Edit tour

Windows Analysis Report
https://iplogger.org/pl/

Overview

General Information

Sample URL:	https://iplogger.org/pl/
Analysis ID:	1526259
Tags:	urlscan
Infos:

Detection

Score:	3
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Connects to several IPs in different countries

Detected non-DNS traffic on DNS port

Executes massive DNS lookups (> 100)

HTML page contains hidden javascript code

Javascript checks online IP of machine

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64

chrome.exe (PID: 1992 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 1004 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2548 --field-trial-handle=2508,i,17245069614072670385,11743802599291548819,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 6688 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://iplogger.org/pl/" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

cleanup

HTTP traffic detected: POST /cdn-cgi/challenge-platform/h/g/jsd/r/8cd8aca56b5c8c41 HTTP/1.1Host: iplogger.orgConnection: keep-aliveContent-Length: 15774sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/jsonAccept: */*Origin: https://iplogger.orgSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _lang=pl; cursor=fLQSi4D3b6c1e8A0D8m2h7x1DYVrKerq; turnback=main%2F

Source: https://4634ffa3edc914a04c470afd55925999.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html	HTTP Parser: vu("https://ban.2trk.info/rtgban?bannerparam\x3dsize\x3d4129::cmpid\x3d64785::bmpclickurl\x3dhttps://adclick.g.doubleclick.net/aclk%3fsa%3dl%26ai%3dcoagw_g4az4rwl5nc9u8p9flpekjn4yfz0a7xgsirwi23arabiabgyqacardjys1wdwitnde0odqxmjizmzuzmdc3n8gbceacakgdacgdaqoe_gfp0nvd9zgijoa-rea5ibvf2_hfu1ogedno84yx_ir4cpt9sy5ssg1jymoobkriyhqz8r4leve3trbbm64wudncifvntx_oxicuvsfdphvijsko_s50ssyvi0kmt37zqztv-duvn7iotq1zp9-d5u-lsxt_aae1c0tv-dcols76fj0rncw9kqtwtb7t5f3gdlo4gbt79_r6wgvtm0l1y2hiuvldiwolbahrqfnuepjg56zh4p0yaecsvjujusaxf0ntlhjnakfbweubjp8th3ofiesdjyncobncv48k9j_j-ho_9ogs9c-ynywzhtd_3gjytgc5u8959ad04qdrruaeayagqttsxtjo9qbjaaagiaghpr4bqaew2buob6qbsqkob4otsqkob_-esqkob9-fsqkob62-sqlybwdsccqiggeqaticigi6c4bagmcagicgqiacsl39wtpyuecg7ox1iap6cwiiayamaeinewjjpahs5fwiaxuzof0hhxv5gg_qfqgafwgyfwiyda%26num%3d1%26sig%3daod64_3virhe3uy5tijilukk6vntd3ta3a%26client%3dca-pub-4148412233530777%26adurl%3dhttps%3a%2f%2fban.2trk.info%2fclick%3frequiredparams%3deyjyyw5rn0eioiiwiiwiymfubmvyvhlwzsi6im5hdgl2zsisimnyaxrlcmlhswqioiiyodqwiiwidhkioii...
Source: https://fundingchoicesmessages.google.com/f/AGSKWxUnc0pYZN22qpSwLx-kkLXe_He5yiF5S1N46dKiLkf6BHbf-CzZVuQBrqonaraeIBu_LfvThmdljxhWjdQv4tTr5IiNi6jOGmb2QWtipVzz9sE9cBodrn-e1LabycMl6YRxRS367Q==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzI4MDgxNjU2LDYzMDAwMDAwXSxudWxsLG51bGwsbnVsbCxbbnVsbCxbNyw2LDEwLDldLG51bGwsMixudWxsLCJlbiIsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLDFdLCJodHRwczovL2lwbG9nZ2VyLm9yZy9wbC8iLG51bGwsW1s4LCItX2dSOThUaG5kMCJdLFs5LCJlbi1VUyJdLFsxOSwiMiJdXV0	HTTP Parser: if (typeof __googlefc.fckernelmanager.run === 'function') {"use strict";this.default_contributorservingresponseclientjs=this.default_contributorservingresponseclientjs\|\|{};(function(_){var window=this;try{var to=function(a){this.l=_.v(a)};_.z(to,_.i);var uo=function(a){this.l=_.v(a)};_.z(uo,_.i);uo.prototype.getwhiteliststatus=function(){return _.l(this,2)};var vo=function(a){this.l=_.v(a)};_.z(vo,_.i);var wo=_.x(vo),xo=function(a,b,c){this.c=a;this.g=_.f(b,to,1);this.i=_.f(b,_.pl,3);this.a=_.f(b,uo,4);a=this.c.location.hostname;this.u=_.dg(this.g,2)&&_.h(this.g,2)!==""?_.h(this.g,2):a;a=new _.sh(_.ql(this.i));this.o=new _.yh(_.t.document,this.u,a);this.j=new _.po(c,a)};xo.prototype.run=function(){if(_.h(this.g,3)){var a=this.o,b=_.h(this.g,3),c=_.$h(a),d=new _.uh;b=_.cg(d,1,b);c=_.n(c,1,b);_.di(a,c)}else _.ai(this.o,"fcnec");_.ro(this.j,_.f(this.i,_.pd,1),this.i.getdefaultconsentrevocationtext(),this.i.getdefaultconsentrevocationclosetext(),this.i.getdefaultconsentrevocationattestationtext(),this.u);_.so(...
Source: https://googleads.g.doubleclick.net/pagead/html/r20241001/r20190131/zrt_lookup_fy2021.html	HTTP Parser: window.parent.postmessage('{"googmsgtype":"pvt","token":"aorygslg2em8bv26egodnlvkmki9yvl23gakoyfaniraydr3wcroikf2czmcwqbtrwsmnw6ozxp_cczoilz241h4b11fjpnmslmsnh4x_pufdem6ces"}', '');window.top.postmessage('{"msg_type":"adsense-labs","key_value":[{"key":"settings","value":"[\\\"ca-pub-6886789169244828\\\",[[1]],null,[[\\\"id=4a89fc91426be815:t=1728081652:rt=1728081652:s=alni_mygotcjupzweksjeblhzmddydkxka\\\",1761777652,\\\"/\\\",\\\"iplogger.org\\\",1],[\\\"uid=00000f02cc538014:t=1728081652:rt=1728081652:s=alni_mya84dfy3cjldurxmjr6dwuo2rubg\\\",1761777652,\\\"/\\\",\\\"iplogger.org\\\",2]],[\\\"id=2654dab390b31786:t=1728081652:rt=1728081652:s=aa-afjbllpgimr6wvnfye8fxpkxb\\\",1743633652,\\\"/\\\",\\\"iplogger.org\\\"]]"}],"googmsgtype":"sth"}', '');window.top.postmessage('{"key_value":[{"key":"qid","value":"cp-imejl9ygdfxkxgwcdyh4xvq"}],"googmsgtype":"adpnt"}', '*');
Source: https://fundingchoicesmessages.google.com/f/AGSKWxVQZnLGKwzIYXgZ2evTw7gZ62kIxMhNMTossTZ4ud8S7zuiBBYAyOhOdp4paDCLSEiY2gaCrLUxcwDauTA6RsdCJSjL7b54-nZBQ_Iqqem8Ot3eZt26X98BmjRtPhxmtyZoUrcT6Q==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzI4MDgxNjUzLDE5MTAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsNl0sbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsMV0sImh0dHBzOi8vaXBsb2dnZXIub3JnL3BsLyIsbnVsbCxbWzgsIi1fZ1I5OFRobmQwIl0sWzksImVuLVVTIl0sWzE5LCIyIl1dXQ	HTTP Parser: if (typeof __googlefc.fckernelmanager.run === 'function') {"use strict";this.default_contributorservingresponseclientjs=this.default_contributorservingresponseclientjs\|\|{};(function(_){var window=this;try{var es,fs,gs,hs,is,js;_.ds=function(a){var b=new map;a=_.r(a);for(var c=a.next();!c.done;c=a.next()){c=c.value;var d=_.l(c,1);cs.has(d)&&_.l(c,2)===2&&b.set(d,cs.get(d))}return b};es={unknown:0,ccpa_does_not_apply:1,not_opted_out:2,opted_out:3};fs={unknown:0,does_not_apply:1,not_opted_out:2,opted_out:3};gs={unknown:0,does_not_apply:1,not_opted_out:2,opted_out:3};hs={unknown:0,does_not_apply:1,not_opted_out:2,opted_out:3};is={unknown:0,does_not_apply:1,not_opted_out:2,opted_out:3};js={unknown:0,does_not_apply:1,not_opted_out:2,opted_out:3};_.ls=function(a,b,c,d,e,f){this.g=a;this.b=b;this.j=c;this.localizeddnstext=d===void 0?null:d;this.localizeddnscollapsetext=e===void 0?null:e;this.i=f;this.overridednslink=_.ks(a);this.initialccpastatusenum=es};_.l=_.ls.prototype;_.l.load=function(){_.qo("ccpa",this,!0,...
Source: https://fundingchoicesmessages.google.com/f/AGSKWxV-IYEyei86Ws7uvrYSJPs9Wvy_09jq-4TnOg-eITQZeobLqGjsRryd2fs6VjSrKA9CH1qdfcotuf9fWMnLsSHwv-ao2o9lz8cWTW_UjozyFPifLnNHoQXBSWkk1MYBrrh4rNorTA==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzI4MDgxNjU0LDUwODAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsNiwxMF0sbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsMV0sImh0dHBzOi8vaXBsb2dnZXIub3JnL3BsLyIsbnVsbCxbWzgsIi1fZ1I5OFRobmQwIl0sWzksImVuLVVTIl0sWzE5LCIyIl1dXQ	HTTP Parser: if (typeof __googlefc.fckernelmanager.run === 'function') {"use strict";this.default_contributorservingresponseclientjs=this.default_contributorservingresponseclientjs\|\|{};(function(_){var window=this;try{var cd=function(a){this.l=_.v(a)};_.z(cd,_.i);var dd=_.x(cd);var ed=function(a,b,c){this.o=a;this.params=b;this.i=c;this.g=_.l(this.params,4);this.u=_.l(this.params,6);this.j=new _.yh(this.o.document,_.h(this.params,3),new _.sh(_.ql(this.i)))};ed.prototype.run=function(){var a=this.g===3&&this.u===1;if(this.g!==2&&!a){a=this.j;var b=_.pf(_.zh(a),4);_.ci(a,b)}a=_.rl(this.i)?_.qb(_.rl(this.i)):new _.sd;_.td(a,9);_.l(a,4)!==1&&_.m(a,4,this.g===2\|\|this.g===3?1:2);_.dg(this.params,5)&&(b=_.h(this.params,5),_.cg(a,6,b));return a};var fd=function(){};fd.prototype.run=function(a,b){var c,d;return _.a(function(e){c=dd(b);d=(new ed(a,c,_.f(c,_.pl,2))).run();return e.return({da:_.k(d)})})};_.tl(8,new fd);}catch(e){_._dumpexception(e)}}).call(this,this.default_contributorservingresponseclientjs);// google inc.//#...

Source: https://iplogger.org/pl/	HTTP Parser: No favicon
Source: https://iplogger.org/pl/	HTTP Parser: No favicon
Source: https://iplogger.org/pl/	HTTP Parser: No favicon
Source: https://iplogger.org/pl/	HTTP Parser: No favicon
Source: https://iplogger.org/pl/	HTTP Parser: No favicon
Source: https://iplogger.org/pl/	HTTP Parser: No favicon
Source: https://iplogger.org/pl/	HTTP Parser: No favicon
Source: https://iplogger.org/pl/	HTTP Parser: No favicon
Source: https://iplogger.org/pl/	HTTP Parser: No favicon
Source: https://iplogger.org/pl/	HTTP Parser: No favicon
Source: https://iplogger.org/pl/	HTTP Parser: No favicon
Source: https://iplogger.org/pl/	HTTP Parser: No favicon
Source: https://iplogger.org/pl/	HTTP Parser: No favicon
Source: https://iplogger.org/pl/	HTTP Parser: No favicon
Source: https://iplogger.org/pl/	HTTP Parser: No favicon
Source: https://iplogger.org/pl/	HTTP Parser: No favicon
Source: https://iplogger.org/pl/	HTTP Parser: No favicon
Source: https://iplogger.org/pl/	HTTP Parser: No favicon
Source: https://iplogger.org/pl/	HTTP Parser: No favicon
Source: https://iplogger.org/pl/	HTTP Parser: No favicon
Source: https://iplogger.org/pl/	HTTP Parser: No favicon
Source: https://iplogger.org/pl/	HTTP Parser: No favicon
Source: https://iplogger.org/pl/	HTTP Parser: No favicon
Source: https://iplogger.org/pl/	HTTP Parser: No favicon
Source: https://iplogger.org/pl/	HTTP Parser: No favicon
Source: https://iplogger.org/pl/	HTTP Parser: No favicon
Source: https://iplogger.org/pl/	HTTP Parser: No favicon
Source: https://iplogger.org/pl/	HTTP Parser: No favicon
Source: https://iplogger.org/pl/	HTTP Parser: No favicon
Source: https://iplogger.org/pl/	HTTP Parser: No favicon
Source: https://iplogger.org/pl/	HTTP Parser: No favicon
Source: https://iplogger.org/pl/	HTTP Parser: No favicon
Source: https://iplogger.org/pl/	HTTP Parser: No favicon
Source: https://iplogger.org/pl/	HTTP Parser: No favicon
Source: https://iplogger.org/pl/	HTTP Parser: No favicon
Source: https://iplogger.org/pl/	HTTP Parser: No favicon
Source: https://iplogger.org/pl/	HTTP Parser: No favicon
Source: https://iplogger.org/pl/	HTTP Parser: No favicon
Source: https://iplogger.org/pl/	HTTP Parser: No favicon
Source: https://iplogger.org/pl/	HTTP Parser: No favicon
Source: https://iplogger.org/pl/	HTTP Parser: No favicon
Source: https://iplogger.org/pl/	HTTP Parser: No favicon
Source: https://iplogger.org/pl/	HTTP Parser: No favicon
Source: https://iplogger.org/pl/	HTTP Parser: No favicon
Source: https://iplogger.org/pl/	HTTP Parser: No favicon
Source: https://iplogger.org/pl/	HTTP Parser: No favicon
Source: https://iplogger.org/pl/	HTTP Parser: No favicon
Source: https://iplogger.org/pl/	HTTP Parser: No favicon
Source: https://iplogger.org/pl/	HTTP Parser: No favicon
Source: https://iplogger.org/pl/	HTTP Parser: No favicon
Source: https://iplogger.org/pl/	HTTP Parser: No favicon
Source: https://iplogger.org/pl/	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.10:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.10:49785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.10:49825 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.222.162.55:443 -> 192.168.2.10:49929 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.10:50105 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 46.228.174.117:443 -> 192.168.2.10:50779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 46.228.174.117:443 -> 192.168.2.10:50889 version: TLS 1.2

Source: global traffic	TCP traffic: 192.168.2.10:50209 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.10:50353 -> 1.1.1.1:53

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.55
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.55
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.85
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.85
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.85
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.85
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60

Source: chromecache_437.4.dr, chromecache_369.4.dr, chromecache_513.4.dr	String found in binary or memory: <a class="footer__social-i fb" href="https://www.facebook.com/iploggerteam" title="Follow us on Facebook" target="_blank"><span class="soc-ico"></span></a> equals www.facebook.com (Facebook)
Source: chromecache_437.4.dr, chromecache_369.4.dr, chromecache_513.4.dr	String found in binary or memory: <a class="footer__social-i yt" href="https://www.youtube.com/@IPLogger-official" title="Follow us on YouTube" target="_blank"><span class="soc-ico"></span></a> equals www.youtube.com (Youtube)
Source: chromecache_434.4.dr, chromecache_561.4.dr	String found in binary or memory: Math.round(q);u["gtm.videoElapsedTime"]=Math.round(f);u["gtm.videoPercent"]=r;u["gtm.videoVisible"]=t;return u},bk:function(){e=zb()},nd:function(){d()}}};var gc=la(["data-gtm-yt-inspected-"]),LC=["www.youtube.com","www.youtube-nocookie.com"],MC,NC=!1; equals www.youtube.com (Youtube)
Source: chromecache_434.4.dr, chromecache_561.4.dr	String found in binary or memory: c?"runIfCanceled":"runIfUncanceled",[]);if(!g.length)return!0;var k=rA(a,c,e);Q(121);if(k["gtm.elementUrl"]==="https://www.facebook.com/tr/")return Q(122),!0;if(d&&f){for(var m=Kb(b,g.length),n=0;n<g.length;++n)g[n](k,m);return m.done}for(var p=0;p<g.length;++p)g[p](k,function(){});return!0},uA=function(){var a=[],b=function(c){return pb(a,function(d){return d.form===c})};return{store:function(c,d){var e=b(c);e?e.button=d:a.push({form:c,button:d})},get:function(c){var d=b(c);return d?d.button:null}}}, equals www.facebook.com (Facebook)
Source: chromecache_434.4.dr, chromecache_561.4.dr	String found in binary or memory: if(!(e\|\|f\|\|g\|\|k.length\|\|m.length))return;var p={hh:e,fh:f,gh:g,Rh:k,Sh:m,He:n,Cb:b},q=C.YT;if(q)return q.ready&&q.ready(d),b;var r=C.onYouTubeIframeAPIReady;C.onYouTubeIframeAPIReady=function(){r&&r();d()};F(function(){for(var t=E.getElementsByTagName("script"),v=t.length,u=0;u<v;u++){var w=t[u].getAttribute("src");if(WC(w,"iframe_api")\|\|WC(w,"player_api"))return b}for(var x=E.getElementsByTagName("iframe"),y=x.length,A=0;A<y;A++)if(!NC&&UC(x[A],p.He))return wc("https://www.youtube.com/iframe_api"), equals www.youtube.com (Youtube)
Source: chromecache_486.4.dr, chromecache_426.4.dr	String found in binary or memory: return b}JC.F="internal.enableAutoEventOnTimer";var gc=la(["data-gtm-yt-inspected-"]),LC=["www.youtube.com","www.youtube-nocookie.com"],MC,NC=!1; equals www.youtube.com (Youtube)
Source: chromecache_434.4.dr, chromecache_561.4.dr	String found in binary or memory: var YB=function(a,b,c,d,e){var f=Pz("fsl",c?"nv.mwt":"mwt",0),g;g=c?Pz("fsl","nv.ids",[]):Pz("fsl","ids",[]);if(!g.length)return!0;var k=Uz(a,"gtm.formSubmit",g),m=a.action;m&&m.tagName&&(m=a.cloneNode(!1).action);Q(121);if(m==="https://www.facebook.com/tr/")return Q(122),!0;k["gtm.elementUrl"]=m;k["gtm.formCanceled"]=c;a.getAttribute("name")!=null&&(k["gtm.interactedFormName"]=a.getAttribute("name"));e&&(k["gtm.formSubmitElement"]=e,k["gtm.formSubmitElementText"]=e.value);if(d&&f){if(!Cy(k,Ey(b, equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: iplogger.org
Source: global traffic	DNS traffic detected: DNS query: cdn.iplogger.org
Source: global traffic	DNS traffic detected: DNS query: static.cloudflareinsights.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: m.servedby-buysellads.com
Source: global traffic	DNS traffic detected: DNS query: fundingchoicesmessages.google.com
Source: global traffic	DNS traffic detected: DNS query: googleads.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: srv.buysellads.com
Source: global traffic	DNS traffic detected: DNS query: cdn4.buysellads.net
Source: global traffic	DNS traffic detected: DNS query: counter.yadro.ru
Source: global traffic	DNS traffic detected: DNS query: btloader.com
Source: global traffic	DNS traffic detected: DNS query: securepubads.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: ad-delivery.net
Source: global traffic	DNS traffic detected: DNS query: ad.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: analytics.google.com
Source: global traffic	DNS traffic detected: DNS query: stats.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: td.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: api.btloader.com
Source: global traffic	DNS traffic detected: DNS query: script.4dex.io
Source: global traffic	DNS traffic detected: DNS query: ib.adnxs.com
Source: global traffic	DNS traffic detected: DNS query: hbopenbid.pubmatic.com
Source: global traffic	DNS traffic detected: DNS query: rt.marphezis.com
Source: global traffic	DNS traffic detected: DNS query: hb-api.omnitagjs.com
Source: global traffic	DNS traffic detected: DNS query: bidder.criteo.com
Source: global traffic	DNS traffic detected: DNS query: pbjs.e-planning.net
Source: global traffic	DNS traffic detected: DNS query: mp.4dex.io
Source: global traffic	DNS traffic detected: DNS query: exchange.cootlogix.com
Source: global traffic	DNS traffic detected: DNS query: prebid.media.net
Source: global traffic	DNS traffic detected: DNS query: onetag-sys.com
Source: global traffic	DNS traffic detected: DNS query: ads.servenobid.com
Source: global traffic	DNS traffic detected: DNS query: c.4dex.io
Source: global traffic	DNS traffic detected: DNS query: cadmus.script.ac
Source: global traffic	DNS traffic detected: DNS query: static.criteo.net
Source: global traffic	DNS traffic detected: DNS query: sync.cootlogix.com
Source: global traffic	DNS traffic detected: DNS query: public.servenobid.com
Source: global traffic	DNS traffic detected: DNS query: ads.pubmatic.com
Source: global traffic	DNS traffic detected: DNS query: acdn.adnxs.com
Source: global traffic	DNS traffic detected: DNS query: visitor.omnitagjs.com
Source: global traffic	DNS traffic detected: DNS query: gw-iad-bid.ymmobi.com
Source: global traffic	DNS traffic detected: DNS query: u-ams03.e-planning.net
Source: global traffic	DNS traffic detected: DNS query: cdn.2trk.info
Source: global traffic	DNS traffic detected: DNS query: ban.2trk.info
Source: global traffic	DNS traffic detected: DNS query: um.simpli.fi
Source: global traffic	DNS traffic detected: DNS query: ads.yieldmo.com
Source: global traffic	DNS traffic detected: DNS query: ssbsync.smartadserver.com
Source: global traffic	DNS traffic detected: DNS query: creativecdn.com
Source: global traffic	DNS traffic detected: DNS query: sync-dmp.aura-dsp.com
Source: global traffic	DNS traffic detected: DNS query: sync.gonet-ads.com
Source: global traffic	DNS traffic detected: DNS query: csync.loopme.me
Source: global traffic	DNS traffic detected: DNS query: cm.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: pm.w55c.net
Source: global traffic	DNS traffic detected: DNS query: sync-tm.everesttech.net
Source: global traffic	DNS traffic detected: DNS query: match.prod.bidr.io
Source: global traffic	DNS traffic detected: DNS query: s.uuidksinc.net
Source: global traffic	DNS traffic detected: DNS query: dsp.adkernel.com
Source: global traffic	DNS traffic detected: DNS query: ssum-sec.casalemedia.com
Source: global traffic	DNS traffic detected: DNS query: secure.adnxs.com
Source: global traffic	DNS traffic detected: DNS query: dis.criteo.com
Source: global traffic	DNS traffic detected: DNS query: api-2-0.spot.im
Source: global traffic	DNS traffic detected: DNS query: sync.richaudience.com
Source: global traffic	DNS traffic detected: DNS query: sync.1rx.io
Source: global traffic	DNS traffic detected: DNS query: x.bidswitch.net
Source: global traffic	DNS traffic detected: DNS query: eu-west-1-cs-rtb.openwebmp.com
Source: global traffic	DNS traffic detected: DNS query: gum.aidemsrv.com
Source: global traffic	DNS traffic detected: DNS query: player.aniview.com
Source: global traffic	DNS traffic detected: DNS query: secure-assets.rubiconproject.com
Source: global traffic	DNS traffic detected: DNS query: ssc-cms.33across.com
Source: global traffic	DNS traffic detected: DNS query: cs-server-s2s.yellowblue.io
Source: global traffic	DNS traffic detected: DNS query: image8.pubmatic.com
Source: global traffic	DNS traffic detected: DNS query: g2.gumgum.com
Source: global traffic	DNS traffic detected: DNS query: pixel.33across.com
Source: global traffic	DNS traffic detected: DNS query: image6.pubmatic.com
Source: global traffic	DNS traffic detected: DNS query: cdn.dxkulture.com
Source: global traffic	DNS traffic detected: DNS query: ce.lijit.com
Source: global traffic	DNS traffic detected: DNS query: ap.lijit.com
Source: global traffic	DNS traffic detected: DNS query: p.rfihub.com
Source: global traffic	DNS traffic detected: DNS query: sync.go.sonobi.com
Source: global traffic	DNS traffic detected: DNS query: prebid.a-mo.net
Source: global traffic	DNS traffic detected: DNS query: ssp.disqus.com
Source: global traffic	DNS traffic detected: DNS query: de.tynt.com
Source: global traffic	DNS traffic detected: DNS query: visitor-risecode.omnitagjs.com
Source: global traffic	DNS traffic detected: DNS query: s.ad.smaato.net
Source: global traffic	DNS traffic detected: DNS query: us-u.openx.net
Source: global traffic	DNS traffic detected: DNS query: ads.stickyadstv.com
Source: global traffic	DNS traffic detected: DNS query: eus.rubiconproject.com
Source: global traffic	DNS traffic detected: DNS query: rtb-csync.smartadserver.com
Source: global traffic	DNS traffic detected: DNS query: cs.admanmedia.com
Source: global traffic	DNS traffic detected: DNS query: s.company-target.com
Source: global traffic	DNS traffic detected: DNS query: dsum-sec.casalemedia.com
Source: global traffic	DNS traffic detected: DNS query: s.amazon-adsystem.com
Source: global traffic	DNS traffic detected: DNS query: i.liadm.com
Source: global traffic	DNS traffic detected: DNS query: casale-match.dotomi.com
Source: global traffic	DNS traffic detected: DNS query: ads.creative-serving.com
Source: global traffic	DNS traffic detected: DNS query: widget.us.criteo.com
Source: global traffic	DNS traffic detected: DNS query: hde.tynt.com
Source: global traffic	DNS traffic detected: DNS query: aax-eu.amazon-adsystem.com
Source: global traffic	DNS traffic detected: DNS query: cms.quantserve.com
Source: global traffic	DNS traffic detected: DNS query: t.adx.opera.com
Source: global traffic	DNS traffic detected: DNS query: dsp-cookie.adfarm1.adition.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundcache-control: no-cache, no-store, must-revalidateexpires: 0pragma: no-cachevary: Accept-Encodingx-content-type-options: nosniffdate: Fri, 04 Oct 2024 22:41:03 GMTcontent-length: 9content-type: text/plain; charset=utf-8x-envoy-upstream-service-time: 0server: ayl-lb-fra02connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service Unavailable: Back-end server is at capacityContent-Length: 0Connection: Close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundcache-control: no-cache, no-store, must-revalidateexpires: 0pragma: no-cachevary: Accept-Encodingx-content-type-options: nosniffdate: Fri, 04 Oct 2024 22:41:39 GMTcontent-length: 9content-type: text/plain; charset=utf-8x-envoy-upstream-service-time: 0server: ayl-lb-fra02connection: close

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2548 --field-trial-handle=2508,i,17245069614072670385,11743802599291548819,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://iplogger.org/pl/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2548 --field-trial-handle=2508,i,17245069614072670385,11743802599291548819,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label
https://ampcid.google.com/v1/publisher:getClientId	0%	URL Reputation	safe
http://mathiasbynens.be/	0%	URL Reputation	safe
https://dis.criteo.com/dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCookie=uid:@@CRITEO_USERID@@	0%	URL Reputation	safe
https://cse.google.com/cse.js	0%	URL Reputation	safe

Name	IP	Active	Malicious	Reputation
securepubads.g.doubleclick.net	142.250.185.162	true	false	unknown
um.simpli.fi	35.204.74.118	true	false	unknown
static.nl3.vip.prod.criteo.net	178.250.1.3	true	false	unknown
global.px.quantserve.com	91.228.74.200	true	false	unknown
ssum.casalemedia.com	104.18.36.155	true	false	unknown
cs.admanmedia.com	80.77.87.162	true	false	unknown
prebid.media.net	34.120.63.153	true	false	unknown
d2yy6p64xsttp1.cloudfront.net	13.32.121.74	true	false	unknown
d-ams1.turn.com	46.228.164.13	true	false	unknown
sync.gonet-ads.com	23.109.14.96	true	false	unknown
rtb.openx.net	35.227.252.103	true	false	unknown
bttrack.com	192.132.33.68	true	false	unknown
stats.g.doubleclick.net	64.233.167.157	true	false	unknown
cdn.w55c.net	3.68.12.15	true	false	unknown
mwzeom.zeotap.com	104.22.50.98	true	false	unknown
ats-eks.eu-central-1.dcs-online-targeting-prd.aws.oath.cloud	3.71.149.231	true	false	unknown
dsum.casalemedia.com	104.18.36.155	true	false	unknown
www.google.com	142.250.184.196	true	false	unknown
c.4dex.io	35.241.34.106	true	false	unknown
sync.intentiq.com	3.160.150.86	true	false	unknown
dckrl2e5yf7xg.cloudfront.net	18.245.46.117	true	false	unknown
id.rlcdn.com	35.244.174.68	true	false	unknown
dsp-cookie.adfarm1.adition.com	80.82.210.217	true	false	unknown
match.adsrvr.org	52.223.40.198	true	false	unknown
match.prod.bidr.io	52.213.102.87	true	false	unknown
ow-lhrc.pubmnet.com	185.64.190.84	true	false	unknown
pagead-googlehosted.l.google.com	172.217.16.193	true	false	unknown
creativecdn.com	185.184.8.90	true	false	unknown
pugm-lhrc.pubmnet.com	185.64.190.78	true	false	unknown
uip.semasio.net	77.243.51.121	true	false	unknown
zeta-ssp-385516103.us-east-1.elb.amazonaws.com	3.227.91.106	true	false	unknown
m.deepintent.com	38.91.45.7	true	false	unknown
events-ssc.33across.com	34.117.239.71	true	false	unknown
nld-prebid.a-mx.net	163.5.194.32	true	false	unknown
pug-lhr-bc.pubmnet.com	185.64.191.210	true	false	unknown
pixel-sync.sitescout.com	34.36.216.150	true	false	unknown
pixel.onaudience.com	54.38.113.7	true	false	unknown
euw-ice.360yield.com	34.251.49.219	true	false	unknown
ssum-sec.casalemedia.com	104.18.36.155	true	false	unknown
googleads.g.doubleclick.net	142.250.186.130	true	false	unknown

Name	Source	Malicious	Antivirus Detection	Reputation
https://cdn.iplogger.org/tools/tools_14.webp)	chromecache_292.4.dr, chromecache_447.4.dr	false		unknown
https://ads.stickyadstv.com/user-matching?id=3663&gdpr=0&gdpr_consent=	chromecache_402.4.dr, chromecache_578.4.dr	false		unknown
https://ampcid.google.com/v1/publisher:getClientId	chromecache_412.4.dr, chromecache_364.4.dr	false	URL Reputation: safe	unknown
https://help.iplogger.org/knowledgebase.php?category=2	chromecache_437.4.dr, chromecache_369.4.dr, chromecache_513.4.dr	false		unknown
https://cdn.iplogger.org/icons/subscription.svg)	chromecache_447.4.dr	false		unknown
https://help.iplogger.org/knowledgebase.php?category=7	chromecache_437.4.dr	false		unknown
https://cdn.iplogger.org/icons/tools_7.svg	chromecache_437.4.dr, chromecache_369.4.dr, chromecache_513.4.dr	false		unknown
https://cdn.iplogger.org/icons/tools_12.svg	chromecache_437.4.dr, chromecache_369.4.dr, chromecache_513.4.dr	false		unknown
https://ep1.adtrafficquality.google/pagead/gen_204?id=sodar2&v=231	chromecache_388.4.dr	false		unknown
https://twitter.com/iplogger_team	chromecache_437.4.dr, chromecache_369.4.dr, chromecache_513.4.dr	false		unknown
https://ep1.adtrafficquality.google/pagead/gen_204?id=sodar2&v=232	chromecache_629.4.dr, chromecache_318.4.dr	false		unknown
https://googleads.g.doubleclick.net/pagead/images/mtad/back_blue.png	chromecache_276.4.dr, chromecache_355.4.dr	false		unknown
https://googleads.g.doubleclick.net/pagead/images/mtad/x_blue.png	chromecache_276.4.dr, chromecache_355.4.dr	false		unknown
https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs	chromecache_402.4.dr, chromecache_578.4.dr	false		unknown
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=NTk2MGFjYjYtNWRlMy0yMTYwLWQxNmQtZjk2ZW	chromecache_468.4.dr	false		unknown
http://mathiasbynens.be/	chromecache_491.4.dr, chromecache_383.4.dr	false	URL Reputation: safe	unknown
https://b1sync.zemanta.com/usersync/gumgum/?puid=e_8bcd42bd-ec75-4d1d-9037-a778c6b07322&gdpr=0&gdpr_	chromecache_384.4.dr	false		unknown
https://rt.marphezis.com/prebid/$	chromecache_622.4.dr, chromecache_357.4.dr	false		unknown
https://secure.adnxs.com/getuid?https%3A%2F%2Fcs.openwebmp.com%2Fcs%3Faid%3D40026%26id%3D$UID&gdpr=0	chromecache_474.4.dr	false		unknown
https://eb2.3lift.com/getuid?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcs.openwebmp.com%2Fcs%3Faid%3D	chromecache_474.4.dr	false		unknown
https://www.kayak.com/semi/gdntext/hotel_destination/315033/en.html%3Fz_sig%3D21b728a03259a111%26z_t	chromecache_355.4.dr	false		unknown
https://ep2.adtrafficquality.google/sodar/$	chromecache_491.4.dr, chromecache_383.4.dr	false		unknown
https://pxl.iqm.com/i/ck/vidazoo?cid=31e29850-07a7-89e6-7964-2d1095369f4e&redir=https%3A%2F%2Fsync.c	chromecache_586.4.dr	false		unknown
https://cdn.iplogger.org/tools/tools_3.webp)	chromecache_292.4.dr, chromecache_447.4.dr	false		unknown
https://github.com/google/safevalues/issues	chromecache_638.4.dr	false		unknown
https://cm-supply-web.gammaplatform.com/adx/usersyncsupply?pid=7&t=pixel	chromecache_520.4.dr	false		unknown
https://cdn.iplogger.org/comfort/aar.svg);	chromecache_390.4.dr	false		unknown
https://cdn.iplogger.org/logo/512.png	chromecache_437.4.dr, chromecache_369.4.dr, chromecache_513.4.dr	false		unknown
https://secure.adnxs.com/getuid?https%3A%2F%2Fsync.aniview.com%2Fcookiesyncendpoint%3Fauid%3D	chromecache_493.4.dr	false		unknown
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156813&predirect=https%3A%2F%2Fcs.openwebmp.co	chromecache_474.4.dr	false		unknown
https://cse.google.com/cse.js	chromecache_491.4.dr, chromecache_383.4.dr	false	URL Reputation: safe	unknown

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Name	Malicious	Antivirus Detection	Reputation
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=8058971a-b811-45bd-b532-b71d6e4eb2d9&gdpr=0&gdpr_consent=&gdpr_pd=&us_privacy=	false		unknown
https://cdn.iplogger.org/css/main.css?2.8.3	false		unknown
https://ib.adnxs.com/prebid/setuid?bidder=rubicon&uid=M1VB7R61-10-J7LN	false		unknown
https://cs-server-s2s.yellowblue.io/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D352%26uid%3D%7BpartnerId%7D	false		unknown
https://cdn.iplogger.org/tools/binchecker.webp	false		unknown
https://cdn.iplogger.org/countries/us.webp	false		unknown
https://ads.dxkulture.com/setuid?bidder=pubmatic&pid=&uid=DF316E5A-01ED-4BFA-B0FF-9900AE994F65&%3CpmUID%3E=164751	false		unknown
https://cs.openwebmp.com/cs?aid=40025&id=ZwBvA9HM6J0AAEyXAFdnkwAA%263405	false		unknown
https://match.adsrvr.org/track/cmf/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=0&gdpr_consent=	false		unknown
https://ps.eyeota.net/match?uid=ZwBvAwAG-scRcQA9&bid=0rijhbu&dc_rc=3&dc_mr=5&dc_orig=3b2cb90&&referrer_pid=3b2cb90	false		unknown
https://dsp.360yield.com/ul_cb/dsp_match/275?ssp=76&gdpr=0&gdpr_consent=&r=https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM3MzUmdGw9MTI5NjAw&piggybackCookie=%7BDSP_USER_ID%7D	false		unknown
https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=ZwBvA9HM6J0AAEyXAFdnkwAADU0AAAAB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=	false		unknown
https://cdn.iplogger.org/tools/tools_12.webp	false		unknown
https://sync.targeting.unrulymedia.com/csync/RX-1f778f7e-41c4-488a-bb32-0398f637debd-003?redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D321%26uid%3DRX-1f778f7e-41c4-488a-bb32-0398f637debd-003	false		unknown
https://ap.lijit.com/pixel?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%24UID	false		unknown
https://cdn.iplogger.org/countries/pl.webp	false		unknown
https://s.company-target.com/s/eqx?sspurl=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D152%26partneruserid%3DPARTNER_USER_ID&gdpr=0&gdpr_consent=	false		unknown
https://visitor-ow.omnitagjs.com/visitor/bsync?uid=ee7f7070fcde32ab0ae4be25799fd7f5&name=Openweb_SSP&gdpr=0&gdpr_consent=&url=https%3A%2F%2Fcs.openwebmp.com%2Fcs%3Faid%3D40035%26id%3D%7BuserId%7D	false		unknown
https://ssc-cms.33across.com/ps/?xi=99&us_privacy=&xu=y-HP4w.mFE2uEycRWq0aOQ4n6slicSaeeJ~A	false		unknown
https://sync.aniview.com/cookiesyncendpoint?auid=&biddername=204&pid=62f53b2c7850d0786f227f64&key=3463a747-4f73-471f-82bd-cfd764df6ed9	false		unknown
https://sync.1rx.io/usersync2/pubmatic&gdpr=0&gdpr_consent=	false		unknown
https://pbjs.e-planning.net/hb/1/7d9e8/1/iplogger.org/ROS?ct=1&r=pbjs&rnd=0.4784073185911146&e=728x90_0%3A728x90%2C970x90%2C468x60%2C980x90%2C990x90%2C690x90%2C675x90%2C670x90%2C650x90%2C630x90%2C600x90%2C580x90%2C570x90%2B728x90_1%3A728x90%2C970x90%2C980x90%2C990x90%2B300x250_0%3A300x250%2C728x90%2C970x250%2C970x90%2C336x280%2C980x90%2C990x90%2C750x100%2C750x200%2C750x300%2C930x180%2C980x120%2B300x250_1%3A300x250%2C728x90%2C970x250%2C970x90%2C336x280%2C980x90%2C990x90%2C750x100%2C750x200%2C750x300%2C930x180%2C980x120%2B300x250_2%3A300x250%2C300x600%2C1x1%2C320x480%2C336x280%2C480x320%2C768x1024%2C1024x768&ur=https%3A%2F%2Fiplogger.org%2Fpl%2F&pbv=8.45.0&ncb=1&vs=FFFFF&crs=UTF-8&fr=https%3A%2F%2Fiplogger.org%2Fpl%2F	false		unknown
https://sync.srv.stackadapt.com/sync?nid=1&gdpr=0&gdpr_consent=	false		unknown
https://pixel-eu.onaudience.com/?partner=270&smartmap=1&gdpr=0&gdpr_consent=&redirect=image2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTI4ODQmdGw9MTI5NjAw%26piggybackCookie%3D%25_rid%26gdpr%3D0%26gdpr_consent%3D%25_gdpr_consent	false		unknown
https://creativecdn.com/cm-notify?pi=adxab&google_nid=rtb_house_tr&google_gid=CAESEPousK1cITv42cAYZIGOwcc&google_cver=1&google_push=AXcoOmTIS7gQ3UV18K1ygVYHnswOmC-yX7AylEByKoNHu1hx7he8na9SqvqZBUrIDmXNZAs8pGGX4CYLnfVth-YSaIGR54z17bXWoA&tc=1	false		unknown
https://sync.a-mo.net/setuid?A=dde875bf-3153-4a25-93f6-381669bd25d0&bidder=adform&uid=2036963313124293268	false		unknown
https://cdn.iplogger.org/tools/tools_7.webp	false		unknown
https://visitor.omnitagjs.com/visitor/sync?name=ZEMANTA_NATIVE_1_2&ttl=720&uid=f2d9136cf53dede7f83ba16171a37fdd&visitor=b93X_ISOb7SQ2g_sbYcf&gdpr=0&gdpr_consent=&gdpr=0	false		unknown
https://onetag-sys.com/usync/?pubId=7a07370227fc000&gdpr=0&gdpr_consent=	false		unknown
https://fundingchoicesmessages.google.com/el/AGSKWxWfDqxxry1LshuKcZtmZiljZStP3sa-fbGMpfohIwnwviAj7rM3tCjDa8nj2OrAYcNUBL0egiGY2VEw3KN25ccJqupQh0NUJ231aq5lpKOV8XvmBs4Yi5Vg0G29wDERrRCG05M0YA==	false		unknown
https://cs.openwebmp.com/cs?aid=40021&id=JcURALZHEtuCxddAQqOQLtXf	false		unknown
https://u.ipw.metadsp.co.uk/sync?ssp=bidswitch&bidswitch_ssp_id=gumgum2&bsw_user_id=${BSW_USER_UD}&bsw_param=8058971a-b811-45bd-b532-b71d6e4eb2d9&gdpr=0&gdpr_consent=&gdpr_pd=&us_privacy=1---	false		unknown
https://b1sync.zemanta.com/usersync/adyoulike/?cb=https%3A%2F%2Fvisitor.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DZEMANTA_BANNER%26ttl%3D720%26uid%3Dbdef6bd95b7450b4e62a32db8c7d8c9d%26visitor%3D__ZUID__%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=&s=2	false		unknown
https://x.bidswitch.net/sync?ssp=gumgum2&user_id=e_8bcd42bd-ec75-4d1d-9037-a778c6b07322&gdpr=0&gdpr_consent=&us_privacy=1---	false		unknown
https://cdn.iplogger.org/countries/br.webp	false		unknown
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=8a94984f-1f66-4571-aabc-c376cbc01fab&gdpr=0&gdpr_consent=	false		unknown
https://rtb-csync.smartadserver.com/redir?partneruserid=AADw507OAN4AABRY9-4MfA&partnerid=127&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26gdpr_consent%3D%26bee_sync_partners%3Dpp%252Cpm%26bee_sync_current_partner%3Dsas%26bee_sync_initiator%3Dpm%26bee_sync_hop_count%3D1%26userid%3DSMART_USER_ID&gdpr=0	false		unknown
https://sync.1rx.io/usersync2/rmpssp?sub=vidazoo&us_privacy=&gdpr=0&gdpr_consent=	false		unknown
https://ssum.casalemedia.com/usermatchredir?s=191503&gdpr=0&gdpr_consent=&cb=https%3A%2F%2Fsync.a-mo.net%2Fsetuid%3FA%3Ddde875bf-3153-4a25-93f6-381669bd25d0%26bidder%3Dindex_rtb%26uid%3D	false		unknown
https://us-u.openx.net/w/1.0/cm?_={CACHEBUSTER}&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dopx%26i%3D	false		unknown
https://t.adx.opera.com/pub/sync?pubid=pub11169426274368&coppa=&us_privacy=	false		unknown
https://ssum-sec.casalemedia.com/usermatchredir?s=190532&gdpr=0&gdpr_consent=&cb=https%3A%2F%2Fcs.openwebmp.com%2Fcs%3Faid%3D40025%26id%3D	false		unknown
https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=117&redir=https%3A%2F%2Fsync.aniview.com%2Fcookiesyncendpoint%3Fauid%3D%26biddername%3D72%26pid%3D62f53b2c7850d0786f227f64%26key%3D%7BuserId%7D	false		unknown
https://cdn.iplogger.org/editor/plugins/colors/trumbowyg.colors.min.js	false		unknown
https://eu-west-1-cs-rtb.openwebmp.com/sync-iframe?redirect=https%3A%2F%2Fvisitor.omnitagjs.com%2Fvisitor%2Fsync%3Fname%3DOPENWEB%26ttl%3D720%26uid%3D9f93135e824096b627ff609f5cdee636%26visitor%3D%7BpartnerId%7D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=	false		unknown
https://fundingchoicesmessages.google.com/i/21814629391?ers=3	false		unknown
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=	false		unknown
https://sync.a-mo.net/setuid?A=dde875bf-3153-4a25-93f6-381669bd25d0&bidder=index_rtb&uid=ZwBvA9HM6J0AAEyXAFdnkwAA%263405	false		unknown
https://prebid.media.net/rtb/prebid?cid=8CU18831I	false		unknown
https://iplogger.org/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js	false		unknown
https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=5672881855	false		unknown
https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=ED3D1A10-49DA-4AE7-B8AB-EAE3476BCA0E&redir=true&gdpr=0&gdpr_consent=&verify=true	false		unknown
https://prebid.a-mo.net/setuid/magnite?uid=M1VB7R61-10-J7LN&gdpr=0	false		unknown
https://u-ams03.e-planning.net/um?uid=ym_user_3d32d880-7791-4e53-a4e3-80ee9f7665fe&dc=dbfd729d40c9c3fc&fi=748a1c4955442715	false		unknown
https://fundingchoicesmessages.google.com/f/AGSKWxUnc0pYZN22qpSwLx-kkLXe_He5yiF5S1N46dKiLkf6BHbf-CzZVuQBrqonaraeIBu_LfvThmdljxhWjdQv4tTr5IiNi6jOGmb2QWtipVzz9sE9cBodrn-e1LabycMl6YRxRS367Q==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzI4MDgxNjU2LDYzMDAwMDAwXSxudWxsLG51bGwsbnVsbCxbbnVsbCxbNyw2LDEwLDldLG51bGwsMixudWxsLCJlbiIsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLDFdLCJodHRwczovL2lwbG9nZ2VyLm9yZy9wbC8iLG51bGwsW1s4LCItX2dSOThUaG5kMCJdLFs5LCJlbi1VUyJdLFsxOSwiMiJdXV0	false		unknown
https://events-ssc.33across.com/match?liv=h&us_privacy=&bidder_id=25&external_user_id=DF316E5A-01ED-4BFA-B0FF-9900AE994F65	false		unknown
https://cs.openwebmp.com/cs?aid=40026&id=5203608688806444167&gdpr=0&gdpr_consent=	false		unknown
https://counter.yadro.ru/hit?t44.6;r;s1280102424;uhttps%3A//iplogger.org/pl/privacy/;hPolityka%20prywatno%u015Bci;0.780748177088008	false		unknown
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_cm&google_hm=TTFWQjdRTFItUC1FSVhP	false		unknown
https://cdn.iplogger.org/js/jquery-3.6.1.min.js	false		unknown
https://ups.analytics.yahoo.com/ups/58679/cms?partner_id=DELI&gdpr=0	false		unknown
https://cdn.iplogger.org/css/template.css?2.8.3	false		unknown
https://ads.servenobid.com/sync?pid=316&uid=DF316E5A-01ED-4BFA-B0FF-9900AE994F65	false		unknown
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESENTbQaaMF4pvHErywm3nQW0&google_push=AXcoOmSldeYwAAHdwDfkP0DSii5otYpNxWE8counoHrh3oKSbV-Eyy54NbzfmQJLFQoyKng9cPU0GWpDeVl-9fc-qlzgmyKXY2NR4Q	false		unknown
https://match.prod.bidr.io/cookie-sync?gdpr=0&gdpr_consent=&bee_sync_partners=pp%2Cpm&bee_sync_current_partner=sas&bee_sync_initiator=pm&bee_sync_hop_count=1&userid=2163883577533894917&gdpr=0&gdpr_consent=	false		unknown
https://cs.openwebmp.com/cs?aid=40035&id=6c624c4922fa06f9531b79d7afca1ecf	false		unknown
https://id.rlcdn.com/711333.gif?&gdpr=0&gdpr_consent=	false		unknown
https://cs.emxdgt.com/um?redirect=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fuser%3FpartnerId%3Dcadent%26userId%3D%24UID%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3D	false		unknown
https://dis.criteo.com/dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCookie=uid:@@CRITEO_USERID@@	false	URL Reputation: safe	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
13.32.27.53	d1mee2k02h94hw.cloudfront.net	United States	7018	ATT-INTERNET4US	false
91.228.74.200	global.px.quantserve.com	United Kingdom	27281	QUANTCASTUS	false
54.194.165.197	cs.yellowblue.io	United States	16509	AMAZON-02US	false
130.211.23.194	api.btloader.com	United States	15169	GOOGLEUS	false
46.137.59.182	blackbird-prd-ew1-alb-87915139.eu-west-1.elb.amazonaws.com	Ireland	16509	AMAZON-02US	false
52.88.8.255	unknown	United States	16509	AMAZON-02US	false
198.47.127.205	pug-ams-bc.pubmnet.com	United States	62713	AS-PUBMATICUS	false
34.254.143.3	load-euw1.exelator.com	United States	16509	AMAZON-02US	false
35.214.199.88	dorpat.geo.iponweb.net	United States	19527	GOOGLE-2US	false
70.42.32.223	nydc1.outbrain.org	United States	22075	AS-OUTBRAINUS	false
142.250.185.110	www3.l.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
88.212.202.52	counter.yadro.ru	Russian Federation	39134	UNITEDNETRU	false
23.88.86.2	matching.truffle.bid	United States	18978	ENZUINC-US	false
35.241.34.106	c.4dex.io	United States	15169	GOOGLEUS	false
64.233.167.157	stats.g.doubleclick.net	United States	15169	GOOGLEUS	false
185.255.84.152	visitor-fra02.omnitagjs.com	France	200271	IGUANE-FR	false
142.250.186.130	googleads.g.doubleclick.net	United States	15169	GOOGLEUS	false
185.255.84.153	unknown	France	200271	IGUANE-FR	false
185.255.84.150	hb-api-fra02.omnitagjs.com	France	200271	IGUANE-FR	false
208.93.169.131	am1-direct-bgp.contextweb.com	United States	26228	SERVEPATHUS	false
157.230.182.57	hlno24mlb.puzztake.com	United States	14061	DIGITALOCEAN-ASNUS	false
185.89.210.180	unknown	Germany	29990	ASN-APPNEXUS	false
52.209.159.106	unknown	United States	16509	AMAZON-02US	false
3.68.12.15	cdn.w55c.net	United States	16509	AMAZON-02US	false
89.149.192.75	unknown	Netherlands	60781	LEASEWEB-NL-AMS-01NetherlandsNL	false
52.215.155.11	rtb.adgrx.com	United States	16509	AMAZON-02US	false
185.89.210.46	unknown	Germany	29990	ASN-APPNEXUS	false
18.156.142.152	sonata-notifications.taptapnetworks.com	United States	16509	AMAZON-02US	false
178.250.1.9	widget.nl3.vip.prod.criteo.com	France	44788	ASN-CRITEO-EUROPEFR	false
35.186.154.107	cm-supply-web.gammaplatform.com	United States	15169	GOOGLEUS	false
178.250.1.3	static.nl3.vip.prod.criteo.net	France	44788	ASN-CRITEO-EUROPEFR	false
13.32.27.23	s.ad.smaato.net	United States	7018	ATT-INTERNET4US	false
54.163.230.132	sync.srv.stackadapt.com	United States	14618	AMAZON-AESUS	false
167.172.152.85	h7mzk9dlb.puzztake.com	United States	14061	DIGITALOCEAN-ASNUS	false
172.67.41.60	unknown	United States	13335	CLOUDFLARENETUS	false
34.102.163.6	ad.mrtnsvr.com	United States	15169	GOOGLEUS	false
104.26.9.169	script.4dex.io	United States	13335	CLOUDFLARENETUS	false
104.22.74.216	btloader.com	United States	13335	CLOUDFLARENETUS	false
104.22.50.98	mwzeom.zeotap.com	United States	13335	CLOUDFLARENETUS	false
211.120.53.204	unknown	Japan	4694	IDCFIDCFrontierIncJP	false
46.228.174.117	sync.1rx.io	United Kingdom	56396	TURNGB	false
151.101.193.108	prod.appnexus.map.fastly.net	United States	54113	FASTLYUS	false
3.125.70.222	ps.eyeota.net	United States	16509	AMAZON-02US	false
104.21.82.186	ban.2trk.info	United States	13335	CLOUDFLARENETUS	false
142.250.185.142	analytics.google.com	United States	15169	GOOGLEUS	false
142.250.184.226	unknown	United States	15169	GOOGLEUS	false
116.202.167.133	inv-nets.admixer.net	Germany	24940	HETZNER-ASDE	false
198.47.127.20	spug-amsfpairbc.pubmnet.com	United States	62713	AS-PUBMATICUS	false
34.217.221.210	visitor-us-west-2.omnitagjs.com	United States	16509	AMAZON-02US	false
147.182.129.240	hj5ozcalb.puzztake.com	United States	27555	BV-PUBLIC-ASNUS	false
35.214.241.248	httplb-gce-nl-clickdistrict.clickdistrict.iponweb.net	United States	19527	GOOGLE-2US	false
52.19.50.135	unknown	United States	16509	AMAZON-02US	false
34.96.71.22	s.dsp-prod.demandbase.com	United States	15169	GOOGLEUS	false
3.75.62.37	unknown	United States	16509	AMAZON-02US	false
216.239.32.181	analytics-alv.google.com	United States	15169	GOOGLEUS	false
104.18.36.155	ssum.casalemedia.com	United States	13335	CLOUDFLARENETUS	false
35.214.132.90	rome-stable-europe-west4.pumpkin.uverse.iponweb.net	United States	19527	GOOGLE-2US	false
198.47.127.18	imgsync-amsfpairbc.pubmnet.com	United States	62713	AS-PUBMATICUS	false
178.250.1.56	in-ftd-65.nl3.vip.prod.criteo.com	France	44788	ASN-CRITEO-EUROPEFR	false
188.42.191.196	ssp.ads.betweendigital.com	Luxembourg	7979	SERVERS-COMUS	false
82.145.213.8	outspot2-ams.adx.opera.com	United Kingdom	39832	NO-OPERANO	false
34.117.239.71	events-ssc.33across.com	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
172.240.155.100	sync.colossusssp.com	United States	7979	SERVERS-COMUS	false
44.218.137.49	unknown	United States	14618	AMAZON-AESUS	false
54.88.142.103	pxl.iqm.com	United States	14618	AMAZON-AESUS	false
3.71.149.231	ats-eks.eu-central-1.dcs-online-targeting-prd.aws.oath.cloud	United States	16509	AMAZON-02US	false
172.64.151.101	dsum-sec.casalemedia.com	United States	13335	CLOUDFLARENETUS	false
195.5.165.20	core.iprom.net	Slovenia	44968	IPROM-ASSI	false
54.171.78.50	unknown	United States	16509	AMAZON-02US	false
54.38.113.8	pixel-eu.onaudience.com	France	16276	OVHFR	false
54.38.113.7	pixel.onaudience.com	France	16276	OVHFR	false
67.202.105.33	de.tynt.com	United States	32748	STEADFASTUS	false
46.137.58.190	rtb.gumgum.com	Ireland	16509	AMAZON-02US	false
172.240.45.78	sync-sc-main-was.aniview.com	United States	7979	SERVERS-COMUS	false
142.250.74.196	unknown	United States	15169	GOOGLEUS	false
192.132.33.68	bttrack.com	United States	18568	BIDTELLECTUS	false
18.245.46.117	dckrl2e5yf7xg.cloudfront.net	United States	16509	AMAZON-02US	false
67.202.105.34	hde.tynt.com	United States	32748	STEADFASTUS	false
142.250.185.134	unknown	United States	15169	GOOGLEUS	false
35.186.193.173	ipac.ctnsnet.com	United States	15169	GOOGLEUS	false
34.111.113.62	pixel.tapad.com	United States	15169	GOOGLEUS	false
3.160.150.86	sync.intentiq.com	United States	16509	AMAZON-02US	false
159.65.211.77	srv.buysellads.com	United States	14061	DIGITALOCEAN-ASNUS	false
8.2.110.134	cs.krushmedia.com	United States	46636	NATCOWEBUS	false
172.67.161.117	cdn.2trk.info	United States	13335	CLOUDFLARENETUS	false
13.32.99.61	d2wcz8sc48ztgm.cloudfront.net	United States	16509	AMAZON-02US	false
34.251.49.219	euw-ice.360yield.com	United States	16509	AMAZON-02US	false
38.91.45.7	m.deepintent.com	United States	174	COGENT-174US	false
63.34.124.142	rw-yieldmo-com-tf-362867385.eu-west-1.elb.amazonaws.com	United States	16509	AMAZON-02US	false
185.64.190.84	ow-lhrc.pubmnet.com	United Kingdom	62713	AS-PUBMATICUS	false
104.18.34.178	mp.4dex.io	United States	13335	CLOUDFLARENETUS	false
51.89.9.251	onetag-sys.com	France	16276	OVHFR	false
98.82.156.207	unknown	United States	11351	TWC-11351-NORTHEASTUS	false
185.64.190.81	spug-lhrc.pubmnet.com	United Kingdom	62713	AS-PUBMATICUS	false
77.243.51.121	uip.semasio.net	Denmark	42697	NETIC-ASDK	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
95.101.148.20	contextual.media.net	European Union	20940	AKAMAI-ASN1EU	false
79.127.216.47	id.a-mx.com	Czech Republic	9080	GINCzechRepublicEUCZ	false
18.192.157.52	cs.emxdgt.com	United States	16509	AMAZON-02US	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1526259
Start date and time:	2024-10-05 00:39:35 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://iplogger.org/pl/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean3.win@76/708@584/100
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Browse: https://iplogger.org/pl/rules/ Browse: https://iplogger.org/pl/privacy/

Input	Output
URL: https://iplogger.org/pl/ Model: jbxai	{ "brand":["IP Logger"], "contains_trigger_text":true, "trigger_text":"Utworz nowy link, led adres URL lub telefon komrkowy", "prominent_button_name":"Zaakceptuj i zamknij", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":true, "has_visible_qrcode":false}

URL: https://iplogger.org/pl/ Model: jbxai	{ "brand":["IP Logger"], "contains_trigger_text":true, "trigger_text":"Utworz nowy link, led adres URL lub telefon komrkowy", "prominent_button_name":"Zaakceptuj i zamknij", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":true, "has_visible_qrcode":false}

URL: https://iplogger.org/pl/ Model: jbxai	{ "brand":["IP Logger"], "contains_trigger_text":true, "trigger_text":"Utwrz nowy link, led adres URL lub telefon komrkowy", "prominent_button_name":"Jest to kod ledzenia", "text_input_field_labels":["Wprowad prawidowy adres URL, numer telefonu lub kod ledzenia"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://iplogger.org/pl/ Model: jbxai	{ "brand":["IP Logger"], "contains_trigger_text":true, "trigger_text":"Utworz nowy link, led adres URL lub telefon komrkowy", "prominent_button_name":"Start Creating", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":true, "has_visible_qrcode":false}

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 4 21:40:32 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9824150662132416
Encrypted:	false
SSDEEP:	48:8DDwbd4nTtGlHBZidAKZdA1uehwiZUklqehGfy+3:8DDxwIhfy
MD5:	A505EAB1B0D983880AAF8F34F1BD1107
SHA1:	BF1AA4E77C05E97A59808E10C72A578200525FA4
SHA-256:	5CCBFB52F12688A464D9920DF5B7DF83F61538C89F6E90A2000ECDEC06EB786D
SHA-512:	AD365E40563BFA2EEBB5A5B1AD58C82F78124232926C6ECB5DB315E57868D5593375A3FCD38CBA477505894B2F462825C3002E1A4FE161E3A7AA9A3B5AB110CF
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....N..l........y... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW$O..PROGRA~1..t......O.IDY......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VDY......L.....................p+j.G.o.o.g.l.e.....T.1.....EW.L..Chrome..>......CW.VDY......M......................k..C.h.r.o.m.e.....`.1.....EW.L..APPLIC~1..H......CW.VDY.............................k..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VDY......N.......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Timestamp	Bytes transferred	Direction	Data
2024-10-04 22:40:31 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 22:40:31 UTC	540	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 22:40:31 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public Last-Modified: Mon, 30 Sep 2024 13:16:38 GMT ETag: "0x8DCE1521DF74B57" x-ms-request-id: 90766f9b-701e-006f-578c-15afc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T224031Z-15767c5fc55qkvj6n60pxm9mbw00000002bg000000008c8p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 22:40:31 UTC	15844	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-10-04 22:40:31 UTC	16384	IN	Data Raw: 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e Data Ascii: "0" /> </L> <R> <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" />
2024-10-04 22:40:31 UTC	16384	IN	Data Raw: 20 20 3c 53 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 53 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 38 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 Data Ascii: <ST> <S T="1" /> </ST></R><$!#>10820v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-781
2024-10-04 22:40:31 UTC	16384	IN	Data Raw: 20 54 3d 22 55 36 34 22 20 49 3d 22 38 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 45 76 65 6e 74 73 5f 41 76 67 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 Data Ascii: T="U64" I="8" O="false" N="Events_Avg"> <S T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32"
2024-10-04 22:40:31 UTC	16384	IN	Data Raw: 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f Data Ascii: "0" O="false" N="Count_CreateCard_ValidPersona_False"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Co
2024-10-04 22:40:31 UTC	16384	IN	Data Raw: 20 20 20 20 3c 53 20 54 3d 22 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a Data Ascii: <S T="31" /> </C> </C> <C T="U32" I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C>
2024-10-04 22:40:31 UTC	16384	IN	Data Raw: 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 Data Ascii: <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMillisec
2024-10-04 22:40:31 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e Data Ascii: R> <V V="0" T="I32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIn
2024-10-04 22:40:31 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: R> </O> </F> <F T="6"> <O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L>
2024-10-04 22:40:31 UTC	16384	IN	Data Raw: 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c Data Ascii: T="6"> <O T="EQ"> <L> <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <

Timestamp	Bytes transferred	Direction	Data
2024-10-04 22:40:32 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 22:40:32 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 22:40:32 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: b9d87bc4-001e-008d-138c-15d91e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T224032Z-15767c5fc55rv8zjq9dg0musxg0000000d2000000000qvrd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 22:40:32 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Timestamp	Bytes transferred	Direction	Data
2024-10-04 22:40:32 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 22:40:32 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 22:40:32 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 4b0a31e7-c01e-00ad-448c-15a2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T224032Z-15767c5fc55472x4k7dmphmadg0000000cx0000000004n6w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 22:40:32 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Timestamp	Bytes transferred	Direction	Data
2024-10-04 22:40:32 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 22:40:32 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 22:40:32 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: b9d87bc3-001e-008d-128c-15d91e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T224032Z-15767c5fc5546rn6ch9zv310e0000000062000000000myhd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 22:40:32 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://iplogger.org/pl/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 227

Chrome Cache Entry: 228

Chrome Cache Entry: 229

Chrome Cache Entry: 230

Chrome Cache Entry: 231

Chrome Cache Entry: 232

Chrome Cache Entry: 233

Chrome Cache Entry: 234

Chrome Cache Entry: 235

Chrome Cache Entry: 236

Chrome Cache Entry: 237

Chrome Cache Entry: 238

Chrome Cache Entry: 239

Chrome Cache Entry: 240

Chrome Cache Entry: 241

Chrome Cache Entry: 242

Chrome Cache Entry: 243

Chrome Cache Entry: 244

Chrome Cache Entry: 245

Chrome Cache Entry: 246

Chrome Cache Entry: 247

Chrome Cache Entry: 248

Windows Analysis Report
https://iplogger.org/pl/

Timestamp	Bytes transferred	Direction	Data
2024-10-04 22:40:32 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 22:40:32 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 22:40:32 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 39d43082-801e-00ac-658c-15fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T224032Z-15767c5fc55sdcjq8ksxt4n9mc00000002bg00000000vubh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 22:40:32 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Timestamp	Bytes transferred	Direction	Data
2024-10-04 22:40:32 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 22:40:32 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 22:40:32 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 1cc2ff82-e01e-0071-478c-1508e7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T224032Z-15767c5fc554l9xf959gp9cb1s00000007dg000000003hgf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 22:40:32 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Timestamp	Bytes transferred	Direction	Data
2024-10-04 22:40:33 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 22:40:33 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 22:40:33 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: aa8826a4-b01e-0053-608c-15cdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T224033Z-15767c5fc55ncqdn59ub6rndq00000000cvg000000009qh9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 22:40:33 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Timestamp	Bytes transferred	Direction	Data
2024-10-04 22:40:33 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 22:40:33 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 22:40:33 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 3a0dc1eb-601e-0032-608c-15eebb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T224033Z-15767c5fc55w69c2zvnrz0gmgw0000000db000000000mthh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 22:40:33 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Timestamp	Bytes transferred	Direction	Data
2024-10-04 22:40:33 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 22:40:33 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 22:40:33 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: b2393cc3-501e-005b-768c-15d7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T224033Z-15767c5fc554w2fgapsyvy8ua00000000cs00000000051yp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 22:40:33 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Timestamp	Bytes transferred	Direction	Data
2024-10-04 22:40:33 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 22:40:33 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 22:40:33 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 757ce4f4-401e-000a-128c-154a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T224033Z-15767c5fc554w2fgapsyvy8ua00000000cng00000000hmzz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 22:40:33 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Timestamp	Bytes transferred	Direction	Data
2024-10-04 22:40:33 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 22:40:33 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 22:40:33 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 24b39cfc-301e-0096-2a8c-15e71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T224033Z-15767c5fc55852fxfeh7csa2dn0000000d5g000000000z4a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 22:40:33 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Timestamp	Bytes transferred	Direction	Data
2024-10-04 22:40:34 UTC	658	OUT	GET /pl/ HTTP/1.1 Host: iplogger.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-04 22:40:34 UTC	1339	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 22:40:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close content-security-policy: default-src * 'unsafe-inline' 'unsafe-eval' data: blob:; access-control-allow-origin: * expires: Mon, 26 Jul 1997 05:00:00 GMT last-modified: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: max-age=3, must-revalidate pragma: no-cache x-xss-protection: 1; mode=block x-frame-options: DENY x-frame-options: SAMEORIGIN set-cookie: _lang=pl; expires=Sat, 04 Oct 2025 22:40:34 GMT; Max-Age=31536000; path=/; domain=.iplogger.org; secure; HttpOnly; SameSite=Lax set-cookie: cursor=fLQSi4D3b6c1e8A0D8m2h7x1DYVrKerq; path=/; domain=.iplogger.org; secure; HttpOnly; SameSite=Lax set-cookie: turnback=main%2F; path=/; domain=.iplogger.org; secure; HttpOnly; SameSite=Lax engine-initialized: 0.017756938934326172 engine-executed: 0.019162893295288086 engine-ended: 0.01917099952697754 engine-errors: 0 engine-finished: 0.01933908462524414 strict-transport-security: max-age=31536000 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wY7FESrcC5C1X1u9Pls5EV8XapZ2uk1MoF0dM8LorG2SXAfvK4ROGIFDY2FkwIuj%2Bv8e2n63Yhcfe%2FCqSbl3tyCWl4X8JKptEUcvAT%2FaG3cSZCfNP%2BvtZ%2FbCAWCNWw%3D%3D"}],"group":"cf-nel","max_age":604800}
2024-10-04 22:40:34 UTC	119	IN	Data Raw: 4e 45 4c 3a 20 7b 22 73 75 63 63 65 73 73 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2c 22 72 65 70 6f 72 74 5f 74 6f 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 63 64 38 61 63 61 35 36 62 35 63 38 63 34 31 2d 45 57 52 0d 0a 0d 0a Data Ascii: NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8cd8aca56b5c8c41-EWR
2024-10-04 22:40:34 UTC	1369	IN	Data Raw: 37 66 66 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 70 6c 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 c2 a9 20 69 70 6c 6f 67 67 65 72 2e 6f 72 67 22 Data Ascii: 7ffa<!DOCTYPE html><html lang="pl"><head><meta http-equiv="content-type" content="text/html; charset=utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="author" content><meta name="copyright" content="Copyright iplogger.org"
2024-10-04 22:40:34 UTC	1369	IN	Data Raw: 61 6c 2d 73 63 61 6c 65 3d 31 2c 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 30 2c 76 69 65 77 70 6f 72 74 2d 66 69 74 3d 63 6f 76 65 72 22 3e 0a 3c 74 69 74 6c 65 3e 49 50 20 4c 6f 67 67 65 72 20 55 52 4c 20 53 68 6f 72 74 65 6e 65 72 20 2d 20 52 65 6a 65 73 74 72 6f 77 61 6e 69 65 20 69 20 c5 9b 6c 65 64 7a 65 6e 69 65 20 61 64 72 65 73 26 6f 61 63 75 74 65 3b 77 20 49 50 3c 2f 74 69 74 6c 65 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 69 70 6c 6f 67 67 65 72 2e 6f 72 67 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 Data Ascii: al-scale=1,maximum-scale=1,user-scalable=0,viewport-fit=cover"><title>IP Logger URL Shortener - Rejestrowanie i ledzenie adresów IP</title><link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon"><link rel="app
2024-10-04 22:40:34 UTC	1369	IN	Data Raw: 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 32 66 34 37 37 33 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 6f 62 69 6c 65 2d 77 65 62 2d 61 70 70 2d 63 61 70 61 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 79 65 73 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 70 70 6c 65 2d 6d 6f 62 69 6c 65 2d 77 65 62 2d 61 70 70 2d 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 50 4c 6f 67 67 65 72 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 70 70 6c 65 2d 6d 6f 62 69 6c 65 2d 77 65 62 2d 61 70 70 2d 73 74 61 74 75 73 2d 62 61 72 2d 73 74 79 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 23 32 66 34 37 37 33 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 6f 62 69 6c 65 22 20 63 6f 6e 74 65 6e 74 3d Data Ascii: ><meta name="theme-color" content="#2f4773"><meta name="mobile-web-app-capable" content="yes"><meta name="apple-mobile-web-app-title" content="IPLogger"><meta name="apple-mobile-web-app-status-bar-style" content="#2f4773"><meta name="mobile" content=
2024-10-04 22:40:34 UTC	1369	IN	Data Raw: 74 22 2c 0a 09 09 20 20 22 69 74 65 6d 4c 69 73 74 45 6c 65 6d 65 6e 74 22 3a 20 5b 0a 09 09 20 20 7b 0a 09 09 20 20 20 20 22 40 74 79 70 65 22 3a 20 22 4c 69 73 74 49 74 65 6d 22 2c 0a 09 09 20 20 20 20 22 70 6f 73 69 74 69 6f 6e 22 3a 20 31 2c 0a 09 09 20 20 20 20 22 69 74 65 6d 22 3a 20 7b 0a 09 09 20 20 20 20 20 20 22 40 69 64 22 3a 20 22 68 74 74 70 73 3a 2f 2f 69 70 6c 6f 67 67 65 72 2e 6f 72 67 2f 75 72 6c 2d 73 68 6f 72 74 65 6e 65 72 2f 22 2c 0a 09 09 20 20 20 20 20 20 22 75 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 69 70 6c 6f 67 67 65 72 2e 6f 72 67 2f 75 72 6c 2d 73 68 6f 72 74 65 6e 65 72 2f 22 2c 0a 09 09 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 55 52 4c 20 53 68 6f 72 74 65 6e 65 72 22 2c 0a 09 09 20 20 20 20 20 20 22 69 6d 61 67 65 22 Data Ascii: t", "itemListElement": [ { "@type": "ListItem", "position": 1, "item": { "@id": "https://iplogger.org/url-shortener/", "url": "https://iplogger.org/url-shortener/", "name": "URL Shortener", "image"
2024-10-04 22:40:34 UTC	1369	IN	Data Raw: 3a 20 22 68 74 74 70 73 3a 2f 2f 69 70 6c 6f 67 67 65 72 2e 6f 72 67 2f 75 72 6c 2d 63 68 65 63 6b 65 72 2f 22 2c 0a 09 09 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 55 52 4c 20 63 68 65 63 6b 65 72 22 2c 0a 09 09 20 20 20 20 20 20 22 69 6d 61 67 65 22 3a 20 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 69 70 6c 6f 67 67 65 72 2e 6f 72 67 2f 69 63 6f 6e 73 2f 74 6f 6f 6c 73 5f 36 2e 73 76 67 22 0a 09 09 20 20 20 20 7d 0a 09 20 20 20 20 20 20 7d 2c 0a 09 20 20 20 20 20 20 7b 0a 09 09 20 20 20 20 22 40 74 79 70 65 22 3a 20 22 4c 69 73 74 49 74 65 6d 22 2c 0a 09 09 20 20 20 20 22 70 6f 73 69 74 69 6f 6e 22 3a 20 36 2c 0a 09 09 20 20 20 20 22 69 74 65 6d 22 3a 20 7b 0a 09 09 20 20 20 20 20 20 22 40 69 64 22 3a 20 22 68 74 74 70 73 3a 2f 2f 69 70 6c 6f 67 67 65 72 Data Ascii: : "https://iplogger.org/url-checker/", "name": "URL checker", "image": "https://cdn.iplogger.org/icons/tools_6.svg" } }, { "@type": "ListItem", "position": 6, "item": { "@id": "https://iplogger
2024-10-04 22:40:34 UTC	1369	IN	Data Raw: 3a 20 7b 0a 09 09 20 20 20 20 20 20 22 40 69 64 22 3a 20 22 68 74 74 70 73 3a 2f 2f 69 70 6c 6f 67 67 65 72 2e 6f 72 67 2f 73 70 65 65 64 74 65 73 74 2f 22 2c 0a 09 09 20 20 20 20 20 20 22 75 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 69 70 6c 6f 67 67 65 72 2e 6f 72 67 2f 73 70 65 65 64 74 65 73 74 2f 22 2c 0a 09 09 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 49 6e 74 65 6e 65 74 20 73 70 65 65 64 74 65 73 74 22 2c 0a 09 09 20 20 20 20 20 20 22 69 6d 61 67 65 22 3a 20 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 69 70 6c 6f 67 67 65 72 2e 6f 72 67 2f 69 63 6f 6e 73 2f 74 6f 6f 6c 73 5f 31 35 2e 73 76 67 22 0a 09 09 20 20 20 20 7d 0a 09 09 20 20 7d 2c 0a 09 09 20 20 7b 0a 09 09 20 20 20 20 22 40 74 79 70 65 22 3a 20 22 4c 69 73 74 49 74 65 6d 22 2c 0a 09 09 20 Data Ascii: : { "@id": "https://iplogger.org/speedtest/", "url": "https://iplogger.org/speedtest/", "name": "Intenet speedtest", "image": "https://cdn.iplogger.org/icons/tools_15.svg" } }, { "@type": "ListItem",
2024-10-04 22:40:34 UTC	1369	IN	Data Raw: 64 6e 2e 69 70 6c 6f 67 67 65 72 2e 6f 72 67 2f 69 63 6f 6e 73 2f 69 70 67 65 6e 65 72 61 74 6f 72 2e 77 65 62 70 22 0a 09 09 20 20 20 20 7d 0a 09 09 20 20 7d 2c 0a 09 09 20 20 7b 0a 09 09 20 20 20 20 22 40 74 79 70 65 22 3a 20 22 4c 69 73 74 49 74 65 6d 22 2c 0a 09 09 20 20 20 20 22 70 6f 73 69 74 69 6f 6e 22 3a 20 31 34 2c 0a 09 09 20 20 20 20 22 69 74 65 6d 22 3a 20 7b 0a 09 09 20 20 20 20 20 20 22 40 69 64 22 3a 20 22 68 74 74 70 73 3a 2f 2f 69 70 6c 6f 67 67 65 72 2e 6f 72 67 2f 62 6c 6f 67 2f 22 2c 0a 09 09 20 20 20 20 20 20 22 75 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 69 70 6c 6f 67 67 65 72 2e 6f 72 67 2f 62 6c 6f 67 2f 22 2c 0a 09 09 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 49 50 6c 6f 67 67 65 72 20 62 6c 6f 67 22 2c 0a 09 09 20 20 20 20 Data Ascii: dn.iplogger.org/icons/ipgenerator.webp" } }, { "@type": "ListItem", "position": 14, "item": { "@id": "https://iplogger.org/blog/", "url": "https://iplogger.org/blog/", "name": "IPlogger blog",
2024-10-04 22:40:34 UTC	1369	IN	Data Raw: 64 61 74 61 2d 6d 6f 64 75 6c 65 3d 22 75 72 6c 5f 73 68 6f 72 74 65 6e 65 72 22 3e 3c 61 20 68 72 65 66 3d 22 2f 70 6c 2f 75 72 6c 2d 73 68 6f 72 74 65 6e 65 72 2f 22 20 72 65 6c 3d 22 63 61 6e 6f 6e 69 63 61 6c 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 74 6f 6f 6c 73 2d 69 63 6f 6e 22 3e 3c 2f 73 70 61 6e 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 74 6f 6f 6c 73 2d 74 65 78 74 22 3e 53 6b 72 61 63 61 63 7a 20 61 64 72 65 73 c3 b3 77 20 55 52 4c 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 3e 3c 2f 6c 69 3e 0a 3c 6c 69 20 64 61 74 61 2d 6d 6f 64 75 6c 65 3d 22 6c 6f 63 61 74 69 6f 6e 5f 74 72 61 63 6b 65 72 22 3e 3c 61 20 68 72 65 66 3d 22 2f 70 6c 2f 6c 6f 63 61 74 69 6f 6e 2d 74 72 61 63 6b 65 72 2f 22 20 72 65 6c 3d 22 63 61 6e 6f 6e 69 63 61 6c 22 3e 0a Data Ascii: data-module="url_shortener"><a href="/pl/url-shortener/" rel="canonical"><span class="tools-icon"></span><span class="tools-text">Skracacz adresw URL</span></a></li><li data-module="location_tracker"><a href="/pl/location-tracker/" rel="canonical">
2024-10-04 22:40:34 UTC	1369	IN	Data Raw: 3e 3c 2f 6c 69 3e 0a 3c 6c 69 20 64 61 74 61 2d 6d 6f 64 75 6c 65 3d 22 69 70 5f 73 65 72 76 69 63 65 73 22 3e 3c 61 20 68 72 65 66 3d 22 2f 70 6c 2f 69 70 2d 73 65 72 76 69 63 65 73 2f 22 20 72 65 6c 3d 22 63 61 6e 6f 6e 69 63 61 6c 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 74 6f 6f 6c 73 2d 69 63 6f 6e 22 3e 3c 2f 73 70 61 6e 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 74 6f 6f 6c 73 2d 74 65 78 74 22 3e 4c 69 63 7a 6e 69 6b 69 20 49 50 20 69 20 70 61 73 6b 69 20 75 c5 bc 79 74 6b 6f 77 6e 69 6b 61 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 3e 3c 2f 6c 69 3e 0a 3c 6c 69 20 64 61 74 61 2d 6d 6f 64 75 6c 65 3d 22 63 72 65 64 69 74 63 61 72 64 22 3e 3c 61 20 68 72 65 66 3d 22 2f 70 6c 2f 63 72 65 64 69 74 43 61 72 64 47 65 6e 65 72 61 74 6f 72 2f 22 20 72 65 Data Ascii: ></li><li data-module="ip_services"><a href="/pl/ip-services/" rel="canonical"><span class="tools-icon"></span><span class="tools-text">Liczniki IP i paski uytkownika</span></a></li><li data-module="creditcard"><a href="/pl/creditCardGenerator/" re

Timestamp	Bytes transferred	Direction	Data
2024-10-04 22:40:34 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 22:40:34 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 22:40:34 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 023e3708-a01e-003d-568c-1598d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T224034Z-15767c5fc55n4msds84xh4z67w00000006t000000000qf85 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 22:40:34 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Timestamp	Bytes transferred	Direction	Data
2024-10-04 22:40:34 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 22:40:34 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 22:40:34 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: e0871f45-901e-00a0-0d8c-156a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T224034Z-15767c5fc554l9xf959gp9cb1s000000077000000000sune x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 22:40:34 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />