7JPKSlrZWbFQJJZ7FFS3DQwNp/A+Qd:YoKwodgpehxTMPKSlrAMrLS38UKd
MD5:	DFB4BEE7C6378574342CDFCE62FDD1D7
SHA1:	75679AE1470880C7209353283879CB58C010621B
SHA-256:	BFF3C0C2907BCFFD63DEDC687B8FCA61197E8B783C644B3D665AC3620C383E3C
SHA-512:	76C8042532A9F0FF590606A920713515356C9B9C6366A1447C2D184F6AAA4D5880A399570D5764E84100C7619DB5EF061BA6C4E535FA2473E69060F76112DF4B
Malicious:	false
Reputation:	low
URL:	https://img1.wsimg.com/blobby/go/static/radpack/@widget/LAYOUT/c/bs-humanisticFilled-91edd0e1.js
Preview:	define("@widget/LAYOUT/c/bs-humanisticFilled-91edd0e1.js",["exports"],(function(e){"use strict";const a=(global.React\|\|guac.react).createElement("path",{fillRule:"evenodd",d:"M16.056 8.255a4.254 4.254 0 1 1-8.507 0 4.254 4.254 0 0 1 8.507 0zm3.052 11.71H4.496a.503.503 0 0 1-.46-.693 8.326 8.326 0 0 1 7.766-5.328 8.326 8.326 0 0 1 7.766 5.328.503.503 0 0 1-.46.694z"});var l={__proto__:null,account:a,person:a,magGlass:(global.React\|\|guac.react).createElement("path",{fillRule:"evenodd",d:"M15.659 14.107c1.048.434 3.446 3.209 3.446 3.209a1.263 1.263 0 0 1 0 1.789 1.263 1.263 0 0 1-1.789 0s-2.775-2.371-3.209-3.419c-.077-.185 0-.591 0-.591l-.369-.362a6.111 6.111 0 0 1-3.656 1.211C6.729 15.944 4 13.265 4 9.972 4 6.679 6.729 4 10.082 4c3.354 0 6.082 2.679 6.082 5.972a5.88 5.88 0 0 1-1.466 3.878l.261.257s.483-.09.7 0zm-5.577.546c2.628 0 4.767-2.1 4.767-4.681s-2.139-4.681-4.767-4.681c-2.628 0-4.767 2.1-4.767 4.681s2.139 4.681 4.767 4.681z"}),cart1:(global.React\|\|guac.react).createElement("path",

Chrome Cache Entry: 116

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (852)
Category:	downloaded
Size (bytes):	919
Entropy (8bit):	5.236642015723828
Encrypted:	false
SSDEEP:	24:caBLoXaPXAH5NUM45cl2TxlBWJSqhPuQHrIYf:t8XyXA/UjmkTxjONrIY
MD5:	1CCD3C1052745E96CE686CC6F6143F10
SHA1:	0B19BB42233073967E22FE75572E12908E70A8C9
SHA-256:	F075FEFC90D97DA32D93AB7A2C9660A9D73B41A3B022497C8E6683CB6F98BF88
SHA-512:	0A274F4D70897638F9EC9F0A04D79C0BF6FA94E297A7938F773345395AC64F2CB87B9DA2D265DDC017C3AE0C16B88B207E8688110AE8A5E91FC662767D78587A
Malicious:	false
Reputation:	low
URL:	https://img1.wsimg.com/blobby/go/static/radpack/@widget/LAYOUT/c/bs-_rollupPluginBabelHelpers-a2e90765.js
Preview:	define("@widget/LAYOUT/c/bs-_rollupPluginBabelHelpers-a2e90765.js",["exports"],(function(e){"use strict";function r(){return r=Object.assign?Object.assign.bind():function(e){for(var r=1;r<arguments.length;r++){var t=arguments[r];for(var n in t)Object.prototype.hasOwnProperty.call(t,n)&&(e[n]=t[n])}return e},r.apply(this,arguments)}e._=function(e,r,t){return(r=function(e){var r=function(e,r){if("object"!=typeof e\|\|null===e)return e;var t=e[Symbol.toPrimitive];if(void 0!==t){var n=t.call(e,r\|\|"default");if("object"!=typeof n)return n;throw new TypeError("@@toPrimitive must return a primitive value.")}return("string"===r?String:Number)(e)}(e,"string");return"symbol"==typeof r?r:String(r)}(r))in e?Object.defineProperty(e,r,{value:t,enumerable:!0,configurable:!0,writable:!0}):e[r]=t,e},e.a=r})),"undefined"!=typeof window&&(window.global=window);.//# sourceMappingURL=bs-_rollupPluginBabelHelpers-a2e90765.js.map.

Chrome Cache Entry: 117

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	525
Entropy (8bit):	5.150899644720806
Encrypted:	false
SSDEEP:	12:YWGhtXIoWFJsTPXE82PwTPXE8veLJVLFN4n:YZXIoWofb2PofbwZ4
MD5:	0DEEF4A8EE83A13EA132EB24BF34CB15
SHA1:	4C6592BF027B907CFF2A59787BF946BAD8F31EE3
SHA-256:	BE164032CAE2CB451D96C0B07695B65CE29B89E54495AFCE4FD104F7DB9AC2E2
SHA-512:	2C0601F10CE00CEA480FB4B9C8CB6C1EBB000F60AE5EF463D6AB6AF9D1F9D56E9A4617DEA8CC42D46761043952B916297CA682B873F4141C4C528F8391DD4F7F
Malicious:	false
Reputation:	low
URL:	https://uopheldlognxo.godaddysites.com/manifest.webmanifest
Preview:	{"scope":"/","start_url":"/","display":"standalone","icons":[{"sizes":"192x192","type":"image/png","src":"//img1.wsimg.com/isteam/ip/5f93a78e-c642-4e8f-82dd-eb36b2ca2216/favicon/f6fe747d-3caa-4b92-8b79-9a28041c203e.png/:/rs=w:192,h:192,m"},{"sizes":"512x512","type":"image/png","src":"//img1.wsimg.com/isteam/ip/5f93a78e-c642-4e8f-82dd-eb36b2ca2216/favicon/f6fe747d-3caa-4b92-8b79-9a28041c203e.png/:/rs=w:512,h:512,m"}],"name":"uopheldlognxo","short_name":"uopheldlognxo","theme_color":"#FFFFFF","background_color":"#FFFFFF"}

Chrome Cache Entry: 118

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1824)
Category:	dropped
Size (bytes):	1874
Entropy (8bit):	4.934407477113311
Encrypted:	false
SSDEEP:	48:fCEX2kA83zdkJi1lvietWdcy0cy7mdOrxGfrIK:aE33zdkJiDvietWdR0R7mdOFYX
MD5:	EDC15AD5DAAC3CFA744BFFDB1E0174BE
SHA1:	E314A5CA702D0E77B2C2C023ADDADE266EA223B2
SHA-256:	3B54AEACFDA01BE53800632989A82F6F5A7F92E927159A37A4324B38D3DFFEF8
SHA-512:	8B8805D67FF993BD406EEB6682B1578537A3D6B7DC6711BE7152120689C77147D8C24351ACEBD2A06AE9B81D858EAED19C44E6792FE3C147EEAF3133C635589B
Malicious:	false
Reputation:	low
Preview:	define("@widget/LAYOUT/c/bs-dataAids-6a839d53.js",["exports"],(function(E){"use strict";var R=(global.keyMirror\|\|guac.keymirror)({BACKGROUND_IMAGE_RENDERED:null,HAMBURGER_MENU_LINK:null,HEADER_WIDGET:null,HEADER_SECTION:null,HEADER_VIDEO:null,HEADER_VIDEO_EMBED_WRAPPER:null,HEADER_VIDEO_EMBED:null,HEADER_VIDEO_EMBED_INSET_POSTER:null,HEADER_VIDEO_EMBED_FILL_POSTER:null,HEADER_VIDEO_BACKGROUND:null,HEADER_SLIDESHOW:null,HEADER_SLIDE:null,HEADER_HERO_SLIDE:null,HEADER_PHONE_RENDERED:null,HEADER_PIPE_RENDERED:null,HEADER_ADDRESS_RENDERED:null,HEADER_LOGO_RENDERED:null,HEADER_LOGO_IMAGE_RENDERED:null,HEADER_LOGO_OVERHANG_CONTAINER:null,HEADER_LOGO_TEXT_RENDERED:null,HEADER_TAGLINE_RENDERED:null,HEADER_TAGLINE2_RENDERED:null,HEADER_NAV_RENDERED:null,HEADER_CTA_BTN:null,CART_ICON_RENDER:null,CART_ICON_COUNT:null,CART_ICON_PIPE:null,CART_TEXT:null,CART_DROPDOWN_RENDERED:null,SEARCH_FORM_RENDERED:null,SEARCH_ICON_RENDERED:null,SEARCH_ICON_RENDERED_OPEN:null,SEARCH_CLOSE_RENDERED:null,SEARCH_FI

Chrome Cache Entry: 119

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (829)
Category:	downloaded
Size (bytes):	876
Entropy (8bit):	5.561256771975726
Encrypted:	false
SSDEEP:	24:cEBLv5pqMIuHMnH7cmo17Jv0ySaUKdei9hJQE2HrIYpb:f75pqaowmWJcySaUKdTfcrIC
MD5:	9219CF782ED219BD3929A51E99503BC2
SHA1:	6AAC399854EC0405949566FAFDCA8C121F0CDA58
SHA-256:	89388608D7BCECED5AD74231681FFCE822AD580ACB9FD7E492970176E3E38347
SHA-512:	D421851026422D46E1561FA852084CE7B41E32C7451DCF85900838265D330F09389DA18F4D8A5FAF3E0A4076508BA7E93EA9C5F8B5B32ACF32205C9B6E65E709
Malicious:	false
Reputation:	low
URL:	https://img1.wsimg.com/blobby/go/static/radpack/@widget/LAYOUT/c/bs-index-4e26cd6b.js
Preview:	define("@widget/LAYOUT/c/bs-index-4e26cd6b.js",["exports"],(function(o){"use strict";const{widgetTypes:e,colorPackCategories:t,themeConstants:n,buttons:l}=(global.Core\|\|guac["@wsb/guac-widget-core"]).constants,s=(global.keyMirror\|\|guac.keymirror)({NONE:null,SMALL_UNDERLINE:null,FULL_UNDERLINE:null,INLINE:null}),i=24,r=n.DEFAULT_OVERLAY_TEXT_SHADOW,a={about4:i,introduction5:i,content5:i,ordering1:i,payment2:i,zillow1:i,reviews1:i,rss1:i,subscribe3:i,mlsSearch1:i,contact10:i,countdown1:i,quote1:i},c={spotlight:{fill:l.fills.SOLID},external:{fill:l.fills.NONE,decoration:l.decorations.NONE,shadow:l.shadows.NONE}};o.A="365px",o.B="24px",o.C=c,o.D=25,o.I=28,o.M=40,o.O="0px 2px 10px rgba(0, 0, 0, 0.3)",o.S=40,o.W={about1:!0},o.a=r,o.b="18px",o.c=a,o.d="600px",o.e=t,o.s=s})),"undefined"!=typeof window&&(window.global=window);.//# sourceMappingURL=bs-index-4e26cd6b.js.map.

Chrome Cache Entry: 120

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (522)
Category:	dropped
Size (bytes):	586
Entropy (8bit):	5.2378887904744955
Encrypted:	false
SSDEEP:	12:H/QL7ANBSyTUXaPXAbDTc/NeL2QiTj+RVngQ2ofXgYhMYTHr+pWgL7AO:cANBLTUXaPXAPTc/tTj+HngQ2CQY/HrQ
MD5:	FADB3719FFA2A9E96CDC64FFEA0220FA
SHA1:	B9B00833E59E99ECE036B518D8429AF5EFEC1163
SHA-256:	E8A5463FF98210D3017DEEE55D5A287AD01AAA11DBE7DEB7D07F7D15D7F609F2
SHA-512:	C6E3581F7676B3204BC0FC8D4DCCF5A383FDE6F17A27D2F855EBEE3D205459BD9866A219808EAB1D4D4B37676D13B516AF546C7125C3FFA22CA74B995A180644
Malicious:	false
Reputation:	low
Preview:	define("@wsb/guac-widget-shared/c/_rollupPluginBabelHelpers-8ce54c82.js",["exports"],(function(e){"use strict";function n(){return n=Object.assign?Object.assign.bind():function(e){for(var n=1;n<arguments.length;n++){var r=arguments[n];for(var t in r)Object.prototype.hasOwnProperty.call(r,t)&&(e[t]=r[t])}return e},n.apply(this,arguments)}e._=n,e.a=function(e,n,r){return n in e?Object.defineProperty(e,n,{value:r,enumerable:!0,configurable:!0,writable:!0}):e[n]=r,e}})),"undefined"!=typeof window&&(window.global=window);.//# sourceMappingURL=_rollupPluginBabelHelpers-8ce54c82.js.map.

Chrome Cache Entry: 121

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	324
Entropy (8bit):	5.376083689062415
Encrypted:	false
SSDEEP:	6:FSPl39b4BSyRbjGJlI9kXJ3+V0q1EkmGHr9EJiKWaEt39J:cd39MBSyVz0XkTHr+pWTt39J
MD5:	ACD4F2B6117E5054FC9BF848AE8121CA
SHA1:	AE4D5F41D854BA8D99A4A1EC6EE6D6C3C0A859B8
SHA-256:	66774F89FCFA5674BE9AEF60E3FE3CB81E4DD88246BDE4E5392DF8B99FEFD4DB
SHA-512:	906FC9144D4AB81E8000CBE4A7AF7AFF775464347449193337E8738D705888C02B9476E083B3B67BDB3CBC312AAC4644C10737BC1FC5F9F08B38F5F45A2410F9
Malicious:	false
Reputation:	low
URL:	https://img1.wsimg.com/blobby/go/static/radpack/@widget/LAYOUT/c/bs-legacyOverrides-42582241.js
Preview:	define("@widget/LAYOUT/c/bs-legacyOverrides-42582241.js",["exports"],(function(e){"use strict";e.g=function(e,i,n){let o={};return"MENU"===i&&"h3"===e&&(o={color:"highlight"},"menu3"===n&&(o.fontSize="large")),o}})),"undefined"!=typeof window&&(window.global=window);.//# sourceMappingURL=bs-legacyOverrides-42582241.js.map.

Chrome Cache Entry: 122

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1824)
Category:	downloaded
Size (bytes):	1874
Entropy (8bit):	4.934407477113311
Encrypted:	false
SSDEEP:	48:fCEX2kA83zdkJi1lvietWdcy0cy7mdOrxGfrIK:aE33zdkJiDvietWdR0R7mdOFYX
MD5:	EDC15AD5DAAC3CFA744BFFDB1E0174BE
SHA1:	E314A5CA702D0E77B2C2C023ADDADE266EA223B2
SHA-256:	3B54AEACFDA01BE53800632989A82F6F5A7F92E927159A37A4324B38D3DFFEF8
SHA-512:	8B8805D67FF993BD406EEB6682B1578537A3D6B7DC6711BE7152120689C77147D8C24351ACEBD2A06AE9B81D858EAED19C44E6792FE3C147EEAF3133C635589B
Malicious:	false
Reputation:	low
URL:	https://img1.wsimg.com/blobby/go/static/radpack/@widget/LAYOUT/c/bs-dataAids-6a839d53.js
Preview:	define("@widget/LAYOUT/c/bs-dataAids-6a839d53.js",["exports"],(function(E){"use strict";var R=(global.keyMirror\|\|guac.keymirror)({BACKGROUND_IMAGE_RENDERED:null,HAMBURGER_MENU_LINK:null,HEADER_WIDGET:null,HEADER_SECTION:null,HEADER_VIDEO:null,HEADER_VIDEO_EMBED_WRAPPER:null,HEADER_VIDEO_EMBED:null,HEADER_VIDEO_EMBED_INSET_POSTER:null,HEADER_VIDEO_EMBED_FILL_POSTER:null,HEADER_VIDEO_BACKGROUND:null,HEADER_SLIDESHOW:null,HEADER_SLIDE:null,HEADER_HERO_SLIDE:null,HEADER_PHONE_RENDERED:null,HEADER_PIPE_RENDERED:null,HEADER_ADDRESS_RENDERED:null,HEADER_LOGO_RENDERED:null,HEADER_LOGO_IMAGE_RENDERED:null,HEADER_LOGO_OVERHANG_CONTAINER:null,HEADER_LOGO_TEXT_RENDERED:null,HEADER_TAGLINE_RENDERED:null,HEADER_TAGLINE2_RENDERED:null,HEADER_NAV_RENDERED:null,HEADER_CTA_BTN:null,CART_ICON_RENDER:null,CART_ICON_COUNT:null,CART_ICON_PIPE:null,CART_TEXT:null,CART_DROPDOWN_RENDERED:null,SEARCH_FORM_RENDERED:null,SEARCH_ICON_RENDERED:null,SEARCH_ICON_RENDERED_OPEN:null,SEARCH_CLOSE_RENDERED:null,SEARCH_FI

Chrome Cache Entry: 69

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (852)
Category:	dropped
Size (bytes):	919
Entropy (8bit):	5.236642015723828
Encrypted:	false
SSDEEP:	24:caBLoXaPXAH5NUM45cl2TxlBWJSqhPuQHrIYf:t8XyXA/UjmkTxjONrIY
MD5:	1CCD3C1052745E96CE686CC6F6143F10
SHA1:	0B19BB42233073967E22FE75572E12908E70A8C9
SHA-256:	F075FEFC90D97DA32D93AB7A2C9660A9D73B41A3B022497C8E6683CB6F98BF88
SHA-512:	0A274F4D70897638F9EC9F0A04D79C0BF6FA94E297A7938F773345395AC64F2CB87B9DA2D265DDC017C3AE0C16B88B207E8688110AE8A5E91FC662767D78587A
Malicious:	false
Reputation:	low
Preview:	define("@widget/LAYOUT/c/bs-_rollupPluginBabelHelpers-a2e90765.js",["exports"],(function(e){"use strict";function r(){return r=Object.assign?Object.assign.bind():function(e){for(var r=1;r<arguments.length;r++){var t=arguments[r];for(var n in t)Object.prototype.hasOwnProperty.call(t,n)&&(e[n]=t[n])}return e},r.apply(this,arguments)}e._=function(e,r,t){return(r=function(e){var r=function(e,r){if("object"!=typeof e\|\|null===e)return e;var t=e[Symbol.toPrimitive];if(void 0!==t){var n=t.call(e,r\|\|"default");if("object"!=typeof n)return n;throw new TypeError("@@toPrimitive must return a primitive value.")}return("string"===r?String:Number)(e)}(e,"string");return"symbol"==typeof r?r:String(r)}(r))in e?Object.defineProperty(e,r,{value:t,enumerable:!0,configurable:!0,writable:!0}):e[r]=t,e},e.a=r})),"undefined"!=typeof window&&(window.global=window);.//# sourceMappingURL=bs-_rollupPluginBabelHelpers-a2e90765.js.map.

