Edit tour

Windows Analysis Report
https://olenabeautymassage.com/

Overview

General Information

Sample URL:	https://olenabeautymassage.com/
Analysis ID:	1522240
Tags:	urlscan
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

No high impact signatures.

Classification

Process Tree

System is w10x64

chrome.exe (PID: 6724 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 3776 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=2008,i,10375255892087321134,2251210952332873724,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 2016 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://olenabeautymassage.com/" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

HTTP traffic detected: HTTP/1.1 404 Not FoundLink: <//img1.wsimg.com/ceph-p3-01/website-builder-data-prod/static/widgets/UX.4.43.14.js>; rel=preload; as=script; crossorigin,<https://img1.wsimg.com/gfonts/s/playfairdisplay/v37/nuFiD-vYSZviVYUb_rj3ij__anPXDTzYgA.woff2>; rel=preload; as=font; crossorigin,<https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZMkids18Q.woff2>; rel=preload; as=font; crossorigin,<https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK1dSBYKcSV-LCoeQqfX1RYOo3qPZ7nsDI.woff2>; rel=preload; as=font; crossorigin,<https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZclSds18Q.woff2>; rel=preload; as=font; crossorigin,<https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zwlxdu.woff2>; rel=preload; as=font; crossorigin,<https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2>; rel=preload; as=font; crossorigin,<https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu.woff2>; rel=preload; as=font; crossorigin,<https://img1.wsimg.com/gfonts/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2>; rel=preload; as=font; crossorigin,<https://fonts.googleapis.com>; rel=preconnect; crossorigin,<https://fonts.gstatic.com>; rel=preconnect; crossorigin,<https://img1.wsimg.com>; rel=preconnect; crossorigin,<https://isteam.wsimg.com>; rel=preconnect; crossoriginCache-Control: max-age=30Content-Security-Policy: frame-ancestors 'self' godaddy.com *.godaddy.comContent-Type: text/html;charset=utf-8Vary: Accept-EncodingServer: DPS/2.0.0+sha-227ca78X-Version: 227ca78X-SiteId: us-east-1Set-Cookie: dps_site_id=us-east-1; path=/; secureDate: Sun, 29 Sep 2024 13:12:24 GMTConnection: closeTransfer-Encoding: chunked

Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49841 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49846 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: olenabeautymassage.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /markup/ad HTTP/1.1Host: olenabeautymassage.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://olenabeautymassage.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: dps_site_id=us-east-1
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /markup/ad HTTP/1.1Host: olenabeautymassage.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: dps_site_id=us-east-1
Source: global traffic	HTTP traffic detected: GET /i.gif?e=eyJ2IjoiMS4xMiIsImF2IjoxMzc5NjY0LCJhdCI6MjQ0NywiYnQiOjAsImNtIjozNjk2NjY5OTcsImNoIjo1NDQ0NSwiY2siOnt9LCJjciI6NDA4ODkzMDIyLCJkaSI6IjQ4MTdlZGUxMWI4ODRmMDNhNThiYzEyOWJiYmQwNjg1IiwiZGoiOjAsImlpIjoiNWE2ZWQ5ODc0NjBhNDVhOWEwNWVmOTMyMDBiMzhiNDIiLCJkbSI6MywiZmMiOjU4Mzk1MjEyMywiZmwiOjU3MTk5NDU0MywiaXAiOiI2NC4yMDIuMTYwLjAiLCJrdyI6Int7a2V5d29yZH19IiwibnciOjEwNjYzLCJwYyI6MCwib3AiOjAsIm1wIjowLCJlYyI6MCwiZ20iOjAsImVwIjpudWxsLCJwciI6MjE4NDY1LCJydCI6MSwicnMiOjUwMCwic2EiOiI1MiIsInNiIjoiaS0wYjQ5OTg3NDE5ODVjNWJmNiIsInNwIjoyNzg2MDc3LCJzdCI6MTI3NjI2NCwidWsiOiJ1ZTEtMzcxZTI0ZTY0YjY1NGI2NzliNGI0YTg4ZTIzZGE1Y2UiLCJ6biI6MzA3NDk1LCJ0cyI6MTcyNzYxNTUzNjk5OSwicG4iOiJ3YW0iLCJnYyI6dHJ1ZSwiZ0MiOnRydWUsImdzIjoibm9uZSIsImRjIjoxLCJ0eiI6IlVUQyIsImJhIjoxLCJmcSI6MH0&s=-CgtbmeDyX5vJammdiu-9EFVU68&publisher_website_key=wam.md5.908adad984e9c56ed39cdfb2219769b5 HTTP/1.1Host: ms.godaddy.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://olenabeautymassage.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /i.gif?e=eyJ2IjoiMS4xMiIsImF2IjoxMzc5NjY0LCJhdCI6MjQ0NywiYnQiOjAsImNtIjozNjk2NjY5OTcsImNoIjo1NDQ0NSwiY2siOnt9LCJjciI6NDA4ODkzMDIyLCJkaSI6IjQ4MTdlZGUxMWI4ODRmMDNhNThiYzEyOWJiYmQwNjg1IiwiZGoiOjAsImlpIjoiNWE2ZWQ5ODc0NjBhNDVhOWEwNWVmOTMyMDBiMzhiNDIiLCJkbSI6MywiZmMiOjU4Mzk1MjEyMywiZmwiOjU3MTk5NDU0MywiaXAiOiI2NC4yMDIuMTYwLjAiLCJrdyI6Int7a2V5d29yZH19IiwibnciOjEwNjYzLCJwYyI6MCwib3AiOjAsIm1wIjowLCJlYyI6MCwiZ20iOjAsImVwIjpudWxsLCJwciI6MjE4NDY1LCJydCI6MSwicnMiOjUwMCwic2EiOiI1MiIsInNiIjoiaS0wYjQ5OTg3NDE5ODVjNWJmNiIsInNwIjoyNzg2MDc3LCJzdCI6MTI3NjI2NCwidWsiOiJ1ZTEtMzcxZTI0ZTY0YjY1NGI2NzliNGI0YTg4ZTIzZGE1Y2UiLCJ6biI6MzA3NDk1LCJ0cyI6MTcyNzYxNTUzNjk5OSwicG4iOiJ3YW0iLCJnYyI6dHJ1ZSwiZ0MiOnRydWUsImdzIjoibm9uZSIsImRjIjoxLCJ0eiI6IlVUQyIsImJhIjoxLCJmcSI6MH0&s=-CgtbmeDyX5vJammdiu-9EFVU68&publisher_website_key=wam.md5.908adad984e9c56ed39cdfb2219769b5 HTTP/1.1Host: ms.godaddy.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: azk=ue1-371e24e64b654b679b4b4a88e23da5ce; azk-ss=true
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: olenabeautymassage.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://olenabeautymassage.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: dps_site_id=us-east-1; _tccl_visitor=3893fdf1-a3a4-4c4d-b14a-ad1f86a90c6b; _tccl_visit=3893fdf1-a3a4-4c4d-b14a-ad1f86a90c6b; _scc_session=pc=1&C_TOUCH=2024-09-29T13:12:17.385Z
Source: global traffic	HTTP traffic detected: GET /sw.js HTTP/1.1Host: olenabeautymassage.comConnection: keep-aliveCache-Control: max-age=0Accept: /Service-Worker: scriptSec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: serviceworkerReferer: https://olenabeautymassage.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: dps_site_id=us-east-1; _tccl_visitor=3893fdf1-a3a4-4c4d-b14a-ad1f86a90c6b; _tccl_visit=3893fdf1-a3a4-4c4d-b14a-ad1f86a90c6b; _scc_session=pc=1&C_TOUCH=2024-09-29T13:12:17.385Z
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: olenabeautymassage.comConnection: keep-alivePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://olenabeautymassage.com/sw.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: dps_site_id=us-east-1; _tccl_visitor=3893fdf1-a3a4-4c4d-b14a-ad1f86a90c6b; _tccl_visit=3893fdf1-a3a4-4c4d-b14a-ad1f86a90c6b; _scc_session=pc=1&C_TOUCH=2024-09-29T13:12:17.385Z
Source: global traffic	HTTP traffic detected: GET /manifest.webmanifest HTTP/1.1Host: olenabeautymassage.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: manifestReferer: https://olenabeautymassage.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: olenabeautymassage.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: img1.wsimg.com
Source: global traffic	DNS traffic detected: DNS query: isteam.wsimg.com
Source: global traffic	DNS traffic detected: DNS query: ms.godaddy.com
Source: global traffic	DNS traffic detected: DNS query: events.api.secureserver.net
Source: global traffic	DNS traffic detected: DNS query: csp.secureserver.net
Source: global traffic	DNS traffic detected: DNS query: www.godaddy.com

Source: chromecache_159.2.dr, chromecache_168.2.dr	String found in binary or memory: http://jedwatson.github.io/classnames
Source: chromecache_132.2.dr, chromecache_126.2.dr	String found in binary or memory: http://scripts.sil.org/OFL
Source: chromecache_132.2.dr, chromecache_126.2.dr	String found in binary or memory: https://github.com/JulietaUla/Montserrat)
Source: chromecache_132.2.dr, chromecache_126.2.dr	String found in binary or memory: https://github.com/clauseggers/Playfair-Display)
Source: chromecache_132.2.dr, chromecache_126.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459W1hyzbi.woff2)
Source: chromecache_132.2.dr, chromecache_126.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459WRhyzbi.woff2)
Source: chromecache_132.2.dr, chromecache_126.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459WZhyzbi.woff2)
Source: chromecache_132.2.dr, chromecache_126.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459Wdhyzbi.woff2)
Source: chromecache_132.2.dr, chromecache_126.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2)
Source: chromecache_132.2.dr, chromecache_126.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/playfairdisplay/v37/nuFiD-vYSZviVYUb_rj3ij__anPXDTLYgFE_.woff2)
Source: chromecache_132.2.dr, chromecache_126.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/playfairdisplay/v37/nuFiD-vYSZviVYUb_rj3ij__anPXDTPYgFE_.woff2)
Source: chromecache_132.2.dr, chromecache_126.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/playfairdisplay/v37/nuFiD-vYSZviVYUb_rj3ij__anPXDTjYgFE_.woff2)
Source: chromecache_132.2.dr, chromecache_126.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/playfairdisplay/v37/nuFiD-vYSZviVYUb_rj3ij__anPXDTzYgA.woff2)
Source: chromecache_132.2.dr, chromecache_126.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK1dSBYKcSV-LCoeQqfX1RYOo3qPZ7jsDJT9g.woff2)
Source: chromecache_132.2.dr, chromecache_126.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK1dSBYKcSV-LCoeQqfX1RYOo3qPZ7ksDJT9g.woff2)
Source: chromecache_132.2.dr, chromecache_126.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK1dSBYKcSV-LCoeQqfX1RYOo3qPZ7nsDI.woff2)
Source: chromecache_132.2.dr, chromecache_126.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK1dSBYKcSV-LCoeQqfX1RYOo3qPZ7osDJT9g.woff2)
Source: chromecache_132.2.dr, chromecache_126.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK1dSBYKcSV-LCoeQqfX1RYOo3qPZ7psDJT9g.woff2)
Source: chromecache_132.2.dr, chromecache_126.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK1dSBYKcSV-LCoeQqfX1RYOo3qPZ7qsDJT9g.woff2)
Source: chromecache_132.2.dr, chromecache_126.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK1dSBYKcSV-LCoeQqfX1RYOo3qPZ7rsDJT9g.woff2)
Source: chromecache_132.2.dr, chromecache_126.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qN67lqDY.woff2)
Source: chromecache_132.2.dr, chromecache_126.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qNK7lqDY.woff2)
Source: chromecache_132.2.dr, chromecache_126.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qNa7lqDY.woff2)
Source: chromecache_132.2.dr, chromecache_126.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qNq7lqDY.woff2)
Source: chromecache_132.2.dr, chromecache_126.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qO67lqDY.woff2)
Source: chromecache_132.2.dr, chromecache_126.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2)
Source: chromecache_132.2.dr, chromecache_126.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qPK7lqDY.woff2)
Source: chromecache_132.2.dr, chromecache_126.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZMkidg18Smxg.woff2)
Source: chromecache_132.2.dr, chromecache_126.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZMkidh18Smxg.woff2)
Source: chromecache_132.2.dr, chromecache_126.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZMkidi18Smxg.woff2)
Source: chromecache_132.2.dr, chromecache_126.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZMkidj18Smxg.woff2)
Source: chromecache_132.2.dr, chromecache_126.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZMkido18Smxg.woff2)
Source: chromecache_132.2.dr, chromecache_126.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZMkids18Q.woff2)
Source: chromecache_132.2.dr, chromecache_126.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZMkidv18Smxg.woff2)
Source: chromecache_132.2.dr, chromecache_126.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZclSdg18Smxg.woff2)
Source: chromecache_132.2.dr, chromecache_126.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZclSdh18Smxg.woff2)
Source: chromecache_132.2.dr, chromecache_126.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZclSdi18Smxg.woff2)
Source: chromecache_132.2.dr, chromecache_126.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZclSdj18Smxg.woff2)
Source: chromecache_132.2.dr, chromecache_126.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZclSdo18Smxg.woff2)
Source: chromecache_132.2.dr, chromecache_126.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZclSds18Q.woff2)
Source: chromecache_132.2.dr, chromecache_126.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZclSdv18Smxg.woff2)
Source: chromecache_132.2.dr, chromecache_126.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwkxduz8A.woff2)
Source: chromecache_132.2.dr, chromecache_126.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlBduz8A.woff2)
Source: chromecache_132.2.dr, chromecache_126.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu.woff2)
Source: chromecache_132.2.dr, chromecache_126.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwmBduz8A.woff2)
Source: chromecache_132.2.dr, chromecache_126.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwmRduz8A.woff2)
Source: chromecache_132.2.dr, chromecache_126.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwmhduz8A.woff2)
Source: chromecache_132.2.dr, chromecache_126.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwmxduz8A.woff2)
Source: chromecache_132.2.dr, chromecache_126.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zwkxduz8A.woff2)
Source: chromecache_132.2.dr, chromecache_126.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zwlBduz8A.woff2)
Source: chromecache_132.2.dr, chromecache_126.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zwlxdu.woff2)
Source: chromecache_132.2.dr, chromecache_126.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zwmBduz8A.woff2)
Source: chromecache_132.2.dr, chromecache_126.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zwmRduz8A.woff2)
Source: chromecache_132.2.dr, chromecache_126.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zwmhduz8A.woff2)
Source: chromecache_132.2.dr, chromecache_126.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zwmxduz8A.woff2)
Source: chromecache_126.2.dr	String found in binary or memory: https://img1.wsimg.com/isteam/stock/xq8VlAd
Source: chromecache_125.2.dr, chromecache_161.2.dr	String found in binary or memory: https://ms.godaddy.com/i.gif?e=eyJ2IjoiMS4xMiIsImF2IjoxMzc5NjY0LCJhdCI6MjQ0NywiYnQiOjAsImNtIjoz
Source: chromecache_125.2.dr, chromecache_161.2.dr	String found in binary or memory: https://ms.godaddy.com/r?e=eyJ2IjoiMS4xMiIsImF2IjoxMzc5NjY0LCJhdCI6MjQ0NywiYnQiOjAsImNtIjozNjk2
Source: chromecache_132.2.dr	String found in binary or memory: https://olenabeautymassage.com/
Source: chromecache_126.2.dr	String found in binary or memory: https://olenabeautymassage.com/404

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=2008,i,10375255892087321134,2251210952332873724,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://olenabeautymassage.com/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=2008,i,10375255892087321134,2251210952332873724,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label	Link
http://jedwatson.github.io/classnames	0%	URL Reputation	safe
http://scripts.sil.org/OFL	0%	URL Reputation	safe

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	unknown
olenabeautymassage.com	76.223.105.230	true	false	unknown
e-prod-alb-s102-eu-west-1-02.adzerk.net	52.208.82.82	true	false	unknown
www.google.com	216.58.206.36	true	false	unknown
isteam.wsimg.com	3.64.248.63	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	unknown
img1.wsimg.com	unknown	unknown	false	unknown
csp.secureserver.net	unknown	unknown	false	unknown
events.api.secureserver.net	unknown	unknown	false	unknown
www.godaddy.com	unknown	unknown	false	unknown
ms.godaddy.com	unknown	unknown	false	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
76.223.105.230	olenabeautymassage.com	United States	16509	AMAZON-02US	false
52.208.82.82	e-prod-alb-s102-eu-west-1-02.adzerk.net	United States	16509	AMAZON-02US	false
216.58.206.36	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
3.64.248.63	isteam.wsimg.com	United States	16509	AMAZON-02US	false
34.250.180.246	unknown	United States	16509	AMAZON-02US	false

IP
192.168.2.4
192.168.2.6

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1522240
Start date and time:	2024-09-29 15:11:16 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 12s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://olenabeautymassage.com/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean0.win@17/156@24/8
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Browse: https://www.godaddy.com/websites/website-builder?isc=pwugc&utm_source=wsb&utm_medium=applications&utm_campaign=en-ca_corp_applications_base

Input	Output
URL: https://olenabeautymassage.com/ Model: jbxai	{ "brand":["GoDaddy Websites + Marketing"], "contains_trigger_text":true, "trigger_text":"This website uses cookies.", "prominent_button_name":"ACCEPT", "text_input_field_labels":["unknown"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.godaddy.com/websites/website-builder?isc=pwugc&utm_source=wsb&utm_medium=applications&utm_campaign=en-ca_corp_applications_base Model: jbxai	"{ \"brand\": [\"GoDaddy\"], \"contains_trigger_text\": true, \"trigger_text\": \"You don't have permission to access \\\\\"http://www.godaddy.com/websites/website-builder?\\\\\" on this server.\", \"prominent_button_name\": \"unknown\", \"text_input_field_labels\": \"unknown\", \"pdf_icon_visible\": false, \"has_visible_captcha\": false, \"has_urgent_text\": false } "

Name	Malicious	Reputation
https://olenabeautymassage.com/sw.js	false	unknown
https://www.godaddy.com/websites/website-builder?isc=pwugc&utm_source=wsb&utm_medium=applications&utm_campaign=en-ca_corp_applications_base	false	unknown
https://olenabeautymassage.com/markup/ad	false	unknown
https://olenabeautymassage.com/	false	unknown
https://olenabeautymassage.com/manifest.webmanifest	false	unknown
https://olenabeautymassage.com/favicon.ico	false	unknown
https://ms.godaddy.com/i.gif?e=eyJ2IjoiMS4xMiIsImF2IjoxMzc5NjY0LCJhdCI6MjQ0NywiYnQiOjAsImNtIjozNjk2NjY5OTcsImNoIjo1NDQ0NSwiY2siOnt9LCJjciI6NDA4ODkzMDIyLCJkaSI6IjQ4MTdlZGUxMWI4ODRmMDNhNThiYzEyOWJiYmQwNjg1IiwiZGoiOjAsImlpIjoiNWE2ZWQ5ODc0NjBhNDVhOWEwNWVmOTMyMDBiMzhiNDIiLCJkbSI6MywiZmMiOjU4Mzk1MjEyMywiZmwiOjU3MTk5NDU0MywiaXAiOiI2NC4yMDIuMTYwLjAiLCJrdyI6Int7a2V5d29yZH19IiwibnciOjEwNjYzLCJwYyI6MCwib3AiOjAsIm1wIjowLCJlYyI6MCwiZ20iOjAsImVwIjpudWxsLCJwciI6MjE4NDY1LCJydCI6MSwicnMiOjUwMCwic2EiOiI1MiIsInNiIjoiaS0wYjQ5OTg3NDE5ODVjNWJmNiIsInNwIjoyNzg2MDc3LCJzdCI6MTI3NjI2NCwidWsiOiJ1ZTEtMzcxZTI0ZTY0YjY1NGI2NzliNGI0YTg4ZTIzZGE1Y2UiLCJ6biI6MzA3NDk1LCJ0cyI6MTcyNzYxNTUzNjk5OSwicG4iOiJ3YW0iLCJnYyI6dHJ1ZSwiZ0MiOnRydWUsImdzIjoibm9uZSIsImRjIjoxLCJ0eiI6IlVUQyIsImJhIjoxLCJmcSI6MH0&s=-CgtbmeDyX5vJammdiu-9EFVU68&publisher_website_key=wam.md5.908adad984e9c56ed39cdfb2219769b5	false	unknown

