Edit tour

Windows Analysis Report
https://kucoinlloiinn8.godaddysites.com/

Overview

General Information

Sample URL:	https://kucoinlloiinn8.godaddysites.com/
Analysis ID:	1521950
Tags:	openphish
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Antivirus / Scanner detection for submitted sample

Phishing site detected (based on logo match)

HTML body contains low number of good links

HTML title does not match URL

Classification

Process Tree

System is w10x64

chrome.exe (PID: 1848 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 1836 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2504 --field-trial-handle=2340,i,1429752358186918888,16718431658222597420,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6332 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://kucoinlloiinn8.godaddysites.com/" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://kucoinlloiinn8.godaddysites.com/

SlashNext: detection malicious, Label: Fraudulent Website type: Phishing & Social Engineering

Phishing

AI detected phishing page

Source: https://kucoinlloiinn8.godaddysites.com/

LLM: Score: 9 Reasons: The legitimate domain for KuCoin is kucoin.com., The provided URL kucoinlloiinn8.godaddysites.com does not match the legitimate domain., The URL contains suspicious elements such as 'kucoinlloiinn8' which is not associated with the legitimate KuCoin domain., The use of 'godaddysites.com' as a domain extension is unusual for a well-known brand like KuCoin., The presence of input fields for username and password on a suspicious URL increases the risk of phishing. DOM: 0.0.pages.csv

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49776 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: kucoinlloiinn8.godaddysites.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /sw.js HTTP/1.1Host: kucoinlloiinn8.godaddysites.comConnection: keep-aliveCache-Control: max-age=0Accept: /Service-Worker: scriptSec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: serviceworkerReferer: https://kucoinlloiinn8.godaddysites.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: dps_site_id=us-east-1
Source: global traffic	HTTP traffic detected: GET /manifest.webmanifest HTTP/1.1Host: kucoinlloiinn8.godaddysites.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: manifestReferer: https://kucoinlloiinn8.godaddysites.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: kucoinlloiinn8.godaddysites.comConnection: keep-alivePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://kucoinlloiinn8.godaddysites.com/sw.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: dps_site_id=us-east-1
Source: global traffic	HTTP traffic detected: GET /eJlMkP-Oo HTTP/1.1Host: gtly.toConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: gtly.toConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://gtly.to/eJlMkP-OoAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: kucoinlloiinn8.godaddysites.com
Source: global traffic	DNS traffic detected: DNS query: img1.wsimg.com
Source: global traffic	DNS traffic detected: DNS query: isteam.wsimg.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: gtly.to

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundx-powered-by: Expresscache-control: private, no-cache, no-store, must-revalidatereferer: content-type: text/html; charset=utf-8etag: W/"188-ze4DTuXMy5nJCVqsdQu1C2/PUow"X-Cloud-Trace-Context: cc740df0aacdf594fafba7995bd47ffcDate: Sun, 29 Sep 2024 04:19:53 GMTServer: Google FrontendContent-Length: 392Via: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundx-powered-by: Expresscache-control: private, no-cache, no-store, must-revalidatecontent-type: text/html; charset=utf-8etag: W/"188-ze4DTuXMy5nJCVqsdQu1C2/PUow"X-Cloud-Trace-Context: 8efbab38335ad929a7116948115b7d05Date: Sun, 29 Sep 2024 04:19:54 GMTServer: Google FrontendContent-Length: 392Via: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close

Source: chromecache_85.2.dr, chromecache_91.2.dr, chromecache_120.2.dr	String found in binary or memory: http://jedwatson.github.io/classnames
Source: chromecache_84.2.dr	String found in binary or memory: http://scripts.sil.org/OFL
Source: chromecache_84.2.dr	String found in binary or memory: https://github.com/JulietaUla/Montserrat)
Source: chromecache_84.2.dr	String found in binary or memory: https://github.com/clauseggers/Playfair-Display)
Source: chromecache_84.2.dr	String found in binary or memory: https://gtly.to/eJlMkP-Oo
Source: chromecache_84.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459W1hyzbi.woff2)
Source: chromecache_84.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459WRhyzbi.woff2)
Source: chromecache_84.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459WZhyzbi.woff2)
Source: chromecache_84.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459Wdhyzbi.woff2)
Source: chromecache_84.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2)
Source: chromecache_84.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/playfairdisplay/v37/nuFiD-vYSZviVYUb_rj3ij__anPXDTLYgFE_.woff2)
Source: chromecache_84.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/playfairdisplay/v37/nuFiD-vYSZviVYUb_rj3ij__anPXDTPYgFE_.woff2)
Source: chromecache_84.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/playfairdisplay/v37/nuFiD-vYSZviVYUb_rj3ij__anPXDTjYgFE_.woff2)
Source: chromecache_84.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/playfairdisplay/v37/nuFiD-vYSZviVYUb_rj3ij__anPXDTzYgA.woff2)
Source: chromecache_84.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK1dSBYKcSV-LCoeQqfX1RYOo3qPZ7jsDJT9g.woff2)
Source: chromecache_84.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK1dSBYKcSV-LCoeQqfX1RYOo3qPZ7ksDJT9g.woff2)
Source: chromecache_84.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK1dSBYKcSV-LCoeQqfX1RYOo3qPZ7nsDI.woff2)
Source: chromecache_84.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK1dSBYKcSV-LCoeQqfX1RYOo3qPZ7osDJT9g.woff2)
Source: chromecache_84.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK1dSBYKcSV-LCoeQqfX1RYOo3qPZ7psDJT9g.woff2)
Source: chromecache_84.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK1dSBYKcSV-LCoeQqfX1RYOo3qPZ7qsDJT9g.woff2)
Source: chromecache_84.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK1dSBYKcSV-LCoeQqfX1RYOo3qPZ7rsDJT9g.woff2)
Source: chromecache_84.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qN67lqDY.woff2)
Source: chromecache_84.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qNK7lqDY.woff2)
Source: chromecache_84.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qNa7lqDY.woff2)
Source: chromecache_84.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qNq7lqDY.woff2)
Source: chromecache_84.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qO67lqDY.woff2)
Source: chromecache_84.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2)
Source: chromecache_84.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qPK7lqDY.woff2)
Source: chromecache_84.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZMkidg18Smxg.woff2)
Source: chromecache_84.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZMkidh18Smxg.woff2)
Source: chromecache_84.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZMkidi18Smxg.woff2)
Source: chromecache_84.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZMkidj18Smxg.woff2)
Source: chromecache_84.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZMkido18Smxg.woff2)
Source: chromecache_84.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZMkids18Q.woff2)
Source: chromecache_84.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZMkidv18Smxg.woff2)
Source: chromecache_84.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZclSdg18Smxg.woff2)
Source: chromecache_84.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZclSdh18Smxg.woff2)
Source: chromecache_84.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZclSdi18Smxg.woff2)
Source: chromecache_84.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZclSdj18Smxg.woff2)
Source: chromecache_84.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZclSdo18Smxg.woff2)
Source: chromecache_84.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZclSds18Q.woff2)
Source: chromecache_84.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZclSdv18Smxg.woff2)
Source: chromecache_84.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwkxduz8A.woff2)
Source: chromecache_84.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlBduz8A.woff2)
Source: chromecache_84.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu.woff2)
Source: chromecache_84.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwmBduz8A.woff2)
Source: chromecache_84.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwmRduz8A.woff2)
Source: chromecache_84.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwmhduz8A.woff2)
Source: chromecache_84.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwmxduz8A.woff2)
Source: chromecache_84.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zwkxduz8A.woff2)
Source: chromecache_84.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zwlBduz8A.woff2)
Source: chromecache_84.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zwlxdu.woff2)
Source: chromecache_84.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zwmBduz8A.woff2)
Source: chromecache_84.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zwmRduz8A.woff2)
Source: chromecache_84.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zwmhduz8A.woff2)
Source: chromecache_84.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zwmxduz8A.woff2)
Source: chromecache_84.2.dr	String found in binary or memory: https://img1.wsimg.com/poly/v3/polyfill.min.js?rum=0&unknown=polyfill&flags=gated&features=Intl.~loc
Source: chromecache_84.2.dr	String found in binary or memory: https://kucoinlloiinn.godaddysites.com/

Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2504 --field-trial-handle=2340,i,1429752358186918888,16718431658222597420,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://kucoinlloiinn8.godaddysites.com/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2504 --field-trial-handle=2340,i,1429752358186918888,16718431658222597420,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label	Link
http://jedwatson.github.io/classnames	0%	URL Reputation	safe
http://scripts.sil.org/OFL	0%	URL Reputation	safe

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.185.68	www.google.com	United States	15169	GOOGLEUS	false
13.248.243.5	kucoinlloiinn8.godaddysites.com	United States	16509	AMAZON-02US	true
34.107.207.124	gtly.to	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
3.64.248.63	isteam.wsimg.com	United States	16509	AMAZON-02US	false