Chrome Cache Entry: 70

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	42544
Entropy (8bit):	7.990738289298452
Encrypted:	true
SSDEEP:	768:yivXlHtJTIAPu4xVChI+s7/WW98XamuwXqJrNLWQhxjSt54CRDshD:1/rxLPRx4hIzDiLqhPwt59ghD
MD5:	271A2D8BCB5B39A0236EA5FF10969DD0
SHA1:	884B259A9BBB693B12BCD48D35804453A1D02298
SHA-256:	771E800D3B7B75F6EB2E1633CBF84816946EFB63E2F64AB5BCDA113254B5FC37
SHA-512:	6A8FB0419EC231C2F25C793F37FA1A97BB917A89D85B575F23828F2F672990F906979A7807815A79027CA6D4345477757140C38A43B44E25BC0F6A10C49DC0A8
Malicious:	false
Reputation:	low
URL:	"https://img1.wsimg.com/isteam/ip/5f93a78e-c642-4e8f-82dd-eb36b2ca2216/uphold.png/:/cr=t:0%25,l:0%25,w:100%25,h:100%25/rs=w:1240,cg:true"
Preview:	RIFF(...WEBPVP8X..............VP8 H...p........>m4.H..,."Q.....gK...w.c.......5.3....).......9....h..@.$.{n.2.......#.Wbh.c.T_.C.#y....[...3.'..g./.......O.?.^.Z......)._....R...2./.....}?...........?._.?G...G.....g..8.k...k.C...w....\|......3........._M.u.7.............O......U.../.......W........e.o...........s.....O...........I.'..._.....}..8...c.W........................H..."D.M...'.o...=.\|.D..."$Od..vI h..J}.JQ...o...c..9D..A..P..gs.{K..q4\|.g..?.l+...........{.!{.;2.gI..Y..0Lp......5p)..J]..P../Z..Fc.z.M.l\..........;.S....( ....B$.l.q.@..`Z&F..}..W..k.u..'/.f...A..!..^J..t..&...... }.."L.....q8....C..%F.1....C.......`]..x3..d.b...?.(.o=2tH...h.!rr..."RN.x=.Z.'.UY....L./.e"?.(7.(..^+....J......k.tQ.LTx..>..}.c.-.......E...C...Fk..."m.Tc.5.g.t0Z.......E,yl=My...KT..5!!.oau..$xu....v....U.E._.3h.y......_..s[}.L.r]..=+tm..#..25.L.2.v...HT26...B..rk..A...E.Vf.....%...jp&......(g!...u......!\.L)..:;....d..+...J..XC+DR..FU...n.hcz..B.*......d

Chrome Cache Entry: 71

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (51862)
Category:	downloaded
Size (bytes):	60644
Entropy (8bit):	5.35123857982882
Encrypted:	false
SSDEEP:	768:RfLoCGFoLE8vvw4xUC/ib7V/Kc5syj14RYX/ly2IxKoTGEOumJ66KzkpzfI2XHmR:zQ14RYtyPKoqumJ66Kzw7I2XHmOi
MD5:	E4C69FDA4325AF7D4DA6FCE08D57F0C9
SHA1:	CDA49402084362675452A4108D8732F0A8505AC9
SHA-256:	BC3A178CEB6D5B9F2ED53D5779D0456C8D383F660D8E1E7172CE3B68A60336A3
SHA-512:	92AD844D5451706CE2A0A2339C86FE28295670063040A0DE3494C2ECFE40DEC4055FDDF98472C4D4B077A47D6798074FB295A4A32BAF38FBD5228E5E00A55CFD
Malicious:	false
Reputation:	low
URL:	https://img1.wsimg.com/blobby/go/5f93a78e-c642-4e8f-82dd-eb36b2ca2216/gpub/700ed430dfc105b4/script.js
Preview:	navigator&&navigator.connection&&(window.networkInfo=navigator.connection,navigator.connection.addEventListener&&navigator.connection.addEventListener("change",({target:n})=>window.networkInfo=n));.const imageObserver=new IntersectionObserver((e,r)=>{var a=e=>{if(e.hasAttribute("data-lazyimg")){var t=e.getAttribute("data-srclazy");let o=e.getAttribute("data-srcsetlazy")\|\|"";if(t&&(e.src=t),o&&window.networkInfo){var n=window.networkInfo.downlink;const r=[{min:0,max:5,regex:/(.?(?=, ))/,qMod:!0},{min:5,max:8,regex:/(.2x)/}];r.forEach(({min:e,max:t,regex:r,qMod:a})=>{e<=n&&n<t&&(r=o.match(r),o=(r&&r.length?r[0]:o)+(a?"/qt=q:"+Math.round((n-e)/(t-e)*100):""))})}e.srcset=o,e.removeAttribute("sizes"),e.removeAttribute("data-lazyimg"),e.removeAttribute("data-srclazy"),e.removeAttribute("data-srcsetlazy")}};e.forEach(e=>{if(e.isIntersecting){const t=e.target;window.networkInfo&&0===window.networkInfo.downlink\|\|([t].concat(Array.from(t.querySelectorAll("[data-lazyimg]"))).forEach(a),r.unobse

Chrome Cache Entry: 72

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1352)
Category:	downloaded
Size (bytes):	1400
Entropy (8bit):	5.307032039583678
Encrypted:	false
SSDEEP:	24:c6BLQZSwXZSUcUxQAQId+06QyyU+bHJRWIFSPhXCoiCUPGyTiKNPR138IHrIYf:j+SwJSxAQ0H0OpwUSPhXCoiCUeuiKNPd
MD5:	5CC6B93D41889C0A55C6C4FCD2D89713
SHA1:	51A59C1DAE337817C4EBAC39FBE61C232705A893
SHA-256:	8671CFDFA128168DB2136D7C17F55BA98DDBA221CDD1ACBBE559D4969280FD51
SHA-512:	8BCAAB1399B6D4D7475C4CF1DC45B0477A9D2AD37578DFCCF23C0C9303716DA1DECD5FBA858D5DD609CB89BCC784E04B72A0D7136BC6EE60DC3EF69CAB977C33
Malicious:	false
Reputation:	low
URL:	https://img1.wsimg.com/blobby/go/static/radpack/@widget/LAYOUT/c/bs-index2-87bd33e6.js
Preview:	define("@widget/LAYOUT/c/bs-index2-87bd33e6.js",["exports"],(function(t){"use strict";t.a=function(){let t=arguments.length>0&&void 0!==arguments[0]?arguments[0]:"medium";return{"> :nth-child(n)":{marginBottom:t}," > :last-child":{marginBottom:"0 !important"}}},t.b=function(){let t=arguments.length>0&&void 0!==arguments[0]?arguments[0]:"medium";return{"> :nth-child(n)":{marginRight:t}," > :last-child":{marginRight:"0 !important"}}},t.c=function(t){const e=function(t){if("string"!=typeof t\|\|"{"!==t[0])return null;try{return JSON.parse(t)}catch(t){return null}}(t)\|\|{};let n=0;return e.blocks&&e.blocks.forEach((t=>{const e=t.text.length;n+=(global._\|\|guac.lodash).clamp(e,25,Math.max(e,25))})),n},t.g=()=>{const t=document.getElementsByClassName("ux-scaled");let e=1;return t&&t.length>0&&(e=t[0].getAttribute("data-scale")),e},t.r=t=>{let{count:e=0,fontSizeMap:n={},defaultFontSize:r}=t;const i=(global._\|\|guac.lodash).reduce(n,((t,e,n)=>{let[r,i=Number.MAX_VALUE]=e;return t.push({range:[r,i],

Chrome Cache Entry: 73

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (905)
Category:	dropped
Size (bytes):	960
Entropy (8bit):	5.203352394673048
Encrypted:	false
SSDEEP:	24:pzBLgJHHVvC+dKbywqIN6ttVFRJB1i/uwBrV7DtZHrIvyU:zSkjbQxz3+uQ7RxrIx
MD5:	62A914B2C847D4D02B76164D7A2A54C6
SHA1:	20D9F49A90A51FA6C8420640610DF77F7A96D919
SHA-256:	B08C2864EC27736C507B1CA4B3A225A19147841B861CD8494DAF95FA370FE639
SHA-512:	E67D3D9F68EF3151D93DEDAA3530DF89F0C957F08561E93134B219DEC23C2A1FE0D109AC666619526742C5411E4636ECE416A3AD1148C1AD0861F0050B41D3DE
Malicious:	false
Reputation:	low
Preview:	define("@wsb/guac-widget-shared/c/_commonjsHelpers-67085353.js",["exports"],(function(e){"use strict";var n="undefined"!=typeof globalThis?globalThis:"undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof self?self:{};e.a=n,e.b=function(e){if(e.__esModule)return e;var n=Object.defineProperty({},"__esModule",{value:!0});return Object.keys(e).forEach((function(t){var r=Object.getOwnPropertyDescriptor(e,t);Object.defineProperty(n,t,r.get?r:{enumerable:!0,get:function(){return e[t]}})})),n},e.c=function(e,n,t){return e(t={path:n,exports:{},require:function(e,n){return function(){throw new Error("Dynamic requires are not currently supported by @rollup/plugin-commonjs")}(null==n&&t.path)}},t.exports),t.exports},e.g=function(e){return e&&e.__esModule&&Object.prototype.hasOwnProperty.call(e,"default")?e.default:e}})),"undefined"!=typeof window&&(window.global=window);.//# sourceMappingURL=_commonjsHelpers-67085353.js.map.

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (63425)
Category:	dropped
Size (bytes):	315045
Entropy (8bit):	5.470972207090544
Encrypted:	false
SSDEEP:	3072:7aOD2q1BSK7x5jfw71nUNdFIh0qrMdB8pbKQJaZkNeQHUC5SIui/+a:Wzq1Bzc71UNhqrMgpbLaZkNfHHWa
MD5:	D8A1FE8B9FD01233B8A030EA79C21DF0
SHA1:	1B2B4474F72FCEE56977101E7C85A8201F730903
SHA-256:	91DEC32BF6596B875CDEB8C7BFFC8B5029A870657D3D7C790E8939F17E24DC20
SHA-512:	C15DBBD27873E22558239D6671B7FA05107A348D44BEC9CD560B8AA6D443D4A86BBBC38FC6F2C18E4D4C82852741B7C995E3E80A1E95B04A0D2DBDA12DCB6F0F
Malicious:	false
Reputation:	low
Preview:	var Core=function(e){var t={};function n(r){if(t[r])return t[r].exports;var o=t[r]={i:r,l:!1,exports:{}};return e[r].call(o.exports,o,o.exports,n),o.l=!0,o.exports}return n.m=e,n.c=t,n.d=function(e,t,r){n.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:r})},n.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},n.t=function(e,t){if(1&t&&(e=n(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var r=Object.create(null);if(n.r(r),Object.defineProperty(r,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var o in e)n.d(r,o,function(t){return e[t]}.bind(null,o));return r},n.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return n.d(t,"a",t),t},n.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},n.p="//img1.wsimg.com/ceph-p3-01/website-builder-data-prod/static/widgets/",n(n.s=68)}([fun

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1352)
Category:	dropped
Size (bytes):	1400
Entropy (8bit):	5.307032039583678
Encrypted:	false
SSDEEP:	24:c6BLQZSwXZSUcUxQAQId+06QyyU+bHJRWIFSPhXCoiCUPGyTiKNPR138IHrIYf:j+SwJSxAQ0H0OpwUSPhXCoiCUeuiKNPd
MD5:	5CC6B93D41889C0A55C6C4FCD2D89713
SHA1:	51A59C1DAE337817C4EBAC39FBE61C232705A893
SHA-256:	8671CFDFA128168DB2136D7C17F55BA98DDBA221CDD1ACBBE559D4969280FD51
SHA-512:	8BCAAB1399B6D4D7475C4CF1DC45B0477A9D2AD37578DFCCF23C0C9303716DA1DECD5FBA858D5DD609CB89BCC784E04B72A0D7136BC6EE60DC3EF69CAB977C33
Malicious:	false
Reputation:	low
Preview:	define("@widget/LAYOUT/c/bs-index2-87bd33e6.js",["exports"],(function(t){"use strict";t.a=function(){let t=arguments.length>0&&void 0!==arguments[0]?arguments[0]:"medium";return{"> :nth-child(n)":{marginBottom:t}," > :last-child":{marginBottom:"0 !important"}}},t.b=function(){let t=arguments.length>0&&void 0!==arguments[0]?arguments[0]:"medium";return{"> :nth-child(n)":{marginRight:t}," > :last-child":{marginRight:"0 !important"}}},t.c=function(t){const e=function(t){if("string"!=typeof t\|\|"{"!==t[0])return null;try{return JSON.parse(t)}catch(t){return null}}(t)\|\|{};let n=0;return e.blocks&&e.blocks.forEach((t=>{const e=t.text.length;n+=(global._\|\|guac.lodash).clamp(e,25,Math.max(e,25))})),n},t.g=()=>{const t=document.getElementsByClassName("ux-scaled");let e=1;return t&&t.length>0&&(e=t[0].getAttribute("data-scale")),e},t.r=t=>{let{count:e=0,fontSizeMap:n={},defaultFontSize:r}=t;const i=(global._\|\|guac.lodash).reduce(n,((t,e,n)=>{let[r,i=Number.MAX_VALUE]=e;return t.push({range:[r,i],

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (6969)
Category:	downloaded
Size (bytes):	7039
Entropy (8bit):	5.2361798012427245
Encrypted:	false
SSDEEP:	192:oLb1MP+fzUiru5feyeCVL+izwhVQ9iPzmHFnYJsvIFO/Esh:oLxmCUiru5fneCVL+izwhVQ9ibmHFnYK
MD5:	DAD318033A09F6ABA68D6EE66F1CDACE
SHA1:	F538D0C3973677A6CDF14E9223AFB432FCF1CF8C
SHA-256:	E8FCFB1552D918B5D9FD715F711255465D6DD4348B4DCEDD362CB00DF9D3DBEF
SHA-512:	6024483003089661D9799000202895EC4ACA6CDEC816BDBC786F6800536AA8E6B93D8B8CA81E1EB6B8122C72CD14172C94C6C49953FFA536E49D71DD7F47499F
Malicious:	false
Reputation:	low
URL:	https://img1.wsimg.com/blobby/go/static/radpack/@widget/LAYOUT/bs-layout13-Theme-publish-Theme-7252afe2.js
Preview:	define("@widget/LAYOUT/bs-layout13-Theme-publish-Theme-7252afe2.js",["exports","~/c/bs-_rollupPluginBabelHelpers","~/c/bs-index3","~/c/bs-themeOverrides","~/c/bs-legacyOverrides","~/c/bs-humanisticFilled","~/c/bs-defaultSocialIconPack","~/c/bs-loaders","~/c/bs-index","~/c/bs-overlayTypes"],(function(e,t,r,o,a,n,i,s,l,g){"use strict";const{colorPackCategories:d,buttons:c}=(global.Core\|\|guac["@wsb/guac-widget-core"]).constants,{LIGHT:u,LIGHT_ALT:m,LIGHT_COLORFUL:h,DARK:p,DARK_ALT:y,DARK_COLORFUL:f,COLORFUL:b,MVP:x}=(global.Core\|\|guac["@wsb/guac-widget-core"]).constants.paintJobs,I={[g.F]:"category-overlay",[g.b]:"category-overlay",[g.I]:"category-solid",[g.B]:"category-overlay",[g.L]:"category-overlay"},S={defaultHeaderTreatment:g.F,imageTreatments:I,heroContentItems:["tagline","tagline2","cta"],nonHeroContentItems:["phone"]};var C={id:"layout13",name:"modern",packs:{color:"005",font:"league-spartan"},logo:{font:"primary"},packCategories:{color:d.ACCENT},headerProperties:{alignmentOption

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	886
Entropy (8bit):	7.1114442359148935
Encrypted:	false
SSDEEP:	12:inh5OooKSIyE1BZI/4IEgTvns7zInUZvlo7Nq7/AOZeUcqj33HWGcRPb3SkEl9eB:ibrTVBZz5IvnCeC/rZEqj3Hy2l
MD5:	22892688FF9809EE89B5FB7CD612A122
SHA1:	FCDF0D63C867D99034C18EA0F128D6B9A22A7FFA
SHA-256:	D8DFB9AF8F69C377A9345E326B57437FCD40D12825C484B2C9E345EBE1270DEB
SHA-512:	C20642896120B2614FACB2A33B4AB4DCE55BB3ED3F9839C8E4E47D3978659C7707DDFAD8526F06C54B2AA58E84A3074812B8E814F00CF20E98F864A6CAB57240
Malicious:	false
Reputation:	low
URL:	"https://img1.wsimg.com/isteam/ip/5f93a78e-c642-4e8f-82dd-eb36b2ca2216/favicon/f6fe747d-3caa-4b92-8b79-9a28041c203e.png/:/rs=w:32,h:32,m"
Preview:	RIFFn...WEBPVP8X..............ALPH......s.......b.m'..N.U.mW......>........U..xS....e._{......&...{..'M....7..}..zP....n/..1&.l..B...jh..y......WC.)+SJ...z...6......(._>...a.w....GP....M....k#A..2.....[..Ckk.."4N..c..T...>.y.2....=.r.>.L......h.4T..R......}B...8G...<>..st.:.r+!B..U./....Cmr..V:.../.V....:.U..i..0...3...A...k..J..s.G.Ky\8.:.me..[#..J.c..c.+..u.\|.V.(.%...?n.........UG...Mz.jZ...:U.o\|.VP8 ....P.... . .>m0.F.".!(.....l..2.u...Inwwa@].o.....d9 ..z.&.....s...{Y[.>..6..X=....-.C_."9i.h5z..7.n...YI.>..l......F.\|.o........-...Y.._...O.;.....<.jg........\..IE..t..e..7..?.....v...1?.W..ZU.....$........_W..c...y.........#.?....y..&Gx..:?....EXIF....Exif..II...........................V...........^...(.......................i.......f.......8c......8c................0210....................0100.................... ........... .......

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	7.7740342467587595
Encrypted:	false
SSDEEP:	24:2gAeCtZZMla0mrgKxg8rPyNqdRCxGQ4GUeGVWor6y+W8c:2gAeDr+gKxnrPykRoPUevo0W8c
MD5:	AB941AE49D7A60AC7D18653D97A298F0
SHA1:	10FA64E8481B0030402BD9E13EC1A7D5FE7D8162
SHA-256:	C2B6BDCF3D1F58907AB62DC86D60868929C70BE4E9D13680D7D198B3E317F932
SHA-512:	086BB129CDA94883ECBD391A9E61AF3969F3320139D283AA2EE709C252EDBBCDF11F2BB30F0FE747214F5966775FE59A579F095EC8C8847C4D6EA1869F700A4A
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR... ... .....szz.....pHYs..........{Rk....IDATX..V}h.U...VTS......>..>.6,.v.y.....m..e......9.EQ&..!A....Q...aA ..k{....f64.>.O.P.....v...u#.~..9.y..\|?.I$........![.......#..Yb&...K.I.T...;C..K.s.i...>.b..8N...H.;S.<..ef........D....wR.oP...!;N...Jk..]v.%.F....H.. .t.6-...Yzf..._.2.(.\|yZ.?>.t.OUZ.q....f@..N...@..:.\.;.m6........o.$..............9..b....3..1.s4.s.......).C.......nxN..9../.....z.C.vU..3.[.......S.{?.[;..-^wc..5...+...wU..\|..x1Z..../.....C.....c.=<........L...HhK.PZ......4.......\...oM.n.z...wE.C.M.._..-.r..^......A...Hse\|...V...Q.o.4..5..g{h.....e.x`x.;q.K.b.$./.j........3E...db.o.ii.]H}.^...Ti.K....^..'.@.....z.`.)...g.o.\|?..>..z...8'>..(S...\|.......\|4N..G........pO..0i....X-.~a....>..D.R<:.Td..I..q.{...&..p.I.Z.f.ZM./..i.1...;.7#5..&...h.I/..@.C..K...J.s...N..<......~.&Z4.UZ."oL>..X.Isx9.>LA.b . .\|w..UiU...Q.T.!0<g9..:.......5......-^w..Q8*qa..S.ui..+"..b..Yk(...e.}A...)6[..,\k.~...+z#.!.O.........7..#:..

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (23126)
Category:	downloaded
Size (bytes):	23189
Entropy (8bit):	4.539345073526186
Encrypted:	false
SSDEEP:	384:7UuK/6kvTqLYddu4bV/yiAhSs1hiAhAiSeG3dvBRU+SMkc6e:QuJ5wI45/c1+ipG3TJSMkU
MD5:	3D092EF4ABA019B14F01C40747E40554
SHA1:	1C26145272FCF4CA91AF501288CCE84B1BFFD38B
SHA-256:	B4C48B77BBE6BBACF7D16BDAA81F5509FB8EA0FBFDDFBF2D12307F7A88518846
SHA-512:	F7180D3D98CF17556E27D62EF719DD9E35041679BAB74BD49BD898EB0FB62018EF6C6B64D06E9E0CAC4A646154DB93A1D35096B098DDCFF7B02CD6889A29DA0A
Malicious:	false
Reputation:	low
URL:	https://img1.wsimg.com/blobby/go/static/radpack/@widget/LAYOUT/c/bs-defaultSocialIconPack-91835b99.js
Preview:	define("@widget/LAYOUT/c/bs-defaultSocialIconPack-91835b99.js",["exports"],(function(a){"use strict";const e=(global.React\|\|guac.react).createElement("path",{d:"M12 2C6.477 2 2 6.477 2 12s4.477 10 10 10 10-4.477 10-10A10 10 0 0 0 12 2zM7.055 13.745a.97.97 0 0 1-.073-.509l.182-2.072a.687.687 0 0 1 .29-.364c.182-.11.582.036.582.036l2.619 1.31s.4.181.4.509c-.037.436-.219.436-.364.509l-3.055.654s-.436.146-.581-.073zm4.945.473l-.036 3.018s.036.437-.219.51c-.144.02-.291.02-.436 0l-2.036-.655a.6.6 0 0 1-.291-.364c-.073-.218.182-.545.182-.545l2.036-2.255s.327-.29.582-.145c.254.145.254.436.218.436zm-.364-3.236a.687.687 0 0 1-.581-.182l-2.51-3.418s-.363-.4-.181-.691a.64.64 0 0 1 .363-.291l2.4-.873c.11-.036.218-.145.582.073.255.145.291.655.291.655l.036 4.145s-.072.51-.4.582zm1.419.582l1.636-2.582s.145-.364.436-.327c.152.002.29.085.364.218l1.382 1.636a.676.676 0 0 1 .072.473c-.072.218-.472.363-.472.363l-2.91.837s-.4.073-.545-.182c-.145-.255 0-.51.037-.436zm3.781 3.309L15.6 16.655a.815.815 0 0 1-.4

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.376083689062415
Encrypted:	false
SSDEEP:	6:FSPl39b4BSyRbjGJlI9kXJ3+V0q1EkmGHr9EJiKWaEt39J:cd39MBSyVz0XkTHr+pWTt39J
MD5:	ACD4F2B6117E5054FC9BF848AE8121CA
SHA1:	AE4D5F41D854BA8D99A4A1EC6EE6D6C3C0A859B8
SHA-256:	66774F89FCFA5674BE9AEF60E3FE3CB81E4DD88246BDE4E5392DF8B99FEFD4DB
SHA-512:	906FC9144D4AB81E8000CBE4A7AF7AFF775464347449193337E8738D705888C02B9476E083B3B67BDB3CBC312AAC4644C10737BC1FC5F9F08B38F5F45A2410F9
Malicious:	false
Reputation:	low
Preview:	define("@widget/LAYOUT/c/bs-legacyOverrides-42582241.js",["exports"],(function(e){"use strict";e.g=function(e,i,n){let o={};return"MENU"===i&&"h3"===e&&(o={color:"highlight"},"menu3"===n&&(o.fontSize="large")),o}})),"undefined"!=typeof window&&(window.global=window);.//# sourceMappingURL=bs-legacyOverrides-42582241.js.map.

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	242081
Entropy (8bit):	5.517740449222352
Encrypted:	false
SSDEEP:	3072:Eu8xUu8gpdmSOvTdTK4Tn9TnatTn9TnApfeVH0pdmSO3iTIT7JlDnDQj3jPGIXST:382/6bbCx0FMKhd
MD5:	EE94D93E4A0EB3D2C41B8C7EE1BB25F6
SHA1:	3C52577F309D7C76DE7EA4E0A40CBB358886A1B4
SHA-256:	22F0A029FD70E639CC74C49BE1071F7710AE42E70CA2AD71C08EB6075B53D4BC
SHA-512:	6605DB1B03094066E506775B6E5B88B72EB928993FC1268F08250F13D66EEABC656FF1203D51527C19D64D6A2358BFF7358E2AC2E5AE474A3C71A53E5535A255
Malicious:	false
Reputation:	low
URL:	https://img1.wsimg.com/blobby/go/static/radpack/@widget/LAYOUT/c/bs-index3-6c39b3c7.js
Preview:	define("@widget/LAYOUT/c/bs-index3-6c39b3c7.js",["radpack","exports","~/c/bs-_rollupPluginBabelHelpers","~/c/bs-overlayTypes","~/c/bs-index2","~/c/bs-index","~/c/bs-dataAids","@wsb/guac-widget-shared@^1/lib/components/ColorSwatch","@wsb/guac-widget-shared@^1/lib/components/Carousel","~/c/bs-navigationDrawer","~/c/bs-searchFormLocations"],(function(e,t,a,r,o,l,n,i,c,s,g){"use strict";class p extends((global.Core\|\|guac["@wsb/guac-widget-core"]).UX2.utils.createElement("Background")){}a._(p,"propTypes",{className:(global.PropTypes\|\|guac["prop-types"]).string,backgroundSize:(global.PropTypes\|\|guac["prop-types"]).string,backgroundPosition:(global.PropTypes\|\|guac["prop-types"]).string,style:(global.PropTypes\|\|guac["prop-types"]).object,imageData:(global.PropTypes\|\|guac["prop-types"]).object,mobileWidthMultiplier:(global.PropTypes\|\|guac["prop-types"]).number,desktopWidthMultiplier:(global.PropTypes\|\|guac["prop-types"]).number,blur:(global.PropTypes\|\|guac["prop-types"]).bool}),a._(p,"defaultPr

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (63425)
Category:	downloaded
Size (bytes):	315045
Entropy (8bit):	5.470972207090544
Encrypted:	false
SSDEEP:	3072:7aOD2q1BSK7x5jfw71nUNdFIh0qrMdB8pbKQJaZkNeQHUC5SIui/+a:Wzq1Bzc71UNhqrMgpbLaZkNfHHWa
MD5:	D8A1FE8B9FD01233B8A030EA79C21DF0
SHA1:	1B2B4474F72FCEE56977101E7C85A8201F730903
SHA-256:	91DEC32BF6596B875CDEB8C7BFFC8B5029A870657D3D7C790E8939F17E24DC20
SHA-512:	C15DBBD27873E22558239D6671B7FA05107A348D44BEC9CD560B8AA6D443D4A86BBBC38FC6F2C18E4D4C82852741B7C995E3E80A1E95B04A0D2DBDA12DCB6F0F
Malicious:	false
Reputation:	low
URL:	https://img1.wsimg.com/ceph-p3-01/website-builder-data-prod/static/widgets/UX.4.29.0.js
Preview:	var Core=function(e){var t={};function n(r){if(t[r])return t[r].exports;var o=t[r]={i:r,l:!1,exports:{}};return e[r].call(o.exports,o,o.exports,n),o.l=!0,o.exports}return n.m=e,n.c=t,n.d=function(e,t,r){n.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:r})},n.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},n.t=function(e,t){if(1&t&&(e=n(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var r=Object.create(null);if(n.r(r),Object.defineProperty(r,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var o in e)n.d(r,o,function(t){return e[t]}.bind(null,o));return r},n.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return n.d(t,"a",t),t},n.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},n.p="//img1.wsimg.com/ceph-p3-01/website-builder-data-prod/static/widgets/",n(n.s=68)}([fun

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (786)
Category:	downloaded
Size (bytes):	842
Entropy (8bit):	5.258991916821592
Encrypted:	false
SSDEEP:	24:caBL+qMLVRGqawadlH0rVRrkAeT25Z2HrIY/:jKqSVMqzarH0brkAeq5ZSrI+
MD5:	31B521136207C11FF1F9985264424E8A
SHA1:	9EAF6B9717979CAEB5C7E846E17B2A89A08DC266
SHA-256:	C818B56446AE5A8D0466FC9C51D85104584E36F6D8B1C77E08A2D354E845E2CD
SHA-512:	DB2A8825F8C67B6361B86F5BB1DEE38089DD57E5E74ECBA335EF7D82D9D5E5AD3F64C07195FCDF700415F6F09B11BDB6A20410462ABAEC443335F19ACF8265B1
Malicious:	false
Reputation:	low
URL:	https://img1.wsimg.com/blobby/go/static/radpack/@widget/LAYOUT/c/bs-themeOverrides-e736c017.js
Preview:	define("@widget/LAYOUT/c/bs-themeOverrides-e736c017.js",["exports"],(function(e){"use strict";(global.Core\|\|guac["@wsb/guac-widget-core"]).constants;e.a=e=>{let{sectionHeadingHR:t}=e;return t?{sectionHeadingHR:t}:{}},e.b=e=>{let{sectionHeadingColor:t}=e;return{HIGHLIGHT:{style:{color:"highlight"}},HIGH_CONTRAST:{style:{color:"highContrast"}}}[t]\|\|{}},e.c=e=>{let{sectionHeadingSize:t}=e;return t?{style:{fontSize:t}}:{}},e.s=e=>{let{sectionHeadingAlignment:t}=e;return{LEFT:{style:{textAlign:"left","@md":{textAlign:"left"}},alignmentOption:"left"},CENTER:{style:{textAlign:"center","@md":{textAlign:"center"}},alignmentOption:"center"},RIGHT:{style:{textAlign:"right","@md":{textAlign:"right"}},alignmentOption:"right"}}[t]\|\|{}}})),"undefined"!=typeof window&&(window.global=window);.//# sourceMappingURL=bs-themeOverrides-e736c017.js.map.

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1211)
Category:	dropped
Size (bytes):	1261
Entropy (8bit):	5.340315611373646
Encrypted:	false
SSDEEP:	24:/BLEQuC0F6lq5lEYwy5WqogVeESgVeId4PXsHrIW:Z4jFYq5lpwW7vdd4PXgrIW
MD5:	CB9BFA0FBDD957FBE7F4841B70341DB2
SHA1:	9CAD12A3580D3E4D340CB867E88B687C75564C5A
SHA-256:	513864FD4EBD1926F3E1E78B436A90C2BC3A5D16835B50415E7B318D7DEEC2A2
SHA-512:	DF98C3262F64DA4EA9CACF75FF7CB685D71B69142D89F726AB3E13CF6F25432DC395D7C0950E1632F0E519F135B02FDA0753739189E51F1C9210ACA6692551DD
Malicious:	false
Reputation:	low
Preview:	define("@wsb/guac-widget-shared/lib/components/ColorSwatch-4196a0a9.js",["exports"],(function(e){"use strict";const o=e=>{let{color:o,isActive:t,inStock:r,isSmall:l}=e;const a=r\|\|void 0===r,c=l?"24px":"38px",n=l?"20px":"32px",i={borderRadius:"50%",borderWidth:"1px",borderStyle:"solid"},s={outer:{...i,display:"flex",alignItems:"center",justifyContent:"center",width:c,height:c,borderColor:t?"lowContrast":"transparent"},inner:{...i,borderColor:"ultraLowContrast",color:"ultraLowContrast",width:n,height:n,background:a?o:`linear-gradient(to left top, ${o} calc(50% - 1px), currentColor, ${o} calc(50% + 1px) )`}};return(global.React\|\|guac.react).createElement((global.Core\|\|guac["@wsb/guac-widget-core"]).UX2.Element.Block,{style:s.outer},(global.React\|\|guac.react).createElement((global.Core\|\|guac["@wsb/guac-widget-core"]).UX2.Element.Block,{style:s.inner}))};o.propTypes={color:(global.PropTypes\|\|guac["prop-types"]).string.isRequired,isActive:(global.PropTypes\|\|guac["prop-types"]).bool,inStock:(

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (5334)
Category:	downloaded
Size (bytes):	17408
Entropy (8bit):	5.435602617421501
Encrypted:	false
SSDEEP:	192:IIX4dosqFTp28AvwithImXl6CTPYz3gpHjbE1jZRAmBpmjwSAxiMzyFwjwSAxl4n:UsT2JTtXgDgpuR9SQCSotOQX4
MD5:	8759075823E2C72EFF51D61D94A75DAF
SHA1:	C2C278A04E106BC9A7A2A8C55D9C793FB2B845BF
SHA-256:	D8AB6C30FCBDC8DA0D6B6CA8F26D262387B9AF03511BCA6F98B4E7D1FBEF1878
SHA-512:	86E24A8DAE499E69672A97A74E84AB19E53B9835718746DE690B98CEFFAF07297E8B1DB0532C099ADF448B6465A033ECE90AE49C635C97C2B74BA1B298448615
Malicious:	false
Reputation:	low
URL:	https://uopheldlognxo.godaddysites.com/
Preview:	<!DOCTYPE html><html lang="en-IN"><head><link rel="icon" href="//img1.wsimg.com/isteam/ip/5f93a78e-c642-4e8f-82dd-eb36b2ca2216/favicon/f6fe747d-3caa-4b92-8b79-9a28041c203e.png/:/rs=w:16,h:16,m" sizes="16x16"/><link rel="icon" href="//img1.wsimg.com/isteam/ip/5f93a78e-c642-4e8f-82dd-eb36b2ca2216/favicon/f6fe747d-3caa-4b92-8b79-9a28041c203e.png/:/rs=w:24,h:24,m" sizes="24x24"/><link rel="icon" href="//img1.wsimg.com/isteam/ip/5f93a78e-c642-4e8f-82dd-eb36b2ca2216/favicon/f6fe747d-3caa-4b92-8b79-9a28041c203e.png/:/rs=w:32,h:32,m" sizes="32x32"/><link rel="icon" href="//img1.wsimg.com/isteam/ip/5f93a78e-c642-4e8f-82dd-eb36b2ca2216/favicon/f6fe747d-3caa-4b92-8b79-9a28041c203e.png/:/rs=w:48,h:48,m" sizes="48x48"/><link rel="icon" href="//img1.wsimg.com/isteam/ip/5f93a78e-c642-4e8f-82dd-eb36b2ca2216/favicon/f6fe747d-3caa-4b92-8b79-9a28041c203e.png/:/rs=w:64,h:64,m" sizes="64x64"/><meta charSet="utf-8"/><meta http-equiv="X-UA-Compatible" content="IE=edge"/><meta name="viewport" content="width=d

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (20947)
Category:	downloaded
Size (bytes):	24399
Entropy (8bit):	5.2375624098374
Encrypted:	false
SSDEEP:	384:UNoz5VHqeg0VzpiyiwffnnPacVorjFtteVT36FCLCpKe9plq2D:ME5qeg0Rp8wffnPVEjFtteEFiSbbl3D
MD5:	753CB19EE1A756E46FAA0F118B1B4E01
SHA1:	248885E3BFE7E71989BA9FFFB33B6EFF18166FEC
SHA-256:	ED9FFA2FBA5ECC75AF2F99E6EBADD5B927086F258037C2A848E94449CC579991
SHA-512:	4482C4D5F2F93DE8E095C549994A7783FA55CD1A6C4C9CC5E697CC2E2F00C98B04D5CB958CC1ADC4D0EF67F300BE014E112AE1D992487F40EB25BC93E8B47AAA
Malicious:	false
Reputation:	low
URL:	https://img1.wsimg.com/blobby/go/static/radpack/@wsb/guac-widget-shared/lib/components/Carousel-3d82957b.js
Preview:	define("@wsb/guac-widget-shared/lib/components/Carousel-3d82957b.js",["exports","~/c/_rollupPluginBabelHelpers","~/c/_commonjsHelpers","~/c/interopRequireDefault","~/c/_react_commonjs-external"],(function(e,t,n,i,r){"use strict";var s=n.c((function(e){function t(n){return e.exports=t="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},e.exports.__esModule=!0,e.exports.default=e.exports,t(n)}e.exports=t,e.exports.__esModule=!0,e.exports.default=e.exports})),o=n.c((function(e){var t=s.default;function n(e){if("function"!=typeof WeakMap)return null;var t=new WeakMap,i=new WeakMap;return(n=function(e){return e?i:t})(e)}e.exports=function(e,i){if(!i&&e&&e.__esModule)return e;if(null===e\|\|"object"!==t(e)&&"function"!=typeof e)return{default:e};var r=n(i);if(r&&r.has(e))return r.get(e);var s={},o=Object.defineProperty&&Object.getOwnPropertyDescr

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	221
Entropy (8bit):	5.32955468303281
Encrypted:	false
SSDEEP:	6:FSPD8WUDDSBSyFbNemGHr9EJiKWaEwI8WUDDn:c5UDGBSyCTHr+pWTwGUDr
MD5:	8F12765EB30FBDCFCDC116D13F7FC272
SHA1:	506E45B7D3930756EACCE0DAD449A3C8CDB3EAC6
SHA-256:	265995EB76326E95613750F6F6570B850F5C22280D262DE9B9632A16CEB98B9B
SHA-512:	7AA2F396B105BCCF2B943FD2AC60929D8BF3A0EB8574B77451CB29816DF8ACDCD07694B526D7E4585F849DFDA3A0FE6E95661179E13F682DBF54098D98154BFB
Malicious:	false
Reputation:	low
URL:	https://img1.wsimg.com/blobby/go/static/radpack/@widget/LAYOUT/c/bs-navigationDrawer-27f5f1f5.js
Preview:	define("@widget/LAYOUT/c/bs-navigationDrawer-27f5f1f5.js",["exports"],(function(i){"use strict";i.N="-249vw"})),"undefined"!=typeof window&&(window.global=window);.//# sourceMappingURL=bs-navigationDrawer-27f5f1f5.js.map.

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (905)
Category:	downloaded
Size (bytes):	960
Entropy (8bit):	5.203352394673048
Encrypted:	false
SSDEEP:	24:pzBLgJHHVvC+dKbywqIN6ttVFRJB1i/uwBrV7DtZHrIvyU:zSkjbQxz3+uQ7RxrIx
MD5:	62A914B2C847D4D02B76164D7A2A54C6
SHA1:	20D9F49A90A51FA6C8420640610DF77F7A96D919
SHA-256:	B08C2864EC27736C507B1CA4B3A225A19147841B861CD8494DAF95FA370FE639
SHA-512:	E67D3D9F68EF3151D93DEDAA3530DF89F0C957F08561E93134B219DEC23C2A1FE0D109AC666619526742C5411E4636ECE416A3AD1148C1AD0861F0050B41D3DE
Malicious:	false
Reputation:	low
URL:	https://img1.wsimg.com/blobby/go/static/radpack/@wsb/guac-widget-shared/c/_commonjsHelpers-67085353.js
Preview:	define("@wsb/guac-widget-shared/c/_commonjsHelpers-67085353.js",["exports"],(function(e){"use strict";var n="undefined"!=typeof globalThis?globalThis:"undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof self?self:{};e.a=n,e.b=function(e){if(e.__esModule)return e;var n=Object.defineProperty({},"__esModule",{value:!0});return Object.keys(e).forEach((function(t){var r=Object.getOwnPropertyDescriptor(e,t);Object.defineProperty(n,t,r.get?r:{enumerable:!0,get:function(){return e[t]}})})),n},e.c=function(e,n,t){return e(t={path:n,exports:{},require:function(e,n){return function(){throw new Error("Dynamic requires are not currently supported by @rollup/plugin-commonjs")}(null==n&&t.path)}},t.exports),t.exports},e.g=function(e){return e&&e.__esModule&&Object.prototype.hasOwnProperty.call(e,"default")?e.default:e}})),"undefined"!=typeof window&&(window.global=window);.//# sourceMappingURL=_commonjsHelpers-67085353.js.map.

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (383)
Category:	dropped
Size (bytes):	437
Entropy (8bit):	5.418011449016951
Encrypted:	false
SSDEEP:	12:cTTgBSyk+Jb8KCjoD3BMXkKbr4Si+THr+pWTDTd:cTTgBL3fCjqMXfr4SiSHrIYDTd
MD5:	21AD22788E6CAA18A4E9E57F7372B108
SHA1:	50EBDD2452193BEAB7D1899F788FBBF32D90DD55
SHA-256:	0FE26F07B9E5D49590F55D31CBC381CA9337850F89B09940E3B384FCD6D26464
SHA-512:	4237775466FC3A94FE9FD769B9A186DBF8559FE5E06442EA107872462B1591DA2EBFC2786DD8D05495538428F668D940A4D851AE8E13DAFBBF8B763EAAD2F063
Malicious:	false
Reputation:	low
Preview:	define("@widget/LAYOUT/c/bs-overlayTypes-e1dbe765.js",["exports"],(function(e){"use strict";const{headerTreatments:{FILL:n,FIT:t,INSET:o,BLUR:a,LEGACY_BLUR:c}}=(global.Core\|\|guac["@wsb/guac-widget-core"]).constants;e.A="accent",e.B=a,e.C="category",e.F=n,e.I=o,e.L=c,e.N="neutral",e.P="primary",e.a="none",e.b=t,e.c="light_dark"})),"undefined"!=typeof window&&(window.global=window);.//# sourceMappingURL=bs-overlayTypes-e1dbe765.js.map.

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	304
Entropy (8bit):	5.609970428503769
Encrypted:	false
SSDEEP:	6:FSPOhWNjZTivBSyv5F/kpIdiEjGWF+ktxRmGHr9EJiKWaEkWNjZTiKF:cUZBSyv5ZdihWF+CRTHr+pWTkAF
MD5:	DAA79AD7558674F6A12D962ABF47F2F6
SHA1:	03EEA0EBEBD11EC14CFA5A651EB0ACA2604829A7
SHA-256:	604281887CD770ED21601933E9636A7A9C8A57A30D7D796AE7D760EEF64D5089
SHA-512:	B335EBCB0C982398C56D9A5F68F5D4E36A850AB139976BD94354C7CD18F1F370866A74F46FCD399F46E410D59AF7FBA890A17003BB4FD456DD43A6DE531D28F9
Malicious:	false
Reputation:	low
URL:	https://img1.wsimg.com/blobby/go/static/radpack/@widget/LAYOUT/c/bs-searchFormLocations-c86f2a99.js
Preview:	define("@widget/LAYOUT/c/bs-searchFormLocations-c86f2a99.js",["exports"],(function(o){"use strict";o.D="DESKTOP_NAV_COVER",o.M="MOBILE_NAV",o.N="NAV_DRAWER",o.S="SIDEBAR",o.a="DESKTOP_NAV"})),"undefined"!=typeof window&&(window.global=window);.//# sourceMappingURL=bs-searchFormLocations-c86f2a99.js.map.

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (383)
Category:	downloaded
Size (bytes):	437
Entropy (8bit):	5.418011449016951
Encrypted:	false
SSDEEP:	12:cTTgBSyk+Jb8KCjoD3BMXkKbr4Si+THr+pWTDTd:cTTgBL3fCjqMXfr4SiSHrIYDTd
MD5:	21AD22788E6CAA18A4E9E57F7372B108
SHA1:	50EBDD2452193BEAB7D1899F788FBBF32D90DD55
SHA-256:	0FE26F07B9E5D49590F55D31CBC381CA9337850F89B09940E3B384FCD6D26464
SHA-512:	4237775466FC3A94FE9FD769B9A186DBF8559FE5E06442EA107872462B1591DA2EBFC2786DD8D05495538428F668D940A4D851AE8E13DAFBBF8B763EAAD2F063
Malicious:	false
Reputation:	low
URL:	https://img1.wsimg.com/blobby/go/static/radpack/@widget/LAYOUT/c/bs-overlayTypes-e1dbe765.js
Preview:	define("@widget/LAYOUT/c/bs-overlayTypes-e1dbe765.js",["exports"],(function(e){"use strict";const{headerTreatments:{FILL:n,FIT:t,INSET:o,BLUR:a,LEGACY_BLUR:c}}=(global.Core\|\|guac["@wsb/guac-widget-core"]).constants;e.A="accent",e.B=a,e.C="category",e.F=n,e.I=o,e.L=c,e.N="neutral",e.P="primary",e.a="none",e.b=t,e.c="light_dark"})),"undefined"!=typeof window&&(window.global=window);.//# sourceMappingURL=bs-overlayTypes-e1dbe765.js.map.

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	330
Entropy (8bit):	4.909032600712556
Encrypted:	false
SSDEEP:	6:0IFFAfYot0+56ZRWHMqh7pYoRPmespQBiTJBifoPmespQBiTJBinNin:jFKfP0O6ZRoMqtp/PSQK+oPSQK0Y
MD5:	1E154E5ED919387FF6D969C8D6C56619
SHA1:	8E9D50DD4961C69460CF1881232CEA4BACCC6EB4
SHA-256:	45FAAA17694E6BA660358AC8005E4A87EEEB817D99BA2A2E8E6684A591EEFDBC
SHA-512:	FA84A9EB79CD9294FCAFB3DAF91CA08FC45EDCDE1BDE218D71F1448EBAEF4386ACDBAB4C2DA6D1CFA1036B88D6B89635D71FFFE00A84FD53CE9933440776D1E0
Malicious:	false
Reputation:	low
URL:	https://img1.wsimg.com/blobby/go/font/LeagueSpartan/league-spartan.css
Preview:	@font-face {. font-family: 'League Spartan';. font-style: normal;. font-weight: 400;. font-display: swap;. src: local('League Spartan'), url(https://img1.wsimg.com/blobby/go/font/LeagueSpartan/LeagueSpartan.woff2) format('woff2'), url(https://img1.wsimg.com/blobby/go/font/LeagueSpartan/LeagueSpartan.woff) format('woff');.}.

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	304
Entropy (8bit):	5.609970428503769
Encrypted:	false
SSDEEP:	6:FSPOhWNjZTivBSyv5F/kpIdiEjGWF+ktxRmGHr9EJiKWaEkWNjZTiKF:cUZBSyv5ZdihWF+CRTHr+pWTkAF
MD5:	DAA79AD7558674F6A12D962ABF47F2F6
SHA1:	03EEA0EBEBD11EC14CFA5A651EB0ACA2604829A7
SHA-256:	604281887CD770ED21601933E9636A7A9C8A57A30D7D796AE7D760EEF64D5089
SHA-512:	B335EBCB0C982398C56D9A5F68F5D4E36A850AB139976BD94354C7CD18F1F370866A74F46FCD399F46E410D59AF7FBA890A17003BB4FD456DD43A6DE531D28F9
Malicious:	false
Reputation:	low
Preview:	define("@widget/LAYOUT/c/bs-searchFormLocations-c86f2a99.js",["exports"],(function(o){"use strict";o.D="DESKTOP_NAV_COVER",o.M="MOBILE_NAV",o.N="NAV_DRAWER",o.S="SIDEBAR",o.a="DESKTOP_NAV"})),"undefined"!=typeof window&&(window.global=window);.//# sourceMappingURL=bs-searchFormLocations-c86f2a99.js.map.

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	886
Entropy (8bit):	7.1114442359148935
Encrypted:	false
SSDEEP:	12:inh5OooKSIyE1BZI/4IEgTvns7zInUZvlo7Nq7/AOZeUcqj33HWGcRPb3SkEl9eB:ibrTVBZz5IvnCeC/rZEqj3Hy2l
MD5:	22892688FF9809EE89B5FB7CD612A122
SHA1:	FCDF0D63C867D99034C18EA0F128D6B9A22A7FFA
SHA-256:	D8DFB9AF8F69C377A9345E326B57437FCD40D12825C484B2C9E345EBE1270DEB
SHA-512:	C20642896120B2614FACB2A33B4AB4DCE55BB3ED3F9839C8E4E47D3978659C7707DDFAD8526F06C54B2AA58E84A3074812B8E814F00CF20E98F864A6CAB57240
Malicious:	false
Reputation:	low
URL:	"https://img1.wsimg.com/isteam/ip/5f93a78e-c642-4e8f-82dd-eb36b2ca2216/favicon/f6fe747d-3caa-4b92-8b79-9a28041c203e.png/:/rs=w:192,h:192,m"
Preview:	RIFFn...WEBPVP8X..............ALPH......s.......b.m'..N.U.mW......>........U..xS....e._{......&...{..'M....7..}..zP....n/..1&.l..B...jh..y......WC.)+SJ...z...6......(._>...a.w....GP....M....k#A..2.....[..Ckk.."4N..c..T...>.y.2....=.r.>.L......h.4T..R......}B...8G...<>..st.:.r+!B..U./....Cmr..V:.../.V....:.U..i..0...3...A...k..J..s.G.Ky\8.:.me..[#..J.c..c.+..u.\|.V.(.%...?n.........UG...Mz.jZ...:U.o\|.VP8 ....P.... . .>m0.F.".!(.....l..2.u...Inwwa@].o.....d9 ..z.&.....s...{Y[.>..6..X=....-.C_."9i.h5z..7.n...YI.>..l......F.\|.o........-...Y.._...O.;.....<.jg........\..IE..t..e..7..?.....v...1?.W..ZU.....$........_W..c...y.........#.?....y..&Gx..:?....EXIF....Exif..II...........................V...........^...(.......................i.......f.......8c......8c................0210....................0100.................... ........... .......

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	266
Entropy (8bit):	5.182741116673583
Encrypted:	false
SSDEEP:	6:F9oNS2BSyRbWsCJwvYtMe1mGHr9EJiKWaO6SZF:HgS2BSyEsCJB1THr+pWIS7
MD5:	8578A331AD09BB2EF6359FEC3916BEFC
SHA1:	38B68F5C02CBDB6E29C50F8858710E0392B0B8D6
SHA-256:	3D7E7552E3801941A408C504AA732223FE2BED5D12E248680847D772182CB639
SHA-512:	B034DDDA04F8DEE0D174651D13A89AF9FE5ED28E1E81FAB229AFA119B9B0A9C418E324FFCE28E909D8D596BEAE98FA1AC0BA09C74E7E7689B945C032088C5E18
Malicious:	false
Reputation:	low
URL:	https://img1.wsimg.com/blobby/go/static/radpack/@wsb/guac-widget-shared/c/_react_commonjs-external-a1351e34.js
Preview:	define("@wsb/guac-widget-shared/c/_react_commonjs-external-a1351e34.js",["exports"],(function(e){"use strict";const n=global.React\|\|guac.react;e._=n})),"undefined"!=typeof window&&(window.global=window);.//# sourceMappingURL=_react_commonjs-external-a1351e34.js.map.

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (12251)
Category:	dropped
Size (bytes):	12309
Entropy (8bit):	4.691953487987274
Encrypted:	false
SSDEEP:	192:Y9hgK/4PoduPprRZ14Iwh0DyTDE7JPKSlrZWbFQJJZ7FFS3DQwNp/A+Qd:YoKwodgpehxTMPKSlrAMrLS38UKd
MD5:	DFB4BEE7C6378574342CDFCE62FDD1D7
SHA1:	75679AE1470880C7209353283879CB58C010621B
SHA-256:	BFF3C0C2907BCFFD63DEDC687B8FCA61197E8B783C644B3D665AC3620C383E3C
SHA-512:	76C8042532A9F0FF590606A920713515356C9B9C6366A1447C2D184F6AAA4D5880A399570D5764E84100C7619DB5EF061BA6C4E535FA2473E69060F76112DF4B
Malicious:	false
Reputation:	low
Preview:	define("@widget/LAYOUT/c/bs-humanisticFilled-91edd0e1.js",["exports"],(function(e){"use strict";const a=(global.React\|\|guac.react).createElement("path",{fillRule:"evenodd",d:"M16.056 8.255a4.254 4.254 0 1 1-8.507 0 4.254 4.254 0 0 1 8.507 0zm3.052 11.71H4.496a.503.503 0 0 1-.46-.693 8.326 8.326 0 0 1 7.766-5.328 8.326 8.326 0 0 1 7.766 5.328.503.503 0 0 1-.46.694z"});var l={__proto__:null,account:a,person:a,magGlass:(global.React\|\|guac.react).createElement("path",{fillRule:"evenodd",d:"M15.659 14.107c1.048.434 3.446 3.209 3.446 3.209a1.263 1.263 0 0 1 0 1.789 1.263 1.263 0 0 1-1.789 0s-2.775-2.371-3.209-3.419c-.077-.185 0-.591 0-.591l-.369-.362a6.111 6.111 0 0 1-3.656 1.211C6.729 15.944 4 13.265 4 9.972 4 6.679 6.729 4 10.082 4c3.354 0 6.082 2.679 6.082 5.972a5.88 5.88 0 0 1-1.466 3.878l.261.257s.483-.09.7 0zm-5.577.546c2.628 0 4.767-2.1 4.767-4.681s-2.139-4.681-4.767-4.681c-2.628 0-4.767 2.1-4.767 4.681s2.139 4.681 4.767 4.681z"}),cart1:(global.React\|\|guac.react).createElement("path",

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (330)
Category:	downloaded
Size (bytes):	390
Entropy (8bit):	5.206764812811324
Encrypted:	false
SSDEEP:	6:F9o8fAX7s4Bszv4yA5FKJyR8aBzzNWLc3oqcqAdfFwC6emGHr9EJiKWayfAX7A:HGs4Bkv4yA5sy+go9Hf+eTHr+pWOA
MD5:	C86B7F8224FA45FB1682AC94D8F75AC6
SHA1:	9561F67AAE74B14702DB79C22F9C7F9E6F3B3239
SHA-256:	010083B88E95F18CEFDB90796ACCE02073E91FC8DFEFB27A7F5F3F75529E4906
SHA-512:	B239BAC43D973D0076F4E0C0720906560B0AED76472F50202841B2EABB66C5AD5774E35449007AA2DC3E6A096330AB14D1AA9374645136C89A20B45E4BBDBC52
Malicious:	false
Reputation:	low
URL:	https://img1.wsimg.com/blobby/go/static/radpack/@wsb/guac-widget-shared/c/interopRequireDefault-c83974f7.js
Preview:	define("@wsb/guac-widget-shared/c/interopRequireDefault-c83974f7.js",["exports","~/c/_commonjsHelpers"],(function(e,o){"use strict";var t=o.c((function(e){e.exports=function(e){return e&&e.__esModule?e:{default:e}},e.exports.__esModule=!0,e.exports.default=e.exports}));e.i=t})),"undefined"!=typeof window&&(window.global=window);.//# sourceMappingURL=interopRequireDefault-c83974f7.js.map.

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=6, orientation=upper-left, xresolution=86, yresolution=94, resolutionunit=2], baseline, precision 8, 1240x766, components 3
Category:	dropped
Size (bytes):	85369
Entropy (8bit):	7.967050164024387
Encrypted:	false
SSDEEP:	1536:5coilS3aQ+lyjMohA8Uy2Xc0gzocnBVedBpOXqumPj+b25QnoXi:G5fohA8Noc0eoczCBcqbjQ25Qnv
MD5:	F0D720C89468A759C12AC8157704AF5C
SHA1:	E3032D9BDD04ADF63826B5F3F810F8001CF032C2
SHA-256:	40BC767335E6ADECB0ACBCBD2CE9C1D468C0204D40F17F4E4CE33BC159A320FD
SHA-512:	8B4B31F2EDC57E11F6D3E3CABE681410729241D1420C83BBCE46464414B165CE5AA48DE92E55FEF087E2862DA3FA58E25406F48AFAC2E3BB8B639CAF10C62056
Malicious:	false
Reputation:	low
Preview:	......Exif..II...........................V...........^...(.......................i.......f.......8c......8c................0210....................0100...........................................C.....................................%...#... , #&'))..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((...........".........................................\.........................!.1..AQa."2q...RST......#B...367Vrtu.....5CUbes...$%&4D..'Fcd.E........................................................!1Q..A.R.."2a.qB.#3..............?..D!....!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..!..rB..#. ....B.j.da.kz...9..t.......V..h~[..'#..Y8..\.+..C.b. ...Nb.%.y........-.{)$.......t.HK.K).....26..s..8.ee'V!-{.Z.C..-p8..4..>*:.:.fB..{.4m.7........v..sK.....dq.2Q..d..7..in.A...."...Mn....Zx"...ln.W=....g.=....^@..J[N

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	266
Entropy (8bit):	5.182741116673583
Encrypted:	false
SSDEEP:	6:F9oNS2BSyRbWsCJwvYtMe1mGHr9EJiKWaO6SZF:HgS2BSyEsCJB1THr+pWIS7
MD5:	8578A331AD09BB2EF6359FEC3916BEFC
SHA1:	38B68F5C02CBDB6E29C50F8858710E0392B0B8D6
SHA-256:	3D7E7552E3801941A408C504AA732223FE2BED5D12E248680847D772182CB639
SHA-512:	B034DDDA04F8DEE0D174651D13A89AF9FE5ED28E1E81FAB229AFA119B9B0A9C418E324FFCE28E909D8D596BEAE98FA1AC0BA09C74E7E7689B945C032088C5E18
Malicious:	false
Reputation:	low
Preview:	define("@wsb/guac-widget-shared/c/_react_commonjs-external-a1351e34.js",["exports"],(function(e){"use strict";const n=global.React\|\|guac.react;e._=n})),"undefined"!=typeof window&&(window.global=window);.//# sourceMappingURL=_react_commonjs-external-a1351e34.js.map.