Name	Source	Malicious	Antivirus Detection	Reputation
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK1dSBYKcSV-LCoeQqfX1RYOo3qPZ7osDJT9g.woff2)	chromecache_132.2.dr, chromecache_126.2.dr	false		unknown
https://olenabeautymassage.com/404	chromecache_126.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qNa7lqDY.woff2)	chromecache_132.2.dr, chromecache_126.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZMkids18Q.woff2)	chromecache_132.2.dr, chromecache_126.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK1dSBYKcSV-LCoeQqfX1RYOo3qPZ7qsDJT9g.woff2)	chromecache_132.2.dr, chromecache_126.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZclSdh18Smxg.woff2)	chromecache_132.2.dr, chromecache_126.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK1dSBYKcSV-LCoeQqfX1RYOo3qPZ7ksDJT9g.woff2)	chromecache_132.2.dr, chromecache_126.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlBduz8A.woff2)	chromecache_132.2.dr, chromecache_126.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zwmRduz8A.woff2)	chromecache_132.2.dr, chromecache_126.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZclSdv18Smxg.woff2)	chromecache_132.2.dr, chromecache_126.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459Wdhyzbi.woff2)	chromecache_132.2.dr, chromecache_126.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZMkidi18Smxg.woff2)	chromecache_132.2.dr, chromecache_126.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/playfairdisplay/v37/nuFiD-vYSZviVYUb_rj3ij__anPXDTjYgFE_.woff2)	chromecache_132.2.dr, chromecache_126.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/playfairdisplay/v37/nuFiD-vYSZviVYUb_rj3ij__anPXDTzYgA.woff2)	chromecache_132.2.dr, chromecache_126.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZMkidg18Smxg.woff2)	chromecache_132.2.dr, chromecache_126.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459WZhyzbi.woff2)	chromecache_132.2.dr, chromecache_126.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zwlBduz8A.woff2)	chromecache_132.2.dr, chromecache_126.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qNq7lqDY.woff2)	chromecache_132.2.dr, chromecache_126.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qN67lqDY.woff2)	chromecache_132.2.dr, chromecache_126.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qO67lqDY.woff2)	chromecache_132.2.dr, chromecache_126.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zwmhduz8A.woff2)	chromecache_132.2.dr, chromecache_126.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zwmBduz8A.woff2)	chromecache_132.2.dr, chromecache_126.2.dr	false		unknown
https://img1.wsimg.com/isteam/stock/xq8VlAd	chromecache_126.2.dr	false		unknown
https://github.com/JulietaUla/Montserrat)	chromecache_132.2.dr, chromecache_126.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwmhduz8A.woff2)	chromecache_132.2.dr, chromecache_126.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZMkido18Smxg.woff2)	chromecache_132.2.dr, chromecache_126.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2)	chromecache_132.2.dr, chromecache_126.2.dr	false		unknown
http://jedwatson.github.io/classnames	chromecache_159.2.dr, chromecache_168.2.dr	false	URL Reputation: safe	unknown
https://github.com/clauseggers/Playfair-Display)	chromecache_132.2.dr, chromecache_126.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/playfairdisplay/v37/nuFiD-vYSZviVYUb_rj3ij__anPXDTPYgFE_.woff2)	chromecache_132.2.dr, chromecache_126.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK1dSBYKcSV-LCoeQqfX1RYOo3qPZ7psDJT9g.woff2)	chromecache_132.2.dr, chromecache_126.2.dr	false		unknown
https://ms.godaddy.com/r?e=eyJ2IjoiMS4xMiIsImF2IjoxMzc5NjY0LCJhdCI6MjQ0NywiYnQiOjAsImNtIjozNjk2	chromecache_125.2.dr, chromecache_161.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu.woff2)	chromecache_132.2.dr, chromecache_126.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK1dSBYKcSV-LCoeQqfX1RYOo3qPZ7rsDJT9g.woff2)	chromecache_132.2.dr, chromecache_126.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZclSdg18Smxg.woff2)	chromecache_132.2.dr, chromecache_126.2.dr	false		unknown
https://ms.godaddy.com/i.gif?e=eyJ2IjoiMS4xMiIsImF2IjoxMzc5NjY0LCJhdCI6MjQ0NywiYnQiOjAsImNtIjoz	chromecache_125.2.dr, chromecache_161.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZclSdi18Smxg.woff2)	chromecache_132.2.dr, chromecache_126.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwmBduz8A.woff2)	chromecache_132.2.dr, chromecache_126.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2)	chromecache_132.2.dr, chromecache_126.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK1dSBYKcSV-LCoeQqfX1RYOo3qPZ7jsDJT9g.woff2)	chromecache_132.2.dr, chromecache_126.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zwmxduz8A.woff2)	chromecache_132.2.dr, chromecache_126.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZclSdo18Smxg.woff2)	chromecache_132.2.dr, chromecache_126.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zwkxduz8A.woff2)	chromecache_132.2.dr, chromecache_126.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZMkidv18Smxg.woff2)	chromecache_132.2.dr, chromecache_126.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qNK7lqDY.woff2)	chromecache_132.2.dr, chromecache_126.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZMkidj18Smxg.woff2)	chromecache_132.2.dr, chromecache_126.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qPK7lqDY.woff2)	chromecache_132.2.dr, chromecache_126.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/playfairdisplay/v37/nuFiD-vYSZviVYUb_rj3ij__anPXDTLYgFE_.woff2)	chromecache_132.2.dr, chromecache_126.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZMkidh18Smxg.woff2)	chromecache_132.2.dr, chromecache_126.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZclSds18Q.woff2)	chromecache_132.2.dr, chromecache_126.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zwlxdu.woff2)	chromecache_132.2.dr, chromecache_126.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK1dSBYKcSV-LCoeQqfX1RYOo3qPZ7nsDI.woff2)	chromecache_132.2.dr, chromecache_126.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwmRduz8A.woff2)	chromecache_132.2.dr, chromecache_126.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459WRhyzbi.woff2)	chromecache_132.2.dr, chromecache_126.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwmxduz8A.woff2)	chromecache_132.2.dr, chromecache_126.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwkxduz8A.woff2)	chromecache_132.2.dr, chromecache_126.2.dr	false		unknown
http://scripts.sil.org/OFL	chromecache_132.2.dr, chromecache_126.2.dr	false	URL Reputation: safe	unknown
https://img1.wsimg.com/gfonts/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459W1hyzbi.woff2)	chromecache_132.2.dr, chromecache_126.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZclSdj18Smxg.woff2)	chromecache_132.2.dr, chromecache_126.2.dr	false		unknown

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 14712, version 1.0
Category:	downloaded
Size (bytes):	14712
Entropy (8bit):	7.984524638079703
Encrypted:	false
SSDEEP:	384:J1xXvtvezpO6syafJ+CnNcxHGoY/7NazJq:dXvFysJfcqNqmFDNaM
MD5:	3AFEAE0D768769F5E5F30AC9805C5B70
SHA1:	3ADA17C2B462DB3E7A1FD85C3F4670DFE7704F4D
SHA-256:	0D0A6262C545E8BBC895116E5AFB22579C468D7ABB77E378F377D6FED57C1DCE
SHA-512:	71C361AC0D7B72B222D4F087B46D1BEA318ED6652C4D37EC3403F0B0616482B5040232E06F2FCF13109CDF6151DC209E882C0DB40B2C6ACE4E2E0292FCDCDAB5
Malicious:	false
Reputation:	low
URL:	https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu.woff2
Preview:	wOF2......9x.......8..9..........................n..<....`..b...\|.@..d..6.$..D. ..\|..4..v%.m.... FO.#F"l.d..#......?t..'$.2..n..Ye.1$..]...$s..W.s9.<%.L.1}Yy.6...-. b..[......7!..<K.W\|.ij.f..?.\;.....N.$..T(.}.9."0n..........g)@.WE..@.....ZV..=U...;....}.:.t.H.B..H((2.E%$.@1...s.]..R]T..2..vQ.m.7....bm....T.....To.w..v)...H..).B!@..,.zB.ev.....3..L....[..z...\f[...BUV...^...0..8.....D.......\.$_e;.._../K.0.D..0.@..`...mn.....b......h..#.n?.A..}v.l..]yq.......].#=N..9p..9b.8i.!Hl......(.p.>.....{..`.^}W..Fc.O.~.....f..a.%..k.I..e9@Ov.dH.M......i.T.....K.x\|L1C..j..r.l..#.l/...=.Z...e...,k.<...A.A.I..]..@._...z.o.f2.....8,..?..qDUQ.S....a..L$V........K.d.F=~Ga..`.T.H......e{\...^..4cap...o!`9.-.d......._.k.Na..@.......`>.d..E...N....!.DE....`e.)P.R......Q.H....FA0..[U......I....d.......y{...J^...........]#...kH....0..}..C.\|b}.n.....7$c. ...........y....-.0...}..D..#...>}.Q.....*...=R...?.4....n...5.!93"/<9Ao.v.e..Jw.S..0..RK...L..k..)....-...M.

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 29, 2024 15:12:10.623152018 CEST	53	54726	1.1.1.1	192.168.2.6
Sep 29, 2024 15:12:10.627252102 CEST	53	64825	1.1.1.1	192.168.2.6
Sep 29, 2024 15:12:11.671678066 CEST	53	52872	1.1.1.1	192.168.2.6
Sep 29, 2024 15:12:12.132297039 CEST	52443	53	192.168.2.6	1.1.1.1
Sep 29, 2024 15:12:12.132504940 CEST	56943	53	192.168.2.6	1.1.1.1
Sep 29, 2024 15:12:12.171773911 CEST	53	52443	1.1.1.1	192.168.2.6
Sep 29, 2024 15:12:12.211380959 CEST	55442	53	192.168.2.6	1.1.1.1
Sep 29, 2024 15:12:12.211555958 CEST	59336	53	192.168.2.6	1.1.1.1
Sep 29, 2024 15:12:12.218705893 CEST	53	55442	1.1.1.1	192.168.2.6
Sep 29, 2024 15:12:12.218723059 CEST	53	59336	1.1.1.1	192.168.2.6
Sep 29, 2024 15:12:12.336365938 CEST	53	56943	1.1.1.1	192.168.2.6
Sep 29, 2024 15:12:13.049386024 CEST	63435	53	192.168.2.6	1.1.1.1
Sep 29, 2024 15:12:13.049552917 CEST	53815	53	192.168.2.6	1.1.1.1
Sep 29, 2024 15:12:13.053231955 CEST	53	65037	1.1.1.1	192.168.2.6
Sep 29, 2024 15:12:13.066657066 CEST	56995	53	192.168.2.6	1.1.1.1
Sep 29, 2024 15:12:13.066875935 CEST	64254	53	192.168.2.6	1.1.1.1
Sep 29, 2024 15:12:13.074573994 CEST	53	64254	1.1.1.1	192.168.2.6
Sep 29, 2024 15:12:13.076026917 CEST	53	56995	1.1.1.1	192.168.2.6
Sep 29, 2024 15:12:16.465298891 CEST	51202	53	192.168.2.6	1.1.1.1
Sep 29, 2024 15:12:16.465588093 CEST	59896	53	192.168.2.6	1.1.1.1
Sep 29, 2024 15:12:17.520947933 CEST	61938	53	192.168.2.6	1.1.1.1
Sep 29, 2024 15:12:17.521481037 CEST	54518	53	192.168.2.6	1.1.1.1
Sep 29, 2024 15:12:17.532313108 CEST	53	61938	1.1.1.1	192.168.2.6
Sep 29, 2024 15:12:17.535363913 CEST	53	54518	1.1.1.1	192.168.2.6
Sep 29, 2024 15:12:17.548664093 CEST	59074	53	192.168.2.6	1.1.1.1
Sep 29, 2024 15:12:17.549874067 CEST	50905	53	192.168.2.6	1.1.1.1
Sep 29, 2024 15:12:17.585879087 CEST	53	59074	1.1.1.1	192.168.2.6
Sep 29, 2024 15:12:17.607558966 CEST	53	50905	1.1.1.1	192.168.2.6
Sep 29, 2024 15:12:17.937500000 CEST	53	58265	1.1.1.1	192.168.2.6
Sep 29, 2024 15:12:19.138078928 CEST	62654	53	192.168.2.6	1.1.1.1
Sep 29, 2024 15:12:19.138250113 CEST	56206	53	192.168.2.6	1.1.1.1
Sep 29, 2024 15:12:19.151581049 CEST	53	56206	1.1.1.1	192.168.2.6
Sep 29, 2024 15:12:19.152848959 CEST	53	62654	1.1.1.1	192.168.2.6
Sep 29, 2024 15:12:24.382195950 CEST	63738	53	192.168.2.6	1.1.1.1
Sep 29, 2024 15:12:24.382440090 CEST	61645	53	192.168.2.6	1.1.1.1
Sep 29, 2024 15:12:24.636827946 CEST	56122	53	192.168.2.6	1.1.1.1
Sep 29, 2024 15:12:24.636970043 CEST	56991	53	192.168.2.6	1.1.1.1
Sep 29, 2024 15:12:25.719855070 CEST	63702	53	192.168.2.6	1.1.1.1
Sep 29, 2024 15:12:25.720163107 CEST	57282	53	192.168.2.6	1.1.1.1
Sep 29, 2024 15:12:29.092838049 CEST	53	57679	1.1.1.1	192.168.2.6
Sep 29, 2024 15:12:33.027121067 CEST	62852	53	192.168.2.6	1.1.1.1
Sep 29, 2024 15:12:33.027297020 CEST	55747	53	192.168.2.6	1.1.1.1
Sep 29, 2024 15:12:47.805309057 CEST	53	60313	1.1.1.1	192.168.2.6
Sep 29, 2024 15:13:09.531326056 CEST	53	61249	1.1.1.1	192.168.2.6
Sep 29, 2024 15:13:10.432964087 CEST	53	65033	1.1.1.1	192.168.2.6

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Sep 29, 2024 15:12:12.336457014 CEST	192.168.2.6	1.1.1.1	c232	(Port unreachable)	Destination Unreachable
Sep 29, 2024 15:12:17.607624054 CEST	192.168.2.6	1.1.1.1	c232	(Port unreachable)	Destination Unreachable

Timestamp	Bytes transferred	Direction	Data
2024-09-29 13:12:07 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 4a 64 48 68 38 39 79 31 4f 55 36 51 73 7a 38 4a 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 64 64 36 66 37 34 39 37 32 65 62 64 66 35 38 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: JdHh89y1OU6Qsz8J.1Context: 8dd6f74972ebdf58
2024-09-29 13:12:07 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-09-29 13:12:07 UTC	1076	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 35 33 0d 0a 4d 53 2d 43 56 3a 20 4a 64 48 68 38 39 79 31 4f 55 36 51 73 7a 38 4a 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 64 64 36 66 37 34 39 37 32 65 62 64 66 35 38 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 58 7a 55 45 6b 33 4e 66 59 68 39 44 37 4a 45 5a 56 62 6c 51 70 7a 62 55 68 49 35 31 6e 4c 71 31 6c 79 78 73 49 65 70 6c 50 58 6f 72 4f 79 52 49 56 48 6e 75 53 2b 51 69 6e 32 63 6a 51 38 47 78 6c 52 66 65 2f 66 72 53 38 6e 4e 35 33 45 6b 50 56 49 67 5a 54 76 4c 63 7a 43 74 4b 2f 74 4b 78 6b 4e 6c 45 66 39 33 48 61 4b 43 39 4b Data Ascii: ATH 2 CON\DEVICE 1053MS-CV: JdHh89y1OU6Qsz8J.2Context: 8dd6f74972ebdf58<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAXzUEk3NfYh9D7JEZVblQpzbUhI51nLq1lyxsIeplPXorOyRIVHnuS+Qin2cjQ8GxlRfe/frS8nN53EkPVIgZTvLczCtK/tKxkNlEf93HaKC9K
2024-09-29 13:12:07 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 4a 64 48 68 38 39 79 31 4f 55 36 51 73 7a 38 4a 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 64 64 36 66 37 34 39 37 32 65 62 64 66 35 38 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: JdHh89y1OU6Qsz8J.3Context: 8dd6f74972ebdf58<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-09-29 13:12:08 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-09-29 13:12:08 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 63 34 45 73 5a 58 55 4c 66 30 4b 6a 66 52 4d 56 52 56 36 56 2b 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: c4EsZXULf0KjfRMVRV6V+g.0Payload parsing failed.

Timestamp	Bytes transferred	Direction	Data
2024-09-29 13:12:11 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 68 61 37 4c 69 61 59 62 38 55 36 49 50 74 4f 41 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 39 33 33 63 34 62 63 37 30 65 66 63 34 39 38 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: ha7LiaYb8U6IPtOA.1Context: 3933c4bc70efc498
2024-09-29 13:12:11 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-09-29 13:12:11 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 68 61 37 4c 69 61 59 62 38 55 36 49 50 74 4f 41 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 39 33 33 63 34 62 63 37 30 65 66 63 34 39 38 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 53 4e 4b 38 62 75 69 73 34 46 69 56 42 76 50 64 4e 59 78 6f 49 58 2b 2f 42 57 6e 67 39 7a 78 38 52 51 33 56 74 37 75 54 62 52 2b 36 31 4a 38 34 54 72 6d 55 57 49 79 59 53 6d 42 37 4b 52 62 45 75 6e 59 77 45 61 6e 55 37 6c 42 67 42 32 75 58 41 32 38 43 78 61 6b 2f 68 46 68 37 68 4e 33 50 32 52 39 36 43 75 6c 52 70 36 4c 32 77 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: ha7LiaYb8U6IPtOA.2Context: 3933c4bc70efc498<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAASNK8buis4FiVBvPdNYxoIX+/BWng9zx8RQ3Vt7uTbR+61J84TrmUWIyYSmB7KRbEunYwEanU7lBgB2uXA28Cxak/hFh7hN3P2R96CulRp6L2w
2024-09-29 13:12:11 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 68 61 37 4c 69 61 59 62 38 55 36 49 50 74 4f 41 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 39 33 33 63 34 62 63 37 30 65 66 63 34 39 38 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: ha7LiaYb8U6IPtOA.3Context: 3933c4bc70efc498<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-09-29 13:12:11 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-09-29 13:12:11 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 4b 30 68 36 64 48 50 78 72 45 69 43 71 63 42 51 37 79 4c 6c 59 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: K0h6dHPxrEiCqcBQ7yLlYA.0Payload parsing failed.

Timestamp	Bytes transferred	Direction	Data
2024-09-29 13:12:12 UTC	665	OUT	GET / HTTP/1.1 Host: olenabeautymassage.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-29 13:12:12 UTC	1814	IN	HTTP/1.1 200 OK Link: <//img1.wsimg.com/ceph-p3-01/website-builder-data-prod/static/widgets/UX.4.43.14.js>; rel=preload; as=script; crossorigin,<https://img1.wsimg.com/gfonts/s/playfairdisplay/v37/nuFiD-vYSZviVYUb_rj3ij__anPXDTzYgA.woff2>; rel=preload; as=font; crossorigin,<https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZMkids18Q.woff2>; rel=preload; as=font; crossorigin,<https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK1dSBYKcSV-LCoeQqfX1RYOo3qPZ7nsDI.woff2>; rel=preload; as=font; crossorigin,<https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZclSds18Q.woff2>; rel=preload; as=font; crossorigin,<https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zwlxdu.woff2>; rel=preload; as=font; crossorigin,<https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2>; rel=preload; as=font; crossorigin,<https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu.woff2>; rel=preload; as=fon [TRUNCATED] Cache-Control: max-age=30 Content-Security-Policy: frame-ancestors 'self' godaddy.com *.godaddy.com Content-Type: text/html;charset=utf-8 Vary: Accept-Encoding Server: DPS/2.0.0+sha-227ca78 X-Version: 227ca78 X-SiteId: us-east-1 Set-Cookie: dps_site_id=us-east-1; path=/; secure ETag: fc079f405c7d612150aaa426389cb059 Date: Sun, 29 Sep 2024 13:12:12 GMT Connection: close Transfer-Encoding: chunked
2024-09-29 13:12:12 UTC	14570	IN	Data Raw: 31 35 31 33 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 43 41 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 53 65 74 3d 22 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 74 69 74 6c 65 3e 4f 6c 65 6e 61 20 53 70 79 72 79 64 6f 6e 6f 76 61 20 45 73 74 68 c3 a9 74 69 71 75 65 20 65 74 20 4d 61 73 73 6f 74 68 c3 a9 72 61 70 69 65 3c 2f 74 69 74 6c 65 3e Data Ascii: 1513f<!DOCTYPE html><html lang="en-CA"><head><meta charSet="utf-8"/><meta http-equiv="X-UA-Compatible" content="IE=edge"/><meta name="viewport" content="width=device-width, initial-scale=1"/><title>Olena Spyrydonova Esthtique et Massothrapie</title>
2024-09-29 13:12:12 UTC	16384	IN	Data Raw: 2d 77 65 69 67 68 74 3a 20 37 30 30 3b 0a 20 20 66 6f 6e 74 2d 64 69 73 70 6c 61 79 3a 20 73 77 61 70 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 68 74 74 70 73 3a 2f 2f 69 6d 67 31 2e 77 73 69 6d 67 2e 63 6f 6d 2f 67 66 6f 6e 74 73 2f 73 2f 73 6f 75 72 63 65 73 61 6e 73 70 72 6f 2f 76 32 32 2f 36 78 4b 77 64 53 42 59 4b 63 53 56 2d 4c 43 6f 65 51 71 66 58 31 52 59 4f 6f 33 71 50 5a 5a 63 6c 53 64 73 31 38 51 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 30 30 30 2d 30 30 46 46 2c 20 55 2b 30 31 33 31 2c 20 55 2b 30 31 35 32 2d 30 31 35 33 2c 20 55 2b 30 32 42 42 2d 30 32 42 43 2c 20 55 2b 30 32 43 36 2c 20 55 2b 30 32 44 41 2c 20 55 2b 30 32 44 43 2c 20 55 2b 30 33 30 34 Data Ascii: -weight: 700; font-display: swap; src: url(https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZclSds18Q.woff2) format('woff2'); unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304
2024-09-29 13:12:12 UTC	16384	IN	Data Raw: 72 63 65 2e 0a 0a 54 68 69 73 20 46 6f 6e 74 20 53 6f 66 74 77 61 72 65 20 69 73 20 6c 69 63 65 6e 73 65 64 20 75 6e 64 65 72 20 74 68 65 20 53 49 4c 20 4f 70 65 6e 20 46 6f 6e 74 20 4c 69 63 65 6e 73 65 2c 20 56 65 72 73 69 6f 6e 20 31 2e 31 2e 0a 54 68 69 73 20 6c 69 63 65 6e 73 65 20 69 73 20 63 6f 70 69 65 64 20 62 65 6c 6f 77 2c 20 61 6e 64 20 69 73 20 61 6c 73 6f 20 61 76 61 69 6c 61 62 6c 65 20 77 69 74 68 20 61 20 46 41 51 20 61 74 3a 20 68 74 74 70 3a 2f 2f 73 63 72 69 70 74 73 2e 73 69 6c 2e 6f 72 67 2f 4f 46 4c 0a 0a e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 Data Ascii: rce.This Font Software is licensed under the SIL Open Font License, Version 1.1.This license is copied below, and is also available with a FAQ at: http://scripts.sil.org/OFL
2024-09-29 13:12:12 UTC	16384	IN	Data Raw: 78 20 2e 63 31 2d 32 36 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 7d 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 20 31 30 32 34 70 78 29 7b 2e 78 20 2e 63 31 2d 33 37 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 34 70 78 7d 7d 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 20 31 30 32 34 70 78 29 7b 2e 78 20 2e 63 31 2d 33 6b 7b 66 6f 6e 74 2d 73 69 7a 65 3a 33 30 70 78 7d 7d 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 20 31 30 32 34 70 78 29 7b 2e 78 20 2e 63 31 2d 33 70 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 38 70 78 7d 7d 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 20 31 30 32 34 70 78 29 7b 2e 78 20 2e 63 31 2d 33 7a 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 7d 7d 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 20 31 30 32 Data Ascii: x .c1-26{display:none}}@media (min-width: 1024px){.x .c1-37{font-size:24px}}@media (min-width: 1024px){.x .c1-3k{font-size:30px}}@media (min-width: 1024px){.x .c1-3p{font-size:18px}}@media (min-width: 1024px){.x .c1-3z{display:flex}}@media (min-width: 102
2024-09-29 13:12:12 UTC	16384	IN	Data Raw: 2d 34 71 20 63 31 2d 34 72 20 63 31 2d 32 36 20 63 31 2d 65 20 63 31 2d 66 20 63 31 2d 67 22 3e 3c 64 69 76 20 64 61 74 61 2d 75 78 3d 22 43 6f 6e 74 61 69 6e 65 72 22 20 63 6c 61 73 73 3d 22 78 2d 65 6c 20 78 2d 65 6c 2d 64 69 76 20 63 31 2d 31 20 63 31 2d 32 20 63 31 2d 32 34 20 63 31 2d 32 32 20 63 31 2d 31 74 20 63 31 2d 31 75 20 63 31 2d 32 75 20 63 31 2d 71 20 63 31 2d 62 20 63 31 2d 63 20 63 31 2d 34 73 20 63 31 2d 64 20 63 31 2d 34 74 20 63 31 2d 34 75 20 63 31 2d 34 76 20 63 31 2d 34 77 20 63 31 2d 34 78 20 63 31 2d 65 20 63 31 2d 34 79 20 63 31 2d 66 20 63 31 2d 34 7a 20 63 31 2d 67 22 3e 3c 64 69 76 20 64 61 74 61 2d 75 78 3d 22 48 65 72 6f 22 20 63 6c 61 73 73 3d 22 78 2d 65 6c 20 78 2d 65 6c 2d 64 69 76 20 63 31 2d 31 20 63 31 2d 32 20 63 31 Data Ascii: -4q c1-4r c1-26 c1-e c1-f c1-g"><div data-ux="Container" class="x-el x-el-div c1-1 c1-2 c1-24 c1-22 c1-1t c1-1u c1-2u c1-q c1-b c1-c c1-4s c1-d c1-4t c1-4u c1-4v c1-4w c1-4x c1-e c1-4y c1-f c1-4z c1-g"><div data-ux="Hero" class="x-el x-el-div c1-1 c1-2 c1
2024-09-29 13:12:12 UTC	6243	IN	Data Raw: 33 2e 36 32 32 20 31 31 31 2e 38 31 38 20 33 2e 37 32 35 35 34 43 31 31 31 2e 35 37 33 20 34 2e 31 38 38 36 33 20 31 31 31 2e 31 39 33 20 34 2e 35 36 38 35 36 20 31 31 30 2e 37 32 39 20 34 2e 38 31 33 31 35 43 31 31 30 2e 36 32 36 20 34 2e 38 36 37 37 37 20 31 31 30 2e 35 36 20 34 2e 39 37 35 33 39 20 31 31 30 2e 35 36 20 35 2e 30 39 32 37 39 43 31 31 30 2e 35 36 20 35 2e 32 31 30 32 20 31 31 30 2e 36 32 36 20 35 2e 33 31 37 38 32 20 31 31 30 2e 37 32 39 20 35 2e 33 37 32 34 34 43 31 31 31 2e 31 39 33 20 35 2e 36 31 37 30 33 20 31 31 31 2e 35 37 33 20 35 2e 39 39 36 39 36 20 31 31 31 2e 38 31 38 20 36 2e 34 36 30 30 34 43 31 31 31 2e 38 34 36 20 36 2e 35 31 32 32 32 20 31 31 31 2e 38 38 36 20 36 2e 35 35 34 36 32 20 31 31 31 2e 39 33 34 20 36 2e 35 38 33 Data Ascii: 3.622 111.818 3.72554C111.573 4.18863 111.193 4.56856 110.729 4.81315C110.626 4.86777 110.56 4.97539 110.56 5.09279C110.56 5.2102 110.626 5.31782 110.729 5.37244C111.193 5.61703 111.573 5.99696 111.818 6.46004C111.846 6.51222 111.886 6.55462 111.934 6.583

Timestamp	Bytes transferred	Direction	Data
2024-09-29 13:12:16 UTC	565	OUT	GET /markup/ad HTTP/1.1 Host: olenabeautymassage.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://olenabeautymassage.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: dps_site_id=us-east-1
2024-09-29 13:12:17 UTC	655	IN	HTTP/1.1 200 OK Link: <https://fonts.googleapis.com>; rel=preconnect; crossorigin,<https://fonts.gstatic.com>; rel=preconnect; crossorigin,<https://img1.wsimg.com>; rel=preconnect; crossorigin,<https://isteam.wsimg.com>; rel=preconnect; crossorigin Cache-Control: max-age=30 Content-Security-Policy: frame-ancestors 'self' godaddy.com *.godaddy.com Content-Type: text/html; charset=utf-8 Pragma: no-cache Expires: 0 Vary: Accept-Encoding Server: DPS/2.0.0+sha-227ca78 X-Version: 227ca78 X-SiteId: us-east-1 Set-Cookie: dps_site_id=us-east-1; path=/; secure Date: Sun, 29 Sep 2024 13:12:17 GMT Connection: close Transfer-Encoding: chunked
2024-09-29 13:12:17 UTC	7275	IN	Data Raw: 31 63 35 65 0d 0a 3c 64 69 76 20 69 64 3d 22 47 4f 44 41 44 44 59 5f 46 52 45 45 4d 49 55 4d 5f 41 44 22 20 63 6c 61 73 73 3d 22 67 64 2d 61 64 2d 77 72 61 70 70 65 72 22 3e 0a 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 22 47 44 20 53 68 65 72 70 61 22 3b 0a 20 20 20 20 20 20 73 72 63 3a 20 75 72 6c 28 27 2f 2f 69 6d 67 31 2e 77 73 69 6d 67 2e 63 6f 6d 2f 62 6c 6f 62 62 79 2f 67 6f 2f 75 78 2f 66 6f 6e 74 73 2f 73 68 65 72 70 61 2f 31 2e 31 2f 67 64 73 68 65 72 70 61 2d 72 65 67 75 6c 61 72 2e 77 6f 66 66 32 27 29 3b 0a 20 20 20 20 20 20 66 6f 6e 74 2d 64 69 73 70 6c 61 79 3a 20 73 77 61 70 3b 0a 20 20 20 20 7d 0a Data Ascii: 1c5e<div id="GODADDY_FREEMIUM_AD" class="gd-ad-wrapper"> <style type="text/css"> @font-face { font-family: "GD Sherpa"; src: url('//img1.wsimg.com/blobby/go/ux/fonts/sherpa/1.1/gdsherpa-regular.woff2'); font-display: swap; }

Timestamp	Bytes transferred	Direction	Data
2024-09-29 13:12:16 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-09-29 13:12:16 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF67) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=99166 Date: Sun, 29 Sep 2024 13:12:16 GMT Connection: close X-CID: 2

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://olenabeautymassage.com/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Chrome Cache Entry: 113

Chrome Cache Entry: 114

Chrome Cache Entry: 115

Chrome Cache Entry: 116

Chrome Cache Entry: 117

Chrome Cache Entry: 118

Chrome Cache Entry: 119

Chrome Cache Entry: 120

Chrome Cache Entry: 121

Chrome Cache Entry: 122

Chrome Cache Entry: 123

Chrome Cache Entry: 124

Chrome Cache Entry: 125

Chrome Cache Entry: 126

Chrome Cache Entry: 127

Windows Analysis Report
https://olenabeautymassage.com/

Timestamp	Bytes transferred	Direction	Data
2024-09-29 13:12:17 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-09-29 13:12:17 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=99195 Date: Sun, 29 Sep 2024 13:12:17 GMT Content-Length: 55 Connection: close X-CID: 2
2024-09-29 13:12:17 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Timestamp	Bytes transferred	Direction	Data
2024-09-29 13:12:18 UTC	386	OUT	GET /markup/ad HTTP/1.1 Host: olenabeautymassage.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: dps_site_id=us-east-1
2024-09-29 13:12:19 UTC	655	IN	HTTP/1.1 200 OK Link: <https://fonts.googleapis.com>; rel=preconnect; crossorigin,<https://fonts.gstatic.com>; rel=preconnect; crossorigin,<https://img1.wsimg.com>; rel=preconnect; crossorigin,<https://isteam.wsimg.com>; rel=preconnect; crossorigin Cache-Control: max-age=30 Content-Security-Policy: frame-ancestors 'self' godaddy.com *.godaddy.com Content-Type: text/html; charset=utf-8 Pragma: no-cache Expires: 0 Vary: Accept-Encoding Server: DPS/2.0.0+sha-227ca78 X-Version: 227ca78 X-SiteId: us-east-1 Set-Cookie: dps_site_id=us-east-1; path=/; secure Date: Sun, 29 Sep 2024 13:12:19 GMT Connection: close Transfer-Encoding: chunked
2024-09-29 13:12:19 UTC	7275	IN	Data Raw: 31 63 35 65 0d 0a 3c 64 69 76 20 69 64 3d 22 47 4f 44 41 44 44 59 5f 46 52 45 45 4d 49 55 4d 5f 41 44 22 20 63 6c 61 73 73 3d 22 67 64 2d 61 64 2d 77 72 61 70 70 65 72 22 3e 0a 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 22 47 44 20 53 68 65 72 70 61 22 3b 0a 20 20 20 20 20 20 73 72 63 3a 20 75 72 6c 28 27 2f 2f 69 6d 67 31 2e 77 73 69 6d 67 2e 63 6f 6d 2f 62 6c 6f 62 62 79 2f 67 6f 2f 75 78 2f 66 6f 6e 74 73 2f 73 68 65 72 70 61 2f 31 2e 31 2f 67 64 73 68 65 72 70 61 2d 72 65 67 75 6c 61 72 2e 77 6f 66 66 32 27 29 3b 0a 20 20 20 20 20 20 66 6f 6e 74 2d 64 69 73 70 6c 61 79 3a 20 73 77 61 70 3b 0a 20 20 20 20 7d 0a Data Ascii: 1c5e<div id="GODADDY_FREEMIUM_AD" class="gd-ad-wrapper"> <style type="text/css"> @font-face { font-family: "GD Sherpa"; src: url('//img1.wsimg.com/blobby/go/ux/fonts/sherpa/1.1/gdsherpa-regular.woff2'); font-display: swap; }

Timestamp	Bytes transferred	Direction	Data
2024-09-29 13:12:18 UTC	1416	OUT	GET /i.gif?e=eyJ2IjoiMS4xMiIsImF2IjoxMzc5NjY0LCJhdCI6MjQ0NywiYnQiOjAsImNtIjozNjk2NjY5OTcsImNoIjo1NDQ0NSwiY2siOnt9LCJjciI6NDA4ODkzMDIyLCJkaSI6IjQ4MTdlZGUxMWI4ODRmMDNhNThiYzEyOWJiYmQwNjg1IiwiZGoiOjAsImlpIjoiNWE2ZWQ5ODc0NjBhNDVhOWEwNWVmOTMyMDBiMzhiNDIiLCJkbSI6MywiZmMiOjU4Mzk1MjEyMywiZmwiOjU3MTk5NDU0MywiaXAiOiI2NC4yMDIuMTYwLjAiLCJrdyI6Int7a2V5d29yZH19IiwibnciOjEwNjYzLCJwYyI6MCwib3AiOjAsIm1wIjowLCJlYyI6MCwiZ20iOjAsImVwIjpudWxsLCJwciI6MjE4NDY1LCJydCI6MSwicnMiOjUwMCwic2EiOiI1MiIsInNiIjoiaS0wYjQ5OTg3NDE5ODVjNWJmNiIsInNwIjoyNzg2MDc3LCJzdCI6MTI3NjI2NCwidWsiOiJ1ZTEtMzcxZTI0ZTY0YjY1NGI2NzliNGI0YTg4ZTIzZGE1Y2UiLCJ6biI6MzA3NDk1LCJ0cyI6MTcyNzYxNTUzNjk5OSwicG4iOiJ3YW0iLCJnYyI6dHJ1ZSwiZ0MiOnRydWUsImdzIjoibm9uZSIsImRjIjoxLCJ0eiI6IlVUQyIsImJhIjoxLCJmcSI6MH0&s=-CgtbmeDyX5vJammdiu-9EFVU68&publisher_website_key=wam.md5.908adad984e9c56ed39cdfb2219769b5 HTTP/1.1 Host: ms.godaddy.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://olenabeautymassage.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-29 13:12:18 UTC	796	IN	HTTP/1.1 200 OK Date: Sun, 29 Sep 2024 13:12:18 GMT Content-Type: image/gif Content-Length: 43 Connection: close Access-Control-Allow-Origin: undefined Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: GET, PUT, POST, DELETE, OPTIONS Access-Control-Allow-Headers: Accept, Origin, Content-Type, Content-Length, X-Adzerk-Explain, X-Adzerk-Sdk-Version Cache-Control: no-cache, no-store, must-revalidate Expires: 0 Pragma: no-cache x-served-by: prod-eventservers-shard102-eu-west-1-01-i-0961e716b4b05936f Set-Cookie: azk=ue1-371e24e64b654b679b4b4a88e23da5ce; Path=/; Expires=Mon, 29 Sep 2025 13:12:18 GMT; Secure; SameSite=None Set-Cookie: azk-ss=true; Path=/; Expires=Mon, 29 Sep 2025 13:12:18 GMT; Secure; SameSite=None ETag: W/"2b-6KwiS6nul+h2cO1vOi8BKLevn+Q"
2024-09-29 13:12:18 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Timestamp	Bytes transferred	Direction	Data
2024-09-29 13:12:19 UTC	1237	OUT	GET /i.gif?e=eyJ2IjoiMS4xMiIsImF2IjoxMzc5NjY0LCJhdCI6MjQ0NywiYnQiOjAsImNtIjozNjk2NjY5OTcsImNoIjo1NDQ0NSwiY2siOnt9LCJjciI6NDA4ODkzMDIyLCJkaSI6IjQ4MTdlZGUxMWI4ODRmMDNhNThiYzEyOWJiYmQwNjg1IiwiZGoiOjAsImlpIjoiNWE2ZWQ5ODc0NjBhNDVhOWEwNWVmOTMyMDBiMzhiNDIiLCJkbSI6MywiZmMiOjU4Mzk1MjEyMywiZmwiOjU3MTk5NDU0MywiaXAiOiI2NC4yMDIuMTYwLjAiLCJrdyI6Int7a2V5d29yZH19IiwibnciOjEwNjYzLCJwYyI6MCwib3AiOjAsIm1wIjowLCJlYyI6MCwiZ20iOjAsImVwIjpudWxsLCJwciI6MjE4NDY1LCJydCI6MSwicnMiOjUwMCwic2EiOiI1MiIsInNiIjoiaS0wYjQ5OTg3NDE5ODVjNWJmNiIsInNwIjoyNzg2MDc3LCJzdCI6MTI3NjI2NCwidWsiOiJ1ZTEtMzcxZTI0ZTY0YjY1NGI2NzliNGI0YTg4ZTIzZGE1Y2UiLCJ6biI6MzA3NDk1LCJ0cyI6MTcyNzYxNTUzNjk5OSwicG4iOiJ3YW0iLCJnYyI6dHJ1ZSwiZ0MiOnRydWUsImdzIjoibm9uZSIsImRjIjoxLCJ0eiI6IlVUQyIsImJhIjoxLCJmcSI6MH0&s=-CgtbmeDyX5vJammdiu-9EFVU68&publisher_website_key=wam.md5.908adad984e9c56ed39cdfb2219769b5 HTTP/1.1 Host: ms.godaddy.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: azk=ue1-371e24e64b654b679b4b4a88e23da5ce; azk-ss=true
2024-09-29 13:12:20 UTC	701	IN	HTTP/1.1 200 OK Date: Sun, 29 Sep 2024 13:12:20 GMT Content-Type: image/gif Content-Length: 43 Connection: close Access-Control-Allow-Origin: undefined Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: GET, PUT, POST, DELETE, OPTIONS Access-Control-Allow-Headers: Accept, Origin, Content-Type, Content-Length, X-Adzerk-Explain, X-Adzerk-Sdk-Version Cache-Control: no-cache, no-store, must-revalidate Expires: 0 Pragma: no-cache x-served-by: prod-eventservers-shard102-eu-west-1-01-i-0ae4ca80b9515194b Set-Cookie: azk=ue1-371e24e64b654b679b4b4a88e23da5ce; Path=/; Expires=Mon, 29 Sep 2025 13:12:20 GMT; Secure; SameSite=None ETag: W/"2b-6KwiS6nul+h2cO1vOi8BKLevn+Q"
2024-09-29 13:12:20 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Timestamp	Bytes transferred	Direction	Data
2024-09-29 13:12:24 UTC	785	OUT	GET /favicon.ico HTTP/1.1 Host: olenabeautymassage.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://olenabeautymassage.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: dps_site_id=us-east-1; _tccl_visitor=3893fdf1-a3a4-4c4d-b14a-ad1f86a90c6b; _tccl_visit=3893fdf1-a3a4-4c4d-b14a-ad1f86a90c6b; _scc_session=pc=1&C_TOUCH=2024-09-29T13:12:17.385Z
2024-09-29 13:12:25 UTC	1781	IN	HTTP/1.1 404 Not Found Link: <//img1.wsimg.com/ceph-p3-01/website-builder-data-prod/static/widgets/UX.4.43.14.js>; rel=preload; as=script; crossorigin,<https://img1.wsimg.com/gfonts/s/playfairdisplay/v37/nuFiD-vYSZviVYUb_rj3ij__anPXDTzYgA.woff2>; rel=preload; as=font; crossorigin,<https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZMkids18Q.woff2>; rel=preload; as=font; crossorigin,<https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK1dSBYKcSV-LCoeQqfX1RYOo3qPZ7nsDI.woff2>; rel=preload; as=font; crossorigin,<https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZclSds18Q.woff2>; rel=preload; as=font; crossorigin,<https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zwlxdu.woff2>; rel=preload; as=font; crossorigin,<https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2>; rel=preload; as=font; crossorigin,<https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu.woff2>; rel=preload; as=fon [TRUNCATED] Cache-Control: max-age=30 Content-Security-Policy: frame-ancestors 'self' godaddy.com *.godaddy.com Content-Type: text/html;charset=utf-8 Vary: Accept-Encoding Server: DPS/2.0.0+sha-227ca78 X-Version: 227ca78 X-SiteId: us-east-1 Set-Cookie: dps_site_id=us-east-1; path=/; secure Date: Sun, 29 Sep 2024 13:12:24 GMT Connection: close Transfer-Encoding: chunked
2024-09-29 13:12:25 UTC	14603	IN	Data Raw: 31 31 35 31 32 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 43 41 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 53 65 74 3d 22 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 74 69 74 6c 65 3e 4f 6c 65 6e 61 20 53 70 79 72 79 64 6f 6e 6f 76 61 20 45 73 74 68 c3 a9 74 69 71 75 65 20 65 74 20 4d 61 73 73 6f 74 68 c3 a9 72 61 70 69 65 3c 2f 74 69 74 6c 65 3e Data Ascii: 11512<!DOCTYPE html><html lang="en-CA"><head><meta charSet="utf-8"/><meta http-equiv="X-UA-Compatible" content="IE=edge"/><meta name="viewport" content="width=device-width, initial-scale=1"/><title>Olena Spyrydonova Esthtique et Massothrapie</title>
2024-09-29 13:12:25 UTC	16384	IN	Data Raw: 73 77 61 70 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 68 74 74 70 73 3a 2f 2f 69 6d 67 31 2e 77 73 69 6d 67 2e 63 6f 6d 2f 67 66 6f 6e 74 73 2f 73 2f 73 6f 75 72 63 65 73 61 6e 73 70 72 6f 2f 76 32 32 2f 36 78 4b 77 64 53 42 59 4b 63 53 56 2d 4c 43 6f 65 51 71 66 58 31 52 59 4f 6f 33 71 50 5a 5a 63 6c 53 64 73 31 38 51 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 30 30 30 2d 30 30 46 46 2c 20 55 2b 30 31 33 31 2c 20 55 2b 30 31 35 32 2d 30 31 35 33 2c 20 55 2b 30 32 42 42 2d 30 32 42 43 2c 20 55 2b 30 32 43 36 2c 20 55 2b 30 32 44 41 2c 20 55 2b 30 32 44 43 2c 20 55 2b 30 33 30 34 2c 20 55 2b 30 33 30 38 2c 20 55 2b 30 33 32 39 2c 20 55 2b 32 30 30 30 2d 32 30 36 46 2c Data Ascii: swap; src: url(https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZclSds18Q.woff2) format('woff2'); unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F,
2024-09-29 13:12:25 UTC	16384	IN	Data Raw: 63 65 6e 73 65 64 20 75 6e 64 65 72 20 74 68 65 20 53 49 4c 20 4f 70 65 6e 20 46 6f 6e 74 20 4c 69 63 65 6e 73 65 2c 20 56 65 72 73 69 6f 6e 20 31 2e 31 2e 0a 54 68 69 73 20 6c 69 63 65 6e 73 65 20 69 73 20 63 6f 70 69 65 64 20 62 65 6c 6f 77 2c 20 61 6e 64 20 69 73 20 61 6c 73 6f 20 61 76 61 69 6c 61 62 6c 65 20 77 69 74 68 20 61 20 46 41 51 20 61 74 3a 20 68 74 74 70 3a 2f 2f 73 63 72 69 70 74 73 2e 73 69 6c 2e 6f 72 67 2f 4f 46 4c 0a 0a e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 2d 0a 53 49 4c 20 4f 50 45 4e 20 46 4f 4e 54 20 4c 49 43 45 Data Ascii: censed under the SIL Open Font License, Version 1.1.This license is copied below, and is also available with a FAQ at: http://scripts.sil.org/OFL-SIL OPEN FONT LICE
2024-09-29 13:12:25 UTC	16384	IN	Data Raw: 63 31 2d 32 20 63 31 2d 32 78 20 63 31 2d 33 32 20 63 31 2d 33 33 20 63 31 2d 33 34 20 63 31 2d 31 78 20 63 31 2d 32 7a 20 63 31 2d 31 62 20 63 31 2d 33 30 20 63 31 2d 31 63 20 63 31 2d 31 65 20 63 31 2d 31 64 20 63 31 2d 31 37 20 63 31 2d 31 35 20 63 31 2d 33 39 20 63 31 2d 31 33 20 63 31 2d 31 31 20 63 31 2d 62 20 63 31 2d 63 20 63 31 2d 64 20 63 31 2d 33 36 20 63 31 2d 33 37 20 63 31 2d 65 20 63 31 2d 66 20 63 31 2d 67 22 3e 3c 64 69 76 20 64 61 74 61 2d 75 78 3d 22 42 6c 6f 63 6b 22 20 64 61 74 61 2d 61 69 64 3d 22 48 45 41 44 45 52 5f 4c 4f 47 4f 5f 52 45 4e 44 45 52 45 44 22 20 63 6c 61 73 73 3d 22 78 2d 65 6c 20 78 2d 65 6c 2d 64 69 76 20 63 31 2d 31 69 20 63 31 2d 31 6a 20 63 31 2d 34 20 63 31 2d 31 64 20 63 31 2d 33 32 20 63 31 2d 63 20 63 31 2d Data Ascii: c1-2 c1-2x c1-32 c1-33 c1-34 c1-1x c1-2z c1-1b c1-30 c1-1c c1-1e c1-1d c1-17 c1-15 c1-39 c1-13 c1-11 c1-b c1-c c1-d c1-36 c1-37 c1-e c1-f c1-g"><div data-ux="Block" data-aid="HEADER_LOGO_RENDERED" class="x-el x-el-div c1-1i c1-1j c1-4 c1-1d c1-32 c1-c c1-
2024-09-29 13:12:25 UTC	7189	IN	Data Raw: 30 35 20 38 2e 36 34 35 38 35 43 31 32 39 2e 33 31 20 38 2e 36 34 30 39 36 20 31 32 39 2e 33 31 32 20 38 2e 36 33 34 34 33 20 31 32 39 2e 33 31 32 20 38 2e 36 32 36 32 38 56 37 2e 38 32 39 37 34 43 31 32 39 2e 33 31 32 20 37 2e 38 32 32 34 20 31 32 39 2e 33 31 20 37 2e 38 31 35 30 36 20 31 32 39 2e 33 30 35 20 37 2e 38 31 30 31 37 5a 4d 31 32 38 2e 32 31 34 20 37 2e 38 31 30 31 37 43 31 32 38 2e 32 30 39 20 37 2e 38 30 35 32 38 20 31 32 38 2e 32 30 33 20 37 2e 38 30 32 38 33 20 31 32 38 2e 31 39 35 20 37 2e 38 30 32 38 33 48 31 32 37 2e 35 32 34 43 31 32 37 2e 35 31 36 20 37 2e 38 30 32 38 33 20 31 32 37 2e 35 30 39 20 37 2e 38 30 35 32 38 20 31 32 37 2e 35 30 34 20 37 2e 38 31 30 31 37 43 31 32 37 2e 34 39 39 20 37 2e 38 31 35 38 38 20 31 32 37 2e 34 39 Data Ascii: 05 8.64585C129.31 8.64096 129.312 8.63443 129.312 8.62628V7.82974C129.312 7.8224 129.31 7.81506 129.305 7.81017ZM128.214 7.81017C128.209 7.80528 128.203 7.80283 128.195 7.80283H127.524C127.516 7.80283 127.509 7.80528 127.504 7.81017C127.499 7.81588 127.49

Timestamp	Bytes transferred	Direction	Data
2024-09-29 13:12:24 UTC	650	OUT	GET /sw.js HTTP/1.1 Host: olenabeautymassage.com Connection: keep-alive Cache-Control: max-age=0 Accept: / Service-Worker: script Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: serviceworker Referer: https://olenabeautymassage.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: dps_site_id=us-east-1; _tccl_visitor=3893fdf1-a3a4-4c4d-b14a-ad1f86a90c6b; _tccl_visit=3893fdf1-a3a4-4c4d-b14a-ad1f86a90c6b; _scc_session=pc=1&C_TOUCH=2024-09-29T13:12:17.385Z
2024-09-29 13:12:25 UTC	663	IN	HTTP/1.1 200 OK Link: <https://fonts.googleapis.com>; rel=preconnect; crossorigin,<https://fonts.gstatic.com>; rel=preconnect; crossorigin,<https://img1.wsimg.com>; rel=preconnect; crossorigin,<https://isteam.wsimg.com>; rel=preconnect; crossorigin Cache-Control: max-age=30 Content-Security-Policy: frame-ancestors 'self' godaddy.com *.godaddy.com Content-Type: application/javascript Vary: Accept-Encoding Server: DPS/2.0.0+sha-227ca78 X-Version: 227ca78 X-SiteId: us-east-1 Set-Cookie: dps_site_id=us-east-1; path=/; secure ETag: e3651b5149f34bb665ab54026e5d0701 Date: Sun, 29 Sep 2024 13:12:24 GMT Connection: close Transfer-Encoding: chunked
2024-09-29 13:12:25 UTC	15721	IN	Data Raw: 38 30 38 61 0d 0a 28 28 29 3d 3e 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 65 3d 7b 38 39 35 3a 28 29 3d 3e 7b 74 72 79 7b 73 65 6c 66 5b 22 77 6f 72 6b 62 6f 78 3a 63 61 63 68 65 61 62 6c 65 2d 72 65 73 70 6f 6e 73 65 3a 36 2e 34 2e 31 22 5d 26 26 5f 28 29 7d 63 61 74 63 68 28 65 29 7b 7d 7d 2c 32 35 39 3a 28 65 2c 74 2c 73 29 3d 3e 7b 73 2e 64 28 74 2c 7b 42 3a 28 29 3d 3e 61 7d 29 2c 73 28 39 31 33 29 3b 63 6c 61 73 73 20 61 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 29 7b 74 68 69 73 2e 70 72 6f 6d 69 73 65 3d 6e 65 77 20 50 72 6f 6d 69 73 65 28 28 28 65 2c 74 29 3d 3e 7b 74 68 69 73 2e 72 65 73 6f 6c 76 65 3d 65 2c 74 68 69 73 2e 72 65 6a 65 63 74 3d 74 7d 29 29 7d 7d 7d 2c 31 32 35 3a 28 65 2c 74 2c 73 29 3d 3e 7b 73 2e 64 28 74 2c 7b 56 3a Data Ascii: 808a(()=>{"use strict";var e={895:()=>{try{self["workbox:cacheable-response:6.4.1"]&&_()}catch(e){}},259:(e,t,s)=>{s.d(t,{B:()=>a}),s(913);class a{constructor(){this.promise=new Promise(((e,t)=>{this.resolve=e,this.reject=t}))}}},125:(e,t,s)=>{s.d(t,{V:
2024-09-29 13:12:25 UTC	16384	IN	Data Raw: 65 2c 74 29 7c 7c 52 2e 68 61 73 28 65 2c 74 29 7d 2c 73 28 35 35 30 29 3b 63 6f 6e 73 74 20 76 3d 22 63 61 63 68 65 2d 65 6e 74 72 69 65 73 22 2c 62 3d 65 3d 3e 7b 63 6f 6e 73 74 20 74 3d 6e 65 77 20 55 52 4c 28 65 2c 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 29 3b 72 65 74 75 72 6e 20 74 2e 68 61 73 68 3d 22 22 2c 74 2e 68 72 65 66 7d 3b 63 6c 61 73 73 20 78 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 65 29 7b 74 68 69 73 2e 5f 64 62 3d 6e 75 6c 6c 2c 74 68 69 73 2e 5f 63 61 63 68 65 4e 61 6d 65 3d 65 7d 5f 75 70 67 72 61 64 65 44 62 28 65 29 7b 63 6f 6e 73 74 20 74 3d 65 2e 63 72 65 61 74 65 4f 62 6a 65 63 74 53 74 6f 72 65 28 76 2c 7b 6b 65 79 50 61 74 68 3a 22 69 64 22 7d 29 3b 74 2e 63 72 65 61 74 65 49 6e 64 65 78 28 22 63 61 63 68 65 4e 61 6d 65 22 2c 22 Data Ascii: e,t)\|\|R.has(e,t)},s(550);const v="cache-entries",b=e=>{const t=new URL(e,location.href);return t.hash="",t.href};class x{constructor(e){this._db=null,this._cacheName=e}_upgradeDb(e){const t=e.createObjectStore(v,{keyPath:"id"});t.createIndex("cacheName","
2024-09-29 13:12:25 UTC	814	IN	Data Raw: 3d 3d 65 2e 64 65 73 74 69 6e 61 74 69 6f 6e 29 2c 6e 65 77 20 74 2e 53 74 61 6c 65 57 68 69 6c 65 52 65 76 61 6c 69 64 61 74 65 28 7b 63 61 63 68 65 4e 61 6d 65 3a 22 73 74 61 74 69 63 2d 72 65 73 6f 75 72 63 65 73 22 2c 70 6c 75 67 69 6e 73 3a 5b 6e 65 77 20 61 2e 43 61 63 68 65 61 62 6c 65 52 65 73 70 6f 6e 73 65 50 6c 75 67 69 6e 28 7b 73 74 61 74 75 73 65 73 3a 5b 32 30 30 5d 7d 29 5d 7d 29 29 2c 28 30 2c 65 2e 72 65 67 69 73 74 65 72 52 6f 75 74 65 29 28 28 28 7b 75 72 6c 3a 65 7d 29 3d 3e 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 22 3d 3d 3d 65 2e 6f 72 69 67 69 6e 29 2c 6e 65 77 20 74 2e 53 74 61 6c 65 57 68 69 6c 65 52 65 76 61 6c 69 64 61 74 65 28 7b 63 61 63 68 65 4e 61 6d 65 3a 22 67 6f 6f 67 6c 65 Data Ascii: ==e.destination),new t.StaleWhileRevalidate({cacheName:"static-resources",plugins:[new a.CacheableResponsePlugin({statuses:[200]})]})),(0,e.registerRoute)((({url:e})=>"https://fonts.googleapis.com"===e.origin),new t.StaleWhileRevalidate({cacheName:"google

Timestamp	Bytes transferred	Direction	Data
2024-09-29 13:12:26 UTC	548	OUT	GET /manifest.webmanifest HTTP/1.1 Host: olenabeautymassage.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: manifest Referer: https://olenabeautymassage.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-29 13:12:26 UTC	666	IN	HTTP/1.1 200 OK Link: <https://fonts.googleapis.com>; rel=preconnect; crossorigin,<https://fonts.gstatic.com>; rel=preconnect; crossorigin,<https://img1.wsimg.com>; rel=preconnect; crossorigin,<https://isteam.wsimg.com>; rel=preconnect; crossorigin Cache-Control: max-age=30 Content-Security-Policy: frame-ancestors 'self' godaddy.com *.godaddy.com Content-Type: application/manifest+json Vary: Accept-Encoding Server: DPS/2.0.0+sha-227ca78 X-Version: 227ca78 X-SiteId: us-east-1 Set-Cookie: dps_site_id=us-east-1; path=/; secure ETag: 45b379114a39bed94b1d08ef1ab86642 Date: Sun, 29 Sep 2024 13:12:26 GMT Connection: close Transfer-Encoding: chunked
2024-09-29 13:12:26 UTC	497	IN	Data Raw: 31 65 35 0d 0a 7b 22 73 63 6f 70 65 22 3a 22 2f 22 2c 22 73 74 61 72 74 5f 75 72 6c 22 3a 22 2f 22 2c 22 64 69 73 70 6c 61 79 22 3a 22 73 74 61 6e 64 61 6c 6f 6e 65 22 2c 22 69 63 6f 6e 73 22 3a 5b 7b 22 73 69 7a 65 73 22 3a 22 31 39 32 78 31 39 32 22 2c 22 74 79 70 65 22 3a 22 69 6d 61 67 65 2f 70 6e 67 22 2c 22 73 72 63 22 3a 22 2f 2f 69 6d 67 31 2e 77 73 69 6d 67 2e 63 6f 6d 2f 69 73 74 65 61 6d 2f 69 70 2f 73 74 61 74 69 63 2f 70 77 61 2d 61 70 70 2f 6c 6f 67 6f 2d 64 65 66 61 75 6c 74 2e 70 6e 67 2f 3a 2f 72 73 3d 77 3a 31 39 32 2c 68 3a 31 39 32 2c 6d 22 7d 2c 7b 22 73 69 7a 65 73 22 3a 22 35 31 32 78 35 31 32 22 2c 22 74 79 70 65 22 3a 22 69 6d 61 67 65 2f 70 6e 67 22 2c 22 73 72 63 22 3a 22 2f 2f 69 6d 67 31 2e 77 73 69 6d 67 2e 63 6f 6d 2f 69 73 Data Ascii: 1e5{"scope":"/","start_url":"/","display":"standalone","icons":[{"sizes":"192x192","type":"image/png","src":"//img1.wsimg.com/isteam/ip/static/pwa-app/logo-default.png/:/rs=w:192,h:192,m"},{"sizes":"512x512","type":"image/png","src":"//img1.wsimg.com/is

Timestamp	Bytes transferred	Direction	Data
2024-09-29 13:12:37 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 35 76 38 65 6a 6d 4c 78 32 55 71 44 54 53 6f 58 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 61 39 32 61 64 63 33 62 63 64 64 63 64 39 37 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 5v8ejmLx2UqDTSoX.1Context: 1a92adc3bcddcd97
2024-09-29 13:12:37 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-09-29 13:12:37 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 35 76 38 65 6a 6d 4c 78 32 55 71 44 54 53 6f 58 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 61 39 32 61 64 63 33 62 63 64 64 63 64 39 37 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 53 4e 4b 38 62 75 69 73 34 46 69 56 42 76 50 64 4e 59 78 6f 49 58 2b 2f 42 57 6e 67 39 7a 78 38 52 51 33 56 74 37 75 54 62 52 2b 36 31 4a 38 34 54 72 6d 55 57 49 79 59 53 6d 42 37 4b 52 62 45 75 6e 59 77 45 61 6e 55 37 6c 42 67 42 32 75 58 41 32 38 43 78 61 6b 2f 68 46 68 37 68 4e 33 50 32 52 39 36 43 75 6c 52 70 36 4c 32 77 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 5v8ejmLx2UqDTSoX.2Context: 1a92adc3bcddcd97<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAASNK8buis4FiVBvPdNYxoIX+/BWng9zx8RQ3Vt7uTbR+61J84TrmUWIyYSmB7KRbEunYwEanU7lBgB2uXA28Cxak/hFh7hN3P2R96CulRp6L2w
2024-09-29 13:12:37 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 35 76 38 65 6a 6d 4c 78 32 55 71 44 54 53 6f 58 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 61 39 32 61 64 63 33 62 63 64 64 63 64 39 37 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 5v8ejmLx2UqDTSoX.3Context: 1a92adc3bcddcd97<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-09-29 13:12:37 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-09-29 13:12:37 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 41 4b 34 34 38 57 45 79 37 55 2b 63 75 49 2f 57 66 32 46 68 38 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: AK448WEy7U+cuI/Wf2Fh8Q.0Payload parsing failed.

Timestamp	Bytes transferred	Direction	Data
2024-09-29 13:13:04 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 75 2f 57 47 62 58 67 48 38 6b 4b 31 39 48 6f 61 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 33 38 30 38 35 31 37 38 34 34 33 33 31 39 64 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: u/WGbXgH8kK19Hoa.1Context: f38085178443319d
2024-09-29 13:13:04 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-09-29 13:13:04 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 75 2f 57 47 62 58 67 48 38 6b 4b 31 39 48 6f 61 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 33 38 30 38 35 31 37 38 34 34 33 33 31 39 64 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 53 4e 4b 38 62 75 69 73 34 46 69 56 42 76 50 64 4e 59 78 6f 49 58 2b 2f 42 57 6e 67 39 7a 78 38 52 51 33 56 74 37 75 54 62 52 2b 36 31 4a 38 34 54 72 6d 55 57 49 79 59 53 6d 42 37 4b 52 62 45 75 6e 59 77 45 61 6e 55 37 6c 42 67 42 32 75 58 41 32 38 43 78 61 6b 2f 68 46 68 37 68 4e 33 50 32 52 39 36 43 75 6c 52 70 36 4c 32 77 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: u/WGbXgH8kK19Hoa.2Context: f38085178443319d<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAASNK8buis4FiVBvPdNYxoIX+/BWng9zx8RQ3Vt7uTbR+61J84TrmUWIyYSmB7KRbEunYwEanU7lBgB2uXA28Cxak/hFh7hN3P2R96CulRp6L2w
2024-09-29 13:13:04 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 75 2f 57 47 62 58 67 48 38 6b 4b 31 39 48 6f 61 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 33 38 30 38 35 31 37 38 34 34 33 33 31 39 64 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: u/WGbXgH8kK19Hoa.3Context: f38085178443319d<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-09-29 13:13:04 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-09-29 13:13:04 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 50 38 4e 41 70 55 39 37 59 6b 75 65 71 62 73 61 50 2b 5a 61 70 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: P8NApU97YkueqbsaP+Zapw.0Payload parsing failed.

Target ID:	0
Start time:	09:12:04
Start date:	29/09/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false