IP
192.168.2.4
192.168.2.5

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1521950
Start date and time:	2024-09-29 06:18:44 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 16s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://kucoinlloiinn8.godaddysites.com/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal60.phis.win@17/96@12/7
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Browse: https://gtly.to/eJlMkP-Oo

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	266
Entropy (8bit):	5.182741116673583
Encrypted:	false
SSDEEP:	6:F9oNS2BSyRbWsCJwvYtMe1mGHr9EJiKWaO6SZF:HgS2BSyEsCJB1THr+pWIS7
MD5:	8578A331AD09BB2EF6359FEC3916BEFC
SHA1:	38B68F5C02CBDB6E29C50F8858710E0392B0B8D6
SHA-256:	3D7E7552E3801941A408C504AA732223FE2BED5D12E248680847D772182CB639
SHA-512:	B034DDDA04F8DEE0D174651D13A89AF9FE5ED28E1E81FAB229AFA119B9B0A9C418E324FFCE28E909D8D596BEAE98FA1AC0BA09C74E7E7689B945C032088C5E18
Malicious:	false
Reputation:	low
URL:	https://img1.wsimg.com/blobby/go/static/radpack/@wsb/guac-widget-shared/c/_react_commonjs-external-a1351e34.js
Preview:	define("@wsb/guac-widget-shared/c/_react_commonjs-external-a1351e34.js",["exports"],(function(e){"use strict";const n=global.React\|\|guac.react;e._=n})),"undefined"!=typeof window&&(window.global=window);.//# sourceMappingURL=_react_commonjs-external-a1351e34.js.map.

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	unknown
gtly.to	34.107.207.124	true	false	unknown
kucoinlloiinn8.godaddysites.com	13.248.243.5	true	true	unknown
www.google.com	142.250.185.68	true	false	unknown
isteam.wsimg.com	3.64.248.63	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	unknown
img1.wsimg.com	unknown	unknown	false	unknown

Name	Source	Malicious	Antivirus Detection	Reputation
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK1dSBYKcSV-LCoeQqfX1RYOo3qPZ7osDJT9g.woff2)	chromecache_84.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qNa7lqDY.woff2)	chromecache_84.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZMkids18Q.woff2)	chromecache_84.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK1dSBYKcSV-LCoeQqfX1RYOo3qPZ7qsDJT9g.woff2)	chromecache_84.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZclSdh18Smxg.woff2)	chromecache_84.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK1dSBYKcSV-LCoeQqfX1RYOo3qPZ7ksDJT9g.woff2)	chromecache_84.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlBduz8A.woff2)	chromecache_84.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zwmRduz8A.woff2)	chromecache_84.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZclSdv18Smxg.woff2)	chromecache_84.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459Wdhyzbi.woff2)	chromecache_84.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZMkidi18Smxg.woff2)	chromecache_84.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/playfairdisplay/v37/nuFiD-vYSZviVYUb_rj3ij__anPXDTjYgFE_.woff2)	chromecache_84.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/playfairdisplay/v37/nuFiD-vYSZviVYUb_rj3ij__anPXDTzYgA.woff2)	chromecache_84.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZMkidg18Smxg.woff2)	chromecache_84.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459WZhyzbi.woff2)	chromecache_84.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zwlBduz8A.woff2)	chromecache_84.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qNq7lqDY.woff2)	chromecache_84.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qN67lqDY.woff2)	chromecache_84.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qO67lqDY.woff2)	chromecache_84.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zwmhduz8A.woff2)	chromecache_84.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zwmBduz8A.woff2)	chromecache_84.2.dr	false		unknown
https://github.com/JulietaUla/Montserrat)	chromecache_84.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwmhduz8A.woff2)	chromecache_84.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZMkido18Smxg.woff2)	chromecache_84.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2)	chromecache_84.2.dr	false		unknown
http://jedwatson.github.io/classnames	chromecache_85.2.dr, chromecache_91.2.dr, chromecache_120.2.dr	false	URL Reputation: safe	unknown
https://github.com/clauseggers/Playfair-Display)	chromecache_84.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/playfairdisplay/v37/nuFiD-vYSZviVYUb_rj3ij__anPXDTPYgFE_.woff2)	chromecache_84.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK1dSBYKcSV-LCoeQqfX1RYOo3qPZ7psDJT9g.woff2)	chromecache_84.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu.woff2)	chromecache_84.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK1dSBYKcSV-LCoeQqfX1RYOo3qPZ7rsDJT9g.woff2)	chromecache_84.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZclSdg18Smxg.woff2)	chromecache_84.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZclSdi18Smxg.woff2)	chromecache_84.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwmBduz8A.woff2)	chromecache_84.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2)	chromecache_84.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK1dSBYKcSV-LCoeQqfX1RYOo3qPZ7jsDJT9g.woff2)	chromecache_84.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zwmxduz8A.woff2)	chromecache_84.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZclSdo18Smxg.woff2)	chromecache_84.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zwkxduz8A.woff2)	chromecache_84.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZMkidv18Smxg.woff2)	chromecache_84.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qNK7lqDY.woff2)	chromecache_84.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZMkidj18Smxg.woff2)	chromecache_84.2.dr	false		unknown
https://kucoinlloiinn.godaddysites.com/	chromecache_84.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qPK7lqDY.woff2)	chromecache_84.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/playfairdisplay/v37/nuFiD-vYSZviVYUb_rj3ij__anPXDTLYgFE_.woff2)	chromecache_84.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZMkidh18Smxg.woff2)	chromecache_84.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZclSds18Q.woff2)	chromecache_84.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zwlxdu.woff2)	chromecache_84.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK1dSBYKcSV-LCoeQqfX1RYOo3qPZ7nsDI.woff2)	chromecache_84.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwmRduz8A.woff2)	chromecache_84.2.dr	false		unknown
https://img1.wsimg.com/poly/v3/polyfill.min.js?rum=0&unknown=polyfill&flags=gated&features=Intl.~loc	chromecache_84.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459WRhyzbi.woff2)	chromecache_84.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwmxduz8A.woff2)	chromecache_84.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwkxduz8A.woff2)	chromecache_84.2.dr	false		unknown
http://scripts.sil.org/OFL	chromecache_84.2.dr	false	URL Reputation: safe	unknown
https://img1.wsimg.com/gfonts/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459W1hyzbi.woff2)	chromecache_84.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZclSdj18Smxg.woff2)	chromecache_84.2.dr	false		unknown

Input	Output
URL: https://gtly.to/eJlMkP-Oo Model: jbxai	{ "brand":[], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://kucoinlloiinn8.godaddysites.com/ Model: jbxai	{ "brand":["KuCoin"], "contains_trigger_text":true, "trigger_text":"Sign Up", "prominent_button_name":"Sign Up", "text_input_field_labels":["username", "password"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://kucoinlloiinn8.godaddysites.com/ Model: jbxai	{ "phishing_score":9, "brands":"KuCoin", "legit_domain":"kucoin.com", "classification":"known", "reasons":["The legitimate domain for KuCoin is kucoin.com.", "The provided URL kucoinlloiinn8.godaddysites.com does not match the legitimate domain.", "The URL contains suspicious elements such as 'kucoinlloiinn8' which is not associated with the legitimate KuCoin domain.", "The use of 'godaddysites.com' as a domain extension is unusual for a well-known brand like KuCoin.", "The presence of input fields for username and password on a suspicious URL increases the risk of phishing."], "brand_matches":[false], "url_match":false, "brand_input":"KuCoin", "input_fields":"username, password"}

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 29, 2024 06:19:29.719518900 CEST	49675	443	192.168.2.4	173.222.162.32
Sep 29, 2024 06:19:39.405858994 CEST	49675	443	192.168.2.4	173.222.162.32
Sep 29, 2024 06:19:40.535718918 CEST	49735	443	192.168.2.4	13.248.243.5
Sep 29, 2024 06:19:40.535754919 CEST	443	49735	13.248.243.5	192.168.2.4
Sep 29, 2024 06:19:40.535825968 CEST	49735	443	192.168.2.4	13.248.243.5
Sep 29, 2024 06:19:40.536257982 CEST	49736	443	192.168.2.4	13.248.243.5
Sep 29, 2024 06:19:40.536309004 CEST	443	49736	13.248.243.5	192.168.2.4
Sep 29, 2024 06:19:40.536477089 CEST	49736	443	192.168.2.4	13.248.243.5
Sep 29, 2024 06:19:40.536654949 CEST	49735	443	192.168.2.4	13.248.243.5
Sep 29, 2024 06:19:40.536665916 CEST	443	49735	13.248.243.5	192.168.2.4
Sep 29, 2024 06:19:40.536860943 CEST	49736	443	192.168.2.4	13.248.243.5
Sep 29, 2024 06:19:40.536875010 CEST	443	49736	13.248.243.5	192.168.2.4
Sep 29, 2024 06:19:41.089080095 CEST	443	49736	13.248.243.5	192.168.2.4
Sep 29, 2024 06:19:41.089885950 CEST	49736	443	192.168.2.4	13.248.243.5
Sep 29, 2024 06:19:41.089906931 CEST	443	49736	13.248.243.5	192.168.2.4
Sep 29, 2024 06:19:41.090317011 CEST	443	49735	13.248.243.5	192.168.2.4
Sep 29, 2024 06:19:41.090660095 CEST	49735	443	192.168.2.4	13.248.243.5
Sep 29, 2024 06:19:41.090683937 CEST	443	49735	13.248.243.5	192.168.2.4
Sep 29, 2024 06:19:41.090958118 CEST	443	49736	13.248.243.5	192.168.2.4
Sep 29, 2024 06:19:41.091022015 CEST	49736	443	192.168.2.4	13.248.243.5
Sep 29, 2024 06:19:41.091716051 CEST	443	49735	13.248.243.5	192.168.2.4
Sep 29, 2024 06:19:41.091762066 CEST	49735	443	192.168.2.4	13.248.243.5
Sep 29, 2024 06:19:41.096070051 CEST	49736	443	192.168.2.4	13.248.243.5
Sep 29, 2024 06:19:41.096144915 CEST	443	49736	13.248.243.5	192.168.2.4
Sep 29, 2024 06:19:41.096455097 CEST	49735	443	192.168.2.4	13.248.243.5
Sep 29, 2024 06:19:41.096518040 CEST	443	49735	13.248.243.5	192.168.2.4
Sep 29, 2024 06:19:41.096744061 CEST	49736	443	192.168.2.4	13.248.243.5
Sep 29, 2024 06:19:41.096760035 CEST	443	49736	13.248.243.5	192.168.2.4
Sep 29, 2024 06:19:41.136885881 CEST	49735	443	192.168.2.4	13.248.243.5
Sep 29, 2024 06:19:41.136894941 CEST	49736	443	192.168.2.4	13.248.243.5
Sep 29, 2024 06:19:41.136910915 CEST	443	49735	13.248.243.5	192.168.2.4
Sep 29, 2024 06:19:41.181813002 CEST	49735	443	192.168.2.4	13.248.243.5
Sep 29, 2024 06:19:41.237584114 CEST	443	49736	13.248.243.5	192.168.2.4
Sep 29, 2024 06:19:41.237611055 CEST	443	49736	13.248.243.5	192.168.2.4
Sep 29, 2024 06:19:41.237641096 CEST	443	49736	13.248.243.5	192.168.2.4
Sep 29, 2024 06:19:41.237660885 CEST	443	49736	13.248.243.5	192.168.2.4
Sep 29, 2024 06:19:41.237705946 CEST	49736	443	192.168.2.4	13.248.243.5
Sep 29, 2024 06:19:41.237716913 CEST	443	49736	13.248.243.5	192.168.2.4
Sep 29, 2024 06:19:41.237724066 CEST	443	49736	13.248.243.5	192.168.2.4
Sep 29, 2024 06:19:41.237770081 CEST	49736	443	192.168.2.4	13.248.243.5
Sep 29, 2024 06:19:41.327685118 CEST	443	49736	13.248.243.5	192.168.2.4
Sep 29, 2024 06:19:41.327708960 CEST	443	49736	13.248.243.5	192.168.2.4
Sep 29, 2024 06:19:41.327805042 CEST	49736	443	192.168.2.4	13.248.243.5
Sep 29, 2024 06:19:41.327825069 CEST	443	49736	13.248.243.5	192.168.2.4
Sep 29, 2024 06:19:41.327891111 CEST	49736	443	192.168.2.4	13.248.243.5
Sep 29, 2024 06:19:41.332075119 CEST	443	49736	13.248.243.5	192.168.2.4
Sep 29, 2024 06:19:41.332113028 CEST	443	49736	13.248.243.5	192.168.2.4
Sep 29, 2024 06:19:41.332155943 CEST	49736	443	192.168.2.4	13.248.243.5
Sep 29, 2024 06:19:41.332159042 CEST	443	49736	13.248.243.5	192.168.2.4
Sep 29, 2024 06:19:41.332211018 CEST	49736	443	192.168.2.4	13.248.243.5
Sep 29, 2024 06:19:41.368426085 CEST	49736	443	192.168.2.4	13.248.243.5
Sep 29, 2024 06:19:41.368452072 CEST	443	49736	13.248.243.5	192.168.2.4
Sep 29, 2024 06:19:41.377285004 CEST	49745	443	192.168.2.4	3.64.248.63
Sep 29, 2024 06:19:41.377309084 CEST	443	49745	3.64.248.63	192.168.2.4
Sep 29, 2024 06:19:41.377368927 CEST	49745	443	192.168.2.4	3.64.248.63
Sep 29, 2024 06:19:41.377688885 CEST	49745	443	192.168.2.4	3.64.248.63
Sep 29, 2024 06:19:41.377703905 CEST	443	49745	3.64.248.63	192.168.2.4
Sep 29, 2024 06:19:42.141093016 CEST	443	49745	3.64.248.63	192.168.2.4
Sep 29, 2024 06:19:42.147437096 CEST	49745	443	192.168.2.4	3.64.248.63
Sep 29, 2024 06:19:42.147447109 CEST	443	49745	3.64.248.63	192.168.2.4
Sep 29, 2024 06:19:42.149199963 CEST	443	49745	3.64.248.63	192.168.2.4
Sep 29, 2024 06:19:42.149255037 CEST	49745	443	192.168.2.4	3.64.248.63
Sep 29, 2024 06:19:42.153680086 CEST	49745	443	192.168.2.4	3.64.248.63
Sep 29, 2024 06:19:42.153825998 CEST	443	49745	3.64.248.63	192.168.2.4
Sep 29, 2024 06:19:42.207421064 CEST	49745	443	192.168.2.4	3.64.248.63
Sep 29, 2024 06:19:42.207432985 CEST	443	49745	3.64.248.63	192.168.2.4
Sep 29, 2024 06:19:42.259291887 CEST	49745	443	192.168.2.4	3.64.248.63
Sep 29, 2024 06:19:43.320334911 CEST	49757	443	192.168.2.4	142.250.185.68
Sep 29, 2024 06:19:43.320386887 CEST	443	49757	142.250.185.68	192.168.2.4
Sep 29, 2024 06:19:43.320523024 CEST	49757	443	192.168.2.4	142.250.185.68
Sep 29, 2024 06:19:43.321273088 CEST	49757	443	192.168.2.4	142.250.185.68
Sep 29, 2024 06:19:43.321285009 CEST	443	49757	142.250.185.68	192.168.2.4
Sep 29, 2024 06:19:44.052381039 CEST	443	49757	142.250.185.68	192.168.2.4
Sep 29, 2024 06:19:44.085686922 CEST	49757	443	192.168.2.4	142.250.185.68
Sep 29, 2024 06:19:44.085719109 CEST	443	49757	142.250.185.68	192.168.2.4
Sep 29, 2024 06:19:44.087081909 CEST	443	49757	142.250.185.68	192.168.2.4
Sep 29, 2024 06:19:44.087148905 CEST	49757	443	192.168.2.4	142.250.185.68
Sep 29, 2024 06:19:44.091444016 CEST	49757	443	192.168.2.4	142.250.185.68
Sep 29, 2024 06:19:44.091556072 CEST	443	49757	142.250.185.68	192.168.2.4
Sep 29, 2024 06:19:44.140091896 CEST	49757	443	192.168.2.4	142.250.185.68
Sep 29, 2024 06:19:44.140119076 CEST	443	49757	142.250.185.68	192.168.2.4
Sep 29, 2024 06:19:44.188265085 CEST	49757	443	192.168.2.4	142.250.185.68
Sep 29, 2024 06:19:44.911355019 CEST	49764	443	192.168.2.4	184.28.90.27
Sep 29, 2024 06:19:44.911467075 CEST	443	49764	184.28.90.27	192.168.2.4
Sep 29, 2024 06:19:44.911559105 CEST	49764	443	192.168.2.4	184.28.90.27
Sep 29, 2024 06:19:44.914189100 CEST	49764	443	192.168.2.4	184.28.90.27
Sep 29, 2024 06:19:44.914227962 CEST	443	49764	184.28.90.27	192.168.2.4
Sep 29, 2024 06:19:45.611980915 CEST	443	49764	184.28.90.27	192.168.2.4
Sep 29, 2024 06:19:45.612076998 CEST	49764	443	192.168.2.4	184.28.90.27
Sep 29, 2024 06:19:45.647974014 CEST	49764	443	192.168.2.4	184.28.90.27
Sep 29, 2024 06:19:45.648006916 CEST	443	49764	184.28.90.27	192.168.2.4
Sep 29, 2024 06:19:45.648325920 CEST	443	49764	184.28.90.27	192.168.2.4
Sep 29, 2024 06:19:45.757407904 CEST	49764	443	192.168.2.4	184.28.90.27
Sep 29, 2024 06:19:45.799401999 CEST	443	49764	184.28.90.27	192.168.2.4
Sep 29, 2024 06:19:45.946331024 CEST	443	49764	184.28.90.27	192.168.2.4
Sep 29, 2024 06:19:45.946415901 CEST	443	49764	184.28.90.27	192.168.2.4
Sep 29, 2024 06:19:45.946624041 CEST	49764	443	192.168.2.4	184.28.90.27
Sep 29, 2024 06:19:45.946624041 CEST	49764	443	192.168.2.4	184.28.90.27
Sep 29, 2024 06:19:45.946655035 CEST	443	49764	184.28.90.27	192.168.2.4
Sep 29, 2024 06:19:45.946682930 CEST	49764	443	192.168.2.4	184.28.90.27
Sep 29, 2024 06:19:45.946691990 CEST	443	49764	184.28.90.27	192.168.2.4
Sep 29, 2024 06:19:46.008682013 CEST	49776	443	192.168.2.4	184.28.90.27
Sep 29, 2024 06:19:46.008745909 CEST	443	49776	184.28.90.27	192.168.2.4
Sep 29, 2024 06:19:46.008867979 CEST	49776	443	192.168.2.4	184.28.90.27
Sep 29, 2024 06:19:46.013725042 CEST	49776	443	192.168.2.4	184.28.90.27
Sep 29, 2024 06:19:46.013751984 CEST	443	49776	184.28.90.27	192.168.2.4
Sep 29, 2024 06:19:46.730235100 CEST	443	49776	184.28.90.27	192.168.2.4
Sep 29, 2024 06:19:46.730318069 CEST	49776	443	192.168.2.4	184.28.90.27
Sep 29, 2024 06:19:46.731756926 CEST	49776	443	192.168.2.4	184.28.90.27
Sep 29, 2024 06:19:46.731771946 CEST	443	49776	184.28.90.27	192.168.2.4
Sep 29, 2024 06:19:46.732016087 CEST	443	49776	184.28.90.27	192.168.2.4
Sep 29, 2024 06:19:46.733155012 CEST	49776	443	192.168.2.4	184.28.90.27
Sep 29, 2024 06:19:46.779405117 CEST	443	49776	184.28.90.27	192.168.2.4
Sep 29, 2024 06:19:47.033041954 CEST	443	49776	184.28.90.27	192.168.2.4
Sep 29, 2024 06:19:47.033118010 CEST	443	49776	184.28.90.27	192.168.2.4
Sep 29, 2024 06:19:47.033159971 CEST	49776	443	192.168.2.4	184.28.90.27
Sep 29, 2024 06:19:47.038239956 CEST	49776	443	192.168.2.4	184.28.90.27
Sep 29, 2024 06:19:47.038254023 CEST	443	49776	184.28.90.27	192.168.2.4
Sep 29, 2024 06:19:49.061944962 CEST	49798	443	192.168.2.4	13.248.243.5
Sep 29, 2024 06:19:49.061984062 CEST	443	49798	13.248.243.5	192.168.2.4
Sep 29, 2024 06:19:49.062267065 CEST	49798	443	192.168.2.4	13.248.243.5
Sep 29, 2024 06:19:49.062355042 CEST	49735	443	192.168.2.4	13.248.243.5
Sep 29, 2024 06:19:49.062849998 CEST	49798	443	192.168.2.4	13.248.243.5
Sep 29, 2024 06:19:49.062858105 CEST	443	49798	13.248.243.5	192.168.2.4
Sep 29, 2024 06:19:49.107404947 CEST	443	49735	13.248.243.5	192.168.2.4
Sep 29, 2024 06:19:49.201001883 CEST	443	49735	13.248.243.5	192.168.2.4
Sep 29, 2024 06:19:49.201066971 CEST	443	49735	13.248.243.5	192.168.2.4
Sep 29, 2024 06:19:49.201086998 CEST	443	49735	13.248.243.5	192.168.2.4
Sep 29, 2024 06:19:49.201116085 CEST	443	49735	13.248.243.5	192.168.2.4
Sep 29, 2024 06:19:49.201138020 CEST	443	49735	13.248.243.5	192.168.2.4
Sep 29, 2024 06:19:49.201158047 CEST	443	49735	13.248.243.5	192.168.2.4
Sep 29, 2024 06:19:49.201179981 CEST	49735	443	192.168.2.4	13.248.243.5
Sep 29, 2024 06:19:49.201179981 CEST	49735	443	192.168.2.4	13.248.243.5
Sep 29, 2024 06:19:49.201230049 CEST	443	49735	13.248.243.5	192.168.2.4
Sep 29, 2024 06:19:49.201251984 CEST	49735	443	192.168.2.4	13.248.243.5
Sep 29, 2024 06:19:49.201251984 CEST	49735	443	192.168.2.4	13.248.243.5
Sep 29, 2024 06:19:49.201286077 CEST	49735	443	192.168.2.4	13.248.243.5
Sep 29, 2024 06:19:49.287022114 CEST	443	49735	13.248.243.5	192.168.2.4
Sep 29, 2024 06:19:49.287076950 CEST	443	49735	13.248.243.5	192.168.2.4
Sep 29, 2024 06:19:49.287154913 CEST	49735	443	192.168.2.4	13.248.243.5
Sep 29, 2024 06:19:49.287154913 CEST	49735	443	192.168.2.4	13.248.243.5
Sep 29, 2024 06:19:49.287194014 CEST	443	49735	13.248.243.5	192.168.2.4
Sep 29, 2024 06:19:49.287313938 CEST	49735	443	192.168.2.4	13.248.243.5
Sep 29, 2024 06:19:49.287322998 CEST	443	49735	13.248.243.5	192.168.2.4
Sep 29, 2024 06:19:49.287364960 CEST	443	49735	13.248.243.5	192.168.2.4
Sep 29, 2024 06:19:49.287513018 CEST	49735	443	192.168.2.4	13.248.243.5
Sep 29, 2024 06:19:49.288594961 CEST	49735	443	192.168.2.4	13.248.243.5
Sep 29, 2024 06:19:49.288618088 CEST	443	49735	13.248.243.5	192.168.2.4
Sep 29, 2024 06:19:49.309568882 CEST	49801	443	192.168.2.4	13.248.243.5
Sep 29, 2024 06:19:49.309617996 CEST	443	49801	13.248.243.5	192.168.2.4
Sep 29, 2024 06:19:49.309683084 CEST	49801	443	192.168.2.4	13.248.243.5
Sep 29, 2024 06:19:49.310008049 CEST	49801	443	192.168.2.4	13.248.243.5
Sep 29, 2024 06:19:49.310024023 CEST	443	49801	13.248.243.5	192.168.2.4
Sep 29, 2024 06:19:49.592031956 CEST	443	49798	13.248.243.5	192.168.2.4
Sep 29, 2024 06:19:49.592463970 CEST	49798	443	192.168.2.4	13.248.243.5
Sep 29, 2024 06:19:49.592477083 CEST	443	49798	13.248.243.5	192.168.2.4
Sep 29, 2024 06:19:49.593470097 CEST	443	49798	13.248.243.5	192.168.2.4
Sep 29, 2024 06:19:49.593854904 CEST	49798	443	192.168.2.4	13.248.243.5
Sep 29, 2024 06:19:49.594114065 CEST	49798	443	192.168.2.4	13.248.243.5
Sep 29, 2024 06:19:49.594114065 CEST	49798	443	192.168.2.4	13.248.243.5
Sep 29, 2024 06:19:49.594121933 CEST	443	49798	13.248.243.5	192.168.2.4
Sep 29, 2024 06:19:49.594166040 CEST	443	49798	13.248.243.5	192.168.2.4
Sep 29, 2024 06:19:49.640734911 CEST	49798	443	192.168.2.4	13.248.243.5
Sep 29, 2024 06:19:49.640755892 CEST	443	49798	13.248.243.5	192.168.2.4
Sep 29, 2024 06:19:49.690184116 CEST	49798	443	192.168.2.4	13.248.243.5
Sep 29, 2024 06:19:49.727595091 CEST	443	49798	13.248.243.5	192.168.2.4
Sep 29, 2024 06:19:49.727659941 CEST	443	49798	13.248.243.5	192.168.2.4
Sep 29, 2024 06:19:49.729516983 CEST	49798	443	192.168.2.4	13.248.243.5
Sep 29, 2024 06:19:49.729993105 CEST	49798	443	192.168.2.4	13.248.243.5
Sep 29, 2024 06:19:49.730005026 CEST	443	49798	13.248.243.5	192.168.2.4
Sep 29, 2024 06:19:49.811299086 CEST	443	49801	13.248.243.5	192.168.2.4
Sep 29, 2024 06:19:49.811588049 CEST	49801	443	192.168.2.4	13.248.243.5
Sep 29, 2024 06:19:49.811602116 CEST	443	49801	13.248.243.5	192.168.2.4
Sep 29, 2024 06:19:49.811969042 CEST	443	49801	13.248.243.5	192.168.2.4
Sep 29, 2024 06:19:49.812488079 CEST	49801	443	192.168.2.4	13.248.243.5
Sep 29, 2024 06:19:49.812488079 CEST	49801	443	192.168.2.4	13.248.243.5
Sep 29, 2024 06:19:49.812560081 CEST	443	49801	13.248.243.5	192.168.2.4
Sep 29, 2024 06:19:49.859493971 CEST	49801	443	192.168.2.4	13.248.243.5
Sep 29, 2024 06:19:49.943708897 CEST	443	49801	13.248.243.5	192.168.2.4
Sep 29, 2024 06:19:49.943806887 CEST	443	49801	13.248.243.5	192.168.2.4
Sep 29, 2024 06:19:49.943837881 CEST	49801	443	192.168.2.4	13.248.243.5
Sep 29, 2024 06:19:49.943842888 CEST	443	49801	13.248.243.5	192.168.2.4
Sep 29, 2024 06:19:49.943852901 CEST	443	49801	13.248.243.5	192.168.2.4
Sep 29, 2024 06:19:49.943866014 CEST	443	49801	13.248.243.5	192.168.2.4
Sep 29, 2024 06:19:49.943867922 CEST	49801	443	192.168.2.4	13.248.243.5
Sep 29, 2024 06:19:49.943897963 CEST	443	49801	13.248.243.5	192.168.2.4
Sep 29, 2024 06:19:49.943898916 CEST	49801	443	192.168.2.4	13.248.243.5
Sep 29, 2024 06:19:49.943911076 CEST	443	49801	13.248.243.5	192.168.2.4
Sep 29, 2024 06:19:49.943936110 CEST	49801	443	192.168.2.4	13.248.243.5
Sep 29, 2024 06:19:49.944137096 CEST	49801	443	192.168.2.4	13.248.243.5
Sep 29, 2024 06:19:50.033730030 CEST	443	49801	13.248.243.5	192.168.2.4
Sep 29, 2024 06:19:50.033759117 CEST	443	49801	13.248.243.5	192.168.2.4
Sep 29, 2024 06:19:50.033864975 CEST	49801	443	192.168.2.4	13.248.243.5
Sep 29, 2024 06:19:50.033864975 CEST	49801	443	192.168.2.4	13.248.243.5
Sep 29, 2024 06:19:50.033895016 CEST	443	49801	13.248.243.5	192.168.2.4
Sep 29, 2024 06:19:50.037250042 CEST	443	49801	13.248.243.5	192.168.2.4
Sep 29, 2024 06:19:50.037323952 CEST	443	49801	13.248.243.5	192.168.2.4
Sep 29, 2024 06:19:50.037345886 CEST	49801	443	192.168.2.4	13.248.243.5
Sep 29, 2024 06:19:50.040059090 CEST	49801	443	192.168.2.4	13.248.243.5
Sep 29, 2024 06:19:50.040978909 CEST	49801	443	192.168.2.4	13.248.243.5
Sep 29, 2024 06:19:50.040993929 CEST	443	49801	13.248.243.5	192.168.2.4
Sep 29, 2024 06:19:53.337471008 CEST	49811	443	192.168.2.4	34.107.207.124
Sep 29, 2024 06:19:53.337518930 CEST	443	49811	34.107.207.124	192.168.2.4
Sep 29, 2024 06:19:53.337641954 CEST	49812	443	192.168.2.4	34.107.207.124
Sep 29, 2024 06:19:53.337675095 CEST	443	49812	34.107.207.124	192.168.2.4
Sep 29, 2024 06:19:53.337713003 CEST	49811	443	192.168.2.4	34.107.207.124
Sep 29, 2024 06:19:53.337745905 CEST	49812	443	192.168.2.4	34.107.207.124
Sep 29, 2024 06:19:53.338088989 CEST	49811	443	192.168.2.4	34.107.207.124
Sep 29, 2024 06:19:53.338102102 CEST	443	49811	34.107.207.124	192.168.2.4
Sep 29, 2024 06:19:53.338366985 CEST	49812	443	192.168.2.4	34.107.207.124
Sep 29, 2024 06:19:53.338378906 CEST	443	49812	34.107.207.124	192.168.2.4
Sep 29, 2024 06:19:53.805563927 CEST	443	49811	34.107.207.124	192.168.2.4
Sep 29, 2024 06:19:53.806035042 CEST	49811	443	192.168.2.4	34.107.207.124
Sep 29, 2024 06:19:53.806057930 CEST	443	49811	34.107.207.124	192.168.2.4
Sep 29, 2024 06:19:53.807663918 CEST	443	49811	34.107.207.124	192.168.2.4
Sep 29, 2024 06:19:53.807720900 CEST	49811	443	192.168.2.4	34.107.207.124
Sep 29, 2024 06:19:53.812858105 CEST	443	49812	34.107.207.124	192.168.2.4
Sep 29, 2024 06:19:53.814477921 CEST	49811	443	192.168.2.4	34.107.207.124
Sep 29, 2024 06:19:53.814594030 CEST	443	49811	34.107.207.124	192.168.2.4
Sep 29, 2024 06:19:53.814954996 CEST	49812	443	192.168.2.4	34.107.207.124
Sep 29, 2024 06:19:53.814986944 CEST	443	49812	34.107.207.124	192.168.2.4
Sep 29, 2024 06:19:53.815054893 CEST	49811	443	192.168.2.4	34.107.207.124
Sep 29, 2024 06:19:53.815061092 CEST	443	49811	34.107.207.124	192.168.2.4
Sep 29, 2024 06:19:53.816492081 CEST	443	49812	34.107.207.124	192.168.2.4
Sep 29, 2024 06:19:53.816553116 CEST	49812	443	192.168.2.4	34.107.207.124
Sep 29, 2024 06:19:53.817461014 CEST	49812	443	192.168.2.4	34.107.207.124
Sep 29, 2024 06:19:53.817552090 CEST	443	49812	34.107.207.124	192.168.2.4
Sep 29, 2024 06:19:53.858258963 CEST	49811	443	192.168.2.4	34.107.207.124
Sep 29, 2024 06:19:53.858264923 CEST	49812	443	192.168.2.4	34.107.207.124
Sep 29, 2024 06:19:53.858294964 CEST	443	49812	34.107.207.124	192.168.2.4
Sep 29, 2024 06:19:53.912053108 CEST	49812	443	192.168.2.4	34.107.207.124
Sep 29, 2024 06:19:53.939888000 CEST	443	49811	34.107.207.124	192.168.2.4
Sep 29, 2024 06:19:53.940141916 CEST	443	49811	34.107.207.124	192.168.2.4
Sep 29, 2024 06:19:53.940195084 CEST	49811	443	192.168.2.4	34.107.207.124
Sep 29, 2024 06:19:53.940646887 CEST	49811	443	192.168.2.4	34.107.207.124
Sep 29, 2024 06:19:53.940660000 CEST	443	49811	34.107.207.124	192.168.2.4
Sep 29, 2024 06:19:53.991349936 CEST	49812	443	192.168.2.4	34.107.207.124
Sep 29, 2024 06:19:54.008184910 CEST	443	49757	142.250.185.68	192.168.2.4
Sep 29, 2024 06:19:54.008272886 CEST	443	49757	142.250.185.68	192.168.2.4
Sep 29, 2024 06:19:54.008349895 CEST	49757	443	192.168.2.4	142.250.185.68
Sep 29, 2024 06:19:54.031423092 CEST	443	49812	34.107.207.124	192.168.2.4
Sep 29, 2024 06:19:54.117624998 CEST	443	49812	34.107.207.124	192.168.2.4
Sep 29, 2024 06:19:54.117805004 CEST	443	49812	34.107.207.124	192.168.2.4
Sep 29, 2024 06:19:54.117885113 CEST	49812	443	192.168.2.4	34.107.207.124
Sep 29, 2024 06:19:54.118308067 CEST	49812	443	192.168.2.4	34.107.207.124
Sep 29, 2024 06:19:54.118338108 CEST	443	49812	34.107.207.124	192.168.2.4
Sep 29, 2024 06:19:54.537187099 CEST	49757	443	192.168.2.4	142.250.185.68
Sep 29, 2024 06:19:54.537254095 CEST	443	49757	142.250.185.68	192.168.2.4
Sep 29, 2024 06:19:56.555347919 CEST	49723	80	192.168.2.4	93.184.221.240
Sep 29, 2024 06:19:56.571075916 CEST	80	49723	93.184.221.240	192.168.2.4
Sep 29, 2024 06:19:56.571145058 CEST	49723	80	192.168.2.4	93.184.221.240
Sep 29, 2024 06:20:27.219197989 CEST	49745	443	192.168.2.4	3.64.248.63
Sep 29, 2024 06:20:27.219214916 CEST	443	49745	3.64.248.63	192.168.2.4
Sep 29, 2024 06:20:41.939724922 CEST	443	49745	3.64.248.63	192.168.2.4
Sep 29, 2024 06:20:41.939924955 CEST	443	49745	3.64.248.63	192.168.2.4
Sep 29, 2024 06:20:41.939980030 CEST	49745	443	192.168.2.4	3.64.248.63
Sep 29, 2024 06:20:43.267648935 CEST	49745	443	192.168.2.4	3.64.248.63
Sep 29, 2024 06:20:43.267668962 CEST	443	49745	3.64.248.63	192.168.2.4
Sep 29, 2024 06:20:43.298372030 CEST	49818	443	192.168.2.4	142.250.185.68
Sep 29, 2024 06:20:43.298415899 CEST	443	49818	142.250.185.68	192.168.2.4
Sep 29, 2024 06:20:43.298485994 CEST	49818	443	192.168.2.4	142.250.185.68
Sep 29, 2024 06:20:43.299053907 CEST	49818	443	192.168.2.4	142.250.185.68
Sep 29, 2024 06:20:43.299066067 CEST	443	49818	142.250.185.68	192.168.2.4
Sep 29, 2024 06:20:43.994260073 CEST	443	49818	142.250.185.68	192.168.2.4
Sep 29, 2024 06:20:43.994585037 CEST	49818	443	192.168.2.4	142.250.185.68
Sep 29, 2024 06:20:43.994610071 CEST	443	49818	142.250.185.68	192.168.2.4
Sep 29, 2024 06:20:43.994947910 CEST	443	49818	142.250.185.68	192.168.2.4
Sep 29, 2024 06:20:43.995379925 CEST	49818	443	192.168.2.4	142.250.185.68
Sep 29, 2024 06:20:43.995451927 CEST	443	49818	142.250.185.68	192.168.2.4
Sep 29, 2024 06:20:44.047000885 CEST	49818	443	192.168.2.4	142.250.185.68
Sep 29, 2024 06:20:45.355756044 CEST	49724	80	192.168.2.4	93.184.221.240
Sep 29, 2024 06:20:45.365801096 CEST	80	49724	93.184.221.240	192.168.2.4
Sep 29, 2024 06:20:45.365875006 CEST	49724	80	192.168.2.4	93.184.221.240
Sep 29, 2024 06:20:53.873910904 CEST	443	49818	142.250.185.68	192.168.2.4
Sep 29, 2024 06:20:53.873980045 CEST	443	49818	142.250.185.68	192.168.2.4
Sep 29, 2024 06:20:53.874064922 CEST	49818	443	192.168.2.4	142.250.185.68
Sep 29, 2024 06:20:55.268299103 CEST	49818	443	192.168.2.4	142.250.185.68
Sep 29, 2024 06:20:55.268336058 CEST	443	49818	142.250.185.68	192.168.2.4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 29, 2024 06:19:39.056879044 CEST	53	57758	1.1.1.1	192.168.2.4
Sep 29, 2024 06:19:39.072823048 CEST	53	61214	1.1.1.1	192.168.2.4
Sep 29, 2024 06:19:40.160619974 CEST	53	59825	1.1.1.1	192.168.2.4
Sep 29, 2024 06:19:40.353938103 CEST	57752	53	192.168.2.4	1.1.1.1
Sep 29, 2024 06:19:40.358628035 CEST	49973	53	192.168.2.4	1.1.1.1
Sep 29, 2024 06:19:40.389987946 CEST	53	49973	1.1.1.1	192.168.2.4
Sep 29, 2024 06:19:40.529187918 CEST	53	57752	1.1.1.1	192.168.2.4
Sep 29, 2024 06:19:41.356128931 CEST	60126	53	192.168.2.4	1.1.1.1
Sep 29, 2024 06:19:41.356280088 CEST	53326	53	192.168.2.4	1.1.1.1
Sep 29, 2024 06:19:41.361685991 CEST	53	60927	1.1.1.1	192.168.2.4
Sep 29, 2024 06:19:41.363137960 CEST	57045	53	192.168.2.4	1.1.1.1
Sep 29, 2024 06:19:41.363289118 CEST	52968	53	192.168.2.4	1.1.1.1
Sep 29, 2024 06:19:41.371778011 CEST	53	52968	1.1.1.1	192.168.2.4
Sep 29, 2024 06:19:41.374074936 CEST	53	57045	1.1.1.1	192.168.2.4
Sep 29, 2024 06:19:42.670798063 CEST	64552	53	192.168.2.4	1.1.1.1
Sep 29, 2024 06:19:42.673285961 CEST	61176	53	192.168.2.4	1.1.1.1
Sep 29, 2024 06:19:43.250433922 CEST	64325	53	192.168.2.4	1.1.1.1
Sep 29, 2024 06:19:43.251214027 CEST	63638	53	192.168.2.4	1.1.1.1
Sep 29, 2024 06:19:43.292658091 CEST	53	64325	1.1.1.1	192.168.2.4
Sep 29, 2024 06:19:43.293303013 CEST	53	63638	1.1.1.1	192.168.2.4
Sep 29, 2024 06:19:53.321116924 CEST	58965	53	192.168.2.4	1.1.1.1
Sep 29, 2024 06:19:53.321378946 CEST	59843	53	192.168.2.4	1.1.1.1
Sep 29, 2024 06:19:53.330879927 CEST	53	59843	1.1.1.1	192.168.2.4
Sep 29, 2024 06:19:53.331912041 CEST	53	58965	1.1.1.1	192.168.2.4
Sep 29, 2024 06:19:56.938544989 CEST	138	138	192.168.2.4	192.168.2.255
Sep 29, 2024 06:19:57.734693050 CEST	53	51335	1.1.1.1	192.168.2.4
Sep 29, 2024 06:20:16.927903891 CEST	53	56664	1.1.1.1	192.168.2.4
Sep 29, 2024 06:20:38.299267054 CEST	53	51944	1.1.1.1	192.168.2.4
Sep 29, 2024 06:20:39.762619972 CEST	53	59064	1.1.1.1	192.168.2.4

Timestamp	Bytes transferred	Direction	Data
2024-09-29 04:19:41 UTC	674	OUT	GET / HTTP/1.1 Host: kucoinlloiinn8.godaddysites.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-29 04:19:41 UTC	1814	IN	HTTP/1.1 200 OK Link: <//img1.wsimg.com/ceph-p3-01/website-builder-data-prod/static/widgets/UX.4.28.12.js>; rel=preload; as=script; crossorigin,<https://img1.wsimg.com/gfonts/s/playfairdisplay/v37/nuFiD-vYSZviVYUb_rj3ij__anPXDTzYgA.woff2>; rel=preload; as=font; crossorigin,<https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZMkids18Q.woff2>; rel=preload; as=font; crossorigin,<https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK1dSBYKcSV-LCoeQqfX1RYOo3qPZ7nsDI.woff2>; rel=preload; as=font; crossorigin,<https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZclSds18Q.woff2>; rel=preload; as=font; crossorigin,<https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zwlxdu.woff2>; rel=preload; as=font; crossorigin,<https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2>; rel=preload; as=font; crossorigin,<https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu.woff2>; rel=preload; as=fon [TRUNCATED] Cache-Control: max-age=30 Content-Security-Policy: frame-ancestors 'self' godaddy.com *.godaddy.com Content-Type: text/html;charset=utf-8 Vary: Accept-Encoding Server: DPS/2.0.0+sha-227ca78 X-Version: 227ca78 X-SiteId: us-east-1 Set-Cookie: dps_site_id=us-east-1; path=/; secure ETag: f2c4a5dda2674cf94a168d9572a94b1e Date: Sun, 29 Sep 2024 04:19:41 GMT Connection: close Transfer-Encoding: chunked
2024-09-29 04:19:41 UTC	14570	IN	Data Raw: 61 32 63 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 49 4e 22 3e 3c 68 65 61 64 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 2f 69 6d 67 31 2e 77 73 69 6d 67 2e 63 6f 6d 2f 69 73 74 65 61 6d 2f 69 70 2f 32 33 39 32 63 32 64 37 2d 38 30 38 35 2d 34 30 35 33 2d 39 36 64 64 2d 31 30 65 64 65 37 38 63 64 37 64 39 2f 66 61 76 69 63 6f 6e 2f 66 37 31 32 31 35 34 31 2d 62 63 34 64 2d 34 31 35 35 2d 39 61 37 39 2d 30 32 62 63 37 36 32 32 62 65 36 34 2e 70 6e 67 2f 3a 2f 72 73 3d 77 3a 31 36 2c 68 3a 31 36 2c 6d 22 20 73 69 7a 65 73 3d 22 31 36 78 31 36 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 2f 69 6d 67 31 2e 77 73 69 6d 67 2e 63 6f 6d 2f Data Ascii: a2cf<!DOCTYPE html><html lang="en-IN"><head><link rel="icon" href="//img1.wsimg.com/isteam/ip/2392c2d7-8085-4053-96dd-10ede78cd7d9/favicon/f7121541-bc4d-4155-9a79-02bc7622be64.png/:/rs=w:16,h:16,m" sizes="16x16"/><link rel="icon" href="//img1.wsimg.com/
2024-09-29 04:19:41 UTC	16384	IN	Data Raw: 6e 74 73 2f 73 2f 73 6f 75 72 63 65 73 61 6e 73 70 72 6f 2f 76 32 32 2f 36 78 4b 77 64 53 42 59 4b 63 53 56 2d 4c 43 6f 65 51 71 66 58 31 52 59 4f 6f 33 71 50 5a 5a 63 6c 53 64 67 31 38 53 6d 78 67 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 31 46 30 30 2d 31 46 46 46 3b 0a 7d 0a 2f 2a 20 67 72 65 65 6b 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 53 6f 75 72 63 65 20 53 61 6e 73 20 50 72 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 69 74 61 6c 69 63 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 37 30 30 3b 0a 20 20 66 6f 6e 74 2d 64 69 73 70 6c 61 79 3a 20 73 77 61 70 3b 0a 20 20 73 72 63 3a 20 75 72 Data Ascii: nts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZclSdg18Smxg.woff2) format('woff2'); unicode-range: U+1F00-1FFF;}/* greek */@font-face { font-family: 'Source Sans Pro'; font-style: italic; font-weight: 700; font-display: swap; src: ur
2024-09-29 04:19:41 UTC	10738	IN	Data Raw: 3a 73 63 61 6c 65 28 2e 31 29 3b 6f 70 61 63 69 74 79 3a 2e 37 7d 38 30 25 7b 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 31 29 3b 6f 70 61 63 69 74 79 3a 31 7d 7d 2e 78 2d 6c 6f 61 64 65 72 20 73 76 67 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 7d 2e 78 2d 6c 6f 61 64 65 72 20 73 76 67 3a 66 69 72 73 74 2d 63 68 69 6c 64 7b 2d 77 65 62 6b 69 74 2d 61 6e 69 6d 61 74 69 6f 6e 3a 6c 6f 61 64 65 72 73 63 61 6c 65 20 2e 37 35 73 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 2e 32 2c 2e 36 38 2c 2e 31 38 2c 31 2e 30 38 29 20 2d 2e 32 34 73 20 69 6e 66 69 6e 69 74 65 3b 61 6e 69 6d 61 74 69 6f 6e 3a 6c 6f 61 64 65 72 73 63 61 6c 65 20 2e 37 35 73 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 2e 32 2c 2e 36 38 2c 2e 31 38 2c 31 2e 30 38 29 20 2d Data Ascii: :scale(.1);opacity:.7}80%{transform:scale(1);opacity:1}}.x-loader svg{display:inline-block}.x-loader svg:first-child{-webkit-animation:loaderscale .75s cubic-bezier(.2,.68,.18,1.08) -.24s infinite;animation:loaderscale .75s cubic-bezier(.2,.68,.18,1.08) -

Timestamp	Bytes transferred	Direction	Data
2024-09-29 04:19:45 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-09-29 04:19:45 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF67) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=131117 Date: Sun, 29 Sep 2024 04:19:45 GMT Connection: close X-CID: 2

Timestamp	Bytes transferred	Direction	Data
2024-09-29 04:19:46 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-09-29 04:19:47 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=131146 Date: Sun, 29 Sep 2024 04:19:46 GMT Content-Length: 55 Connection: close X-CID: 2
2024-09-29 04:19:47 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Timestamp	Bytes transferred	Direction	Data
2024-09-29 04:19:49 UTC	514	OUT	GET /sw.js HTTP/1.1 Host: kucoinlloiinn8.godaddysites.com Connection: keep-alive Cache-Control: max-age=0 Accept: / Service-Worker: script Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: serviceworker Referer: https://kucoinlloiinn8.godaddysites.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: dps_site_id=us-east-1
2024-09-29 04:19:49 UTC	663	IN	HTTP/1.1 200 OK Link: <https://fonts.googleapis.com>; rel=preconnect; crossorigin,<https://fonts.gstatic.com>; rel=preconnect; crossorigin,<https://img1.wsimg.com>; rel=preconnect; crossorigin,<https://isteam.wsimg.com>; rel=preconnect; crossorigin Cache-Control: max-age=30 Content-Security-Policy: frame-ancestors 'self' godaddy.com *.godaddy.com Content-Type: application/javascript Vary: Accept-Encoding Server: DPS/2.0.0+sha-227ca78 X-Version: 227ca78 X-SiteId: us-east-1 Set-Cookie: dps_site_id=us-east-1; path=/; secure ETag: b388c18392b5c76b6cacc4e4cb7518f5 Date: Sun, 29 Sep 2024 04:19:49 GMT Connection: close Transfer-Encoding: chunked
2024-09-29 04:19:49 UTC	15721	IN	Data Raw: 38 30 62 61 0d 0a 28 28 29 3d 3e 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 65 3d 7b 38 39 35 3a 28 29 3d 3e 7b 74 72 79 7b 73 65 6c 66 5b 22 77 6f 72 6b 62 6f 78 3a 63 61 63 68 65 61 62 6c 65 2d 72 65 73 70 6f 6e 73 65 3a 36 2e 34 2e 31 22 5d 26 26 5f 28 29 7d 63 61 74 63 68 28 65 29 7b 7d 7d 2c 32 35 39 3a 28 65 2c 74 2c 73 29 3d 3e 7b 73 2e 64 28 74 2c 7b 42 3a 28 29 3d 3e 61 7d 29 2c 73 28 39 31 33 29 3b 63 6c 61 73 73 20 61 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 29 7b 74 68 69 73 2e 70 72 6f 6d 69 73 65 3d 6e 65 77 20 50 72 6f 6d 69 73 65 28 28 28 65 2c 74 29 3d 3e 7b 74 68 69 73 2e 72 65 73 6f 6c 76 65 3d 65 2c 74 68 69 73 2e 72 65 6a 65 63 74 3d 74 7d 29 29 7d 7d 7d 2c 31 32 35 3a 28 65 2c 74 2c 73 29 3d 3e 7b 73 2e 64 28 74 2c 7b 56 3a Data Ascii: 80ba(()=>{"use strict";var e={895:()=>{try{self["workbox:cacheable-response:6.4.1"]&&_()}catch(e){}},259:(e,t,s)=>{s.d(t,{B:()=>a}),s(913);class a{constructor(){this.promise=new Promise(((e,t)=>{this.resolve=e,this.reject=t}))}}},125:(e,t,s)=>{s.d(t,{V:
2024-09-29 04:19:49 UTC	16384	IN	Data Raw: 65 2c 74 29 7c 7c 52 2e 68 61 73 28 65 2c 74 29 7d 2c 73 28 35 35 30 29 3b 63 6f 6e 73 74 20 76 3d 22 63 61 63 68 65 2d 65 6e 74 72 69 65 73 22 2c 62 3d 65 3d 3e 7b 63 6f 6e 73 74 20 74 3d 6e 65 77 20 55 52 4c 28 65 2c 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 29 3b 72 65 74 75 72 6e 20 74 2e 68 61 73 68 3d 22 22 2c 74 2e 68 72 65 66 7d 3b 63 6c 61 73 73 20 78 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 65 29 7b 74 68 69 73 2e 5f 64 62 3d 6e 75 6c 6c 2c 74 68 69 73 2e 5f 63 61 63 68 65 4e 61 6d 65 3d 65 7d 5f 75 70 67 72 61 64 65 44 62 28 65 29 7b 63 6f 6e 73 74 20 74 3d 65 2e 63 72 65 61 74 65 4f 62 6a 65 63 74 53 74 6f 72 65 28 76 2c 7b 6b 65 79 50 61 74 68 3a 22 69 64 22 7d 29 3b 74 2e 63 72 65 61 74 65 49 6e 64 65 78 28 22 63 61 63 68 65 4e 61 6d 65 22 2c 22 Data Ascii: e,t)\|\|R.has(e,t)},s(550);const v="cache-entries",b=e=>{const t=new URL(e,location.href);return t.hash="",t.href};class x{constructor(e){this._db=null,this._cacheName=e}_upgradeDb(e){const t=e.createObjectStore(v,{keyPath:"id"});t.createIndex("cacheName","
2024-09-29 04:19:49 UTC	862	IN	Data Raw: 7b 72 65 71 75 65 73 74 3a 65 7d 29 3d 3e 22 73 74 79 6c 65 22 3d 3d 3d 65 2e 64 65 73 74 69 6e 61 74 69 6f 6e 7c 7c 22 73 63 72 69 70 74 22 3d 3d 3d 65 2e 64 65 73 74 69 6e 61 74 69 6f 6e 29 2c 6e 65 77 20 74 2e 53 74 61 6c 65 57 68 69 6c 65 52 65 76 61 6c 69 64 61 74 65 28 7b 63 61 63 68 65 4e 61 6d 65 3a 22 73 74 61 74 69 63 2d 72 65 73 6f 75 72 63 65 73 22 2c 70 6c 75 67 69 6e 73 3a 5b 6e 65 77 20 61 2e 43 61 63 68 65 61 62 6c 65 52 65 73 70 6f 6e 73 65 50 6c 75 67 69 6e 28 7b 73 74 61 74 75 73 65 73 3a 5b 32 30 30 5d 7d 29 5d 7d 29 29 2c 28 30 2c 65 2e 72 65 67 69 73 74 65 72 52 6f 75 74 65 29 28 28 28 7b 75 72 6c 3a 65 7d 29 3d 3e 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 22 3d 3d 3d 65 2e 6f 72 69 67 69 Data Ascii: {request:e})=>"style"===e.destination\|\|"script"===e.destination),new t.StaleWhileRevalidate({cacheName:"static-resources",plugins:[new a.CacheableResponsePlugin({statuses:[200]})]})),(0,e.registerRoute)((({url:e})=>"https://fonts.googleapis.com"===e.origi

Timestamp	Bytes transferred	Direction	Data
2024-09-29 04:19:49 UTC	566	OUT	GET /manifest.webmanifest HTTP/1.1 Host: kucoinlloiinn8.godaddysites.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: manifest Referer: https://kucoinlloiinn8.godaddysites.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-29 04:19:49 UTC	666	IN	HTTP/1.1 200 OK Link: <https://fonts.googleapis.com>; rel=preconnect; crossorigin,<https://fonts.gstatic.com>; rel=preconnect; crossorigin,<https://img1.wsimg.com>; rel=preconnect; crossorigin,<https://isteam.wsimg.com>; rel=preconnect; crossorigin Cache-Control: max-age=30 Content-Security-Policy: frame-ancestors 'self' godaddy.com *.godaddy.com Content-Type: application/manifest+json Vary: Accept-Encoding Server: DPS/2.0.0+sha-227ca78 X-Version: 227ca78 X-SiteId: us-east-1 Set-Cookie: dps_site_id=us-east-1; path=/; secure ETag: b74f396517b460a53b6c134f5a80aafa Date: Sun, 29 Sep 2024 04:19:49 GMT Connection: close Transfer-Encoding: chunked
2024-09-29 04:19:49 UTC	537	IN	Data Raw: 32 30 64 0d 0a 7b 22 73 63 6f 70 65 22 3a 22 2f 22 2c 22 73 74 61 72 74 5f 75 72 6c 22 3a 22 2f 22 2c 22 64 69 73 70 6c 61 79 22 3a 22 73 74 61 6e 64 61 6c 6f 6e 65 22 2c 22 69 63 6f 6e 73 22 3a 5b 7b 22 73 69 7a 65 73 22 3a 22 31 39 32 78 31 39 32 22 2c 22 74 79 70 65 22 3a 22 69 6d 61 67 65 2f 70 6e 67 22 2c 22 73 72 63 22 3a 22 2f 2f 69 6d 67 31 2e 77 73 69 6d 67 2e 63 6f 6d 2f 69 73 74 65 61 6d 2f 69 70 2f 32 33 39 32 63 32 64 37 2d 38 30 38 35 2d 34 30 35 33 2d 39 36 64 64 2d 31 30 65 64 65 37 38 63 64 37 64 39 2f 66 61 76 69 63 6f 6e 2f 66 37 31 32 31 35 34 31 2d 62 63 34 64 2d 34 31 35 35 2d 39 61 37 39 2d 30 32 62 63 37 36 32 32 62 65 36 34 2e 70 6e 67 2f 3a 2f 72 73 3d 77 3a 31 39 32 2c 68 3a 31 39 32 2c 6d 22 7d 2c 7b 22 73 69 7a 65 73 22 3a 22 Data Ascii: 20d{"scope":"/","start_url":"/","display":"standalone","icons":[{"sizes":"192x192","type":"image/png","src":"//img1.wsimg.com/isteam/ip/2392c2d7-8085-4053-96dd-10ede78cd7d9/favicon/f7121541-bc4d-4155-9a79-02bc7622be64.png/:/rs=w:192,h:192,m"},{"sizes":"