Static File Info

⊘No static file info

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 28, 2024 04:51:40.090253115 CEST	49674	443	192.168.2.6	173.222.162.64
Sep 28, 2024 04:51:40.090253115 CEST	49673	443	192.168.2.6	173.222.162.64
Sep 28, 2024 04:51:40.402745962 CEST	49672	443	192.168.2.6	173.222.162.64
Sep 28, 2024 04:51:45.416662931 CEST	49710	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:51:45.416795969 CEST	443	49710	40.113.103.199	192.168.2.6
Sep 28, 2024 04:51:45.416908979 CEST	49710	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:51:45.417557001 CEST	49710	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:51:45.417596102 CEST	443	49710	40.113.103.199	192.168.2.6
Sep 28, 2024 04:51:46.194551945 CEST	443	49710	40.113.103.199	192.168.2.6
Sep 28, 2024 04:51:46.194691896 CEST	49710	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:51:47.021214008 CEST	49710	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:51:47.021306992 CEST	443	49710	40.113.103.199	192.168.2.6
Sep 28, 2024 04:51:47.021621943 CEST	443	49710	40.113.103.199	192.168.2.6
Sep 28, 2024 04:51:47.023145914 CEST	49710	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:51:47.023435116 CEST	49710	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:51:47.023447990 CEST	443	49710	40.113.103.199	192.168.2.6
Sep 28, 2024 04:51:47.023586988 CEST	49710	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:51:47.071407080 CEST	443	49710	40.113.103.199	192.168.2.6
Sep 28, 2024 04:51:47.197619915 CEST	443	49710	40.113.103.199	192.168.2.6
Sep 28, 2024 04:51:47.197751999 CEST	443	49710	40.113.103.199	192.168.2.6
Sep 28, 2024 04:51:47.197814941 CEST	49710	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:51:47.198061943 CEST	49710	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:51:47.198108912 CEST	443	49710	40.113.103.199	192.168.2.6
Sep 28, 2024 04:51:48.622739077 CEST	49711	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:51:48.622843981 CEST	443	49711	40.113.103.199	192.168.2.6
Sep 28, 2024 04:51:48.622935057 CEST	49711	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:51:48.624012947 CEST	49711	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:51:48.624049902 CEST	443	49711	40.113.103.199	192.168.2.6
Sep 28, 2024 04:51:49.553662062 CEST	443	49711	40.113.103.199	192.168.2.6
Sep 28, 2024 04:51:49.553736925 CEST	49711	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:51:49.555669069 CEST	49711	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:51:49.555685043 CEST	443	49711	40.113.103.199	192.168.2.6
Sep 28, 2024 04:51:49.555943012 CEST	443	49711	40.113.103.199	192.168.2.6
Sep 28, 2024 04:51:49.558022976 CEST	49711	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:51:49.558136940 CEST	49711	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:51:49.558144093 CEST	443	49711	40.113.103.199	192.168.2.6
Sep 28, 2024 04:51:49.558298111 CEST	49711	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:51:49.599411011 CEST	443	49711	40.113.103.199	192.168.2.6
Sep 28, 2024 04:51:49.713090897 CEST	49673	443	192.168.2.6	173.222.162.64
Sep 28, 2024 04:51:49.727654934 CEST	443	49711	40.113.103.199	192.168.2.6
Sep 28, 2024 04:51:49.727736950 CEST	443	49711	40.113.103.199	192.168.2.6
Sep 28, 2024 04:51:49.727802992 CEST	49711	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:51:49.727910995 CEST	49711	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:51:49.727951050 CEST	443	49711	40.113.103.199	192.168.2.6
Sep 28, 2024 04:51:49.779192924 CEST	49674	443	192.168.2.6	173.222.162.64
Sep 28, 2024 04:51:49.889029980 CEST	49717	443	192.168.2.6	13.248.243.5
Sep 28, 2024 04:51:49.889076948 CEST	443	49717	13.248.243.5	192.168.2.6
Sep 28, 2024 04:51:49.889151096 CEST	49717	443	192.168.2.6	13.248.243.5
Sep 28, 2024 04:51:49.904403925 CEST	49718	443	192.168.2.6	13.248.243.5
Sep 28, 2024 04:51:49.904428959 CEST	443	49718	13.248.243.5	192.168.2.6
Sep 28, 2024 04:51:49.904484987 CEST	49718	443	192.168.2.6	13.248.243.5
Sep 28, 2024 04:51:49.904700041 CEST	49717	443	192.168.2.6	13.248.243.5
Sep 28, 2024 04:51:49.904716015 CEST	443	49717	13.248.243.5	192.168.2.6
Sep 28, 2024 04:51:49.905459881 CEST	49718	443	192.168.2.6	13.248.243.5
Sep 28, 2024 04:51:49.905469894 CEST	443	49718	13.248.243.5	192.168.2.6
Sep 28, 2024 04:51:50.043430090 CEST	49672	443	192.168.2.6	173.222.162.64
Sep 28, 2024 04:51:50.377227068 CEST	443	49718	13.248.243.5	192.168.2.6
Sep 28, 2024 04:51:50.378675938 CEST	443	49717	13.248.243.5	192.168.2.6
Sep 28, 2024 04:51:50.422013044 CEST	49718	443	192.168.2.6	13.248.243.5
Sep 28, 2024 04:51:50.423121929 CEST	49717	443	192.168.2.6	13.248.243.5
Sep 28, 2024 04:51:50.423130989 CEST	443	49717	13.248.243.5	192.168.2.6
Sep 28, 2024 04:51:50.423305988 CEST	49718	443	192.168.2.6	13.248.243.5
Sep 28, 2024 04:51:50.423310041 CEST	443	49718	13.248.243.5	192.168.2.6
Sep 28, 2024 04:51:50.424323082 CEST	443	49717	13.248.243.5	192.168.2.6
Sep 28, 2024 04:51:50.424413919 CEST	49717	443	192.168.2.6	13.248.243.5
Sep 28, 2024 04:51:50.425317049 CEST	443	49718	13.248.243.5	192.168.2.6
Sep 28, 2024 04:51:50.425421000 CEST	49718	443	192.168.2.6	13.248.243.5
Sep 28, 2024 04:51:50.425785065 CEST	49717	443	192.168.2.6	13.248.243.5
Sep 28, 2024 04:51:50.425851107 CEST	443	49717	13.248.243.5	192.168.2.6
Sep 28, 2024 04:51:50.426184893 CEST	49718	443	192.168.2.6	13.248.243.5
Sep 28, 2024 04:51:50.426263094 CEST	443	49718	13.248.243.5	192.168.2.6
Sep 28, 2024 04:51:50.426393032 CEST	49717	443	192.168.2.6	13.248.243.5
Sep 28, 2024 04:51:50.426398039 CEST	443	49717	13.248.243.5	192.168.2.6
Sep 28, 2024 04:51:50.470935106 CEST	49718	443	192.168.2.6	13.248.243.5
Sep 28, 2024 04:51:50.470942974 CEST	443	49718	13.248.243.5	192.168.2.6
Sep 28, 2024 04:51:50.531167030 CEST	49718	443	192.168.2.6	13.248.243.5
Sep 28, 2024 04:51:50.542831898 CEST	443	49717	13.248.243.5	192.168.2.6
Sep 28, 2024 04:51:50.542890072 CEST	443	49717	13.248.243.5	192.168.2.6
Sep 28, 2024 04:51:50.542907000 CEST	443	49717	13.248.243.5	192.168.2.6
Sep 28, 2024 04:51:50.542968035 CEST	49717	443	192.168.2.6	13.248.243.5
Sep 28, 2024 04:51:50.542980909 CEST	443	49717	13.248.243.5	192.168.2.6
Sep 28, 2024 04:51:50.542992115 CEST	49717	443	192.168.2.6	13.248.243.5
Sep 28, 2024 04:51:50.543003082 CEST	443	49717	13.248.243.5	192.168.2.6
Sep 28, 2024 04:51:50.543024063 CEST	49717	443	192.168.2.6	13.248.243.5
Sep 28, 2024 04:51:50.613305092 CEST	443	49717	13.248.243.5	192.168.2.6
Sep 28, 2024 04:51:50.613390923 CEST	443	49717	13.248.243.5	192.168.2.6
Sep 28, 2024 04:51:50.613466024 CEST	49717	443	192.168.2.6	13.248.243.5
Sep 28, 2024 04:51:50.615497112 CEST	49717	443	192.168.2.6	13.248.243.5
Sep 28, 2024 04:51:50.615514040 CEST	443	49717	13.248.243.5	192.168.2.6
Sep 28, 2024 04:51:50.625690937 CEST	49726	443	192.168.2.6	35.157.66.55
Sep 28, 2024 04:51:50.625715971 CEST	443	49726	35.157.66.55	192.168.2.6
Sep 28, 2024 04:51:50.625783920 CEST	49726	443	192.168.2.6	35.157.66.55
Sep 28, 2024 04:51:50.625965118 CEST	49726	443	192.168.2.6	35.157.66.55
Sep 28, 2024 04:51:50.625991106 CEST	443	49726	35.157.66.55	192.168.2.6
Sep 28, 2024 04:51:51.360491037 CEST	443	49726	35.157.66.55	192.168.2.6
Sep 28, 2024 04:51:51.360754013 CEST	49726	443	192.168.2.6	35.157.66.55
Sep 28, 2024 04:51:51.360764027 CEST	443	49726	35.157.66.55	192.168.2.6
Sep 28, 2024 04:51:51.362200022 CEST	443	49726	35.157.66.55	192.168.2.6
Sep 28, 2024 04:51:51.362276077 CEST	49726	443	192.168.2.6	35.157.66.55
Sep 28, 2024 04:51:51.363102913 CEST	49726	443	192.168.2.6	35.157.66.55
Sep 28, 2024 04:51:51.363193035 CEST	443	49726	35.157.66.55	192.168.2.6
Sep 28, 2024 04:51:51.415884972 CEST	49726	443	192.168.2.6	35.157.66.55
Sep 28, 2024 04:51:51.415914059 CEST	443	49726	35.157.66.55	192.168.2.6
Sep 28, 2024 04:51:51.463180065 CEST	49726	443	192.168.2.6	35.157.66.55
Sep 28, 2024 04:51:51.700005054 CEST	443	49705	173.222.162.64	192.168.2.6
Sep 28, 2024 04:51:51.700144053 CEST	49705	443	192.168.2.6	173.222.162.64
Sep 28, 2024 04:51:53.278837919 CEST	49734	443	192.168.2.6	142.250.186.100
Sep 28, 2024 04:51:53.278870106 CEST	443	49734	142.250.186.100	192.168.2.6
Sep 28, 2024 04:51:53.278959990 CEST	49734	443	192.168.2.6	142.250.186.100
Sep 28, 2024 04:51:53.279475927 CEST	49734	443	192.168.2.6	142.250.186.100
Sep 28, 2024 04:51:53.279488087 CEST	443	49734	142.250.186.100	192.168.2.6
Sep 28, 2024 04:51:54.040853977 CEST	443	49734	142.250.186.100	192.168.2.6
Sep 28, 2024 04:51:54.041307926 CEST	49734	443	192.168.2.6	142.250.186.100
Sep 28, 2024 04:51:54.041331053 CEST	443	49734	142.250.186.100	192.168.2.6
Sep 28, 2024 04:51:54.042349100 CEST	443	49734	142.250.186.100	192.168.2.6
Sep 28, 2024 04:51:54.042390108 CEST	49734	443	192.168.2.6	142.250.186.100
Sep 28, 2024 04:51:54.045218945 CEST	49734	443	192.168.2.6	142.250.186.100
Sep 28, 2024 04:51:54.045284033 CEST	443	49734	142.250.186.100	192.168.2.6
Sep 28, 2024 04:51:54.068238974 CEST	49746	443	192.168.2.6	184.28.90.27
Sep 28, 2024 04:51:54.068264008 CEST	443	49746	184.28.90.27	192.168.2.6
Sep 28, 2024 04:51:54.068331957 CEST	49746	443	192.168.2.6	184.28.90.27
Sep 28, 2024 04:51:54.072026014 CEST	49746	443	192.168.2.6	184.28.90.27
Sep 28, 2024 04:51:54.072052002 CEST	443	49746	184.28.90.27	192.168.2.6
Sep 28, 2024 04:51:54.185638905 CEST	49734	443	192.168.2.6	142.250.186.100
Sep 28, 2024 04:51:54.185672045 CEST	443	49734	142.250.186.100	192.168.2.6
Sep 28, 2024 04:51:54.294537067 CEST	49734	443	192.168.2.6	142.250.186.100
Sep 28, 2024 04:51:54.719631910 CEST	443	49746	184.28.90.27	192.168.2.6
Sep 28, 2024 04:51:54.719697952 CEST	49746	443	192.168.2.6	184.28.90.27
Sep 28, 2024 04:51:54.726362944 CEST	49746	443	192.168.2.6	184.28.90.27
Sep 28, 2024 04:51:54.726370096 CEST	443	49746	184.28.90.27	192.168.2.6
Sep 28, 2024 04:51:54.726599932 CEST	443	49746	184.28.90.27	192.168.2.6
Sep 28, 2024 04:51:54.777096987 CEST	49746	443	192.168.2.6	184.28.90.27
Sep 28, 2024 04:51:54.977936029 CEST	49746	443	192.168.2.6	184.28.90.27
Sep 28, 2024 04:51:55.023405075 CEST	443	49746	184.28.90.27	192.168.2.6
Sep 28, 2024 04:51:55.164160013 CEST	443	49746	184.28.90.27	192.168.2.6
Sep 28, 2024 04:51:55.165458918 CEST	443	49746	184.28.90.27	192.168.2.6
Sep 28, 2024 04:51:55.165720940 CEST	49746	443	192.168.2.6	184.28.90.27
Sep 28, 2024 04:51:55.170941114 CEST	49746	443	192.168.2.6	184.28.90.27
Sep 28, 2024 04:51:55.170957088 CEST	443	49746	184.28.90.27	192.168.2.6
Sep 28, 2024 04:51:55.170983076 CEST	49746	443	192.168.2.6	184.28.90.27
Sep 28, 2024 04:51:55.170990944 CEST	443	49746	184.28.90.27	192.168.2.6
Sep 28, 2024 04:51:55.479337931 CEST	49761	443	192.168.2.6	184.28.90.27
Sep 28, 2024 04:51:55.479365110 CEST	443	49761	184.28.90.27	192.168.2.6
Sep 28, 2024 04:51:55.483340979 CEST	49761	443	192.168.2.6	184.28.90.27
Sep 28, 2024 04:51:55.491942883 CEST	49761	443	192.168.2.6	184.28.90.27
Sep 28, 2024 04:51:55.491959095 CEST	443	49761	184.28.90.27	192.168.2.6
Sep 28, 2024 04:51:56.155287027 CEST	443	49761	184.28.90.27	192.168.2.6
Sep 28, 2024 04:51:56.155375957 CEST	49761	443	192.168.2.6	184.28.90.27
Sep 28, 2024 04:51:56.162134886 CEST	49761	443	192.168.2.6	184.28.90.27
Sep 28, 2024 04:51:56.162147045 CEST	443	49761	184.28.90.27	192.168.2.6
Sep 28, 2024 04:51:56.162435055 CEST	443	49761	184.28.90.27	192.168.2.6
Sep 28, 2024 04:51:56.165203094 CEST	49761	443	192.168.2.6	184.28.90.27
Sep 28, 2024 04:51:56.211421967 CEST	443	49761	184.28.90.27	192.168.2.6
Sep 28, 2024 04:51:56.432673931 CEST	443	49761	184.28.90.27	192.168.2.6
Sep 28, 2024 04:51:56.432884932 CEST	443	49761	184.28.90.27	192.168.2.6
Sep 28, 2024 04:51:56.432945013 CEST	49761	443	192.168.2.6	184.28.90.27
Sep 28, 2024 04:51:56.434911966 CEST	49761	443	192.168.2.6	184.28.90.27
Sep 28, 2024 04:51:56.434959888 CEST	443	49761	184.28.90.27	192.168.2.6
Sep 28, 2024 04:51:56.435014963 CEST	49761	443	192.168.2.6	184.28.90.27
Sep 28, 2024 04:51:56.435031891 CEST	443	49761	184.28.90.27	192.168.2.6
Sep 28, 2024 04:51:56.663248062 CEST	49718	443	192.168.2.6	13.248.243.5
Sep 28, 2024 04:51:56.669246912 CEST	49774	443	192.168.2.6	13.248.243.5
Sep 28, 2024 04:51:56.669306040 CEST	443	49774	13.248.243.5	192.168.2.6
Sep 28, 2024 04:51:56.669373989 CEST	49774	443	192.168.2.6	13.248.243.5
Sep 28, 2024 04:51:56.670365095 CEST	49774	443	192.168.2.6	13.248.243.5
Sep 28, 2024 04:51:56.670377970 CEST	443	49774	13.248.243.5	192.168.2.6
Sep 28, 2024 04:51:56.703406096 CEST	443	49718	13.248.243.5	192.168.2.6
Sep 28, 2024 04:51:56.772871017 CEST	443	49718	13.248.243.5	192.168.2.6
Sep 28, 2024 04:51:56.772963047 CEST	443	49718	13.248.243.5	192.168.2.6
Sep 28, 2024 04:51:56.772984982 CEST	443	49718	13.248.243.5	192.168.2.6
Sep 28, 2024 04:51:56.773008108 CEST	443	49718	13.248.243.5	192.168.2.6
Sep 28, 2024 04:51:56.773031950 CEST	49718	443	192.168.2.6	13.248.243.5
Sep 28, 2024 04:51:56.773031950 CEST	49718	443	192.168.2.6	13.248.243.5
Sep 28, 2024 04:51:56.773049116 CEST	443	49718	13.248.243.5	192.168.2.6
Sep 28, 2024 04:51:56.773066998 CEST	443	49718	13.248.243.5	192.168.2.6
Sep 28, 2024 04:51:56.773075104 CEST	443	49718	13.248.243.5	192.168.2.6
Sep 28, 2024 04:51:56.773092031 CEST	49718	443	192.168.2.6	13.248.243.5
Sep 28, 2024 04:51:56.773111105 CEST	443	49718	13.248.243.5	192.168.2.6
Sep 28, 2024 04:51:56.773133993 CEST	49718	443	192.168.2.6	13.248.243.5
Sep 28, 2024 04:51:56.773142099 CEST	443	49718	13.248.243.5	192.168.2.6
Sep 28, 2024 04:51:56.773188114 CEST	49718	443	192.168.2.6	13.248.243.5
Sep 28, 2024 04:51:56.813891888 CEST	49718	443	192.168.2.6	13.248.243.5
Sep 28, 2024 04:51:56.855256081 CEST	443	49718	13.248.243.5	192.168.2.6
Sep 28, 2024 04:51:56.855268002 CEST	443	49718	13.248.243.5	192.168.2.6
Sep 28, 2024 04:51:56.855295897 CEST	443	49718	13.248.243.5	192.168.2.6
Sep 28, 2024 04:51:56.855304003 CEST	443	49718	13.248.243.5	192.168.2.6
Sep 28, 2024 04:51:56.855359077 CEST	443	49718	13.248.243.5	192.168.2.6
Sep 28, 2024 04:51:56.855370045 CEST	49718	443	192.168.2.6	13.248.243.5
Sep 28, 2024 04:51:56.855370045 CEST	49718	443	192.168.2.6	13.248.243.5
Sep 28, 2024 04:51:56.855418921 CEST	443	49718	13.248.243.5	192.168.2.6
Sep 28, 2024 04:51:56.855443954 CEST	49718	443	192.168.2.6	13.248.243.5
Sep 28, 2024 04:51:56.855488062 CEST	49718	443	192.168.2.6	13.248.243.5
Sep 28, 2024 04:51:56.855496883 CEST	443	49718	13.248.243.5	192.168.2.6
Sep 28, 2024 04:51:56.855520964 CEST	443	49718	13.248.243.5	192.168.2.6
Sep 28, 2024 04:51:56.855581999 CEST	49718	443	192.168.2.6	13.248.243.5
Sep 28, 2024 04:51:56.856616020 CEST	49718	443	192.168.2.6	13.248.243.5
Sep 28, 2024 04:51:56.856632948 CEST	443	49718	13.248.243.5	192.168.2.6
Sep 28, 2024 04:51:56.877691031 CEST	49776	443	192.168.2.6	13.248.243.5
Sep 28, 2024 04:51:56.877784967 CEST	443	49776	13.248.243.5	192.168.2.6
Sep 28, 2024 04:51:56.877866983 CEST	49776	443	192.168.2.6	13.248.243.5
Sep 28, 2024 04:51:56.878070116 CEST	49776	443	192.168.2.6	13.248.243.5
Sep 28, 2024 04:51:56.878113985 CEST	443	49776	13.248.243.5	192.168.2.6
Sep 28, 2024 04:51:57.159271955 CEST	443	49774	13.248.243.5	192.168.2.6
Sep 28, 2024 04:51:57.159487009 CEST	49774	443	192.168.2.6	13.248.243.5
Sep 28, 2024 04:51:57.159519911 CEST	443	49774	13.248.243.5	192.168.2.6
Sep 28, 2024 04:51:57.160995007 CEST	443	49774	13.248.243.5	192.168.2.6
Sep 28, 2024 04:51:57.161076069 CEST	49774	443	192.168.2.6	13.248.243.5
Sep 28, 2024 04:51:57.161431074 CEST	49774	443	192.168.2.6	13.248.243.5
Sep 28, 2024 04:51:57.161510944 CEST	443	49774	13.248.243.5	192.168.2.6
Sep 28, 2024 04:51:57.161724091 CEST	49774	443	192.168.2.6	13.248.243.5
Sep 28, 2024 04:51:57.161730051 CEST	443	49774	13.248.243.5	192.168.2.6
Sep 28, 2024 04:51:57.214982986 CEST	49774	443	192.168.2.6	13.248.243.5
Sep 28, 2024 04:51:57.277149916 CEST	443	49774	13.248.243.5	192.168.2.6
Sep 28, 2024 04:51:57.277247906 CEST	443	49774	13.248.243.5	192.168.2.6
Sep 28, 2024 04:51:57.277308941 CEST	49774	443	192.168.2.6	13.248.243.5
Sep 28, 2024 04:51:57.277977943 CEST	49774	443	192.168.2.6	13.248.243.5
Sep 28, 2024 04:51:57.278007984 CEST	443	49774	13.248.243.5	192.168.2.6
Sep 28, 2024 04:51:57.297995090 CEST	49781	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:51:57.298046112 CEST	443	49781	40.113.103.199	192.168.2.6
Sep 28, 2024 04:51:57.298118114 CEST	49781	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:51:57.298886061 CEST	49781	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:51:57.298904896 CEST	443	49781	40.113.103.199	192.168.2.6
Sep 28, 2024 04:51:57.302923918 CEST	49782	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:51:57.302951097 CEST	443	49782	40.113.103.199	192.168.2.6
Sep 28, 2024 04:51:57.303009033 CEST	49782	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:51:57.303550005 CEST	49782	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:51:57.303567886 CEST	443	49782	40.113.103.199	192.168.2.6
Sep 28, 2024 04:51:57.345952034 CEST	443	49776	13.248.243.5	192.168.2.6
Sep 28, 2024 04:51:57.346245050 CEST	49776	443	192.168.2.6	13.248.243.5
Sep 28, 2024 04:51:57.346282959 CEST	443	49776	13.248.243.5	192.168.2.6
Sep 28, 2024 04:51:57.346633911 CEST	443	49776	13.248.243.5	192.168.2.6
Sep 28, 2024 04:51:57.347055912 CEST	49776	443	192.168.2.6	13.248.243.5
Sep 28, 2024 04:51:57.347121954 CEST	443	49776	13.248.243.5	192.168.2.6
Sep 28, 2024 04:51:57.347230911 CEST	49776	443	192.168.2.6	13.248.243.5
Sep 28, 2024 04:51:57.391402960 CEST	443	49776	13.248.243.5	192.168.2.6
Sep 28, 2024 04:51:57.466655016 CEST	443	49776	13.248.243.5	192.168.2.6
Sep 28, 2024 04:51:57.466681957 CEST	443	49776	13.248.243.5	192.168.2.6
Sep 28, 2024 04:51:57.466700077 CEST	443	49776	13.248.243.5	192.168.2.6
Sep 28, 2024 04:51:57.466792107 CEST	49776	443	192.168.2.6	13.248.243.5
Sep 28, 2024 04:51:57.466841936 CEST	443	49776	13.248.243.5	192.168.2.6
Sep 28, 2024 04:51:57.466897964 CEST	49776	443	192.168.2.6	13.248.243.5
Sep 28, 2024 04:51:57.547408104 CEST	443	49776	13.248.243.5	192.168.2.6
Sep 28, 2024 04:51:57.547498941 CEST	49776	443	192.168.2.6	13.248.243.5
Sep 28, 2024 04:51:57.547513962 CEST	443	49776	13.248.243.5	192.168.2.6
Sep 28, 2024 04:51:57.547586918 CEST	49776	443	192.168.2.6	13.248.243.5
Sep 28, 2024 04:51:57.548288107 CEST	49776	443	192.168.2.6	13.248.243.5
Sep 28, 2024 04:51:57.548327923 CEST	443	49776	13.248.243.5	192.168.2.6
Sep 28, 2024 04:51:58.111077070 CEST	443	49782	40.113.103.199	192.168.2.6
Sep 28, 2024 04:51:58.111176014 CEST	49782	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:51:58.120978117 CEST	443	49781	40.113.103.199	192.168.2.6
Sep 28, 2024 04:51:58.121057987 CEST	49781	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:51:58.133419991 CEST	49782	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:51:58.133447886 CEST	443	49782	40.113.103.199	192.168.2.6
Sep 28, 2024 04:51:58.133460045 CEST	49781	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:51:58.133472919 CEST	443	49781	40.113.103.199	192.168.2.6
Sep 28, 2024 04:51:58.133723974 CEST	443	49782	40.113.103.199	192.168.2.6
Sep 28, 2024 04:51:58.133863926 CEST	443	49781	40.113.103.199	192.168.2.6
Sep 28, 2024 04:51:58.135895967 CEST	49781	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:51:58.136023045 CEST	49781	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:51:58.136029005 CEST	443	49781	40.113.103.199	192.168.2.6
Sep 28, 2024 04:51:58.136296988 CEST	49781	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:51:58.138145924 CEST	49782	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:51:58.138263941 CEST	49782	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:51:58.138271093 CEST	443	49782	40.113.103.199	192.168.2.6
Sep 28, 2024 04:51:58.138407946 CEST	49782	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:51:58.179402113 CEST	443	49782	40.113.103.199	192.168.2.6
Sep 28, 2024 04:51:58.179413080 CEST	443	49781	40.113.103.199	192.168.2.6
Sep 28, 2024 04:51:58.308552980 CEST	443	49781	40.113.103.199	192.168.2.6
Sep 28, 2024 04:51:58.308629036 CEST	443	49781	40.113.103.199	192.168.2.6
Sep 28, 2024 04:51:58.308918953 CEST	49781	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:51:58.309345007 CEST	49781	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:51:58.309369087 CEST	443	49781	40.113.103.199	192.168.2.6
Sep 28, 2024 04:51:58.309381962 CEST	49781	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:51:58.311855078 CEST	443	49782	40.113.103.199	192.168.2.6
Sep 28, 2024 04:51:58.312125921 CEST	443	49782	40.113.103.199	192.168.2.6
Sep 28, 2024 04:51:58.312182903 CEST	49782	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:51:58.312485933 CEST	49782	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:51:58.312490940 CEST	443	49782	40.113.103.199	192.168.2.6
Sep 28, 2024 04:52:02.689023018 CEST	49705	443	192.168.2.6	173.222.162.64
Sep 28, 2024 04:52:02.689748049 CEST	49791	443	192.168.2.6	173.222.162.64
Sep 28, 2024 04:52:02.689757109 CEST	49705	443	192.168.2.6	173.222.162.64
Sep 28, 2024 04:52:02.689805031 CEST	443	49791	173.222.162.64	192.168.2.6
Sep 28, 2024 04:52:02.689955950 CEST	49791	443	192.168.2.6	173.222.162.64
Sep 28, 2024 04:52:02.691348076 CEST	49791	443	192.168.2.6	173.222.162.64
Sep 28, 2024 04:52:02.691364050 CEST	443	49791	173.222.162.64	192.168.2.6
Sep 28, 2024 04:52:03.025870085 CEST	443	49705	173.222.162.64	192.168.2.6
Sep 28, 2024 04:52:03.025880098 CEST	443	49705	173.222.162.64	192.168.2.6
Sep 28, 2024 04:52:03.632534981 CEST	443	49791	173.222.162.64	192.168.2.6
Sep 28, 2024 04:52:03.632599115 CEST	49791	443	192.168.2.6	173.222.162.64
Sep 28, 2024 04:52:03.857752085 CEST	443	49734	142.250.186.100	192.168.2.6
Sep 28, 2024 04:52:03.857924938 CEST	443	49734	142.250.186.100	192.168.2.6
Sep 28, 2024 04:52:03.857975960 CEST	49734	443	192.168.2.6	142.250.186.100
Sep 28, 2024 04:52:05.400121927 CEST	49734	443	192.168.2.6	142.250.186.100
Sep 28, 2024 04:52:05.400161982 CEST	443	49734	142.250.186.100	192.168.2.6
Sep 28, 2024 04:52:11.528036118 CEST	49793	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:52:11.528105021 CEST	443	49793	40.113.103.199	192.168.2.6
Sep 28, 2024 04:52:11.528294086 CEST	49793	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:52:11.529328108 CEST	49793	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:52:11.529351950 CEST	443	49793	40.113.103.199	192.168.2.6
Sep 28, 2024 04:52:12.327967882 CEST	443	49793	40.113.103.199	192.168.2.6
Sep 28, 2024 04:52:12.328063965 CEST	49793	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:52:12.334745884 CEST	49793	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:52:12.334772110 CEST	443	49793	40.113.103.199	192.168.2.6
Sep 28, 2024 04:52:12.335707903 CEST	443	49793	40.113.103.199	192.168.2.6
Sep 28, 2024 04:52:12.338833094 CEST	49793	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:52:12.339086056 CEST	49793	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:52:12.339097023 CEST	443	49793	40.113.103.199	192.168.2.6
Sep 28, 2024 04:52:12.340300083 CEST	49793	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:52:12.387412071 CEST	443	49793	40.113.103.199	192.168.2.6
Sep 28, 2024 04:52:12.515320063 CEST	443	49793	40.113.103.199	192.168.2.6
Sep 28, 2024 04:52:12.515553951 CEST	443	49793	40.113.103.199	192.168.2.6
Sep 28, 2024 04:52:12.515705109 CEST	49793	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:52:12.516057014 CEST	49793	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:52:12.516077042 CEST	443	49793	40.113.103.199	192.168.2.6
Sep 28, 2024 04:52:14.143605947 CEST	49794	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:52:14.143667936 CEST	443	49794	40.113.103.199	192.168.2.6
Sep 28, 2024 04:52:14.143846035 CEST	49794	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:52:14.144750118 CEST	49794	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:52:14.144763947 CEST	443	49794	40.113.103.199	192.168.2.6
Sep 28, 2024 04:52:14.922873020 CEST	443	49794	40.113.103.199	192.168.2.6
Sep 28, 2024 04:52:14.922947884 CEST	49794	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:52:14.924989939 CEST	49794	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:52:14.924998045 CEST	443	49794	40.113.103.199	192.168.2.6
Sep 28, 2024 04:52:14.925266027 CEST	443	49794	40.113.103.199	192.168.2.6
Sep 28, 2024 04:52:14.926423073 CEST	49794	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:52:14.926482916 CEST	49794	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:52:14.926486969 CEST	443	49794	40.113.103.199	192.168.2.6
Sep 28, 2024 04:52:14.926583052 CEST	49794	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:52:14.971399069 CEST	443	49794	40.113.103.199	192.168.2.6
Sep 28, 2024 04:52:15.096561909 CEST	443	49794	40.113.103.199	192.168.2.6
Sep 28, 2024 04:52:15.096645117 CEST	443	49794	40.113.103.199	192.168.2.6
Sep 28, 2024 04:52:15.096930981 CEST	49794	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:52:15.097275972 CEST	49794	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:52:22.790513992 CEST	443	49791	173.222.162.64	192.168.2.6
Sep 28, 2024 04:52:22.790584087 CEST	49791	443	192.168.2.6	173.222.162.64
Sep 28, 2024 04:52:33.346184015 CEST	49795	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:52:33.346247911 CEST	443	49795	40.113.103.199	192.168.2.6
Sep 28, 2024 04:52:33.346365929 CEST	49795	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:52:33.347809076 CEST	49795	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:52:33.347826004 CEST	443	49795	40.113.103.199	192.168.2.6
Sep 28, 2024 04:52:34.139141083 CEST	443	49795	40.113.103.199	192.168.2.6
Sep 28, 2024 04:52:34.139223099 CEST	49795	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:52:34.145128965 CEST	49795	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:52:34.145155907 CEST	443	49795	40.113.103.199	192.168.2.6
Sep 28, 2024 04:52:34.145344973 CEST	443	49795	40.113.103.199	192.168.2.6
Sep 28, 2024 04:52:34.147043943 CEST	49795	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:52:34.147104025 CEST	49795	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:52:34.147111893 CEST	443	49795	40.113.103.199	192.168.2.6
Sep 28, 2024 04:52:34.147213936 CEST	49795	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:52:34.191404104 CEST	443	49795	40.113.103.199	192.168.2.6
Sep 28, 2024 04:52:34.318842888 CEST	443	49795	40.113.103.199	192.168.2.6
Sep 28, 2024 04:52:34.318922997 CEST	443	49795	40.113.103.199	192.168.2.6
Sep 28, 2024 04:52:34.318974018 CEST	49795	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:52:34.319302082 CEST	49795	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:52:34.319330931 CEST	443	49795	40.113.103.199	192.168.2.6
Sep 28, 2024 04:52:35.589365005 CEST	49796	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:52:35.589461088 CEST	443	49796	40.113.103.199	192.168.2.6
Sep 28, 2024 04:52:35.589720964 CEST	49796	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:52:35.590737104 CEST	49796	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:52:35.590773106 CEST	443	49796	40.113.103.199	192.168.2.6
Sep 28, 2024 04:52:36.372453928 CEST	443	49796	40.113.103.199	192.168.2.6
Sep 28, 2024 04:52:36.372534037 CEST	49796	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:52:36.374429941 CEST	49796	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:52:36.374455929 CEST	443	49796	40.113.103.199	192.168.2.6
Sep 28, 2024 04:52:36.374690056 CEST	443	49796	40.113.103.199	192.168.2.6
Sep 28, 2024 04:52:36.376353025 CEST	49796	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:52:36.376401901 CEST	49796	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:52:36.376415968 CEST	443	49796	40.113.103.199	192.168.2.6
Sep 28, 2024 04:52:36.376521111 CEST	49796	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:52:36.417258978 CEST	49726	443	192.168.2.6	35.157.66.55
Sep 28, 2024 04:52:36.417295933 CEST	443	49726	35.157.66.55	192.168.2.6
Sep 28, 2024 04:52:36.419421911 CEST	443	49796	40.113.103.199	192.168.2.6
Sep 28, 2024 04:52:36.551920891 CEST	443	49796	40.113.103.199	192.168.2.6
Sep 28, 2024 04:52:36.551987886 CEST	443	49796	40.113.103.199	192.168.2.6
Sep 28, 2024 04:52:36.552067041 CEST	49796	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:52:36.552268028 CEST	49796	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:52:36.552299976 CEST	443	49796	40.113.103.199	192.168.2.6
Sep 28, 2024 04:52:51.176676989 CEST	443	49726	35.157.66.55	192.168.2.6
Sep 28, 2024 04:52:51.176764965 CEST	443	49726	35.157.66.55	192.168.2.6
Sep 28, 2024 04:52:51.176810980 CEST	49726	443	192.168.2.6	35.157.66.55
Sep 28, 2024 04:52:53.051794052 CEST	49726	443	192.168.2.6	35.157.66.55
Sep 28, 2024 04:52:53.051822901 CEST	443	49726	35.157.66.55	192.168.2.6
Sep 28, 2024 04:52:53.139830112 CEST	49799	443	192.168.2.6	142.250.186.100
Sep 28, 2024 04:52:53.139884949 CEST	443	49799	142.250.186.100	192.168.2.6
Sep 28, 2024 04:52:53.139945030 CEST	49799	443	192.168.2.6	142.250.186.100
Sep 28, 2024 04:52:53.140789032 CEST	49799	443	192.168.2.6	142.250.186.100
Sep 28, 2024 04:52:53.140803099 CEST	443	49799	142.250.186.100	192.168.2.6
Sep 28, 2024 04:52:53.768691063 CEST	443	49799	142.250.186.100	192.168.2.6
Sep 28, 2024 04:52:53.775561094 CEST	49799	443	192.168.2.6	142.250.186.100
Sep 28, 2024 04:52:53.775589943 CEST	443	49799	142.250.186.100	192.168.2.6
Sep 28, 2024 04:52:53.775892019 CEST	443	49799	142.250.186.100	192.168.2.6
Sep 28, 2024 04:52:53.776726007 CEST	49799	443	192.168.2.6	142.250.186.100
Sep 28, 2024 04:52:53.776797056 CEST	443	49799	142.250.186.100	192.168.2.6
Sep 28, 2024 04:52:53.823004007 CEST	49799	443	192.168.2.6	142.250.186.100
Sep 28, 2024 04:52:54.342899084 CEST	49800	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:52:54.342935085 CEST	443	49800	40.113.103.199	192.168.2.6
Sep 28, 2024 04:52:54.342988968 CEST	49800	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:52:54.343704939 CEST	49800	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:52:54.343714952 CEST	443	49800	40.113.103.199	192.168.2.6
Sep 28, 2024 04:52:55.145010948 CEST	443	49800	40.113.103.199	192.168.2.6
Sep 28, 2024 04:52:55.145092010 CEST	49800	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:52:55.147047043 CEST	49800	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:52:55.147059917 CEST	443	49800	40.113.103.199	192.168.2.6
Sep 28, 2024 04:52:55.147278070 CEST	443	49800	40.113.103.199	192.168.2.6
Sep 28, 2024 04:52:55.148554087 CEST	49800	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:52:55.148633957 CEST	49800	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:52:55.148642063 CEST	443	49800	40.113.103.199	192.168.2.6
Sep 28, 2024 04:52:55.148798943 CEST	49800	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:52:55.195403099 CEST	443	49800	40.113.103.199	192.168.2.6
Sep 28, 2024 04:52:55.328366995 CEST	443	49800	40.113.103.199	192.168.2.6
Sep 28, 2024 04:52:55.328443050 CEST	443	49800	40.113.103.199	192.168.2.6
Sep 28, 2024 04:52:55.328481913 CEST	49800	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:52:55.328660965 CEST	49800	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:52:55.328680992 CEST	443	49800	40.113.103.199	192.168.2.6
Sep 28, 2024 04:53:03.472704887 CEST	49802	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:53:03.472752094 CEST	443	49802	40.113.103.199	192.168.2.6
Sep 28, 2024 04:53:03.473001003 CEST	49802	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:53:03.473783970 CEST	49802	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:53:03.473803997 CEST	443	49802	40.113.103.199	192.168.2.6
Sep 28, 2024 04:53:03.694921970 CEST	443	49799	142.250.186.100	192.168.2.6
Sep 28, 2024 04:53:03.694972038 CEST	443	49799	142.250.186.100	192.168.2.6
Sep 28, 2024 04:53:03.695590019 CEST	49799	443	192.168.2.6	142.250.186.100
Sep 28, 2024 04:53:04.279686928 CEST	443	49802	40.113.103.199	192.168.2.6
Sep 28, 2024 04:53:04.279763937 CEST	49802	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:53:04.284012079 CEST	49802	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:53:04.284033060 CEST	443	49802	40.113.103.199	192.168.2.6
Sep 28, 2024 04:53:04.284394026 CEST	443	49802	40.113.103.199	192.168.2.6
Sep 28, 2024 04:53:04.286087990 CEST	49802	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:53:04.286154032 CEST	49802	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:53:04.286160946 CEST	443	49802	40.113.103.199	192.168.2.6
Sep 28, 2024 04:53:04.286341906 CEST	49802	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:53:04.327408075 CEST	443	49802	40.113.103.199	192.168.2.6
Sep 28, 2024 04:53:04.459667921 CEST	443	49802	40.113.103.199	192.168.2.6
Sep 28, 2024 04:53:04.459832907 CEST	443	49802	40.113.103.199	192.168.2.6
Sep 28, 2024 04:53:04.459887981 CEST	49802	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:53:04.459970951 CEST	49802	443	192.168.2.6	40.113.103.199
Sep 28, 2024 04:53:04.459985971 CEST	443	49802	40.113.103.199	192.168.2.6
Sep 28, 2024 04:53:05.028122902 CEST	49799	443	192.168.2.6	142.250.186.100
Sep 28, 2024 04:53:05.028157949 CEST	443	49799	142.250.186.100	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 28, 2024 04:51:48.937583923 CEST	53	64978	1.1.1.1	192.168.2.6
Sep 28, 2024 04:51:48.953912020 CEST	53	57167	1.1.1.1	192.168.2.6
Sep 28, 2024 04:51:49.879554033 CEST	54199	53	192.168.2.6	1.1.1.1
Sep 28, 2024 04:51:49.879693985 CEST	50445	53	192.168.2.6	1.1.1.1
Sep 28, 2024 04:51:49.887639999 CEST	53	54199	1.1.1.1	192.168.2.6
Sep 28, 2024 04:51:49.888155937 CEST	53	50445	1.1.1.1	192.168.2.6
Sep 28, 2024 04:51:49.942786932 CEST	53	62300	1.1.1.1	192.168.2.6
Sep 28, 2024 04:51:50.593772888 CEST	59319	53	192.168.2.6	1.1.1.1
Sep 28, 2024 04:51:50.593887091 CEST	52166	53	192.168.2.6	1.1.1.1
Sep 28, 2024 04:51:50.599406004 CEST	53	63859	1.1.1.1	192.168.2.6
Sep 28, 2024 04:51:50.611268044 CEST	50484	53	192.168.2.6	1.1.1.1
Sep 28, 2024 04:51:50.611737013 CEST	57448	53	192.168.2.6	1.1.1.1
Sep 28, 2024 04:51:50.620191097 CEST	53	50484	1.1.1.1	192.168.2.6
Sep 28, 2024 04:51:50.621579885 CEST	53	57448	1.1.1.1	192.168.2.6
Sep 28, 2024 04:51:53.268335104 CEST	49601	53	192.168.2.6	1.1.1.1
Sep 28, 2024 04:51:53.269967079 CEST	58406	53	192.168.2.6	1.1.1.1
Sep 28, 2024 04:51:53.275156975 CEST	53	49601	1.1.1.1	192.168.2.6
Sep 28, 2024 04:51:53.276628017 CEST	53	58406	1.1.1.1	192.168.2.6
Sep 28, 2024 04:51:53.630384922 CEST	59088	53	192.168.2.6	1.1.1.1
Sep 28, 2024 04:51:53.630898952 CEST	51414	53	192.168.2.6	1.1.1.1
Sep 28, 2024 04:52:07.391119957 CEST	53	62128	1.1.1.1	192.168.2.6
Sep 28, 2024 04:52:26.565527916 CEST	53	57865	1.1.1.1	192.168.2.6
Sep 28, 2024 04:52:48.903908968 CEST	53	54473	1.1.1.1	192.168.2.6
Sep 28, 2024 04:52:49.542123079 CEST	53	60058	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 28, 2024 04:51:49.879554033 CEST	192.168.2.6	1.1.1.1	0x544e	Standard query (0)	uopheldlognxo.godaddysites.com	A (IP address)	IN (0x0001)	false
Sep 28, 2024 04:51:49.879693985 CEST	192.168.2.6	1.1.1.1	0xd956	Standard query (0)	uopheldlognxo.godaddysites.com	65	IN (0x0001)	false
Sep 28, 2024 04:51:50.593772888 CEST	192.168.2.6	1.1.1.1	0x8edb	Standard query (0)	img1.wsimg.com	A (IP address)	IN (0x0001)	false
Sep 28, 2024 04:51:50.593887091 CEST	192.168.2.6	1.1.1.1	0x2783	Standard query (0)	img1.wsimg.com	65	IN (0x0001)	false
Sep 28, 2024 04:51:50.611268044 CEST	192.168.2.6	1.1.1.1	0x723d	Standard query (0)	isteam.wsimg.com	A (IP address)	IN (0x0001)	false
Sep 28, 2024 04:51:50.611737013 CEST	192.168.2.6	1.1.1.1	0xf6c6	Standard query (0)	isteam.wsimg.com	65	IN (0x0001)	false
Sep 28, 2024 04:51:53.268335104 CEST	192.168.2.6	1.1.1.1	0xe8cd	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Sep 28, 2024 04:51:53.269967079 CEST	192.168.2.6	1.1.1.1	0x42e2	Standard query (0)	www.google.com	65	IN (0x0001)	false
Sep 28, 2024 04:51:53.630384922 CEST	192.168.2.6	1.1.1.1	0xb292	Standard query (0)	img1.wsimg.com	A (IP address)	IN (0x0001)	false
Sep 28, 2024 04:51:53.630898952 CEST	192.168.2.6	1.1.1.1	0x12fd	Standard query (0)	img1.wsimg.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 28, 2024 04:51:49.887639999 CEST	1.1.1.1	192.168.2.6	0x544e	No error (0)	uopheldlognxo.godaddysites.com		13.248.243.5	A (IP address)	IN (0x0001)	false
Sep 28, 2024 04:51:49.887639999 CEST	1.1.1.1	192.168.2.6	0x544e	No error (0)	uopheldlognxo.godaddysites.com		76.223.105.230	A (IP address)	IN (0x0001)	false
Sep 28, 2024 04:51:50.600692987 CEST	1.1.1.1	192.168.2.6	0x8edb	No error (0)	img1.wsimg.com	global-wildcard.wsimg.com.sni-only.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 28, 2024 04:51:50.601067066 CEST	1.1.1.1	192.168.2.6	0x2783	No error (0)	img1.wsimg.com	global-wildcard.wsimg.com.sni-only.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 28, 2024 04:51:50.620191097 CEST	1.1.1.1	192.168.2.6	0x723d	No error (0)	isteam.wsimg.com		35.157.66.55	A (IP address)	IN (0x0001)	false
Sep 28, 2024 04:51:50.620191097 CEST	1.1.1.1	192.168.2.6	0x723d	No error (0)	isteam.wsimg.com		3.121.64.201	A (IP address)	IN (0x0001)	false
Sep 28, 2024 04:51:53.275156975 CEST	1.1.1.1	192.168.2.6	0xe8cd	No error (0)	www.google.com		142.250.186.100	A (IP address)	IN (0x0001)	false
Sep 28, 2024 04:51:53.276628017 CEST	1.1.1.1	192.168.2.6	0x42e2	No error (0)	www.google.com			65	IN (0x0001)	false
Sep 28, 2024 04:51:53.637428045 CEST	1.1.1.1	192.168.2.6	0xb292	No error (0)	img1.wsimg.com	global-wildcard.wsimg.com.sni-only.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 28, 2024 04:51:53.641297102 CEST	1.1.1.1	192.168.2.6	0x12fd	No error (0)	img1.wsimg.com	global-wildcard.wsimg.com.sni-only.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 28, 2024 04:52:01.210640907 CEST	1.1.1.1	192.168.2.6	0xd92e	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 28, 2024 04:52:01.210640907 CEST	1.1.1.1	192.168.2.6	0xd92e	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Sep 28, 2024 04:52:22.533886909 CEST	1.1.1.1	192.168.2.6	0x7d3c	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Sep 28, 2024 04:52:22.533886909 CEST	1.1.1.1	192.168.2.6	0x7d3c	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Sep 28, 2024 04:52:41.721723080 CEST	1.1.1.1	192.168.2.6	0xdc13	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Sep 28, 2024 04:52:41.721723080 CEST	1.1.1.1	192.168.2.6	0xdc13	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Sep 28, 2024 04:53:02.163292885 CEST	1.1.1.1	192.168.2.6	0x5bc4	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Sep 28, 2024 04:53:02.163292885 CEST	1.1.1.1	192.168.2.6	0x5bc4	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

uopheldlognxo.godaddysites.com

fs.microsoft.com

https:

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49709	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-09-28 02:51:37 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 48 69 75 48 61 6c 70 56 38 6b 53 4a 38 76 74 53 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 61 61 64 34 35 32 66 65 31 66 62 30 62 64 63 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: HiuHalpV8kSJ8vtS.1Context: 1aad452fe1fb0bdc
2024-09-28 02:51:37 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-09-28 02:51:37 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 48 69 75 48 61 6c 70 56 38 6b 53 4a 38 76 74 53 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 61 61 64 34 35 32 66 65 31 66 62 30 62 64 63 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 57 78 6f 76 37 50 52 6f 72 79 58 63 6c 6c 59 63 63 79 52 59 4e 55 71 68 6b 2f 42 4f 31 58 41 71 4f 56 45 65 4b 6f 71 5a 53 42 7a 31 65 35 38 4a 2b 4b 33 52 55 69 71 6b 71 73 33 73 77 37 78 2b 37 4c 59 45 46 6d 77 70 63 4e 6c 31 62 34 55 6b 44 52 49 68 4c 45 30 44 37 73 43 63 4c 43 6e 41 31 31 56 6d 34 57 33 5a 6a 55 39 47 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: HiuHalpV8kSJ8vtS.2Context: 1aad452fe1fb0bdc<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWWxov7PRoryXcllYccyRYNUqhk/BO1XAqOVEeKoqZSBz1e58J+K3RUiqkqs3sw7x+7LYEFmwpcNl1b4UkDRIhLE0D7sCcLCnA11Vm4W3ZjU9G
2024-09-28 02:51:37 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 48 69 75 48 61 6c 70 56 38 6b 53 4a 38 76 74 53 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 61 61 64 34 35 32 66 65 31 66 62 30 62 64 63 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: HiuHalpV8kSJ8vtS.3Context: 1aad452fe1fb0bdc
2024-09-28 02:51:37 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-09-28 02:51:37 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 6d 6f 37 70 30 59 6a 2b 2b 45 43 54 49 79 6d 6b 78 4c 59 7a 35 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: mo7p0Yj++ECTIymkxLYz5A.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.6	49710	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-09-28 02:51:47 UTC	70	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 34 0d 0a 4d 53 2d 43 56 3a 20 34 2f 54 66 37 58 33 55 66 45 4b 70 42 4e 2b 2f 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 39 64 63 35 35 34 32 31 64 38 38 63 61 65 0d 0a 0d 0a Data Ascii: CNT 1 CON 304MS-CV: 4/Tf7X3UfEKpBN+/.1Context: d9dc55421d88cae
2024-09-28 02:51:47 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-09-28 02:51:47 UTC	1083	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 30 0d 0a 4d 53 2d 43 56 3a 20 34 2f 54 66 37 58 33 55 66 45 4b 70 42 4e 2b 2f 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 39 64 63 35 35 34 32 31 64 38 38 63 61 65 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 57 78 6f 76 37 50 52 6f 72 79 58 63 6c 6c 59 63 63 79 52 59 4e 55 71 68 6b 2f 42 4f 31 58 41 71 4f 56 45 65 4b 6f 71 5a 53 42 7a 31 65 35 38 4a 2b 4b 33 52 55 69 71 6b 71 73 33 73 77 37 78 2b 37 4c 59 45 46 6d 77 70 63 4e 6c 31 62 34 55 6b 44 52 49 68 4c 45 30 44 37 73 43 63 4c 43 6e 41 31 31 56 6d 34 57 33 5a 6a 55 39 47 59 Data Ascii: ATH 2 CON\DEVICE 1060MS-CV: 4/Tf7X3UfEKpBN+/.2Context: d9dc55421d88cae<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWWxov7PRoryXcllYccyRYNUqhk/BO1XAqOVEeKoqZSBz1e58J+K3RUiqkqs3sw7x+7LYEFmwpcNl1b4UkDRIhLE0D7sCcLCnA11Vm4W3ZjU9GY
2024-09-28 02:51:47 UTC	73	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 35 0d 0a 4d 53 2d 43 56 3a 20 34 2f 54 66 37 58 33 55 66 45 4b 70 42 4e 2b 2f 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 39 64 63 35 35 34 32 31 64 38 38 63 61 65 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 55MS-CV: 4/Tf7X3UfEKpBN+/.3Context: d9dc55421d88cae
2024-09-28 02:51:47 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-09-28 02:51:47 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 30 6e 56 50 6b 30 57 62 45 30 2b 6e 4a 70 51 49 48 68 39 78 72 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 0nVPk0WbE0+nJpQIHh9xrg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.6	49711	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-09-28 02:51:49 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 43 4c 47 42 65 52 6e 69 67 45 65 36 78 65 63 69 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 38 66 65 65 62 33 36 61 39 39 63 61 63 34 61 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: CLGBeRnigEe6xeci.1Context: 98feeb36a99cac4a
2024-09-28 02:51:49 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-09-28 02:51:49 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 43 4c 47 42 65 52 6e 69 67 45 65 36 78 65 63 69 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 38 66 65 65 62 33 36 61 39 39 63 61 63 34 61 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 57 78 6f 76 37 50 52 6f 72 79 58 63 6c 6c 59 63 63 79 52 59 4e 55 71 68 6b 2f 42 4f 31 58 41 71 4f 56 45 65 4b 6f 71 5a 53 42 7a 31 65 35 38 4a 2b 4b 33 52 55 69 71 6b 71 73 33 73 77 37 78 2b 37 4c 59 45 46 6d 77 70 63 4e 6c 31 62 34 55 6b 44 52 49 68 4c 45 30 44 37 73 43 63 4c 43 6e 41 31 31 56 6d 34 57 33 5a 6a 55 39 47 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: CLGBeRnigEe6xeci.2Context: 98feeb36a99cac4a<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWWxov7PRoryXcllYccyRYNUqhk/BO1XAqOVEeKoqZSBz1e58J+K3RUiqkqs3sw7x+7LYEFmwpcNl1b4UkDRIhLE0D7sCcLCnA11Vm4W3ZjU9G
2024-09-28 02:51:49 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 43 4c 47 42 65 52 6e 69 67 45 65 36 78 65 63 69 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 38 66 65 65 62 33 36 61 39 39 63 61 63 34 61 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: CLGBeRnigEe6xeci.3Context: 98feeb36a99cac4a<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-09-28 02:51:49 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-09-28 02:51:49 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 55 38 74 37 4b 41 44 61 47 45 71 6f 35 35 41 33 2b 4c 47 44 43 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: U8t7KADaGEqo55A3+LGDCQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49717	13.248.243.5	443	764	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-28 02:51:50 UTC	673	OUT	GET / HTTP/1.1 Host: uopheldlognxo.godaddysites.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-28 02:51:50 UTC	785	IN	HTTP/1.1 200 OK Link: <//img1.wsimg.com/ceph-p3-01/website-builder-data-prod/static/widgets/UX.4.29.0.js>; rel=preload; as=script; crossorigin,<https://fonts.googleapis.com>; rel=preconnect; crossorigin,<https://fonts.gstatic.com>; rel=preconnect; crossorigin,<https://img1.wsimg.com>; rel=preconnect; crossorigin,<https://isteam.wsimg.com>; rel=preconnect; crossorigin Cache-Control: max-age=30 Content-Security-Policy: frame-ancestors 'self' godaddy.com *.godaddy.com Content-Type: text/html;charset=utf-8 Vary: Accept-Encoding Server: DPS/2.0.0+sha-227ca78 X-Version: 227ca78 X-SiteId: us-east-1 Set-Cookie: dps_site_id=us-east-1; path=/; secure ETag: 8759075823e2c72eff51d61d94a75daf Date: Sat, 28 Sep 2024 02:51:50 GMT Connection: close Transfer-Encoding: chunked
2024-09-28 02:51:50 UTC	15599	IN	Data Raw: 34 34 30 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 49 4e 22 3e 3c 68 65 61 64 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 2f 69 6d 67 31 2e 77 73 69 6d 67 2e 63 6f 6d 2f 69 73 74 65 61 6d 2f 69 70 2f 35 66 39 33 61 37 38 65 2d 63 36 34 32 2d 34 65 38 66 2d 38 32 64 64 2d 65 62 33 36 62 32 63 61 32 32 31 36 2f 66 61 76 69 63 6f 6e 2f 66 36 66 65 37 34 37 64 2d 33 63 61 61 2d 34 62 39 32 2d 38 62 37 39 2d 39 61 32 38 30 34 31 63 32 30 33 65 2e 70 6e 67 2f 3a 2f 72 73 3d 77 3a 31 36 2c 68 3a 31 36 2c 6d 22 20 73 69 7a 65 73 3d 22 31 36 78 31 36 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 2f 69 6d 67 31 2e 77 73 69 6d 67 2e 63 6f 6d 2f Data Ascii: 4400<!DOCTYPE html><html lang="en-IN"><head><link rel="icon" href="//img1.wsimg.com/isteam/ip/5f93a78e-c642-4e8f-82dd-eb36b2ca2216/favicon/f6fe747d-3caa-4b92-8b79-9a28041c203e.png/:/rs=w:16,h:16,m" sizes="16x16"/><link rel="icon" href="//img1.wsimg.com/
2024-09-28 02:51:50 UTC	1822	IN	Data Raw: 63 31 2d 67 20 63 31 2d 31 20 63 31 2d 32 20 63 31 2d 62 20 63 31 2d 63 20 63 31 2d 64 20 63 31 2d 65 20 63 31 2d 66 20 63 31 2d 67 22 3e 3c 64 69 76 3e 20 3c 73 65 63 74 69 6f 6e 20 64 61 74 61 2d 75 78 3d 22 53 65 63 74 69 6f 6e 22 20 63 6c 61 73 73 3d 22 78 2d 65 6c 20 78 2d 65 6c 2d 73 65 63 74 69 6f 6e 20 63 31 2d 31 20 63 31 2d 32 20 63 31 2d 33 20 63 31 2d 68 20 63 31 2d 69 20 63 31 2d 62 20 63 31 2d 63 20 63 31 2d 6c 20 63 31 2d 6d 20 63 31 2d 64 20 63 31 2d 65 20 63 31 2d 66 20 63 31 2d 67 22 3e 3c 64 69 76 20 64 61 74 61 2d 75 78 3d 22 43 6f 6e 74 61 69 6e 65 72 22 20 63 6c 61 73 73 3d 22 78 2d 65 6c 20 78 2d 65 6c 2d 64 69 76 20 63 31 2d 31 20 63 31 2d 32 20 63 31 2d 73 20 63 31 2d 74 20 63 31 2d 75 20 63 31 2d 76 20 63 31 2d 77 20 63 31 2d 62 Data Ascii: c1-g c1-1 c1-2 c1-b c1-c c1-d c1-e c1-f c1-g"><div> <section data-ux="Section" class="x-el x-el-section c1-1 c1-2 c1-3 c1-h c1-i c1-b c1-c c1-l c1-m c1-d c1-e c1-f c1-g"><div data-ux="Container" class="x-el x-el-div c1-1 c1-2 c1-s c1-t c1-u c1-v c1-w c1-b

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49746	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-09-28 02:51:54 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-09-28 02:51:55 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF67) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=222787 Date: Sat, 28 Sep 2024 02:51:55 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49761	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-09-28 02:51:56 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-09-28 02:51:56 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=222816 Date: Sat, 28 Sep 2024 02:51:56 GMT Content-Length: 55 Connection: close X-CID: 2
2024-09-28 02:51:56 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49718	13.248.243.5	443	764	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-28 02:51:56 UTC	512	OUT	GET /sw.js HTTP/1.1 Host: uopheldlognxo.godaddysites.com Connection: keep-alive Cache-Control: max-age=0 Accept: / Service-Worker: script Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: serviceworker Referer: https://uopheldlognxo.godaddysites.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: dps_site_id=us-east-1
2024-09-28 02:51:56 UTC	663	IN	HTTP/1.1 200 OK Link: <https://fonts.googleapis.com>; rel=preconnect; crossorigin,<https://fonts.gstatic.com>; rel=preconnect; crossorigin,<https://img1.wsimg.com>; rel=preconnect; crossorigin,<https://isteam.wsimg.com>; rel=preconnect; crossorigin Cache-Control: max-age=30 Content-Security-Policy: frame-ancestors 'self' godaddy.com *.godaddy.com Content-Type: application/javascript Vary: Accept-Encoding Server: DPS/2.0.0+sha-227ca78 X-Version: 227ca78 X-SiteId: us-east-1 Set-Cookie: dps_site_id=us-east-1; path=/; secure ETag: 13e5eb81b382492659903c3717dd1ce5 Date: Sat, 28 Sep 2024 02:51:56 GMT Connection: close Transfer-Encoding: chunked
2024-09-28 02:51:56 UTC	15721	IN	Data Raw: 38 30 62 36 0d 0a 28 28 29 3d 3e 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 65 3d 7b 38 39 35 3a 28 29 3d 3e 7b 74 72 79 7b 73 65 6c 66 5b 22 77 6f 72 6b 62 6f 78 3a 63 61 63 68 65 61 62 6c 65 2d 72 65 73 70 6f 6e 73 65 3a 36 2e 34 2e 31 22 5d 26 26 5f 28 29 7d 63 61 74 63 68 28 65 29 7b 7d 7d 2c 32 35 39 3a 28 65 2c 74 2c 73 29 3d 3e 7b 73 2e 64 28 74 2c 7b 42 3a 28 29 3d 3e 61 7d 29 2c 73 28 39 31 33 29 3b 63 6c 61 73 73 20 61 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 29 7b 74 68 69 73 2e 70 72 6f 6d 69 73 65 3d 6e 65 77 20 50 72 6f 6d 69 73 65 28 28 28 65 2c 74 29 3d 3e 7b 74 68 69 73 2e 72 65 73 6f 6c 76 65 3d 65 2c 74 68 69 73 2e 72 65 6a 65 63 74 3d 74 7d 29 29 7d 7d 7d 2c 31 32 35 3a 28 65 2c 74 2c 73 29 3d 3e 7b 73 2e 64 28 74 2c 7b 56 3a Data Ascii: 80b6(()=>{"use strict";var e={895:()=>{try{self["workbox:cacheable-response:6.4.1"]&&_()}catch(e){}},259:(e,t,s)=>{s.d(t,{B:()=>a}),s(913);class a{constructor(){this.promise=new Promise(((e,t)=>{this.resolve=e,this.reject=t}))}}},125:(e,t,s)=>{s.d(t,{V:
2024-09-28 02:51:56 UTC	16384	IN	Data Raw: 65 2c 74 29 7c 7c 52 2e 68 61 73 28 65 2c 74 29 7d 2c 73 28 35 35 30 29 3b 63 6f 6e 73 74 20 76 3d 22 63 61 63 68 65 2d 65 6e 74 72 69 65 73 22 2c 62 3d 65 3d 3e 7b 63 6f 6e 73 74 20 74 3d 6e 65 77 20 55 52 4c 28 65 2c 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 29 3b 72 65 74 75 72 6e 20 74 2e 68 61 73 68 3d 22 22 2c 74 2e 68 72 65 66 7d 3b 63 6c 61 73 73 20 78 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 65 29 7b 74 68 69 73 2e 5f 64 62 3d 6e 75 6c 6c 2c 74 68 69 73 2e 5f 63 61 63 68 65 4e 61 6d 65 3d 65 7d 5f 75 70 67 72 61 64 65 44 62 28 65 29 7b 63 6f 6e 73 74 20 74 3d 65 2e 63 72 65 61 74 65 4f 62 6a 65 63 74 53 74 6f 72 65 28 76 2c 7b 6b 65 79 50 61 74 68 3a 22 69 64 22 7d 29 3b 74 2e 63 72 65 61 74 65 49 6e 64 65 78 28 22 63 61 63 68 65 4e 61 6d 65 22 2c 22 Data Ascii: e,t)\|\|R.has(e,t)},s(550);const v="cache-entries",b=e=>{const t=new URL(e,location.href);return t.hash="",t.href};class x{constructor(e){this._db=null,this._cacheName=e}_upgradeDb(e){const t=e.createObjectStore(v,{keyPath:"id"});t.createIndex("cacheName","
2024-09-28 02:51:56 UTC	858	IN	Data Raw: 75 65 73 74 3a 65 7d 29 3d 3e 22 73 74 79 6c 65 22 3d 3d 3d 65 2e 64 65 73 74 69 6e 61 74 69 6f 6e 7c 7c 22 73 63 72 69 70 74 22 3d 3d 3d 65 2e 64 65 73 74 69 6e 61 74 69 6f 6e 29 2c 6e 65 77 20 74 2e 53 74 61 6c 65 57 68 69 6c 65 52 65 76 61 6c 69 64 61 74 65 28 7b 63 61 63 68 65 4e 61 6d 65 3a 22 73 74 61 74 69 63 2d 72 65 73 6f 75 72 63 65 73 22 2c 70 6c 75 67 69 6e 73 3a 5b 6e 65 77 20 61 2e 43 61 63 68 65 61 62 6c 65 52 65 73 70 6f 6e 73 65 50 6c 75 67 69 6e 28 7b 73 74 61 74 75 73 65 73 3a 5b 32 30 30 5d 7d 29 5d 7d 29 29 2c 28 30 2c 65 2e 72 65 67 69 73 74 65 72 52 6f 75 74 65 29 28 28 28 7b 75 72 6c 3a 65 7d 29 3d 3e 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 22 3d 3d 3d 65 2e 6f 72 69 67 69 6e 29 2c 6e Data Ascii: uest:e})=>"style"===e.destination\|\|"script"===e.destination),new t.StaleWhileRevalidate({cacheName:"static-resources",plugins:[new a.CacheableResponsePlugin({statuses:[200]})]})),(0,e.registerRoute)((({url:e})=>"https://fonts.googleapis.com"===e.origin),n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49774	13.248.243.5	443	764	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-28 02:51:57 UTC	564	OUT	GET /manifest.webmanifest HTTP/1.1 Host: uopheldlognxo.godaddysites.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: manifest Referer: https://uopheldlognxo.godaddysites.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-28 02:51:57 UTC	666	IN	HTTP/1.1 200 OK Link: <https://fonts.googleapis.com>; rel=preconnect; crossorigin,<https://fonts.gstatic.com>; rel=preconnect; crossorigin,<https://img1.wsimg.com>; rel=preconnect; crossorigin,<https://isteam.wsimg.com>; rel=preconnect; crossorigin Cache-Control: max-age=30 Content-Security-Policy: frame-ancestors 'self' godaddy.com *.godaddy.com Content-Type: application/manifest+json Vary: Accept-Encoding Server: DPS/2.0.0+sha-227ca78 X-Version: 227ca78 X-SiteId: us-east-1 Set-Cookie: dps_site_id=us-east-1; path=/; secure ETag: 0deef4a8ee83a13ea132eb24bf34cb15 Date: Sat, 28 Sep 2024 02:51:57 GMT Connection: close Transfer-Encoding: chunked
2024-09-28 02:51:57 UTC	537	IN	Data Raw: 32 30 64 0d 0a 7b 22 73 63 6f 70 65 22 3a 22 2f 22 2c 22 73 74 61 72 74 5f 75 72 6c 22 3a 22 2f 22 2c 22 64 69 73 70 6c 61 79 22 3a 22 73 74 61 6e 64 61 6c 6f 6e 65 22 2c 22 69 63 6f 6e 73 22 3a 5b 7b 22 73 69 7a 65 73 22 3a 22 31 39 32 78 31 39 32 22 2c 22 74 79 70 65 22 3a 22 69 6d 61 67 65 2f 70 6e 67 22 2c 22 73 72 63 22 3a 22 2f 2f 69 6d 67 31 2e 77 73 69 6d 67 2e 63 6f 6d 2f 69 73 74 65 61 6d 2f 69 70 2f 35 66 39 33 61 37 38 65 2d 63 36 34 32 2d 34 65 38 66 2d 38 32 64 64 2d 65 62 33 36 62 32 63 61 32 32 31 36 2f 66 61 76 69 63 6f 6e 2f 66 36 66 65 37 34 37 64 2d 33 63 61 61 2d 34 62 39 32 2d 38 62 37 39 2d 39 61 32 38 30 34 31 63 32 30 33 65 2e 70 6e 67 2f 3a 2f 72 73 3d 77 3a 31 39 32 2c 68 3a 31 39 32 2c 6d 22 7d 2c 7b 22 73 69 7a 65 73 22 3a 22 Data Ascii: 20d{"scope":"/","start_url":"/","display":"standalone","icons":[{"sizes":"192x192","type":"image/png","src":"//img1.wsimg.com/isteam/ip/5f93a78e-c642-4e8f-82dd-eb36b2ca2216/favicon/f6fe747d-3caa-4b92-8b79-9a28041c203e.png/:/rs=w:192,h:192,m"},{"sizes":"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49776	13.248.243.5	443	764	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-28 02:51:57 UTC	490	OUT	GET / HTTP/1.1 Host: uopheldlognxo.godaddysites.com Connection: keep-alive Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://uopheldlognxo.godaddysites.com/sw.js Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: dps_site_id=us-east-1
2024-09-28 02:51:57 UTC	785	IN	HTTP/1.1 200 OK Link: <//img1.wsimg.com/ceph-p3-01/website-builder-data-prod/static/widgets/UX.4.29.0.js>; rel=preload; as=script; crossorigin,<https://fonts.googleapis.com>; rel=preconnect; crossorigin,<https://fonts.gstatic.com>; rel=preconnect; crossorigin,<https://img1.wsimg.com>; rel=preconnect; crossorigin,<https://isteam.wsimg.com>; rel=preconnect; crossorigin Cache-Control: max-age=30 Content-Security-Policy: frame-ancestors 'self' godaddy.com *.godaddy.com Content-Type: text/html;charset=utf-8 Vary: Accept-Encoding Server: DPS/2.0.0+sha-227ca78 X-Version: 227ca78 X-SiteId: us-east-1 Set-Cookie: dps_site_id=us-east-1; path=/; secure ETag: 8759075823e2c72eff51d61d94a75daf Date: Sat, 28 Sep 2024 02:51:57 GMT Connection: close Transfer-Encoding: chunked
2024-09-28 02:51:57 UTC	15599	IN	Data Raw: 34 34 30 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 49 4e 22 3e 3c 68 65 61 64 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 2f 69 6d 67 31 2e 77 73 69 6d 67 2e 63 6f 6d 2f 69 73 74 65 61 6d 2f 69 70 2f 35 66 39 33 61 37 38 65 2d 63 36 34 32 2d 34 65 38 66 2d 38 32 64 64 2d 65 62 33 36 62 32 63 61 32 32 31 36 2f 66 61 76 69 63 6f 6e 2f 66 36 66 65 37 34 37 64 2d 33 63 61 61 2d 34 62 39 32 2d 38 62 37 39 2d 39 61 32 38 30 34 31 63 32 30 33 65 2e 70 6e 67 2f 3a 2f 72 73 3d 77 3a 31 36 2c 68 3a 31 36 2c 6d 22 20 73 69 7a 65 73 3d 22 31 36 78 31 36 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 2f 69 6d 67 31 2e 77 73 69 6d 67 2e 63 6f 6d 2f Data Ascii: 4400<!DOCTYPE html><html lang="en-IN"><head><link rel="icon" href="//img1.wsimg.com/isteam/ip/5f93a78e-c642-4e8f-82dd-eb36b2ca2216/favicon/f6fe747d-3caa-4b92-8b79-9a28041c203e.png/:/rs=w:16,h:16,m" sizes="16x16"/><link rel="icon" href="//img1.wsimg.com/
2024-09-28 02:51:57 UTC	1822	IN	Data Raw: 63 31 2d 67 20 63 31 2d 31 20 63 31 2d 32 20 63 31 2d 62 20 63 31 2d 63 20 63 31 2d 64 20 63 31 2d 65 20 63 31 2d 66 20 63 31 2d 67 22 3e 3c 64 69 76 3e 20 3c 73 65 63 74 69 6f 6e 20 64 61 74 61 2d 75 78 3d 22 53 65 63 74 69 6f 6e 22 20 63 6c 61 73 73 3d 22 78 2d 65 6c 20 78 2d 65 6c 2d 73 65 63 74 69 6f 6e 20 63 31 2d 31 20 63 31 2d 32 20 63 31 2d 33 20 63 31 2d 68 20 63 31 2d 69 20 63 31 2d 62 20 63 31 2d 63 20 63 31 2d 6c 20 63 31 2d 6d 20 63 31 2d 64 20 63 31 2d 65 20 63 31 2d 66 20 63 31 2d 67 22 3e 3c 64 69 76 20 64 61 74 61 2d 75 78 3d 22 43 6f 6e 74 61 69 6e 65 72 22 20 63 6c 61 73 73 3d 22 78 2d 65 6c 20 78 2d 65 6c 2d 64 69 76 20 63 31 2d 31 20 63 31 2d 32 20 63 31 2d 73 20 63 31 2d 74 20 63 31 2d 75 20 63 31 2d 76 20 63 31 2d 77 20 63 31 2d 62 Data Ascii: c1-g c1-1 c1-2 c1-b c1-c c1-d c1-e c1-f c1-g"><div> <section data-ux="Section" class="x-el x-el-section c1-1 c1-2 c1-3 c1-h c1-i c1-b c1-c c1-l c1-m c1-d c1-e c1-f c1-g"><div data-ux="Container" class="x-el x-el-div c1-1 c1-2 c1-s c1-t c1-u c1-v c1-w c1-b

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.6	49781	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-09-28 02:51:58 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 58 6c 67 51 59 41 61 42 48 30 61 56 59 42 43 62 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 35 65 34 30 39 64 66 65 34 33 31 62 30 61 31 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: XlgQYAaBH0aVYBCb.1Context: a5e409dfe431b0a1
2024-09-28 02:51:58 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-09-28 02:51:58 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 58 6c 67 51 59 41 61 42 48 30 61 56 59 42 43 62 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 35 65 34 30 39 64 66 65 34 33 31 62 30 61 31 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 57 78 6f 76 37 50 52 6f 72 79 58 63 6c 6c 59 63 63 79 52 59 4e 55 71 68 6b 2f 42 4f 31 58 41 71 4f 56 45 65 4b 6f 71 5a 53 42 7a 31 65 35 38 4a 2b 4b 33 52 55 69 71 6b 71 73 33 73 77 37 78 2b 37 4c 59 45 46 6d 77 70 63 4e 6c 31 62 34 55 6b 44 52 49 68 4c 45 30 44 37 73 43 63 4c 43 6e 41 31 31 56 6d 34 57 33 5a 6a 55 39 47 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: XlgQYAaBH0aVYBCb.2Context: a5e409dfe431b0a1<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWWxov7PRoryXcllYccyRYNUqhk/BO1XAqOVEeKoqZSBz1e58J+K3RUiqkqs3sw7x+7LYEFmwpcNl1b4UkDRIhLE0D7sCcLCnA11Vm4W3ZjU9G
2024-09-28 02:51:58 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 58 6c 67 51 59 41 61 42 48 30 61 56 59 42 43 62 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 35 65 34 30 39 64 66 65 34 33 31 62 30 61 31 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: XlgQYAaBH0aVYBCb.3Context: a5e409dfe431b0a1
2024-09-28 02:51:58 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-09-28 02:51:58 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 34 6f 51 65 50 56 42 76 65 55 6d 47 4c 73 68 47 30 54 62 49 41 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 4oQePVBveUmGLshG0TbIAA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.6	49782	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-09-28 02:51:58 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 43 51 56 70 48 50 2f 4d 41 45 57 49 6b 47 6c 57 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 37 36 38 64 31 33 34 61 65 32 36 33 31 33 65 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: CQVpHP/MAEWIkGlW.1Context: 8768d134ae26313e
2024-09-28 02:51:58 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-09-28 02:51:58 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 43 51 56 70 48 50 2f 4d 41 45 57 49 6b 47 6c 57 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 37 36 38 64 31 33 34 61 65 32 36 33 31 33 65 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 57 78 6f 76 37 50 52 6f 72 79 58 63 6c 6c 59 63 63 79 52 59 4e 55 71 68 6b 2f 42 4f 31 58 41 71 4f 56 45 65 4b 6f 71 5a 53 42 7a 31 65 35 38 4a 2b 4b 33 52 55 69 71 6b 71 73 33 73 77 37 78 2b 37 4c 59 45 46 6d 77 70 63 4e 6c 31 62 34 55 6b 44 52 49 68 4c 45 30 44 37 73 43 63 4c 43 6e 41 31 31 56 6d 34 57 33 5a 6a 55 39 47 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: CQVpHP/MAEWIkGlW.2Context: 8768d134ae26313e<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWWxov7PRoryXcllYccyRYNUqhk/BO1XAqOVEeKoqZSBz1e58J+K3RUiqkqs3sw7x+7LYEFmwpcNl1b4UkDRIhLE0D7sCcLCnA11Vm4W3ZjU9G
2024-09-28 02:51:58 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 43 51 56 70 48 50 2f 4d 41 45 57 49 6b 47 6c 57 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 37 36 38 64 31 33 34 61 65 32 36 33 31 33 65 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: CQVpHP/MAEWIkGlW.3Context: 8768d134ae26313e<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-09-28 02:51:58 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-09-28 02:51:58 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 66 6d 7a 67 70 39 4d 38 32 45 57 71 4f 6d 50 72 51 52 47 32 52 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: fmzgp9M82EWqOmPrQRG2Rw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.6	49793	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-09-28 02:52:12 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 4d 49 78 73 69 56 78 53 35 45 53 67 42 51 52 71 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 62 38 64 61 30 38 62 61 30 35 66 39 65 65 36 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: MIxsiVxS5ESgBQRq.1Context: 4b8da08ba05f9ee6
2024-09-28 02:52:12 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-09-28 02:52:12 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 4d 49 78 73 69 56 78 53 35 45 53 67 42 51 52 71 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 62 38 64 61 30 38 62 61 30 35 66 39 65 65 36 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 57 78 6f 76 37 50 52 6f 72 79 58 63 6c 6c 59 63 63 79 52 59 4e 55 71 68 6b 2f 42 4f 31 58 41 71 4f 56 45 65 4b 6f 71 5a 53 42 7a 31 65 35 38 4a 2b 4b 33 52 55 69 71 6b 71 73 33 73 77 37 78 2b 37 4c 59 45 46 6d 77 70 63 4e 6c 31 62 34 55 6b 44 52 49 68 4c 45 30 44 37 73 43 63 4c 43 6e 41 31 31 56 6d 34 57 33 5a 6a 55 39 47 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: MIxsiVxS5ESgBQRq.2Context: 4b8da08ba05f9ee6<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWWxov7PRoryXcllYccyRYNUqhk/BO1XAqOVEeKoqZSBz1e58J+K3RUiqkqs3sw7x+7LYEFmwpcNl1b4UkDRIhLE0D7sCcLCnA11Vm4W3ZjU9G
2024-09-28 02:52:12 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 4d 49 78 73 69 56 78 53 35 45 53 67 42 51 52 71 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 62 38 64 61 30 38 62 61 30 35 66 39 65 65 36 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: MIxsiVxS5ESgBQRq.3Context: 4b8da08ba05f9ee6<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-09-28 02:52:12 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-09-28 02:52:12 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 64 4e 62 4f 6f 61 48 37 45 55 47 45 33 31 70 53 58 2f 68 30 78 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: dNbOoaH7EUGE31pSX/h0xA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.6	49794	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-09-28 02:52:14 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 38 4d 74 36 2f 79 31 6d 6a 45 53 50 36 4c 62 43 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 39 37 38 62 38 65 63 30 35 66 61 33 66 33 36 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 8Mt6/y1mjESP6LbC.1Context: 8978b8ec05fa3f36
2024-09-28 02:52:14 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-09-28 02:52:14 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 38 4d 74 36 2f 79 31 6d 6a 45 53 50 36 4c 62 43 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 39 37 38 62 38 65 63 30 35 66 61 33 66 33 36 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 57 78 6f 76 37 50 52 6f 72 79 58 63 6c 6c 59 63 63 79 52 59 4e 55 71 68 6b 2f 42 4f 31 58 41 71 4f 56 45 65 4b 6f 71 5a 53 42 7a 31 65 35 38 4a 2b 4b 33 52 55 69 71 6b 71 73 33 73 77 37 78 2b 37 4c 59 45 46 6d 77 70 63 4e 6c 31 62 34 55 6b 44 52 49 68 4c 45 30 44 37 73 43 63 4c 43 6e 41 31 31 56 6d 34 57 33 5a 6a 55 39 47 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 8Mt6/y1mjESP6LbC.2Context: 8978b8ec05fa3f36<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWWxov7PRoryXcllYccyRYNUqhk/BO1XAqOVEeKoqZSBz1e58J+K3RUiqkqs3sw7x+7LYEFmwpcNl1b4UkDRIhLE0D7sCcLCnA11Vm4W3ZjU9G
2024-09-28 02:52:14 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 38 4d 74 36 2f 79 31 6d 6a 45 53 50 36 4c 62 43 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 39 37 38 62 38 65 63 30 35 66 61 33 66 33 36 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: 8Mt6/y1mjESP6LbC.3Context: 8978b8ec05fa3f36
2024-09-28 02:52:15 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-09-28 02:52:15 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 49 2b 61 62 6e 55 2b 2f 58 55 69 56 66 79 44 55 61 55 57 44 79 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: I+abnU+/XUiVfyDUaUWDyQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.6	49795	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-09-28 02:52:34 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 71 53 41 55 64 57 6e 42 6d 6b 43 35 37 6a 32 2f 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 37 38 64 38 65 63 39 31 30 34 38 36 32 36 30 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: qSAUdWnBmkC57j2/.1Context: 678d8ec910486260
2024-09-28 02:52:34 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-09-28 02:52:34 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 71 53 41 55 64 57 6e 42 6d 6b 43 35 37 6a 32 2f 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 37 38 64 38 65 63 39 31 30 34 38 36 32 36 30 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 57 78 6f 76 37 50 52 6f 72 79 58 63 6c 6c 59 63 63 79 52 59 4e 55 71 68 6b 2f 42 4f 31 58 41 71 4f 56 45 65 4b 6f 71 5a 53 42 7a 31 65 35 38 4a 2b 4b 33 52 55 69 71 6b 71 73 33 73 77 37 78 2b 37 4c 59 45 46 6d 77 70 63 4e 6c 31 62 34 55 6b 44 52 49 68 4c 45 30 44 37 73 43 63 4c 43 6e 41 31 31 56 6d 34 57 33 5a 6a 55 39 47 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: qSAUdWnBmkC57j2/.2Context: 678d8ec910486260<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWWxov7PRoryXcllYccyRYNUqhk/BO1XAqOVEeKoqZSBz1e58J+K3RUiqkqs3sw7x+7LYEFmwpcNl1b4UkDRIhLE0D7sCcLCnA11Vm4W3ZjU9G
2024-09-28 02:52:34 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 71 53 41 55 64 57 6e 42 6d 6b 43 35 37 6a 32 2f 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 37 38 64 38 65 63 39 31 30 34 38 36 32 36 30 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: qSAUdWnBmkC57j2/.3Context: 678d8ec910486260
2024-09-28 02:52:34 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-09-28 02:52:34 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 53 52 6c 62 32 6c 64 32 63 30 53 55 67 4a 6a 74 4e 34 67 32 75 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: SRlb2ld2c0SUgJjtN4g2ug.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.6	49796	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-09-28 02:52:36 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 42 32 4a 48 65 52 74 76 64 30 61 77 55 76 78 35 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 63 66 65 64 36 66 66 62 64 35 65 34 32 63 39 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: B2JHeRtvd0awUvx5.1Context: 1cfed6ffbd5e42c9
2024-09-28 02:52:36 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-09-28 02:52:36 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 42 32 4a 48 65 52 74 76 64 30 61 77 55 76 78 35 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 63 66 65 64 36 66 66 62 64 35 65 34 32 63 39 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 57 78 6f 76 37 50 52 6f 72 79 58 63 6c 6c 59 63 63 79 52 59 4e 55 71 68 6b 2f 42 4f 31 58 41 71 4f 56 45 65 4b 6f 71 5a 53 42 7a 31 65 35 38 4a 2b 4b 33 52 55 69 71 6b 71 73 33 73 77 37 78 2b 37 4c 59 45 46 6d 77 70 63 4e 6c 31 62 34 55 6b 44 52 49 68 4c 45 30 44 37 73 43 63 4c 43 6e 41 31 31 56 6d 34 57 33 5a 6a 55 39 47 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: B2JHeRtvd0awUvx5.2Context: 1cfed6ffbd5e42c9<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWWxov7PRoryXcllYccyRYNUqhk/BO1XAqOVEeKoqZSBz1e58J+K3RUiqkqs3sw7x+7LYEFmwpcNl1b4UkDRIhLE0D7sCcLCnA11Vm4W3ZjU9G
2024-09-28 02:52:36 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 42 32 4a 48 65 52 74 76 64 30 61 77 55 76 78 35 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 63 66 65 64 36 66 66 62 64 35 65 34 32 63 39 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: B2JHeRtvd0awUvx5.3Context: 1cfed6ffbd5e42c9<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-09-28 02:52:36 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-09-28 02:52:36 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 37 47 76 73 73 72 33 4e 6f 55 61 2f 54 6e 6f 78 39 4e 49 66 6c 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 7Gvssr3NoUa/Tnox9NIflw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.6	49800	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-09-28 02:52:55 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 74 7a 6f 45 32 41 71 5a 73 6b 2b 49 6e 6b 69 45 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 38 37 66 36 38 38 62 35 33 63 61 34 33 32 35 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: tzoE2AqZsk+InkiE.1Context: 287f688b53ca4325
2024-09-28 02:52:55 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-09-28 02:52:55 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 74 7a 6f 45 32 41 71 5a 73 6b 2b 49 6e 6b 69 45 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 38 37 66 36 38 38 62 35 33 63 61 34 33 32 35 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 57 78 6f 76 37 50 52 6f 72 79 58 63 6c 6c 59 63 63 79 52 59 4e 55 71 68 6b 2f 42 4f 31 58 41 71 4f 56 45 65 4b 6f 71 5a 53 42 7a 31 65 35 38 4a 2b 4b 33 52 55 69 71 6b 71 73 33 73 77 37 78 2b 37 4c 59 45 46 6d 77 70 63 4e 6c 31 62 34 55 6b 44 52 49 68 4c 45 30 44 37 73 43 63 4c 43 6e 41 31 31 56 6d 34 57 33 5a 6a 55 39 47 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: tzoE2AqZsk+InkiE.2Context: 287f688b53ca4325<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWWxov7PRoryXcllYccyRYNUqhk/BO1XAqOVEeKoqZSBz1e58J+K3RUiqkqs3sw7x+7LYEFmwpcNl1b4UkDRIhLE0D7sCcLCnA11Vm4W3ZjU9G
2024-09-28 02:52:55 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 74 7a 6f 45 32 41 71 5a 73 6b 2b 49 6e 6b 69 45 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 38 37 66 36 38 38 62 35 33 63 61 34 33 32 35 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: tzoE2AqZsk+InkiE.3Context: 287f688b53ca4325
2024-09-28 02:52:55 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-09-28 02:52:55 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 77 6f 52 54 37 48 52 48 68 55 32 62 50 6a 68 58 67 75 61 52 65 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: woRT7HRHhU2bPjhXguaReQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.6	49802	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-09-28 02:53:04 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 34 68 4f 74 6b 69 73 51 5a 6b 53 37 42 75 61 67 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 64 36 64 64 62 62 63 30 32 37 35 39 32 63 36 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 4hOtkisQZkS7Buag.1Context: fd6ddbbc027592c6
2024-09-28 02:53:04 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-09-28 02:53:04 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 34 68 4f 74 6b 69 73 51 5a 6b 53 37 42 75 61 67 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 64 36 64 64 62 62 63 30 32 37 35 39 32 63 36 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 57 78 6f 76 37 50 52 6f 72 79 58 63 6c 6c 59 63 63 79 52 59 4e 55 71 68 6b 2f 42 4f 31 58 41 71 4f 56 45 65 4b 6f 71 5a 53 42 7a 31 65 35 38 4a 2b 4b 33 52 55 69 71 6b 71 73 33 73 77 37 78 2b 37 4c 59 45 46 6d 77 70 63 4e 6c 31 62 34 55 6b 44 52 49 68 4c 45 30 44 37 73 43 63 4c 43 6e 41 31 31 56 6d 34 57 33 5a 6a 55 39 47 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 4hOtkisQZkS7Buag.2Context: fd6ddbbc027592c6<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWWxov7PRoryXcllYccyRYNUqhk/BO1XAqOVEeKoqZSBz1e58J+K3RUiqkqs3sw7x+7LYEFmwpcNl1b4UkDRIhLE0D7sCcLCnA11Vm4W3ZjU9G
2024-09-28 02:53:04 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 34 68 4f 74 6b 69 73 51 5a 6b 53 37 42 75 61 67 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 64 36 64 64 62 62 63 30 32 37 35 39 32 63 36 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 4hOtkisQZkS7Buag.3Context: fd6ddbbc027592c6<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-09-28 02:53:04 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-09-28 02:53:04 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 39 4b 50 7a 63 77 64 64 62 6b 69 50 64 51 77 49 45 45 62 4e 33 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 9KPzcwddbkiPdQwIEEbN3w.0Payload parsing failed.

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

Analysis Process: chrome.exePID: 4136, Parent PID: 5924

General

Target ID:	0
Start time:	22:51:42
Start date:	27/09/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 764, Parent PID: 4136

General

Target ID:	2
Start time:	22:51:47
Start date:	27/09/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1960 --field-trial-handle=1712,i,10613786820341075908,2899989241652874171,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 3820, Parent PID: 5924

General

Target ID:	3
Start time:	22:51:49
Start date:	27/09/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://uopheldlognxo.godaddysites.com/"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://uopheldlognxo.godaddysites.com/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Chrome Cache Entry: 113

Chrome Cache Entry: 114

Chrome Cache Entry: 115

Chrome Cache Entry: 116

Chrome Cache Entry: 117

Chrome Cache Entry: 118

Chrome Cache Entry: 119

Chrome Cache Entry: 120

Chrome Cache Entry: 121

Chrome Cache Entry: 122

Chrome Cache Entry: 69

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Windows Analysis Report
https://uopheldlognxo.godaddysites.com/