Edit tour

Windows Analysis Report
https://countercultureusa.com/

Overview

General Information

Sample URL:	https://countercultureusa.com/
Analysis ID:	1527498
Tags:	urlscan
Infos:

Detection

Score:	3
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Creates files inside the system directory

Deletes files inside the Windows folder

Detected non-DNS traffic on DNS port

HTML body contains low number of good links

HTML body contains password input but no form action

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64

chrome.exe (PID: 3140 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 6416 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2348 --field-trial-handle=2312,i,15511970055958057797,735130785780526194,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 5364 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4780 --field-trial-handle=2312,i,15511970055958057797,735130785780526194,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 6448 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://countercultureusa.com/" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

cleanup

HTTP traffic detected: POST /api/v1/bulklog HTTP/1.1Host: panorama.wixapps.netConnection: keep-aliveContent-Length: 510sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: text/plain;charset=UTF-8Accept: */*Origin: https://www.countercultureawards.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://www.countercultureawards.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: https://www.countercultureawards.com/	HTTP Parser: No <meta name="author".. found
Source: https://www.countercultureawards.com/	HTTP Parser: No <meta name="author".. found
Source: https://www.countercultureawards.com/	HTTP Parser: No <meta name="author".. found
Source: https://www.countercultureawards.com/	HTTP Parser: No <meta name="author".. found
Source: https://www.countercultureawards.com/	HTTP Parser: No <meta name="author".. found
Source: https://www.countercultureawards.com/nominations	HTTP Parser: No <meta name="author".. found
Source: https://www.countercultureawards.com/nominations	HTTP Parser: No <meta name="author".. found
Source: https://www.countercultureawards.com/	HTTP Parser: No <meta name="author".. found
Source: https://www.countercultureawards.com/sponsorships	HTTP Parser: No <meta name="author".. found
Source: https://www.countercultureawards.com/nominations	HTTP Parser: No <meta name="author".. found

Source: https://www.countercultureawards.com/	HTTP Parser: No <meta name="copyright".. found
Source: https://www.countercultureawards.com/	HTTP Parser: No <meta name="copyright".. found
Source: https://www.countercultureawards.com/	HTTP Parser: No <meta name="copyright".. found
Source: https://www.countercultureawards.com/	HTTP Parser: No <meta name="copyright".. found
Source: https://www.countercultureawards.com/	HTTP Parser: No <meta name="copyright".. found
Source: https://www.countercultureawards.com/nominations	HTTP Parser: No <meta name="copyright".. found
Source: https://www.countercultureawards.com/nominations	HTTP Parser: No <meta name="copyright".. found
Source: https://www.countercultureawards.com/	HTTP Parser: No <meta name="copyright".. found
Source: https://www.countercultureawards.com/sponsorships	HTTP Parser: No <meta name="copyright".. found
Source: https://www.countercultureawards.com/nominations	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.10:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.222.162.55:443 -> 192.168.2.10:49935 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.55
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.55
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.85
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.85
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.85
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.85
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.85
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60

Source: global traffic	DNS traffic detected: DNS query: countercultureusa.com
Source: global traffic	DNS traffic detected: DNS query: www.countercultureawards.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: static.parastorage.com
Source: global traffic	DNS traffic detected: DNS query: static.wixstatic.com
Source: global traffic	DNS traffic detected: DNS query: siteassets.parastorage.com
Source: global traffic	DNS traffic detected: DNS query: frog.wix.com
Source: global traffic	DNS traffic detected: DNS query: panorama.wixapps.net
Source: global traffic	DNS traffic detected: DNS query: video.wixstatic.com

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3140_330902706	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3140_330902706\sets.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3140_330902706\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3140_330902706\LICENSE	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3140_330902706\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3140_330902706\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3140_330902706\manifest.fingerprint	Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2348 --field-trial-handle=2312,i,15511970055958057797,735130785780526194,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://countercultureusa.com/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4780 --field-trial-handle=2312,i,15511970055958057797,735130785780526194,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2348 --field-trial-handle=2312,i,15511970055958057797,735130785780526194,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4780 --field-trial-handle=2312,i,15511970055958057797,735130785780526194,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	11 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source: chromecache_522.6.dr, chromecache_575.6.dr	String found in binary or memory: http://getify.mit-license.org
Source: chromecache_522.6.dr, chromecache_575.6.dr	String found in binary or memory: http://jedwatson.github.io/classnames
Source: chromecache_472.6.dr, chromecache_329.6.dr, chromecache_488.6.dr, chromecache_307.6.dr	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chromecache_472.6.dr, chromecache_329.6.dr, chromecache_488.6.dr, chromecache_307.6.dr	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chromecache_472.6.dr, chromecache_329.6.dr, chromecache_488.6.dr, chromecache_307.6.dr	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chromecache_472.6.dr, chromecache_329.6.dr, chromecache_488.6.dr, chromecache_307.6.dr	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chromecache_377.6.dr, chromecache_555.6.dr	String found in binary or memory: http://underscorejs.org/LICENSE
Source: chromecache_682.6.dr, chromecache_648.6.dr, chromecache_454.6.dr	String found in binary or memory: http://www.videolan.org/x264.html
Source: sets.json.4.dr	String found in binary or memory: https://07c225f3.online
Source: sets.json.4.dr	String found in binary or memory: https://24.hu
Source: sets.json.4.dr	String found in binary or memory: https://aajtak.in
Source: sets.json.4.dr	String found in binary or memory: https://abczdrowie.pl
Source: sets.json.4.dr	String found in binary or memory: https://alice.tw
Source: sets.json.4.dr	String found in binary or memory: https://ambitionbox.com
Source: chromecache_375.6.dr, chromecache_593.6.dr	String found in binary or memory: https://api.whatsapp.com/send?phone=
Source: sets.json.4.dr	String found in binary or memory: https://autobild.de
Source: sets.json.4.dr	String found in binary or memory: https://baomoi.com
Source: sets.json.4.dr	String found in binary or memory: https://bild.de
Source: sets.json.4.dr	String found in binary or memory: https://blackrock.com
Source: sets.json.4.dr	String found in binary or memory: https://blackrockadvisorelite.it
Source: sets.json.4.dr	String found in binary or memory: https://bluradio.com
Source: chromecache_472.6.dr, chromecache_329.6.dr, chromecache_488.6.dr, chromecache_307.6.dr	String found in binary or memory: https://bo.wix.com/suricate/
Source: sets.json.4.dr	String found in binary or memory: https://bolasport.com
Source: sets.json.4.dr	String found in binary or memory: https://bonvivir.com
Source: chromecache_472.6.dr, chromecache_329.6.dr, chromecache_488.6.dr, chromecache_307.6.dr	String found in binary or memory: https://browser.sentry-cdn.com/6.18.2/bundle.min.js
Source: sets.json.4.dr	String found in binary or memory: https://bumbox.com
Source: sets.json.4.dr	String found in binary or memory: https://businessinsider.com.pl
Source: sets.json.4.dr	String found in binary or memory: https://businesstoday.in
Source: sets.json.4.dr	String found in binary or memory: https://cachematrix.com
Source: sets.json.4.dr	String found in binary or memory: https://cafemedia.com
Source: sets.json.4.dr	String found in binary or memory: https://caracoltv.com
Source: sets.json.4.dr	String found in binary or memory: https://carcostadvisor.be
Source: sets.json.4.dr	String found in binary or memory: https://carcostadvisor.com
Source: sets.json.4.dr	String found in binary or memory: https://carcostadvisor.fr
Source: sets.json.4.dr	String found in binary or memory: https://cardsayings.net
Source: sets.json.4.dr	String found in binary or memory: https://chatbot.com
Source: sets.json.4.dr	String found in binary or memory: https://chennien.com
Source: sets.json.4.dr	String found in binary or memory: https://citybibleforum.org
Source: sets.json.4.dr	String found in binary or memory: https://clarosports.com
Source: sets.json.4.dr	String found in binary or memory: https://clmbtech.com

Source	Detection	Scanner	Label
https://wieistmeineip.de	0%	URL Reputation	safe
https://mercadoshops.com.co	0%	URL Reputation	safe
https://static.parastorage.com/services/wix-thunderbolt/dist/platformPubsub.236f41ee.chunk.min.js.ma	0%	URL Reputation	safe
https://static.parastorage.com/services/editor-elements-design-systems/dist/thunderbolt/	0%	URL Reputation	safe
https://static.parastorage.com/services/wix-thunderbolt/dist/BuilderPathsContainer.691f2882.chunk.min.js	0%	URL Reputation	safe
https://mercadolivre.com	0%	URL Reputation	safe
https://static.parastorage.com/services/wix-thunderbolt/dist/group_7.13d622e8.chunk.min.js.map	0%	URL Reputation	safe
https://medonet.pl	0%	URL Reputation	safe
https://static.parastorage.com/services/wix-thunderbolt/dist/panorama.051dc072.chunk.min.js	0%	URL Reputation	safe
https://mercadoshops.com.br	0%	URL Reputation	safe
http://polymer.github.io/AUTHORS.txt	0%	URL Reputation	safe
https://johndeere.com	0%	URL Reputation	safe
https://baomoi.com	0%	URL Reputation	safe
https://elfinancierocr.com	0%	URL Reputation	safe
https://bolasport.com	0%	URL Reputation	safe
https://desimartini.com	0%	URL Reputation	safe
https://hearty.app	0%	URL Reputation	safe
https://mercadoshops.com	0%	URL Reputation	safe
https://static.parastorage.com/services/wix-thunderbolt/dist/createPlatformWorker.inline.08729d0b.bu	0%	URL Reputation	safe
https://p106.net	0%	URL Reputation	safe
https://radio2.be	0%	URL Reputation	safe
https://openjsf.org/	0%	URL Reputation	safe
https://songshare.com	0%	URL Reputation	safe
https://smaker.pl	0%	URL Reputation	safe
https://p24.hu	0%	URL Reputation	safe
http://getify.mit-license.org	0%	URL Reputation	safe
http://polymer.github.io/PATENTS.txt	0%	URL Reputation	safe
https://mightytext.net	0%	URL Reputation	safe
https://hazipatika.com	0%	URL Reputation	safe
https://joyreactor.com	0%	URL Reputation	safe
https://wildixin.com	0%	URL Reputation	safe
https://eworkbookcloud.com	0%	URL Reputation	safe
https://static.parastorage.com/services/wix-thunderbolt/dist/cyclicTabbing.e156be92.chunk.min.js.map	0%	URL Reputation	safe
https://chennien.com	0%	URL Reputation	safe
https://drimer.travel	0%	URL Reputation	safe
https://static.parastorage.com/services/wix-thunderbolt/dist/animations.0c47ed2a.chunk.min.js.map	0%	URL Reputation	safe
https://mercadopago.cl	0%	URL Reputation	safe
https://static.parastorage.com/services/wix-thunderbolt/dist/group_7.bae0ce0c.chunk.min.css	0%	URL Reputation	safe
http://underscorejs.org/LICENSE	0%	URL Reputation	safe
https://bonvivir.com	0%	URL Reputation	safe

Name	Source	Malicious	Antivirus Detection	Reputation
https://wieistmeineip.de	sets.json.4.dr	false	URL Reputation: safe	unknown
https://mercadoshops.com.co	sets.json.4.dr	false	URL Reputation: safe	unknown
https://static.parastorage.com/services/wix-thunderbolt/dist/platformPubsub.236f41ee.chunk.min.js.ma	chromecache_469.6.dr, chromecache_594.6.dr	false	URL Reputation: safe	unknown
https://static.parastorage.com/services/editor-elements-design-systems/dist/thunderbolt/	chromecache_685.6.dr, chromecache_342.6.dr	false	URL Reputation: safe	unknown
https://mercadolivre.com	sets.json.4.dr	false	URL Reputation: safe	unknown
https://static.parastorage.com/services/wix-thunderbolt/dist/group_7.13d622e8.chunk.min.js.map	chromecache_321.6.dr, chromecache_691.6.dr	false	URL Reputation: safe	unknown
https://medonet.pl	sets.json.4.dr	false	URL Reputation: safe	unknown
https://mercadoshops.com.br	sets.json.4.dr	false	URL Reputation: safe	unknown
http://polymer.github.io/AUTHORS.txt	chromecache_472.6.dr, chromecache_329.6.dr, chromecache_488.6.dr, chromecache_307.6.dr	false	URL Reputation: safe	unknown
https://johndeere.com	sets.json.4.dr	false	URL Reputation: safe	unknown
https://baomoi.com	sets.json.4.dr	false	URL Reputation: safe	unknown
https://elfinancierocr.com	sets.json.4.dr	false	URL Reputation: safe	unknown
https://bolasport.com	sets.json.4.dr	false	URL Reputation: safe	unknown
https://static.parastorage.com/services/wix-thunderbolt/dist/platform.08affa9c.chunk.min.js.map	chromecache_662.6.dr, chromecache_586.6.dr	false		unknown
https://desimartini.com	sets.json.4.dr	false	URL Reputation: safe	unknown
https://hearty.app	sets.json.4.dr	false	URL Reputation: safe	unknown
https://static.parastorage.com/services/wix-thunderbolt/dist/triggersAndReactions.66bcbb0c.chunk.min	chromecache_704.6.dr, chromecache_328.6.dr	false		unknown
https://mercadoshops.com	sets.json.4.dr	false	URL Reputation: safe	unknown
https://nlc.hu	sets.json.4.dr	false		unknown
https://static.parastorage.com/services/wix-thunderbolt/dist/createPlatformWorker.inline.08729d0b.bu	chromecache_307.6.dr	false	URL Reputation: safe	unknown
https://p106.net	sets.json.4.dr	false	URL Reputation: safe	unknown
https://radio2.be	sets.json.4.dr	false	URL Reputation: safe	unknown
https://static.parastorage.com/services/wix-thunderbolt/dist/initCustomElements.inline.1d2da1fc.bund	chromecache_472.6.dr, chromecache_329.6.dr, chromecache_488.6.dr, chromecache_307.6.dr	false		unknown
https://openjsf.org/	chromecache_377.6.dr, chromecache_555.6.dr	false	URL Reputation: safe	unknown
https://songshare.com	sets.json.4.dr	false	URL Reputation: safe	unknown
https://smaker.pl	sets.json.4.dr	false	URL Reputation: safe	unknown
https://p24.hu	sets.json.4.dr	false	URL Reputation: safe	unknown
https://24.hu	sets.json.4.dr	false		unknown
http://getify.mit-license.org	chromecache_522.6.dr, chromecache_575.6.dr	false	URL Reputation: safe	unknown
http://polymer.github.io/PATENTS.txt	chromecache_472.6.dr, chromecache_329.6.dr, chromecache_488.6.dr, chromecache_307.6.dr	false	URL Reputation: safe	unknown
https://mightytext.net	sets.json.4.dr	false	URL Reputation: safe	unknown
https://hazipatika.com	sets.json.4.dr	false	URL Reputation: safe	unknown
https://joyreactor.com	sets.json.4.dr	false	URL Reputation: safe	unknown
https://wildixin.com	sets.json.4.dr	false	URL Reputation: safe	unknown
https://eworkbookcloud.com	sets.json.4.dr	false	URL Reputation: safe	unknown
https://static.parastorage.com/services/wix-thunderbolt/dist/cyclicTabbing.e156be92.chunk.min.js.map	chromecache_524.6.dr, chromecache_576.6.dr	false	URL Reputation: safe	unknown
https://chennien.com	sets.json.4.dr	false	URL Reputation: safe	unknown
https://drimer.travel	sets.json.4.dr	false	URL Reputation: safe	unknown
https://static.parastorage.com/services/wix-thunderbolt/dist/reporter-api.d81e6559.chunk.min.js.map	chromecache_552.6.dr, chromecache_394.6.dr	false		unknown
https://static.parastorage.com/services/wix-thunderbolt/dist/animations.0c47ed2a.chunk.min.js.map	chromecache_596.6.dr, chromecache_407.6.dr	false	URL Reputation: safe	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
185.230.63.186	countercultureusa.com	Israel	58182	WIX_COMIL	false
34.49.229.81	td-static-34-49-229-81.parastorage.com	United States	2686	ATGS-MMD-ASUS	false
108.156.22.112	unknown	United States	16509	AMAZON-02US	false
44.213.232.30	bi-flogger-alb-ext-343643057.us-east-1.elb.amazonaws.com	United States	14618	AMAZON-AESUS	false
99.86.4.125	unknown	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
34.149.87.45	td-ccm-neg-87-45.wixdns.net	United States	2686	ATGS-MMD-ASUS	false
108.156.60.6	d1cq301dpr7fww.cloudfront.net	United States	16509	AMAZON-02US	false
142.250.184.228	www.google.com	United States	15169	GOOGLEUS	false
34.149.206.255	glb-editor.wix.com	United States	2686	ATGS-MMD-ASUS	false

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	unknown
glb-editor.wix.com	34.149.206.255	true	false	unknown
td-static-34-49-229-81.parastorage.com	34.49.229.81	true	false	unknown
d1cq301dpr7fww.cloudfront.net	108.156.60.6	true	false	unknown
www.google.com	142.250.184.228	true	false	unknown
td-ccm-neg-87-45.wixdns.net	34.149.87.45	true	false	unknown
bi-flogger-alb-ext-343643057.us-east-1.elb.amazonaws.com	44.213.232.30	true	false	unknown
countercultureusa.com	185.230.63.186	true	false	unknown
www.countercultureawards.com	unknown	unknown	false	unknown
video.wixstatic.com	unknown	unknown	false	unknown
static.wixstatic.com	unknown	unknown	false	unknown
siteassets.parastorage.com	unknown	unknown	false	unknown
frog.wix.com	unknown	unknown	false	unknown
panorama.wixapps.net	unknown	unknown	false	unknown
static.parastorage.com	unknown	unknown	false	unknown

Name	Malicious	Antivirus Detection	Reputation
https://frog.wix.com/bolt-performance?src=72&evid=21&appName=wix-studio&is_rollout=1&is_sav_rollout=0&is_dac_rollout=0&dc=42&microPop=fastly_42_g&is_cached=false&msid=aec87294-d8d8-402e-abdc-357ee8d9bbbb&session_id=3d5638fc-d6c6-4971-ab9d-c9af34a890ab&ish=false&isb=false&vsi=88e80c02-0805-4e43-bb65-9e06b9f60d69&caching=miss,miss_miss&pv=visible&pn=1&v=1.14629.0&url=https%3A%2F%2Fwww.countercultureawards.com%2Fblank-2&st=2&ts=470&tsn=5081&platformOnSite=true	false		unknown
https://frog.wix.com/bt?src=29&evid=3&viewer_name=wix-studio&caching=miss,miss_miss&dc=42&microPop=fastly_42_g&et=1&event_name=Init&is_cached=false&is_platform_loaded=0&is_rollout=1&ism=1&isp=0&isjp=false&iss=1&ita=1&msid=aec87294-d8d8-402e-abdc-357ee8d9bbbb&pn=1&sessionId=d6f4bdd2-e6ff-4856-aeaa-01b93f6f882b&siterev=183-__siteCacheRevision__&st=2&ts=1350&tts=7817&url=https%3A%2F%2Fwww.countercultureawards.com%2F&v=1.14629.0&vsi=d9d661f8-4303-470c-a3ca-ca841a89bf9c&_brandId=studio	false		unknown
https://static.wixstatic.com/media/e13646_a05758360a66439cae58940689968591~mv2.png/v1/fit/w_474,h_700,q_90/e13646_a05758360a66439cae58940689968591~mv2.webp	false		unknown
https://frog.wix.com/bolt-performance?src=72&evid=28&appName=wix-studio&is_rollout=1&is_sav_rollout=0&is_dac_rollout=0&dc=42&microPop=fastly_42_g&is_cached=false&msid=aec87294-d8d8-402e-abdc-357ee8d9bbbb&session_id=28996680-bd3f-4543-a900-5fc2b73c3b98&ish=false&isb=false&vsi=7b6735d8-e101-4a0e-a0c6-e1b49644ea50&caching=miss,miss_miss&pv=hidden&pn=1&v=1.14629.0&url=https%3A%2F%2Fwww.countercultureawards.com%2Fnominations&st=2&ts=1490&tsn=4841&name=partially_visible&duration=1728255697551&pageId=dylya&isSuccessfulSSR=true	false		unknown
https://frog.wix.com/site-members?_msid=aec87294-d8d8-402e-abdc-357ee8d9bbbb&vsi=88e80c02-0805-4e43-bb65-9e06b9f60d69&_av=thunderbolt-1.14629.0&isb=false&_brandId=studio&_siteBranchId=undefined&_ms=7303&_isHeadless=undefined&_hostingPlatform=VIEWER&_lv=2.0.985%7CC&_visitorId=ce43ae29-6ad9-4167-b18d-a6b77a3ec5c0&_siteMemberId=undefined&bsi=d561b4a1-a8cb-41a2-a0fb-768a26f8307f%7C1&src=5&evid=698&biToken=aec87294-d8d8-402e-abdc-357ee8d9bbbb&context=undefined&ts=2692&viewmode=undefined&visitor_id=ce43ae29-6ad9-4167-b18d-a6b77a3ec5c0&site_member_id=undefined&site_settings_lng=en&browser_lng=en&lng_mismatch=false&layout=undefined&_isca=1&_iscf=1&_ispd=0&_ise=0&_=17282556881350	false		unknown
https://static.parastorage.com/services/wix-thunderbolt/dist/BuilderPathsContainer.691f2882.chunk.min.js	false	URL Reputation: safe	unknown
https://static.parastorage.com/services/editor-elements-library/dist/thunderbolt/rb_wixui.thunderbolt[StylableButton_Default].24cb2eec.bundle.min.js	false		unknown
https://static.parastorage.com/services/wix-thunderbolt/dist/panorama.051dc072.chunk.min.js	false	URL Reputation: safe	unknown
https://static.wixstatic.com/media/bf7074_eb7681163ee74779b9e606fbdb2e1375~mv2.jpg/v1/fit/w_480,h_359,q_90/bf7074_eb7681163ee74779b9e606fbdb2e1375~mv2.webp	false		unknown
https://www.countercultureawards.com/_api/v1/access-tokens	false		unknown
https://static.wixstatic.com/media/bf7074_a07445f052d24d6081a95085c4d17f77~mv2.jpg/v1/fill/w_264,h_198,q_90/bf7074_a07445f052d24d6081a95085c4d17f77~mv2.webp	false		unknown
https://static.parastorage.com/unpkg/requirejs-bolt@2.3.6/requirejs.min.js	false		unknown
https://static.parastorage.com/services/editor-elements-library/dist/corvid/rb_wixui.corvid[VideoPlayer].ec4933ce.bundle.min.js	false		unknown
https://frog.wix.com/bt?src=29&evid=3&viewer_name=wix-studio&caching=miss,miss_miss&dc=42&microPop=fastly_42_g&et=1&event_name=Init&is_cached=false&is_platform_loaded=0&is_rollout=1&ism=1&isp=0&isjp=false&iss=1&ita=1&msid=aec87294-d8d8-402e-abdc-357ee8d9bbbb&pn=1&sessionId=3d5638fc-d6c6-4971-ab9d-c9af34a890ab&siterev=183-__siteCacheRevision__&st=2&ts=727&tts=5338&url=https%3A%2F%2Fwww.countercultureawards.com%2Fblank-2&v=1.14629.0&vsi=88e80c02-0805-4e43-bb65-9e06b9f60d69&_brandId=studio	false		unknown
https://static.parastorage.com/services/editor-elements-library/dist/thunderbolt/rb_wixui.thunderbolt_menu.ac32560b.bundle.min.js	false		unknown
https://frog.wix.com/site-members?_msid=aec87294-d8d8-402e-abdc-357ee8d9bbbb&vsi=8adefcb5-8179-4738-9d93-d9f8d8b3a607&_av=thunderbolt-1.14629.0&isb=false&_brandId=studio&_siteBranchId=undefined&_ms=3098&_isHeadless=undefined&_hostingPlatform=VIEWER&_lv=2.0.985%7CC&_visitorId=ce43ae29-6ad9-4167-b18d-a6b77a3ec5c0&_siteMemberId=undefined&bsi=d561b4a1-a8cb-41a2-a0fb-768a26f8307f%7C1&src=5&evid=698&biToken=aec87294-d8d8-402e-abdc-357ee8d9bbbb&context=undefined&ts=2232&viewmode=undefined&visitor_id=ce43ae29-6ad9-4167-b18d-a6b77a3ec5c0&site_member_id=undefined&site_settings_lng=en&browser_lng=en&lng_mismatch=false&layout=undefined&_isca=1&_iscf=1&_ispd=0&_ise=0&_=17282557265170	false		unknown
https://static.parastorage.com/services/wix-thunderbolt/dist/group_2.e7604236.chunk.min.js	false		unknown
https://static.parastorage.com/services/editor-elements-library/dist/corvid/rb_wixui.corvid[ImageX].54b24c6d.bundle.min.js	false		unknown
https://static.parastorage.com/services/pro-gallery-tpa/1.968.0/assets/locale/pro-gallery/messages_en.json	false		unknown
https://static.wixstatic.com/media/e13646_402e032e547042a09424a618b95ce564~mv2.png/v1/fit/w_474,h_700,q_90/e13646_402e032e547042a09424a618b95ce564~mv2.webp	false		unknown
https://static.parastorage.com/services/wix-thunderbolt/dist/feature-elementory-support-wix-code-sdk.d200f6b0.chunk.min.js	false		unknown
https://static.parastorage.com/services/form-app/1.1252.0/viewerScript.bundle.min.js	false		unknown
https://video.wixstatic.com/video/11062b_d578b9d4ffba48c68d086ec29fe9e6f0/720p/mp4/file.mp4	false		unknown
https://static.parastorage.com/services/wix-thunderbolt/dist/group_7.bae0ce0c.chunk.min.css	false	URL Reputation: safe	unknown
https://frog.wix.com/bolt-performance?src=72&evid=28&appName=wix-studio&is_rollout=1&is_sav_rollout=0&is_dac_rollout=0&dc=42&microPop=fastly_42_g&is_cached=false&msid=aec87294-d8d8-402e-abdc-357ee8d9bbbb&session_id=d6f4bdd2-e6ff-4856-aeaa-01b93f6f882b&ish=false&isb=false&vsi=d9d661f8-4303-470c-a3ca-ca841a89bf9c&caching=miss,miss_miss&pv=visible&pn=1&v=1.14629.0&url=https%3A%2F%2Fwww.countercultureawards.com%2F&st=2&ts=1055&tsn=7522&name=partially_visible&duration=1728255661608&pageId=c1dmp&isSuccessfulSSR=true	false		unknown
https://static.parastorage.com/services/editor-elements-library/dist/thunderbolt/rb_wixui.thunderbolt[VectorImage_VectorButton].2287df62.bundle.min.js	false		unknown
https://static.parastorage.com/services/wix-thunderbolt/dist/usedPlatformApis.c3e70464.chunk.min.js	false	URL Reputation: safe	unknown
https://static.parastorage.com/services/editor-elements-library/dist/thunderbolt/rb_wixui.thunderbolt_bootstrap-responsive.af222ade.bundle.min.js	false		unknown
https://static.parastorage.com/services/editor-elements-library/dist/thunderbolt/rb_wixui.thunderbolt[SkipToContentButton].69abe737.bundle.min.js	false	URL Reputation: safe	unknown
https://static.parastorage.com/services/wix-thunderbolt/dist/group_5.9009bcc2.chunk.min.js	false		unknown
https://frog.wix.com/bolt-performance?src=72&evid=21&appName=wix-studio&is_rollout=1&is_sav_rollout=0&is_dac_rollout=0&dc=42&microPop=fastly_42_g&is_cached=false&msid=aec87294-d8d8-402e-abdc-357ee8d9bbbb&session_id=d6f4bdd2-e6ff-4856-aeaa-01b93f6f882b&ish=false&isb=false&vsi=d9d661f8-4303-470c-a3ca-ca841a89bf9c&caching=miss,miss_miss&pv=visible&pn=1&v=1.14629.0&url=https%3A%2F%2Fwww.countercultureawards.com%2F&st=2&ts=1055&tsn=7522&platformOnSite=true	false		unknown
https://static.parastorage.com/services/wix-thunderbolt/dist/group_7.13d622e8.chunk.min.js	false	URL Reputation: safe	unknown
https://static.parastorage.com/unpkg/react-dom@18.3.1/umd/react-dom.production.min.js	false	URL Reputation: safe	unknown
https://static.parastorage.com/services/editor-elements-library/dist/thunderbolt/rb_wixui.thunderbolt[Container_ResponsiveBox].83d3f750.bundle.min.js	false		unknown
https://static.parastorage.com/services/wix-thunderbolt/dist/group_11.3fa95a07.chunk.min.js	false		unknown

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1527498
Start date and time:	2024-10-07 00:59:58 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://countercultureusa.com/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean3.win@23/633@32/11
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Browse: https://www.countercultureawards.com/blank-2 Browse: https://www.countercultureawards.com/nominations Browse: https://www.countercultureawards.com/sponsorships

Input	Output
URL: https://www.countercultureawards.com/ Model: jbxai	{ "brand":["Counter Culture Awards"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"Home", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "text":"Home Gallery Nominations Sponsorships RSVP Committee", "has_visible_qrcode":false}

URL: https://www.countercultureawards.com/blank-2 Model: jbxai	{ "brand":["Counter Culture Awards"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "text":"Counter Culture Awards", "has_visible_qrcode":false}

URL: https://www.countercultureawards.com/sponsorships Model: jbxai	{ "brand":[], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"Go", "text_input_field_labels":["Password"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "text":"Guest Area Please enter the password below.", "has_visible_qrcode":false}

URL: https://www.countercultureawards.com/sponsorships Model: jbxai	{ "brand":[], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"Go", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "text":"Guest Area Please enter the password below. Password Go", "has_visible_qrcode":false}

URL: https://www.countercultureawards.com/sponsorships Model: jbxai	{ "phishing_score":3, "brands":"unknown", "legit_domain":"countercultureawards.com", "classification":"unknown", "reasons":["The brand is marked as 'unknown', and there is no clear indication of a well-known brand associated with the URL.", "The domain 'countercultureawards.com' does not appear to be associated with any well-known brand.", "There are no obvious misspellings or suspicious elements in the URL itself.", "The URL does not contain extra words or unusual domain extensions that are typically associated with phishing attempts."], "brand_matches":[], "url_match":true, "brand_input":"unknown", "input_fields":"unknown"}

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Oct 6 22:00:55 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9814381947523985
Encrypted:	false
SSDEEP:	48:8e8bd2T45HkidAKZdA1uehwiZUklqehHMy+3:8e9MnmMy
MD5:	E96F3FA515C1A9A17913CB9658664618
SHA1:	303780E5BE010969EBDBADD6202F132B028A9194
SHA-256:	316E1A7E3CDB9BE158650563652906FC13AD8F438E10D84B3512374D99BD60AE
SHA-512:	1CCBA8501703589135E10BA91807080AA0695D2E639FB22EC72290B5306BCA5C0BB1971814F55C93DB7DBECA46CD43654B3B5271930FD0E3E988AE918CAC1E84
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.......C.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW$O..PROGRA~1..t......O.IFY......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VFY......L.....................p+j.G.o.o.g.l.e.....T.1.....EW.L..Chrome..>......CW.VFY......M......................k..C.h.r.o.m.e.....`.1.....EW.L..APPLIC~1..H......CW.VFY.............................k..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VFY......N.......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........l.0......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 7, 2024 01:00:55.364614964 CEST	192.168.2.10	1.1.1.1	0xa83d	Standard query (0)	countercultureusa.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:00:55.364614964 CEST	192.168.2.10	1.1.1.1	0xa226	Standard query (0)	countercultureusa.com	65	IN (0x0001)	false
Oct 7, 2024 01:00:56.025250912 CEST	192.168.2.10	1.1.1.1	0x288	Standard query (0)	www.countercultureawards.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:00:56.025394917 CEST	192.168.2.10	1.1.1.1	0x87fc	Standard query (0)	www.countercultureawards.com	65	IN (0x0001)	false
Oct 7, 2024 01:00:57.985209942 CEST	192.168.2.10	1.1.1.1	0xdacb	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:00:57.985585928 CEST	192.168.2.10	1.1.1.1	0xee73	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 7, 2024 01:01:01.764833927 CEST	192.168.2.10	1.1.1.1	0x3bc0	Standard query (0)	static.parastorage.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:01:01.765011072 CEST	192.168.2.10	1.1.1.1	0x3cd6	Standard query (0)	static.parastorage.com	65	IN (0x0001)	false
Oct 7, 2024 01:01:01.796669960 CEST	192.168.2.10	1.1.1.1	0x7942	Standard query (0)	static.wixstatic.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:01:01.796787977 CEST	192.168.2.10	1.1.1.1	0x2af2	Standard query (0)	static.wixstatic.com	65	IN (0x0001)	false
Oct 7, 2024 01:01:01.915971041 CEST	192.168.2.10	1.1.1.1	0x8b32	Standard query (0)	siteassets.parastorage.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:01:01.915971041 CEST	192.168.2.10	1.1.1.1	0x75c9	Standard query (0)	siteassets.parastorage.com	65	IN (0x0001)	false
Oct 7, 2024 01:01:02.710058928 CEST	192.168.2.10	1.1.1.1	0xae7d	Standard query (0)	www.countercultureawards.com	65	IN (0x0001)	false
Oct 7, 2024 01:01:02.710058928 CEST	192.168.2.10	1.1.1.1	0x3405	Standard query (0)	www.countercultureawards.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:01:02.848962069 CEST	192.168.2.10	1.1.1.1	0x5af0	Standard query (0)	frog.wix.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:01:02.849399090 CEST	192.168.2.10	1.1.1.1	0x26e1	Standard query (0)	frog.wix.com	65	IN (0x0001)	false
Oct 7, 2024 01:01:02.850574970 CEST	192.168.2.10	1.1.1.1	0x7342	Standard query (0)	panorama.wixapps.net	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:01:02.850758076 CEST	192.168.2.10	1.1.1.1	0xf0cc	Standard query (0)	panorama.wixapps.net	65	IN (0x0001)	false
Oct 7, 2024 01:01:02.968746901 CEST	192.168.2.10	1.1.1.1	0x28c1	Standard query (0)	static.wixstatic.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:01:02.968996048 CEST	192.168.2.10	1.1.1.1	0xb894	Standard query (0)	static.wixstatic.com	65	IN (0x0001)	false
Oct 7, 2024 01:01:03.165287971 CEST	192.168.2.10	1.1.1.1	0x16dc	Standard query (0)	video.wixstatic.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:01:03.165642023 CEST	192.168.2.10	1.1.1.1	0x7f91	Standard query (0)	video.wixstatic.com	65	IN (0x0001)	false
Oct 7, 2024 01:01:03.523171902 CEST	192.168.2.10	1.1.1.1	0xaa38	Standard query (0)	static.parastorage.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:01:03.523238897 CEST	192.168.2.10	1.1.1.1	0x5c5b	Standard query (0)	static.parastorage.com	65	IN (0x0001)	false
Oct 7, 2024 01:01:12.406591892 CEST	192.168.2.10	1.1.1.1	0xe823	Standard query (0)	siteassets.parastorage.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:01:12.406867027 CEST	192.168.2.10	1.1.1.1	0x6c27	Standard query (0)	siteassets.parastorage.com	65	IN (0x0001)	false
Oct 7, 2024 01:02:04.003004074 CEST	192.168.2.10	1.1.1.1	0x7afe	Standard query (0)	static.wixstatic.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:02:04.003681898 CEST	192.168.2.10	1.1.1.1	0xfd5	Standard query (0)	static.wixstatic.com	65	IN (0x0001)	false
Oct 7, 2024 01:02:04.890950918 CEST	192.168.2.10	1.1.1.1	0x207e	Standard query (0)	frog.wix.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:02:04.891068935 CEST	192.168.2.10	1.1.1.1	0x7768	Standard query (0)	frog.wix.com	65	IN (0x0001)	false
Oct 7, 2024 01:02:08.527445078 CEST	192.168.2.10	1.1.1.1	0xfa5e	Standard query (0)	static.parastorage.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:02:08.527686119 CEST	192.168.2.10	1.1.1.1	0x2e4c	Standard query (0)	static.parastorage.com	65	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 7, 2024 01:00:55.398001909 CEST	1.1.1.1	192.168.2.10	0xa83d	No error (0)	countercultureusa.com		185.230.63.186	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:00:56.058387041 CEST	1.1.1.1	192.168.2.10	0x288	No error (0)	www.countercultureawards.com	cdn1.wixdns.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 01:00:56.058387041 CEST	1.1.1.1	192.168.2.10	0x288	No error (0)	cdn1.wixdns.net	td-ccm-neg-87-45.wixdns.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 01:00:56.058387041 CEST	1.1.1.1	192.168.2.10	0x288	No error (0)	td-ccm-neg-87-45.wixdns.net		34.149.87.45	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:00:56.075663090 CEST	1.1.1.1	192.168.2.10	0x87fc	No error (0)	www.countercultureawards.com	cdn1.wixdns.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 01:00:56.075663090 CEST	1.1.1.1	192.168.2.10	0x87fc	No error (0)	cdn1.wixdns.net	td-ccm-neg-87-45.wixdns.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 01:00:57.991970062 CEST	1.1.1.1	192.168.2.10	0xdacb	No error (0)	www.google.com		142.250.184.228	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:00:57.992342949 CEST	1.1.1.1	192.168.2.10	0xee73	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 7, 2024 01:01:01.771559000 CEST	1.1.1.1	192.168.2.10	0x3bc0	No error (0)	static.parastorage.com	static-external.parastorage.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 01:01:01.771559000 CEST	1.1.1.1	192.168.2.10	0x3bc0	No error (0)	static-external.parastorage.com	td-static-34-49-229-81.parastorage.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 01:01:01.771559000 CEST	1.1.1.1	192.168.2.10	0x3bc0	No error (0)	td-static-34-49-229-81.parastorage.com		34.49.229.81	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:01:01.773405075 CEST	1.1.1.1	192.168.2.10	0x3cd6	No error (0)	static.parastorage.com	static-external.parastorage.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 01:01:01.773405075 CEST	1.1.1.1	192.168.2.10	0x3cd6	No error (0)	static-external.parastorage.com	td-static-34-49-229-81.parastorage.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 01:01:01.803699970 CEST	1.1.1.1	192.168.2.10	0x7942	No error (0)	static.wixstatic.com	d1cq301dpr7fww.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 01:01:01.803699970 CEST	1.1.1.1	192.168.2.10	0x7942	No error (0)	d1cq301dpr7fww.cloudfront.net		108.156.60.6	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:01:01.803699970 CEST	1.1.1.1	192.168.2.10	0x7942	No error (0)	d1cq301dpr7fww.cloudfront.net		108.156.60.94	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:01:01.803699970 CEST	1.1.1.1	192.168.2.10	0x7942	No error (0)	d1cq301dpr7fww.cloudfront.net		108.156.60.112	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:01:01.803699970 CEST	1.1.1.1	192.168.2.10	0x7942	No error (0)	d1cq301dpr7fww.cloudfront.net		108.156.60.124	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:01:01.805345058 CEST	1.1.1.1	192.168.2.10	0x2af2	No error (0)	static.wixstatic.com	d1cq301dpr7fww.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 01:01:01.922954082 CEST	1.1.1.1	192.168.2.10	0x8b32	No error (0)	siteassets.parastorage.com	static.parastorage.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 01:01:01.922954082 CEST	1.1.1.1	192.168.2.10	0x8b32	No error (0)	static.parastorage.com	static-external.parastorage.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 01:01:01.922954082 CEST	1.1.1.1	192.168.2.10	0x8b32	No error (0)	static-external.parastorage.com	td-static-34-49-229-81.parastorage.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 01:01:01.922954082 CEST	1.1.1.1	192.168.2.10	0x8b32	No error (0)	td-static-34-49-229-81.parastorage.com		34.49.229.81	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:01:01.923315048 CEST	1.1.1.1	192.168.2.10	0x75c9	No error (0)	siteassets.parastorage.com	static.parastorage.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 01:01:01.923315048 CEST	1.1.1.1	192.168.2.10	0x75c9	No error (0)	static.parastorage.com	static-external.parastorage.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 01:01:01.923315048 CEST	1.1.1.1	192.168.2.10	0x75c9	No error (0)	static-external.parastorage.com	td-static-34-49-229-81.parastorage.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 01:01:02.750283003 CEST	1.1.1.1	192.168.2.10	0x3405	No error (0)	www.countercultureawards.com	cdn1.wixdns.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 01:01:02.750283003 CEST	1.1.1.1	192.168.2.10	0x3405	No error (0)	cdn1.wixdns.net	td-ccm-neg-87-45.wixdns.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 01:01:02.750283003 CEST	1.1.1.1	192.168.2.10	0x3405	No error (0)	td-ccm-neg-87-45.wixdns.net		34.149.87.45	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:01:02.764301062 CEST	1.1.1.1	192.168.2.10	0xae7d	No error (0)	www.countercultureawards.com	cdn1.wixdns.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 01:01:02.764301062 CEST	1.1.1.1	192.168.2.10	0xae7d	No error (0)	cdn1.wixdns.net	td-ccm-neg-87-45.wixdns.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 01:01:02.855935097 CEST	1.1.1.1	192.168.2.10	0x5af0	No error (0)	frog.wix.com	bi-flogger-alb-ext-343643057.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 01:01:02.855935097 CEST	1.1.1.1	192.168.2.10	0x5af0	No error (0)	bi-flogger-alb-ext-343643057.us-east-1.elb.amazonaws.com		44.213.232.30	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:01:02.855935097 CEST	1.1.1.1	192.168.2.10	0x5af0	No error (0)	bi-flogger-alb-ext-343643057.us-east-1.elb.amazonaws.com		54.85.229.148	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:01:02.855935097 CEST	1.1.1.1	192.168.2.10	0x5af0	No error (0)	bi-flogger-alb-ext-343643057.us-east-1.elb.amazonaws.com		34.229.4.171	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:01:02.855935097 CEST	1.1.1.1	192.168.2.10	0x5af0	No error (0)	bi-flogger-alb-ext-343643057.us-east-1.elb.amazonaws.com		52.21.166.98	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:01:02.855935097 CEST	1.1.1.1	192.168.2.10	0x5af0	No error (0)	bi-flogger-alb-ext-343643057.us-east-1.elb.amazonaws.com		34.196.93.134	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:01:02.855935097 CEST	1.1.1.1	192.168.2.10	0x5af0	No error (0)	bi-flogger-alb-ext-343643057.us-east-1.elb.amazonaws.com		50.17.183.161	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:01:02.857404947 CEST	1.1.1.1	192.168.2.10	0x7342	No error (0)	panorama.wixapps.net	verticals.wix.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 01:01:02.857404947 CEST	1.1.1.1	192.168.2.10	0x7342	No error (0)	verticals.wix.com	editor.wix.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 01:01:02.857404947 CEST	1.1.1.1	192.168.2.10	0x7342	No error (0)	editor.wix.com	glb-editor.wix.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 01:01:02.857404947 CEST	1.1.1.1	192.168.2.10	0x7342	No error (0)	glb-editor.wix.com		34.149.206.255	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:01:02.857543945 CEST	1.1.1.1	192.168.2.10	0xf0cc	No error (0)	panorama.wixapps.net	verticals.wix.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 01:01:02.857543945 CEST	1.1.1.1	192.168.2.10	0xf0cc	No error (0)	verticals.wix.com	editor.wix.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 01:01:02.857543945 CEST	1.1.1.1	192.168.2.10	0xf0cc	No error (0)	editor.wix.com	glb-editor.wix.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 01:01:02.872814894 CEST	1.1.1.1	192.168.2.10	0x26e1	No error (0)	frog.wix.com	bi-flogger-alb-ext-343643057.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 01:01:02.975949049 CEST	1.1.1.1	192.168.2.10	0x28c1	No error (0)	static.wixstatic.com	d1cq301dpr7fww.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 01:01:02.975949049 CEST	1.1.1.1	192.168.2.10	0x28c1	No error (0)	d1cq301dpr7fww.cloudfront.net		108.156.22.112	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:01:02.975949049 CEST	1.1.1.1	192.168.2.10	0x28c1	No error (0)	d1cq301dpr7fww.cloudfront.net		108.156.22.93	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:01:02.975949049 CEST	1.1.1.1	192.168.2.10	0x28c1	No error (0)	d1cq301dpr7fww.cloudfront.net		108.156.22.46	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:01:02.975949049 CEST	1.1.1.1	192.168.2.10	0x28c1	No error (0)	d1cq301dpr7fww.cloudfront.net		108.156.22.36	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:01:02.977087975 CEST	1.1.1.1	192.168.2.10	0xb894	No error (0)	static.wixstatic.com	d1cq301dpr7fww.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 01:01:03.175055981 CEST	1.1.1.1	192.168.2.10	0x7f91	No error (0)	video.wixstatic.com	media-router.wixstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 01:01:03.175055981 CEST	1.1.1.1	192.168.2.10	0x7f91	No error (0)	media-router.wixstatic.com	aws.media-router.wixstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 01:01:03.175055981 CEST	1.1.1.1	192.168.2.10	0x7f91	No error (0)	aws.media-router.wixstatic.com	d1cq301dpr7fww.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 01:01:03.187405109 CEST	1.1.1.1	192.168.2.10	0x16dc	No error (0)	video.wixstatic.com	media-router.wixstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 01:01:03.187405109 CEST	1.1.1.1	192.168.2.10	0x16dc	No error (0)	media-router.wixstatic.com	aws.media-router.wixstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 01:01:03.187405109 CEST	1.1.1.1	192.168.2.10	0x16dc	No error (0)	aws.media-router.wixstatic.com	d1cq301dpr7fww.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 01:01:03.187405109 CEST	1.1.1.1	192.168.2.10	0x16dc	No error (0)	d1cq301dpr7fww.cloudfront.net		99.86.4.125	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:01:03.187405109 CEST	1.1.1.1	192.168.2.10	0x16dc	No error (0)	d1cq301dpr7fww.cloudfront.net		99.86.4.105	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:01:03.187405109 CEST	1.1.1.1	192.168.2.10	0x16dc	No error (0)	d1cq301dpr7fww.cloudfront.net		99.86.4.79	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:01:03.187405109 CEST	1.1.1.1	192.168.2.10	0x16dc	No error (0)	d1cq301dpr7fww.cloudfront.net		99.86.4.90	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:01:03.529759884 CEST	1.1.1.1	192.168.2.10	0xaa38	No error (0)	static.parastorage.com	static-external.parastorage.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 01:01:03.529759884 CEST	1.1.1.1	192.168.2.10	0xaa38	No error (0)	static-external.parastorage.com	td-static-34-49-229-81.parastorage.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 01:01:03.529759884 CEST	1.1.1.1	192.168.2.10	0xaa38	No error (0)	td-static-34-49-229-81.parastorage.com		34.49.229.81	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:01:03.530158043 CEST	1.1.1.1	192.168.2.10	0x5c5b	No error (0)	static.parastorage.com	static-external.parastorage.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 01:01:03.530158043 CEST	1.1.1.1	192.168.2.10	0x5c5b	No error (0)	static-external.parastorage.com	td-static-34-49-229-81.parastorage.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 01:01:12.413642883 CEST	1.1.1.1	192.168.2.10	0x6c27	No error (0)	siteassets.parastorage.com	static.parastorage.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 01:01:12.413642883 CEST	1.1.1.1	192.168.2.10	0x6c27	No error (0)	static.parastorage.com	static-external.parastorage.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 01:01:12.413642883 CEST	1.1.1.1	192.168.2.10	0x6c27	No error (0)	static-external.parastorage.com	td-static-34-49-229-81.parastorage.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 01:01:12.413736105 CEST	1.1.1.1	192.168.2.10	0xe823	No error (0)	siteassets.parastorage.com	static.parastorage.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 01:01:12.413736105 CEST	1.1.1.1	192.168.2.10	0xe823	No error (0)	static.parastorage.com	static-external.parastorage.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 01:01:12.413736105 CEST	1.1.1.1	192.168.2.10	0xe823	No error (0)	static-external.parastorage.com	td-static-34-49-229-81.parastorage.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 01:01:12.413736105 CEST	1.1.1.1	192.168.2.10	0xe823	No error (0)	td-static-34-49-229-81.parastorage.com		34.49.229.81	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:01:24.334001064 CEST	1.1.1.1	192.168.2.10	0x1f07	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:01:24.334001064 CEST	1.1.1.1	192.168.2.10	0x1f07	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:01:48.202311039 CEST	1.1.1.1	192.168.2.10	0x2880	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:01:48.202311039 CEST	1.1.1.1	192.168.2.10	0x2880	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:02:04.010222912 CEST	1.1.1.1	192.168.2.10	0x7afe	No error (0)	static.wixstatic.com	d1cq301dpr7fww.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 01:02:04.010222912 CEST	1.1.1.1	192.168.2.10	0x7afe	No error (0)	d1cq301dpr7fww.cloudfront.net		99.86.4.125	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:02:04.010222912 CEST	1.1.1.1	192.168.2.10	0x7afe	No error (0)	d1cq301dpr7fww.cloudfront.net		99.86.4.105	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:02:04.010222912 CEST	1.1.1.1	192.168.2.10	0x7afe	No error (0)	d1cq301dpr7fww.cloudfront.net		99.86.4.79	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:02:04.010222912 CEST	1.1.1.1	192.168.2.10	0x7afe	No error (0)	d1cq301dpr7fww.cloudfront.net		99.86.4.90	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:02:04.010715008 CEST	1.1.1.1	192.168.2.10	0xfd5	No error (0)	static.wixstatic.com	d1cq301dpr7fww.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 01:02:04.897516012 CEST	1.1.1.1	192.168.2.10	0x7768	No error (0)	frog.wix.com	bi-flogger-alb-ext-343643057.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 01:02:04.897814035 CEST	1.1.1.1	192.168.2.10	0x207e	No error (0)	frog.wix.com	bi-flogger-alb-ext-343643057.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 01:02:04.897814035 CEST	1.1.1.1	192.168.2.10	0x207e	No error (0)	bi-flogger-alb-ext-343643057.us-east-1.elb.amazonaws.com		44.213.232.30	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:02:04.897814035 CEST	1.1.1.1	192.168.2.10	0x207e	No error (0)	bi-flogger-alb-ext-343643057.us-east-1.elb.amazonaws.com		34.229.4.171	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:02:04.897814035 CEST	1.1.1.1	192.168.2.10	0x207e	No error (0)	bi-flogger-alb-ext-343643057.us-east-1.elb.amazonaws.com		50.17.183.161	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:02:04.897814035 CEST	1.1.1.1	192.168.2.10	0x207e	No error (0)	bi-flogger-alb-ext-343643057.us-east-1.elb.amazonaws.com		52.21.166.98	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:02:04.897814035 CEST	1.1.1.1	192.168.2.10	0x207e	No error (0)	bi-flogger-alb-ext-343643057.us-east-1.elb.amazonaws.com		54.85.229.148	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:02:04.897814035 CEST	1.1.1.1	192.168.2.10	0x207e	No error (0)	bi-flogger-alb-ext-343643057.us-east-1.elb.amazonaws.com		34.196.93.134	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:02:08.534336090 CEST	1.1.1.1	192.168.2.10	0xfa5e	No error (0)	static.parastorage.com	static-external.parastorage.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 01:02:08.534336090 CEST	1.1.1.1	192.168.2.10	0xfa5e	No error (0)	static-external.parastorage.com	td-static-34-49-229-81.parastorage.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 01:02:08.534336090 CEST	1.1.1.1	192.168.2.10	0xfa5e	No error (0)	td-static-34-49-229-81.parastorage.com		34.49.229.81	A (IP address)	IN (0x0001)	false
Oct 7, 2024 01:02:08.534797907 CEST	1.1.1.1	192.168.2.10	0x2e4c	No error (0)	static.parastorage.com	static-external.parastorage.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 01:02:08.534797907 CEST	1.1.1.1	192.168.2.10	0x2e4c	No error (0)	static-external.parastorage.com	td-static-34-49-229-81.parastorage.com		CNAME (Canonical name)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2024-10-06 23:00:53 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 23:00:53 UTC	540	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 23:00:53 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public Last-Modified: Fri, 04 Oct 2024 23:21:50 GMT ETag: "0x8DCE4CB535A72FA" x-ms-request-id: 4dad204e-401e-005b-4bf5-169c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T230053Z-1657d5bbd48cpbzgkvtewk0wu000000002s0000000009z7c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 23:00:53 UTC	15844	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-10-06 23:00:54 UTC	16384	IN	Data Raw: 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e Data Ascii: "0" /> </L> <R> <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" />
2024-10-06 23:00:54 UTC	16384	IN	Data Raw: 20 20 3c 53 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 53 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 38 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 Data Ascii: <ST> <S T="1" /> </ST></R><$!#>10820v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-781
2024-10-06 23:00:54 UTC	16384	IN	Data Raw: 20 54 3d 22 55 36 34 22 20 49 3d 22 38 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 45 76 65 6e 74 73 5f 41 76 67 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 Data Ascii: T="U64" I="8" O="false" N="Events_Avg"> <S T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32"
2024-10-06 23:00:54 UTC	16384	IN	Data Raw: 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f Data Ascii: "0" O="false" N="Count_CreateCard_ValidPersona_False"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Co
2024-10-06 23:00:54 UTC	16384	IN	Data Raw: 20 20 20 20 3c 53 20 54 3d 22 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a Data Ascii: <S T="31" /> </C> </C> <C T="U32" I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C>
2024-10-06 23:00:54 UTC	16384	IN	Data Raw: 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 Data Ascii: <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMillisec
2024-10-06 23:00:54 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e Data Ascii: R> <V V="0" T="I32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIn
2024-10-06 23:00:54 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: R> </O> </F> <F T="6"> <O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L>
2024-10-06 23:00:54 UTC	16384	IN	Data Raw: 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c Data Ascii: T="6"> <O T="EQ"> <L> <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <

Timestamp	Bytes transferred	Direction	Data
2024-10-06 23:00:55 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 23:00:55 UTC	563	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 23:00:55 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 8aaf7b13-d01e-0028-46fd-167896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T230055Z-1657d5bbd48f7nlxc7n5fnfzh0000000025g00000000ua9a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 23:00:55 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Timestamp	Bytes transferred	Direction	Data
2024-10-06 23:00:55 UTC	192	OUT	GET /rules/rule120100v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 23:00:55 UTC	471	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 23:00:55 GMT Content-Type: text/xml Content-Length: 1000 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB097AFC9" x-ms-request-id: a79f927d-a01e-0098-24c9-168556000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T230055Z-1657d5bbd48jwrqbupe3ktsx9w00000002qg00000000z6u3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 23:00:55 UTC	1000	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 31 30 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 32 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 52 65 73 75 6d 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 49 20 54 3d 22 33 22 20 49 3d 22 33 30 73 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 35 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120100" V="3" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <A T="2" E="TelemetryResume" /> <TI T="3" I="30s" /> <R T="4" R="120100" /> <TH T="5">

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://countercultureusa.com/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3140_330902706\LICENSE

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3140_330902706\_metadata\verified_contents.json

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3140_330902706\manifest.fingerprint

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3140_330902706\manifest.json

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3140_330902706\sets.json

Chrome Cache Entry: 296

Chrome Cache Entry: 297

Chrome Cache Entry: 298

Chrome Cache Entry: 299

Chrome Cache Entry: 300

Chrome Cache Entry: 301

Chrome Cache Entry: 302

Chrome Cache Entry: 303

Chrome Cache Entry: 304

Chrome Cache Entry: 305

Chrome Cache Entry: 306

Chrome Cache Entry: 307

Chrome Cache Entry: 308

Chrome Cache Entry: 309

Chrome Cache Entry: 310

Chrome Cache Entry: 311

Windows Analysis Report
https://countercultureusa.com/

Timestamp	Bytes transferred	Direction	Data
2024-10-06 23:00:55 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 23:00:55 UTC	563	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 23:00:55 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 4545068c-701e-0050-0e05-176767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T230055Z-1657d5bbd48vhs7r2p1ky7cs5w00000002ug00000000wcu8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 23:00:55 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Timestamp	Bytes transferred	Direction	Data
2024-10-06 23:00:55 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 23:00:55 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 23:00:55 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: d4448e94-101e-00a2-2703-179f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T230055Z-1657d5bbd48xdq5dkwwugdpzr000000002vg00000000v66w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 23:00:55 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Timestamp	Bytes transferred	Direction	Data
2024-10-06 23:00:55 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 23:00:55 UTC	563	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 23:00:55 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: c62b5fc1-401e-0067-3a60-1709c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T230055Z-1657d5bbd48vhs7r2p1ky7cs5w00000002yg00000000cwsk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 23:00:55 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Timestamp	Bytes transferred	Direction	Data
2024-10-06 23:00:55 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 23:00:55 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 23:00:55 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 3ea0840d-701e-0053-1012-173a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T230055Z-1657d5bbd48762wn1qw4s5sd3000000002g000000000esmm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 23:00:55 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Timestamp	Bytes transferred	Direction	Data
2024-10-06 23:00:55 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 23:00:55 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 23:00:55 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 28f6fc08-301e-0020-466a-176299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T230055Z-1657d5bbd482lxwq1dp2t1zwkc00000002c000000000fnqg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 23:00:55 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Timestamp	Bytes transferred	Direction	Data
2024-10-06 23:00:55 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 23:00:55 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 23:00:55 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 73fc0cc0-d01e-008e-5fee-16387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T230055Z-1657d5bbd48xdq5dkwwugdpzr000000002y000000000gtf8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 23:00:55 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Timestamp	Bytes transferred	Direction	Data
2024-10-06 23:00:55 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 23:00:55 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 23:00:55 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 15158de7-401e-0029-4b00-179b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T230055Z-1657d5bbd48t66tjar5xuq22r800000002pg000000005z1m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 23:00:55 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Timestamp	Bytes transferred	Direction	Data
2024-10-06 23:00:55 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 23:00:55 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 23:00:55 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 1707b783-801e-00a3-53e5-167cfb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T230055Z-1657d5bbd48jwrqbupe3ktsx9w00000002y0000000001h66 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 23:00:55 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Timestamp	Bytes transferred	Direction	Data
2024-10-06 23:00:55 UTC	664	OUT	GET / HTTP/1.1 Host: countercultureusa.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-06 23:00:56 UTC	714	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 06 Oct 2024 23:00:55 GMT Content-Length: 0 Connection: close location: https://www.countercultureawards.com/ x-wix-cache-control: public, max-age=86400 strict-transport-security: max-age=86400 Age: 705 Server-Timing: cache;desc=hit, varnish;desc=hit, dc;desc=42 X-Seen-By: oDbbMvfdXCdtsgjD2KgaM8iHE4dbw+wewoJ5nvKoyjE=,m0j2EEknGIVUW/liY8BLLlAwLb1tXR23DYhcoMEdpYDu/2EjeiyKjB/JVOb8T5Ve,2d58ifebGbosy5xc+FRalvU4RE7Djxq7QANXASutX7ait9UNHamhbE9kixRDFLyRf8GET16Dvh0P0htGxeCLCA==,2UNV7KOq4oGjA5+PKsX47C3Dm4evq/BoMKcAXGKUm7xYgeUJqUXtid+86vZww+nL Cache-Control: no-cache X-Wix-Request-Id: 1728255655.95993185100115948 Server: Pepyaka X-Content-Type-Options: nosniff

Timestamp	Bytes transferred	Direction	Data
2024-10-06 23:00:56 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 23:00:56 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 23:00:56 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 915c1ee4-001e-0079-3000-1712e8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T230056Z-1657d5bbd48qjg85buwfdynm5w00000002s000000000c38r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 23:00:56 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"