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://kucoinlloiinn8.godaddysites.com/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Chrome Cache Entry: 113

Chrome Cache Entry: 114

Chrome Cache Entry: 115

Chrome Cache Entry: 116

Chrome Cache Entry: 117

Chrome Cache Entry: 118

Chrome Cache Entry: 119

Chrome Cache Entry: 120

Chrome Cache Entry: 121

Chrome Cache Entry: 122

Chrome Cache Entry: 123

Chrome Cache Entry: 124

Chrome Cache Entry: 125

Chrome Cache Entry: 126

Windows Analysis Report
https://kucoinlloiinn8.godaddysites.com/

Timestamp	Bytes transferred	Direction	Data
2024-09-29 04:19:53 UTC	639	OUT	GET /eJlMkP-Oo HTTP/1.1 Host: gtly.to Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-29 04:19:53 UTC	437	IN	HTTP/1.1 404 Not Found x-powered-by: Express cache-control: private, no-cache, no-store, must-revalidate referer: content-type: text/html; charset=utf-8 etag: W/"188-ze4DTuXMy5nJCVqsdQu1C2/PUow" X-Cloud-Trace-Context: cc740df0aacdf594fafba7995bd47ffc Date: Sun, 29 Sep 2024 04:19:53 GMT Server: Google Frontend Content-Length: 392 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-09-29 04:19:53 UTC	392	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 73 77 2d 77 73 30 74 36 75 68 36 67 64 79 6e 35 31 76 6e 36 6d 71 77 6c 65 36 32 33 76 36 78 6e 6e 6c 6e 78 79 6a 34 69 62 78 6e 39 6e 65 35 76 6b 36 74 6e 38 61 72 71 6a 76 35 75 61 38 77 37 2d 6f 33 71 30 66 6e 77 71 6c 65 39 64 67 37 73 6f 30 79 6d 39 33 6f 6e 34 30 74 6e 61 66 35 35 74 37 67 78 6d 77 65 6a 39 7a 64 30 39 72 68 70 73 76 34 72 70 73 33 6d 31 31 33 70 79 62 67 35 69 68 62 2c 20 6e 73 77 2d 65 38 71 69 68 6f 72 30 6b 62 70 6d 36 65 32 38 33 61 67 75 6d 77 79 36 38 32 67 64 77 7a 68 6a 70 66 73 61 61 71 38 37 66 6a 6e 6a 6a 6b 6a 6c 73 35 31 32 34 74 34 79 71 31 61 34 38 2d 34 39 36 2d 75 34 6d 77 39 75 38 2d Data Ascii: <html><head><meta name="keywords" content="nsw-ws0t6uh6gdyn51vn6mqwle623v6xnnlnxyj4ibxn9ne5vk6tn8arqjv5ua8w7-o3q0fnwqle9dg7so0ym93on40tnaf55t7gxmwej9zd09rhpsv4rps3m113pybg5ihb, nsw-e8qihor0kbpm6e283agumwy682gdwzhjpfsaaq87fjnjjkjls5124t4yq1a48-496-u4mw9u8-

Timestamp	Bytes transferred	Direction	Data
2024-09-29 04:19:53 UTC	579	OUT	GET /favicon.ico HTTP/1.1 Host: gtly.to Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://gtly.to/eJlMkP-Oo Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-29 04:19:54 UTC	426	IN	HTTP/1.1 404 Not Found x-powered-by: Express cache-control: private, no-cache, no-store, must-revalidate content-type: text/html; charset=utf-8 etag: W/"188-ze4DTuXMy5nJCVqsdQu1C2/PUow" X-Cloud-Trace-Context: 8efbab38335ad929a7116948115b7d05 Date: Sun, 29 Sep 2024 04:19:54 GMT Server: Google Frontend Content-Length: 392 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-09-29 04:19:54 UTC	392	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 73 77 2d 77 73 30 74 36 75 68 36 67 64 79 6e 35 31 76 6e 36 6d 71 77 6c 65 36 32 33 76 36 78 6e 6e 6c 6e 78 79 6a 34 69 62 78 6e 39 6e 65 35 76 6b 36 74 6e 38 61 72 71 6a 76 35 75 61 38 77 37 2d 6f 33 71 30 66 6e 77 71 6c 65 39 64 67 37 73 6f 30 79 6d 39 33 6f 6e 34 30 74 6e 61 66 35 35 74 37 67 78 6d 77 65 6a 39 7a 64 30 39 72 68 70 73 76 34 72 70 73 33 6d 31 31 33 70 79 62 67 35 69 68 62 2c 20 6e 73 77 2d 65 38 71 69 68 6f 72 30 6b 62 70 6d 36 65 32 38 33 61 67 75 6d 77 79 36 38 32 67 64 77 7a 68 6a 70 66 73 61 61 71 38 37 66 6a 6e 6a 6a 6b 6a 6c 73 35 31 32 34 74 34 79 71 31 61 34 38 2d 34 39 36 2d 75 34 6d 77 39 75 38 2d Data Ascii: <html><head><meta name="keywords" content="nsw-ws0t6uh6gdyn51vn6mqwle623v6xnnlnxyj4ibxn9ne5vk6tn8arqjv5ua8w7-o3q0fnwqle9dg7so0ym93on40tnaf55t7gxmwej9zd09rhpsv4rps3m113pybg5ihb, nsw-e8qihor0kbpm6e283agumwy682gdwzhjpfsaaq87fjnjjkjls5124t4yq1a48-496-u4mw9u8-

Target ID:	0
Start time:	00:19:34
Start date:	29/09/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	2
Start time:	00:19:37
Start date:	29/09/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2504 --field-trial-handle=2340,i,1429752358186918888,16718431658222597420,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	3
Start time:	00:19:39
Start date:	29/09/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://kucoinlloiinn8.godaddysites.com/"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre