Edit tour

Windows Analysis Report
https://url.za.m.mimecastprotect.com/s/25ZWCQ1LLnt4mw7QuPhvFGTIX4?domain=irp.cdn-website.com

Overview

General Information

Sample URL:	https://url.za.m.mimecastprotect.com/s/25ZWCQ1LLnt4mw7QuPhvFGTIX4?domain=irp.cdn-website.com
Analysis ID:	1527688
Infos:

Detection

Score:	21
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Phishing site detected (based on favicon image match)

Detected suspicious crossdomain redirect

HTML page contains hidden javascript code

Classification

Process Tree

System is w10x64

chrome.exe (PID: 4140 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 5100 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2464 --field-trial-handle=2340,i,18365201021849973980,14929015494435994504,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 1912 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://url.za.m.mimecastprotect.com/s/25ZWCQ1LLnt4mw7QuPhvFGTIX4?domain=irp.cdn-website.com" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

HTTP traffic detected: POST /gen_204?s=webhp&t=cap&atyp=csi&ei=14QDZ6_3LcGOxc8PquDd8QU&rt=wsrt.6409,cbt.93,hst.53&opi=89978449&dt=&ts=300 HTTP/1.1Host: www.google.comConnection: keep-aliveContent-Length: 0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.134"Content-Type: text/plain;charset=UTF-8sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: */*Origin: https://www.google.comX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AVYB7co9OoczZgmVhks_I-VIZoqS-4ykhpDtkIk7bshMUnQFxua_ApxkTw; NID=518=y5HtF7pexbdgFXc0yJz1_W08sSyC6S796Ke3TrcpBq3kTrZ2IjeSXU-tE5-tQoPSOILxhRWKySy5VwffJ6R_CQMTh5CdpdbYTG-FxyESnTl6shZBF_u32zBmnD3j78d2wMUZIi6jyXFuPqOA0ItVOE20IVHB6whJVFAoJ6qZeHMJaxm9oOZjgTdjs2NgcWST94o

Source: global traffic

HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Type: application/xmlTransfer-Encoding: chunkedConnection: keep-aliveDate: Mon, 07 Oct 2024 06:50:55 GMTServer: AmazonS3X-Cache: Error from cloudfrontVia: 1.1 a54cda8ccda3480314f451558e4dd062.cloudfront.net (CloudFront)X-Amz-Cf-Pop: FRA60-P3Alt-Svc: h3=":443"; ma=86400X-Amz-Cf-Id: VQF2krwbOQ3dATGltv_trAALH7fIr3pTXp_-HAvUusONHYzU02mxMQ==cache-control: max-age=31536000Data Raw: 66 33 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 45 72 72 6f 72 3e 3c 43 6f 64 65 3e 41 63 63 65 73 73 44 65 6e 69 65 64 3c 2f 43 6f 64 65 3e 3c 4d 65 73 73 61 67 65 3e 41 63 63 65 73 73 20 44 65 6e 69 65 64 3c 2f 4d 65 73 73 61 67 65 3e 3c 52 65 71 75 65 73 74 49 64 3e 44 58 4a 39 5a 56 51 56 4e 37 42 36 37 58 50 46 3c 2f 52 65 71 75 65 73 74 49 64 3e 3c 48 6f 73 74 49 64 3e 42 69 38 51 4e 73 72 71 64 34 72 5a 72 6b 38 71 39 4e 65 55 4c 62 75 46 68 4a 4b 69 76 7a 53 64 41 79 70 54 32 46 44 73 6f 67 71 64 34 6a 41 52 57 76 47 50 44 4b 55 4a 35 65 37 61 64 70 63 63 4d 4e 36 46 63 4e 46 4e 41 6d 67 3d 3c 2f 48 6f 73 74 49 64 3e 3c 2f 45 72 72 6f 72 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: f3<?xml version="1.0" encoding="UTF-8"?><Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>DXJ9ZVQVN7B67XPF</RequestId><HostId>Bi8QNsrqd4rZrk8q9NeULbuFhJKivzSdAypT2FDsogqd4jARWvGPDKUJ5e7adpccMN6FcNFNAmg=</HostId></Error>0

Source: http://irp.cdn-website.com/ff7d1c02/files/uploaded/courire.html	HTTP Parser: No favicon
Source: https://www.google.com/	HTTP Parser: No favicon
Source: https://www.google.com/	HTTP Parser: No favicon
Source: https://www.google.com/	HTTP Parser: No favicon
Source: https://www.google.com/	HTTP Parser: No favicon
Source: https://www.google.com/	HTTP Parser: No favicon
Source: https://www.google.com/imghp?hl=en&ogbl	HTTP Parser: No favicon
Source: https://www.google.com/imghp?hl=en&ogbl	HTTP Parser: No favicon
Source: https://www.google.com/imghp?hl=en&ogbl	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49833 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49844 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49999 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:50325 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:50428 version: TLS 1.2

Source:	Binary string: Zdb=function(a,b,c,d,e,f){var g=new Map,h={},l=[],m=c.xm.getChildren(),p=1,q;for(q in m)if(!f\|\|q===f){var u=m[q],z=u.name;g.set(z,q);var A=u.wy(Ndb(c),d,e);if($db(a,A)){u=a;var E=p,M=b,O=c.oa;c.xm.getName();A=A.eJ?aeb(u,M,A,E):A.recursive?beb(u,M,A,E):ceb(u,M,A,E,O);u=A.exa;A=A.I8a;u&&(h[z]=u,p+=1,l.push.apply(l,_.md(A)))}}return{Pzd:h,fEc:l,Ozd:g}};ceb=function(a,b,c,d,e){e=_.Pdb(_.Odb(a.oa(c.id,c.Ed),e),c.UH,c.Xr);a=Tdb(a,b,e,d+";0",c);return{exa:_.me([a.exa]),I8a:a.I8a}}; source: chromecache_583.2.dr
Source:	Binary string: _.ndb=function(a,b,c,d){_.eoa()&&_.foa.get(a)&&(a=_.Te.get(a),!c&&b&&(c=_.Ue(b)),_.Je(b\|\|document.body,a,{element:b,dataset:c,event:d,jL:void 0,nxb:!0}))};_.odb=function(a,b,c){_.Xga(a,c);return _.tb(a,2,_.Wea(b),_.La())};_.pdb=function(a){return a.previousElementSibling!==void 0?a.previousElementSibling:_.wAa(a.previousSibling,!1)};qdb=function(a,b,c,d,e,f,g){_.cm.call(this,a);this.clientX=c;this.clientY=d;this.left=f!==void 0?f:b.deltaX;this.top=g!==void 0?g:b.deltaY;this.ka=b};_.hh(qdb,_.cm); source: chromecache_381.2.dr, chromecache_397.2.dr
Source:	Binary string: [];f=JNb(f,c);!f&&b&&(b=e?a.slice(0,d):a,f=JNb(b,c));return f},LNb=function(a,b){for(var c=a.length-1;c>=0;c--){var d=a[c];if(_.XLb(d,b))return d}},MNb=function(a,b){var c=b===void 0?{}:b;b=c.threshold===void 0?0:c.threshold;c=c.wrap===void 0?!0:c.wrap;var d=INb(a);a=d.pDb;d=d.k9b;var e=d>=0&&d<a.length,f=e?a.slice(0,d+1):[];f=LNb(f,b);!f&&c&&(c=e?a.slice(d+1):a,f=LNb(c,b));return f},NNb=function(a){(0,_.un)(function(){throw a;},0)},ONb=function(a,b){var c;return(c=a.reverse().find(function(d){return d.Ua=== source: chromecache_381.2.dr, chromecache_397.2.dr
Source:	Binary string: _.ar=function(a,b){if(!b)return a;var c=_.fc(b,function(d){return function(){return d}});return _.Pdb(a,function(){return _.me(b)},c)}; source: chromecache_583.2.dr
Source:	Binary string: var INb=function(a){if(!document.body.contains(a))throw Error("Yf");var b=Array.from(document.body.querySelectorAll("[tabindex], a, input, textarea, select, button"));a=_.$aa(b,a,_.zAa);if(a>=0)return{pDb:b,k9b:a-1,j9b:a+1};a=-a-1;return{pDb:b,k9b:a-1,j9b:a}},JNb=function(a,b){for(var c=0;c<a.length;c++){var d=a[c];if(_.XLb(d,b))return d}},KNb=function(a){var b={};var c=b.threshold===void 0?0:b.threshold;b=b.wrap===void 0?!0:b.wrap;var d=INb(a);a=d.pDb;d=d.j9b;var e=d>=0&&d<a.length,f=e?a.slice(d): source: chromecache_381.2.dr, chromecache_397.2.dr
Source:	Binary string: _.IDb=function(a,b,c,d,e,f,g){var h,l,m,p;return _.Kg(function(q){switch(q.oa){case 1:h=a.startUpdate();l=new _.jo("async","csi",void 0,{MYc:!1});m=new _.NDb(l,e.y7a,a);_.ODb(a,l,e.context,e.PPa);_.PDb(a,"yl");_.Cg(q,2);if(g){q.Fb(4);break}return q.yield(_.LDb(a,b,c,d,e,!1,l),5);case 5:g=q.Aa;case 4:return _.QDb(g),q.yield(RDb(e.onReady),6);case 6:return q.Aa?(a.setState("yp"),q.return(!1)):q.yield(_.ADb(h,g,a,{Hi:l,MAa:e.qIa,rX:m,kva:e.UK,Toa:e.Toa,ska:e.ska,source:f,triggerElement:e.trigger}),7); source: chromecache_495.2.dr, chromecache_440.2.dr
Source:	Binary string: var Ldb=function(a,b){var c=_.UKa(a);if(c)return _.me(c);if(c=a.XyHi9)return c;c=_.ue(a,function(d){return!!d.attributes&&!!d.attributes.getNamedItem("c-wiz")});if(!c\|\|a.getAttribute("data-node-index")==="0;0")return Kdb(b,a);b=Ldb(c,b);if(!a.hasAttribute("c-wiz"))return b;b=b.then(function(d){return Idb(d).then(function(e){var f=a.getAttribute("data-node-index");e=e[f];if(!e)throw Error("se`"+d.id+"`"+a.getAttribute("jsrenderer")+"`"+f);_.Jdb(e,a);return e})});return a.XyHi9=b};var Mdb=function(a,b,c){this.xm=a;this.Ca=c\|\|void 0;this.Da=b},Ndb=function(a){return a.Ca\|\|new (a.xm.getParams().Cb)};Mdb.prototype.iia=function(){return this.Oa};Mdb.prototype.Aa=function(a){this.Ba=a;return this};_.Odb=function(a,b){a.oa=Object.assign(a.oa\|\|{},b);return a};Mdb.prototype.m$a=function(){var a=this.oa&&this.oa.Ku\|\|[];a.push({key:_.Yp,value:!0});return _.Odb(this,{Ku:a})};_.Pdb=function(a,b,c){a.Fa=b;a.Ia=c;return a}; source: chromecache_583.2.dr
Source:	Binary string: aeb=function(a,b,c,d){return{exa:c.UH(a).then(function(e){var f=_.hc(e);if(e.bSa){var g=e.bSa\|\|[];var h=_.ta(f,function(l){return e[l]==g})}else h=f[0],g=e[h]\|\|[];return _.Ug(g,function(l,m){var p=_.lia(e,function(q){return!Array.isArray(q)});p[h]=l;l=_.Pdb(this.oa(c.id,c.Ed),function(){return p},c.Xr);return Tdb(this,b,l,d+";"+m,c).exa},this)},void 0,a),I8a:[]}};beb=function(a,b,c,d){return{exa:c.UH(a).then(function(e){return zdb(e)?ceb(a,b,c,d).exa:_.me([])}),I8a:[]}}; source: chromecache_583.2.dr
Source:	Binary string: case 7:if(!_.SDb(a,h))return q.return(!1);a.setState("yf");_.TDb(m,a.element);return q.return(!0);case 2:p=_.Gg(q);_.UDb(l,e.y7a);if(!_.SDb(a,h))return q.return(!1);_.PDb(a,"ye");throw p;}})};_.ODb=function(a,b,c,d){b.start();b.Gc("astyp",a.kH);(c==null?void 0:c.get("arc_id"))==="stev"&&(b.Gc("trt","st"),b.Gc("ssr","0"),d&&b.Gc("bb","1"));a=b.oa.startDate;var e,f,g,h;c=(e=google)==null?void 0:(f=e.timers)==null?void 0:(g=f.async)==null?void 0:(h=g.t)==null?void 0:h.atit;a&&c&&b.dB("tcdt",a-c)}; source: chromecache_495.2.dr, chromecache_440.2.dr
Source:	Binary string: _.JDb.prototype.reset=function(){this.element.textContent="";this.element.removeAttribute("eid");this.setState("yp");delete this.element.__yup;_.hg()};_.JDb.prototype.setState=function(a){_.sl.removeAll(this.element,gEb);_.sl.removeAll(this.element,hEb);_.sl.add(this.element,a);_.Kt(this.element,iEb[a])};_.PDb=function(a,b){_.sl.removeAll(a.element,hEb);_.sl.add(a.element,b);_.Kt(a.element,iEb[b])};gEb=["yp","yf","yi"];hEb=["yl","ye"];jEb={}; source: chromecache_495.2.dr, chromecache_440.2.dr
Source:	Binary string: _.pDb=function(a,b){oDb++;oDb===1&&_.Fqa("dos",function(){return""+oDb});_.Xd().Gc("dos","ssrc."+oDb+",target."+b).log()};_.qDb=function(a,b){_.Xd().Gc("dos","solved,target."+b).log()};_.rDb=function(a){var b,c,d;return(b=a?(c=window.google)==null?void 0:(d=c.ia)==null?void 0:d.r[a]:void 0)&&b.m===0?b:void 0}; source: chromecache_495.2.dr, chromecache_440.2.dr
Source:	Binary string: cEb=function(a){var b,c,d;_.Kg(function(e){if(e.oa==1){if(a.oa!==a.Aa)return e.return();a.Hi.Gc("ima",String(a.Da));a.Hi.Gc("imn",String(a.oa));b=_.n(Object.keys(_.KCb));for(c=b.next();!c.done;c=b.next())d=c.value,a.Hi.Gc(d,_.KCb[d]());_.ko(a.Hi,"art");return a.y7a?e.yield(a.y7a(a.Hi),2):e.Fb(2)}a.Hi.log();_.Bg(e)})};var vDb=_.pDb,yDb=_.qDb;var fEb,gEb,hEb,jEb,iEb;fEb=0;_.JDb=function(a){this.element=a;this.Hra=_.ezb(a);this.oa=_.fzb(a);this.kH=_.gzb(this.Hra,this.oa,a);this.XIa=_.Xc(a,"asyncRclass")\|\|"";this.method=(this.P1=_.Xc(a,"asyncToken"))\|\|_.Xc(a,"asyncMethod")==="stateful"?"POST":"GET"};_.JDb.prototype.startUpdate=function(){fEb++;return this.element.__yup=fEb};_.SDb=function(a,b){return b===a.element.__yup}; source: chromecache_495.2.dr, chromecache_440.2.dr
Source:	Binary string: _.LDb=function(a,b,c,d,e,f,g){var h=_.LCb.delegate().pyb.build(b,c,d,_.Rzb(a.element,e.trigger),e,a.element.id,f);g&&(h.Hi=g);var l=_.LCb.delegate().Us;return l.fetch(h).catch(function(m){return _.Kg(function(p){return p.return(xDb(m,a.element.id,l,h))})})};VDb=function(a){return function(b){var c=_.nDb(b);c&&_.pDb(c,a);throw b;}};_.QDb=function(a){a.header&&(a=_.H(a.header,2))&&a!==String(_.SCb)&&_.TCb.set(a,(_.TCb.get(a)\|\|0)+1)}; source: chromecache_495.2.dr, chromecache_440.2.dr
Source:	Binary string: _.Odb=function(a,b){return Ndb(a.QN,b).then(function(c){if(c.size()>0)return c.Yc(0);throw _.MKa(a,b);})};_.nr=function(a,b,c){b=_.qg(b);return new _.lg(_.rf(a.QN,b,c))};_.or=function(a,b,c){b=_.qg(b);b=_.nr(a,b,c);if(b.size()>=1)return b.Yc(0);throw _.MKa(a,c);};_.Pdb=function(a,b){return _.Rn(a,'[jsname="'+b+'"]')};_.Qdb=function(a){a.oa=null;if(a.oL){if(a.oa){var b=a.oa;b.Oc=a.oL;b.render()}else _.yc(a.oL,_.Nk);_.Wl.Rb(a.oL,!!a.oa)}};_.Rdb=function(a,b){a.fRa=b;a.AP&&_.Wl.Rb(a.AP,a.fRa)}; source: chromecache_381.2.dr, chromecache_397.2.dr

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45

Source: chromecache_417.2.dr	String found in binary or memory: L.getElementsByTagName("iframe"),ka=P.length,na=0;na<ka;na++)if(!v&&c(P[na],H.He)){oJ("https://www.youtube.com/iframe_api");v=!0;break}})}}else F(u.vtp_gtmOnSuccess)}var q=["www.youtube.com","www.youtube-nocookie.com"],r={UNSTARTED:-1,ENDED:0,PLAYING:1,PAUSED:2,BUFFERING:3,CUED:5},t,v=!1;Z.__ytl=n;Z.__ytl.o="ytl";Z.__ytl.isVendorTemplate=!0;Z.__ytl.priorityOverride=0;Z.__ytl.isInfrastructure=!1; equals www.youtube.com (Youtube)
Source: chromecache_572.2.dr, chromecache_383.2.dr, chromecache_505.2.dr, chromecache_417.2.dr	String found in binary or memory: Math.round(q);u["gtm.videoElapsedTime"]=Math.round(f);u["gtm.videoPercent"]=r;u["gtm.videoVisible"]=t;return u},bk:function(){e=zb()},nd:function(){d()}}};var gc=la(["data-gtm-yt-inspected-"]),LC=["www.youtube.com","www.youtube-nocookie.com"],MC,NC=!1; equals www.youtube.com (Youtube)
Source: chromecache_383.2.dr, chromecache_505.2.dr	String found in binary or memory: if(!(e\|\|f\|\|g\|\|k.length\|\|m.length))return;var p={hh:e,fh:f,gh:g,Rh:k,Sh:m,He:n,Cb:b},q=C.YT;if(q)return q.ready&&q.ready(d),b;var r=C.onYouTubeIframeAPIReady;C.onYouTubeIframeAPIReady=function(){r&&r();d()};F(function(){for(var t=E.getElementsByTagName("script"),v=t.length,u=0;u<v;u++){var w=t[u].getAttribute("src");if(WC(w,"iframe_api")\|\|WC(w,"player_api"))return b}for(var x=E.getElementsByTagName("iframe"),y=x.length,A=0;A<y;A++)if(!NC&&UC(x[A],p.He))return wc("https://www.youtube.com/iframe_api"), equals www.youtube.com (Youtube)
Source: chromecache_303.2.dr, chromecache_329.2.dr, chromecache_352.2.dr, chromecache_567.2.dr, chromecache_399.2.dr, chromecache_276.2.dr	String found in binary or memory: return b}JC.F="internal.enableAutoEventOnTimer";var gc=la(["data-gtm-yt-inspected-"]),LC=["www.youtube.com","www.youtube-nocookie.com"],MC,NC=!1; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: url.za.m.mimecastprotect.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: irp.cdn-website.com
Source: global traffic	DNS traffic detected: DNS query: jordanharris.co.za
Source: global traffic	DNS traffic detected: DNS query: google.com
Source: global traffic	DNS traffic detected: DNS query: ogs.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: sustainability.google
Source: global traffic	DNS traffic detected: DNS query: googletagmanager.com
Source: global traffic	DNS traffic detected: DNS query: lh3.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: www.blog.google
Source: global traffic	DNS traffic detected: DNS query: blog.google
Source: global traffic	DNS traffic detected: DNS query: csp.withgoogle.com
Source: global traffic	DNS traffic detected: DNS query: mail.google.com

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2464 --field-trial-handle=2340,i,18365201021849973980,14929015494435994504,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://url.za.m.mimecastprotect.com/s/25ZWCQ1LLnt4mw7QuPhvFGTIX4?domain=irp.cdn-website.com"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2464 --field-trial-handle=2340,i,18365201021849973980,14929015494435994504,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label	Link
https://stats.g.doubleclick.net/g/collect	0%	URL Reputation	safe
http://www.broofa.com	0%	URL Reputation	safe
https://sustainability.google/static/index.min.js?cache=47ade0f	0%	URL Reputation	safe
https://ogs.google.com/widget/callout?eom=1	0%	URL Reputation	safe
https://cct.google/taggy/agent.js	0%	URL Reputation	safe
https://sustainability.google/static/index.min.css?cache=732a3af	0%	URL Reputation	safe
https://blog.google/outreach-initiatives/sustainability/google-wildfire-boundary-maps-europe-africa/	0%	URL Reputation	safe
https://blog.google/outreach-initiatives/sustainability/google-ai-project-greenlight/	0%	URL Reputation	safe
https://fonts.google.com/license/googlerestricted	0%	URL Reputation	safe
https://lens.google.com	0%	URL Reputation	safe
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SpvAvsXfWWo.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-MoqWi0fF1M09Ccs-6QfulXvxfdg/cb=gapi.loaded_0	0%	URL Reputation	safe
https://lh3.googleusercontent.com/2noIz2X2ov5fXwxhW8AbSDnLpp8tT3mI3-iV_OQ2UOwX_EhIBBgip7FPRs10DYmPKinVM98Qkjr1uN3BhQ3StGXCp1-O_wPwoLZeDQ=rw-e365-w2880	0%	Virustotal		Browse
https://ogs.google.com/	0%	Virustotal		Browse
https://www.google.com/images/hpp/ic_wahlberg_product_core_48.png8.png	0%	Virustotal		Browse
https://gsap.com	0%	Virustotal		Browse
https://ogs.google.com/widget/callout	0%	Virustotal		Browse
https://lh3.googleusercontent.com/YqGm39Z5sh9A5xtQbH_iZFAKj6kwCkY447q5cjzGcb85qccGrZn5xO_N_XwKpx1nd3XA-l6tJyz2qk7Xxk8ThS1-W78mBoEfPVKF4hm4=rw-e365-w2880	0%	Virustotal		Browse
https://google.com/search/howsearchworks/?fg=1	0%	Virustotal		Browse
https://www.google.com	0%	Virustotal		Browse
https://csp.withgoogle.com/csp/uxe-owners-acl/www_google	0%	Virustotal		Browse
https://www.youtube.com/iframe_api	0%	Virustotal		Browse

Name	IP	Active	Malicious	Reputation
google.com	216.58.212.174	true	false	unknown
csp.withgoogle.com	142.250.185.81	true	false	unknown
plus.l.google.com	216.58.212.174	true	false	unknown
mail.google.com	172.217.18.101	true	false	unknown
googletagmanager.com	142.250.185.104	true	false	unknown
irp.cdn-website.com	13.32.99.71	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	unknown
bg.microsoft.map.fastly.net	199.232.210.172	true	false	unknown
www3.l.google.com	142.250.185.206	true	false	unknown
play.google.com	216.58.206.46	true	false	unknown
sustainability.google	216.239.34.21	true	false	unknown
ghs-svc-https-sni.ghs-ssl.googlehosted.com	172.217.18.19	true	false	unknown
www.google.com	142.250.181.228	true	false	unknown
blog.google	216.239.36.21	true	false	unknown
googlehosted.l.googleusercontent.com	142.250.185.161	true	false	unknown
url.za.m.mimecastprotect.com	41.74.192.103	true	false	unknown
jordanharris.co.za	156.38.230.238	true	false	unknown
www.blog.google	unknown	unknown	false	unknown
ogs.google.com	unknown	unknown	false	unknown
lh3.googleusercontent.com	unknown	unknown	false	unknown
apis.google.com	unknown	unknown	false	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.185.104	googletagmanager.com	United States	15169	GOOGLEUS	false
41.74.192.103	url.za.m.mimecastprotect.com	South Africa	37235	MimecastSAZA	false
216.239.36.21	blog.google	United States	15169	GOOGLEUS	false
13.32.99.71	irp.cdn-website.com	United States	16509	AMAZON-02US	false
216.58.206.46	play.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.184.238	unknown	United States	15169	GOOGLEUS	false
172.217.18.101	mail.google.com	United States	15169	GOOGLEUS	false
142.250.186.46	unknown	United States	15169	GOOGLEUS	false
172.217.18.19	ghs-svc-https-sni.ghs-ssl.googlehosted.com	United States	15169	GOOGLEUS	false
216.58.206.33	unknown	United States	15169	GOOGLEUS	false
216.239.34.21	sustainability.google	United States	15169	GOOGLEUS	false
142.250.185.161	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
142.250.185.81	csp.withgoogle.com	United States	15169	GOOGLEUS	false
216.58.212.174	google.com	United States	15169	GOOGLEUS	false
156.38.230.238	jordanharris.co.za	South Africa	37153	xneeloZA	false
216.239.32.21	unknown	United States	15169	GOOGLEUS	false
216.58.206.68	unknown	United States	15169	GOOGLEUS	false
142.250.181.228	www.google.com	United States	15169	GOOGLEUS	false

IP
192.168.2.8
192.168.2.7
192.168.2.4
192.168.2.6

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1527688
Start date and time:	2024-10-07 08:49:39 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 25s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://url.za.m.mimecastprotect.com/s/25ZWCQ1LLnt4mw7QuPhvFGTIX4?domain=irp.cdn-website.com
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	SUS
Classification:	sus21.phis.win@23/579@42/23
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Browse: https://sustainability.google/?utm_source=googlehpfooter&utm_medium=housepromos&utm_campaign=bottom-footer&utm_content= Browse: https://google.com/search/howsearchworks/?fg=1 Browse: https://mail.google.com/mail/&ogbl Browse: https://www.google.com/imghp?hl=en&ogbl

Input	Output
URL: http://irp.cdn-website.com/ff7d1c02/files/uploaded/courire.html Model: jbxai	{ "brand":[], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "text":"You will be redirected to a new page in 2 seconds.", "has_visible_qrcode":false}

URL: https://www.google.com/ Model: jbxai	{ "brand":["Google"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"Sign in", "text_input_field_labels":["Google Search", "I'm Feeling Lucky"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "text":"Google Search I'm Feeling Lucky Our third decade of climate action: join us", "has_visible_qrcode":false}

URL: https://www.google.com/search/howsearchworks/?fg=1 Model: jbxai	{ "brand":["Google"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"Learn more", "text_input_field_labels":["Generative AI in Search", "Check the facts with these Google features", "Your data in Search"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "text":"Explore the world of Google Search Discover the details of how Search works - from the technology we make to the approach we take.", "has_visible_qrcode":false}

URL: https://www.google.com/intl/en-US/gmail/about/ Model: jbxai	{ "brand":["Gmail"], "contains_trigger_text":true, "trigger_text":"Get more done with Gmail. Now integrated with Google Chat, Google Meet, and more, all in one place.", "prominent_button_name":"Create an account", "text_input_field_labels":["For work"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "text":"Secure, smart, and easy to use email", "has_visible_qrcode":false}

URL: https://www.google.com/imghp?hl=en&ogbl Model: jbxai	{ "brand":["Google"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"Sign in", "text_input_field_labels":["unknown"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "text":"Google Images", "has_visible_qrcode":false}

Name	Malicious	Antivirus Detection	Reputation
https://www.google.com/search/howsearchworks/assets/HxYQzxVf.min.js	false		unknown
https://www.google.com/gen_204?atyp=i&ct=psnt&cad=&nt=navigate&ei=14QDZ6_3LcGOxc8PquDd8QU&zx=1728283872799&opi=89978449	false		unknown
https://www.google.com/gen_204?atyp=i&ei=14QDZ6_3LcGOxc8PquDd8QU&ct=slh&v=t1&m=HV&pv=0.4223501884765619&me=1:1728283864355,V,0,0,1280,907:0,B,907:0,N,1,14QDZ6_3LcGOxc8PquDd8QU:0,R,1,1,0,0,1280,907:4585,x:5100,h,1,1,o:2,e,H&zx=1728283874043&opi=89978449	false		unknown
https://lh3.googleusercontent.com/2noIz2X2ov5fXwxhW8AbSDnLpp8tT3mI3-iV_OQ2UOwX_EhIBBgip7FPRs10DYmPKinVM98Qkjr1uN3BhQ3StGXCp1-O_wPwoLZeDQ=rw-e365-w2880	false	0%, Virustotal, Browse	unknown
https://www.google.com/search/howsearchworks/assets/vQ8El_Rl.min.js	false		unknown
https://sustainability.google/static/img/icons.svg	false		unknown
https://lh3.googleusercontent.com/DeWZgEYlH2q4TTbBRoog4uNnVRjqzWYmCj7_meS-_EZ_TSyWr22SIBeaCTsEAuu5U0QaubzYyJKyUzQmEqZQ5ZVAGHJrno0fKYEdZA=s0-rw-e365	false		unknown
https://lh3.googleusercontent.com/ByIuDjG_OxNhZWu_Bix9cHR32kCnpGrjVaunDIzC9Q75eon4dC4Ei5h2pcD85FyPcjk01iAIXNjCRMA99E2GK6qhjvxYjCzAa_APmw=s0-rw-e365	false		unknown
https://www.google.com/images/hpp/ic_wahlberg_product_core_48.png8.png	false	0%, Virustotal, Browse	unknown
https://www.google.com/gen_204?atyp=csi&ei=AoUDZ6yFGqDAxc8P6qO0wAc&s=promo&rt=hpbas.5680&zx=1728283911746&opi=89978449	false		unknown
https://www.google.com/search/howsearchworks/assets/hIvGK13F.min.js	false		unknown
https://lh3.googleusercontent.com/YqGm39Z5sh9A5xtQbH_iZFAKj6kwCkY447q5cjzGcb85qccGrZn5xO_N_XwKpx1nd3XA-l6tJyz2qk7Xxk8ThS1-W78mBoEfPVKF4hm4=rw-e365-w2880	false	0%, Virustotal, Browse	unknown
https://google.com/search/howsearchworks/?fg=1	false	0%, Virustotal, Browse	unknown
https://www.google.com/search/howsearchworks/assets/rwBjrn-0.min.js	false		unknown
https://www.google.com/search/howsearchworks/assets/bAPu5B1A.min.js	false		unknown
https://www.google.com/search/howsearchworks/assets/5Ss99t85.min.js	false		unknown
https://csp.withgoogle.com/csp/uxe-owners-acl/www_google	false	0%, Virustotal, Browse	unknown
https://lh3.googleusercontent.com/uJrIoy0GJ8gU_MZo9wDRvrJM9LWV1noGXNytkoQtZE8sgTKXS5MM5NPMckKZyrk4sGykUMHv6DaMequsYcvqymH7jH6AF6dMesc=s0-rw-e365	false		unknown
https://lh3.googleusercontent.com/hgUtJ1raSgkAHurP6yDzukLnNF1V7vS4MTeqzThHkHTz1sc8nYizzkb6TPElQ0_LzIZEmwIEYgv7J1PZO-KUvQjONRqHNTc3p72BnEQ=rw-e365-w2880	false		unknown
https://www.google.com/search/howsearchworks/assets/J8wBfiw3.min.js	false		unknown
https://www.google.com/search/howsearchworks/assets/axwyNx0d.css	false		unknown
https://blog.google/api/v2/latest/?tags=sustainability	false		unknown
https://sustainability.google/static/index.min.js?cache=47ade0f	false	URL Reputation: safe	unknown
https://www.google.com/xjs/_/ss/k=xjs.hd.Yezew14qcA8.L.B1.O/am=JFUAAAAAAAAAAAwAAAAAAAAAAAAAAAAAAAAAgAAAABAAAAAAAAAAQAGwkwAAACMAgA0ACAAAAAAAAQDAAAAAAAAAIAEAAAAEACoAAAAAAIAAABBBAACgCAAAEICAECAAAAEUQAhQgAQEiiAehQAAAMAAAAAhAAwwDEBQAcAoQAAAAACAAAACIAQAAACKAAQIANAjEAAGgJwAAAiBHgACAAAAQAAAASAAAGYCMEAGIAAAAAAAAIAMAAAAAAAAAAAAAAAAAAAAAAAAAABAABAAUAAAAAAAAAAAAAAAAAAAAAAC/d=0/br=1/rs=ACT90oGlnpTjtZ3mgAjOvTJj3VYUmVfu2g/m=syjy,syo2?xjs=s4	false		unknown
https://www.google.com/imghp?hl=en&ogbl	false		unknown
https://www.google.com/search/howsearchworks/assets/MDzy0XxA.css	false		unknown
https://www.google.com/gmail/about/static-2.0/css/partials/app-downloads.css?fingerprint=9a6fb1bb67e1c16f7ce7c44e82c95da2	false		unknown
https://www.google.com/xjs/_/js/k=xjs.s.en_US.uzv50Xj9NxM.es5.O/am=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAABAgQCAAAAAAACgAAAAAAAAAAAAAAAAAAAAAQCACAkBAAAAQAAAAWAAAAQEAAACAAAAQEAAAQIAIAACgAAAAAAAAAAACIAGACAAAAAAAuAAAIFAEAAAACAAAwAAAAEAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAEEIB-AAAAAAAAAAAAAAIAAAAAwAAAAAAAAAAAAEAAAAAQBAAADJABCAAAAAAAAOA-AAgeABhSWAAAAAAAAAAAAAAAAAAgQTAWJKAgAAAAAAAAAAAAAAAAAAAAgJSgiQME/d=0/dg=0/br=1/rs=ACT90oFyFW8oD27tefqpyROo7okFWK41jg/m=lOO0Vd,sy9a,P6sQOc?xjs=s4	false		unknown
https://lh3.googleusercontent.com/GhfIwA6ZINFkFgE77BVZ596ZtFXFc72Z6OfHGeHh4VO8ZSNBZkXXcRdgWvhzJKDzmy22DROUcJKCaZbeDHpT7raQ-ZKBmj1MM1JqGQ=rw-e365-w2880	false		unknown
https://jordanharris.co.za/kyc/index.php	false		unknown
https://www.google.com/search/howsearchworks/assets/BhmWRCy0.min.js	false		unknown
https://lh3.googleusercontent.com/fvNhHugJAnsAS2DJW1V3kQ-0lsCTl2eDWV9NW2p4KXStsynp7EjqGSiACH9xSdCIvPvw0z9l_L7kOtfVZH07iQuasGIGWyFqhpdY=s0-rw-e365	false		unknown
https://lh3.googleusercontent.com/zVX_dAFZOrsdAax2aYItNILgBV4SU93ES5ih12EORRQ4TqiRa7eSbTllW__cwtNCypVoytKiX1opH0Nk4s3MjoB3baA9d-6kwdq2=s0-rw-e365	false		unknown
https://www.google.com/xjs/_/js/k=xjs.hd.en.5kvEiulbeUw.es5.O/am=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAgEKAAAAAKAAAAAAAAAAAAAAAAAAAIAAQQAAIgEAAAIAAAsAAAQCACAAAAEBAIAACcCjXAAAEQBMAAAAAAAQAAAEigAAAAgAAMAAAAAgAAAAAABAAQAAAAAAAAAAAAAAAAAAgAACAQAAAAAAAAAAAAgAAACAHgAAAAAAAABAAAAAQQAAMEAGIAAAAAAAAKAPAIIHwJDCAgAAAAAAAAAAAAAABCBBMBcSUBCAAAAAAAAAAAAAAAAAAJCSJi5s/d=0/dg=0/br=1/rs=ACT90oGSzVDXW8M9D9lUEsPx_RYLIQTZxw/m=sy1ei,P10Owf,sy1db,sy1d9,syqz,gSZvdb,sy10f,sy10e,WlNQGd,syr4,syr1,syr0,syqy,DPreE,sy10r,sy10p,nabPbb,sy109,sy107,syjy,syo2,CnSW2d,kQvlef,sy10q,fXO0xe?xjs=s4	false		unknown
https://www.google.com/gmail/about/static-2.0/css/partials/tabset.css?fingerprint=467f3ebe7088a2f543d8586f41b7cbc4	false		unknown
https://www.google.com/gmail/about/static-2.0/images/favicon.ico?fingerprint=913d48cd5d48ba34313131f246f99d6b	false		unknown
https://www.google.com/xjs/_/js/k=xjs.hd.en.5kvEiulbeUw.es5.O/am=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAgEKAAAAAKAAAAAAAAAAAAAAAAAAAIAAQQAAIgEAAAIAAAsAAAQCACAAAAEBAIAACcCjXAAAEQBMAAAAAAAQAAAEigAAAAgAAMAAAAAgAAAAAABAAQAAAAAAAAAAAAAAAAAAgAACAQAAAAAAAAAAAAgAAACAHgAAAAAAAABAAAAAQQAAMEAGIAAAAAAAAKAPAIIHwJDCAgAAAAAAAAAAAAAABCBBMBcSUBCAAAAAAAAAAAAAAAAAAJCSJi5s/d=0/dg=0/br=1/rs=ACT90oGSzVDXW8M9D9lUEsPx_RYLIQTZxw/m=aLUfP?xjs=s4	false		unknown
https://www.google.com/gen_204?s=imghp&t=cap&atyp=csi&ei=AoUDZ6yFGqDAxc8P6qO0wAc&rt=wsrt.1162,cbs.507,cbt.845,hst.493&opi=89978449&dt=&ts=196044	false		unknown
https://lh3.googleusercontent.com/-l2uCHxepneGNmf6MyjbK_YHkf7i3lgbrUWvNJL8CQInmOWrMChhC9vcKs27pJqtERrM7t14UCh0rPVcKg3rHBl2hAV3pUwCrgSP=s0-rw-e365	false		unknown
https://www.google.com/gen_204?s=webhp&t=aft&atyp=csi&ei=14QDZ6_3LcGOxc8PquDd8QU&rt=wsrt.6409,aft.1342,afti.1342,cbt.93,hst.53,prt.960&imn=11&ima=1&imad=0&imac=1&wh=907&aftie=NF&aft=1&aftp=907&opi=89978449&dt=&ts=201155	false		unknown
https://www.google.com/gen_204?atyp=i&ct=psnt&cad=&nt=navigate&ei=AoUDZ6yFGqDAxc8P6qO0wAc&zx=1728283911764&opi=89978449	false		unknown
https://www.google.com/async/hpba?vet=10ahUKEwjvvpSO1_uIAxVBR_EDHSpwN14Qj-0KCBU..i&ei=14QDZ6_3LcGOxc8PquDd8QU&opi=89978449&yv=3&sp_imghp=false&sp_hpte=1&sp_hpep=1&stick=&cs=0&async=_basejs:%2Fxjs%2F_%2Fjs%2Fk%3Dxjs.hd.en.5kvEiulbeUw.es5.O%2Fam%3DAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAgEKAAAAAKAAAAAAAAAAAAAAAAAAAIAAQQAAIgEAAAIAAAsAAAQCACAAAAEBAIAACcCjXAAAEQBMAAAAAAAQAAAEigAAAAgAAMAAAAAgAAAAAABAAQAAAAAAAAAAAAAAAAAAgAACAQAAAAAAAAAAAAgAAACAHgAAAAAAAABAAAAAQQAAMEAGIAAAAAAAAKAPAIIHwJDCAgAAAAAAAAAAAAAABCBBMBcSUBCAAAAAAAAAAAAAAAAAAJCSJi5s%2Fdg%3D0%2Fbr%3D1%2Frs%3DACT90oGSzVDXW8M9D9lUEsPx_RYLIQTZxw,_basecss:%2Fxjs%2F_%2Fss%2Fk%3Dxjs.hd.Yezew14qcA8.L.B1.O%2Fam%3DJFUAAAAAAAAAAAwAAAAAAAAAAAAAAAAAAAAAgAAAABAAAAAAAAAAQAGwkwAAACMAgA0ACAAAAAAAAQDAAAAAAAAAIAEAAAAEACoAAAAAAIAAABBBAACgCAAAEICAECAAAAEUQAhQgAQEiiAehQAAAMAAAAAhAAwwDEBQAcAoQAAAAACAAAACIAQAAACKAAQIANAjEAAGgJwAAAiBHgACAAAAQAAAASAAAGYCMEAGIAAAAAAAAIAMAAAAAAAAAAAAAAAAAAAAAAAAAABAABAAUAAAAAAAAAAAAAAAAAAAAAAC%2Fbr%3D1%2Frs%3DACT90oGlnpTjtZ3mgAjOvTJj3VYUmVfu2g,_basecomb:%2Fxjs%2F_%2Fjs%2Fk%3Dxjs.hd.en.5kvEiulbeUw.es5.O%2Fck%3Dxjs.hd.Yezew14qcA8.L.B1.O%2Fam%3DJFUAAAAAAAAAAAwAAAAAAAAAAAAAAAAAAAAAgAAAABAAAAAAAAAAQgG6kwAAAKMAgA0ACAAAAAAAAQDAAIAAQQAAIgEAAAIEACsAAAQCAKAAABFBAICgCcCjXICAESBMAAEUQAhQgAQEiiAehQgAAMAAAAAhAAwwDEBQAcAoQAAAAACAAAACIAQAgACKAQQIANAjEAAGgJwAAAiBHgACAAAAQABAASAAQWYCMEAGIAAAAAAAAKAPAIIHwJDCAgAAAAAAAAAAAAAABCBBMBcSUBCAAAAAAAAAAAAAAAAAAJCSJi5s%2Fd%3D1%2Fed%3D1%2Fdg%3D0%2Fbr%3D1%2Fujg%3D1%2Frs%3DACT90oEsOMBmjg0aKgF6STcbh8CO_-XcZw,_fmt:prog,_id:_14QDZ6_3LcGOxc8PquDd8QU_8	false		unknown
https://sustainability.google/static/index.min.css?cache=732a3af	false	URL Reputation: safe	unknown
https://www.google.com/favicon.ico	false		unknown
https://lh3.googleusercontent.com/Kkh1J0HrlRSnxSQrtnP4DFSMb4SI7Rz0yAT0G6ku1QOARBJJ4To-rDzu0tfCOMWvNCtYvCYaM92ISqiDPr-8KtwNqYO3xuJERwASsfn2=rw-e365-w2880	false		unknown
https://play.google.com/log?format=json&hasfast=true	false		unknown
https://www.google.com/gmail/about/static-2.0/css/partials/faq.css?fingerprint=afb0340686e17c85e91ba61dd70651ae	false		unknown
https://www.google.com/gmail/about/static-2.0/css/partials/touts.css?fingerprint=7aff0f2c9265f44e073b9bc6b21b52d2	false		unknown
https://www.google.com/xjs/_/ss/k=xjs.s.N7uEhNpUhSA.L.B1.O/am=QAoAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAAEAACAAAAAAAAAAgAgAsEwCAAAwAgAANgAgAAAAAAAIAAAYAAAAAAAAkAAAAAAAAgBUAAAAAAAAAIAAAEAEBAAAFAIAAAhAAAAABgAAAACEAAEACKAAQgCgAAkIFAGIRyEAAAAwAAAAEAAGGAYgqABgAIAAAAAAAAAAAQAAAYAQAAAAUEAAAAECAPQIBIABICcAAIQAgAAgAAAAAEAAAAABAAEAgJgADJABCAAAAAAAAAASAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAAAAAAAAAAAAAABA/d=1/ed=1/br=1/rs=ACT90oEoYfaM-HUWdIuBXAYllUktsRAKSA/m=cdos,hsm,jsa,mb4ZUb,d,csi,cEt90b,SNUn3,qddgKe,sTsDMc,dtl0hd,eHDfl	false		unknown
https://www.google.com/search/howsearchworks/assets/vjYgswK-.min.js	false		unknown
https://www.google.com/search/howsearchworks/assets/44SUZn7a.min.js	false		unknown
https://www.google.com/gen_204?s=webhp&t=cap&atyp=csi&ei=14QDZ6_3LcGOxc8PquDd8QU&rt=wsrt.6409,cbt.93,hst.53&opi=89978449&dt=&ts=300	false		unknown
https://www.google.com/gmail/about/static-2.0/css/partials/ctas.css?fingerprint=c7d60243e96641b21b71cdf43cca655f	false		unknown
https://www.google.com/images/searchbox/desktop_searchbox_sprites318_hr.webp	false		unknown
https://www.google.com/xjs/_/js/k=xjs.hd.en.5kvEiulbeUw.es5.O/ck=xjs.hd.Yezew14qcA8.L.B1.O/am=JFUAAAAAAAAAAAwAAAAAAAAAAAAAAAAAAAAAgAAAABAAAAAAAAAAQgG6kwAAAKMAgA0ACAAAAAAAAQDAAIAAQQAAIgEAAAIEACsAAAQCAKAAABFBAICgCcCjXICAESBMAAEUQAhQgAQEiiAehQgAAMAAAAAhAAwwDEBQAcAoQAAAAACAAAACIAQAgACKAQQIANAjEAAGgJwAAAiBHgACAAAAQABAASAAQWYCMEAGIAAAAAAAAKAPAIIHwJDCAgAAAAAAAAAAAAAABCBBMBcSUBCAAAAAAAAAAAAAAAAAAJCSJi5s/d=0/dg=0/br=1/ujg=1/rs=ACT90oEsOMBmjg0aKgF6STcbh8CO_-XcZw/m=sb_wiz,aa,abd,sysl,sysk,sysf,syfz,sysj,sys5,sy10k,syzs,sysa,syzr,syta,sysg,sysi,syse,sysy,sys2,sysz,syt0,sysr,sysv,sysb,sysp,syss,syst,syrv,sysn,sys6,sys7,sys0,syrj,syrh,syrg,sys9,syzq,syt9,syrt,syt8,async,syw6,ifl,pHXghd,sf,sytp,syts,sy49q,sonic,TxCJfd,sy49u,qzxzOb,IsdWVc,sy49w,sy1fb,sy1bo,sy1bk,syrf,syrd,syre,syrc,syrb,sy48d,sy48g,sy2ca,sy17i,sy12e,sy12f,syrp,syr7,syfd,sybx,syc0,sybv,sybz,syby,sycr,spch,MpJwZc,UUJqVe,sy7o,sOXFj,sy7n,s39S4,oGtAuc,NTMZac,nAFL3,sy8g,sy8f,q0xTif,y05UD,sy12x,sy1ca,sy1c4,syyp,sy1bw,sy14g,sywa,syyr,sy7v,syyq,syyo,syyn,syym,syys,sya9,syb5,sy1c3,sy148,sy1bs,sy14d,sy1c2,sy12s,sy1bx,sy1bt,sy14e,sy14f,sy1c5,sy12h,sy1c1,sy1c0,sy1by,synn,sy1bz,sy1c7,sy1bm,sy1bu,sy1bl,sy1br,sy1bn,sy15c,sy1bv,sy1bh,sy14i,sy14j,syyu,syyv,epYOx,syuo,syun,rtH1bd,sy1ct,sy18l,sy17a,sygb,sy1cs,sy12k,sy1cr,sy17b,sygd,sy1cu,SMquOb,sy8i,sygk,sygh,sygi,sygl,sygg,sygt,sygr,sygp,sygf,syco,sycj,sycm,syam,syae,syb8,syal,syak,syaj,sya7,syb3,syas,sy9u,sy9t,syck,syc2,syc3,syc9,syaq,sybb,syc8,syc1,sybu,sybt,syah,syao,syc4,sybp,sybm,sybl,sybn,syag,syb9,sybg,sybe,sybi,sybf,sybh,syab,syb6,syct,syd8,sycu,syd9,syac,syb7,sya8,syb4,syar,syad,sycs,sych,sycd,syce,sy9x,sya1,sy9y,sya2,sy9z,sy9r,sy9o,sy9q,sya6,syc5,syg5,syge,syga,syg8,sy81,sy7y,sy80,syg7,sygc,syg6,syg4,syg1,syg0,sy84,uxMpU,syfw,syd3,syd1,sycv,syda,sycx,sycw,sybj,sycz,sycq,sy90,sy8z,sy8y,Mlhmy,QGR0gd,aurFic,sy99,fKUV3e,OTA3Ae,sy8j,OmgaI,EEDORb,PoEs9b,Pjplud,sy8u,sy8n,A1yn5d,YIZmRd,uY49fb,sy7t,sy7u,sy7s,sy7r,byfTOb,lsjVmc,LEikZe,kWgXee,Ug7Xab,U0aPgd,ovKuLd,sgY6Zb,qafBPd,ebZ3mb,dowIGb,sy1cz,sy1cv,syut,sy1cy,syz6,d5EhJe,sy1df,fCxEDd,sywb,sy1de,sy1dd,sy1dc,sy1d8,sy1d3,sy1d5,sy1d4,sy1d7,sy1ai,sy1ab,sy17r,T1HOxc,sy1d6,sy1d2,zx30Y,sy1dg,sy1da,sy18y,Wo3n8,sys1,loL8vb,syt3,syt2,syt1,ms4mZb,syq7,B2qlPe,syvo,NzU6V,sy10w,syw5,zGLm3b,syxj,syxk,syxb,DhPYme?xjs=s3	false		unknown
https://www.google.com/search/howsearchworks/assets/_OAi-NRQ.min.js	false		unknown
https://www.google.com/search/howsearchworks/assets/NticlS_l.min.js	false		unknown
https://lh3.googleusercontent.com/Cle-1GLl4P8zbJafbrnN8-7CgfVSduAR1j2DACNepAm5JL37GANl8tIM1h72Cyga71wO2lGcNPONnQl5MKFi_1TGSBQM8mV9qaKdQw=rw-e365-w2880	false		unknown
https://www.google.com/	false		unknown
https://www.google.com/client_204?atyp=i&biw=1280&bih=907&ei=14QDZ6_3LcGOxc8PquDd8QU&opi=89978449	false		unknown
https://www.google.com/xjs/_/ss/k=xjs.s.N7uEhNpUhSA.L.B1.O/am=QAoAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAAEAACAAAAAAAAAAgAgAsEwCAAAwAgAANgAgAAAAAAAIAAAYAAAAAAAAkAAAAAAAAgBUAAAAAAAAAIAAAEAEBAAAFAIAAAhAAAAABgAAAACEAAEACKAAQgCgAAkIFAGIRyEAAAAwAAAAEAAGGAYgqABgAIAAAAAAAAAAAQAAAYAQAAAAUEAAAAECAPQIBIABICcAAIQAgAAgAAAAAEAAAAABAAEAgJgADJABCAAAAAAAAAASAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAAAAAAAAAAAAAABA/d=0/br=1/rs=ACT90oEoYfaM-HUWdIuBXAYllUktsRAKSA/m=syj6,sy1cp?xjs=s4	false		unknown
https://www.google.com/search/howsearchworks/assets/p9kcPq91.min.js	false		unknown
https://lh3.googleusercontent.com/OMmSijDU0neu_vZPqLWBrVJsQGT_D0ejrnpIgQMPkTZC-0s9dO6_kbV3sGb2q9BWmpEQDirGidE1rvGwp9BnCPpv0QfzLqnZ-noZLw=s0-rw-e365	false		unknown
https://lh3.googleusercontent.com/LSYb8fYo6BAagAGpNrc_tg1pGwWDUiQ6Q_b_aHGIL6YFJS3t3Q9tz8Zp_PDemg8w4wkFh8ronfMjHlZxzyrxJI_yHogTxmMKtVEQyA=rw-e365-w2880	false		unknown
https://www.google.com/images/branding/googlelogo/1x/googlelogo_color_272x92dp.png	false		unknown
https://www.google.com/gen_204?atyp=csi&ei=14QDZ6_3LcGOxc8PquDd8QU&s=promo&rt=hpbas.5537&zx=1728283868933&opi=89978449	false		unknown
https://www.google.com/intl/en-US/gmail/about/	false		unknown
https://www.google.com/search/howsearchworks/assets/RpI-OtYr.min.js	false		unknown
https://www.google.com/xjs/_/js/md=2/k=xjs.s.en_US.uzv50Xj9NxM.es5.O/am=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAABAgQCAAAAAAACgAAAAAAAAAAAAAAAAAAAAAQCACAkBAAAAQAAAAWAAAAQEAAACAAAAQEAAAQIAIAACgAAAAAAAAAAACIAGACAAAAAAAuAAAIFAEAAAACAAAwAAAAEAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAEEIB-AAAAAAAAAAAAAAIAAAAAwAAAAAAAAAAAAEAAAAAQBAAADJABCAAAAAAAAOA-AAgeABhSWAAAAAAAAAAAAAAAAAAgQTAWJKAgAAAAAAAAAAAAAAAAAAAAgJSgiQME/rs=ACT90oFyFW8oD27tefqpyROo7okFWK41jg	false		unknown
https://www.google.com/xjs/_/js/k=xjs.s.en_US.uzv50Xj9NxM.es5.O/ck=xjs.s.N7uEhNpUhSA.L.B1.O/am=QAoAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAAEAACAAAAAAAAAAhAgQuEwCAAAwCgAANgAgAAAAAAAIAAAYAAAQCACAkBAAAAQAAgBWAAAAQEAAAKAAAEQEBAAQNAIAAChAAAAABgAAAACMAGECCKAAQgCuAAkIFAGIRyECAAAwAAAAEAAGGAYgqABgAIAAAAAAAAAAAQAAAYAQAAAEUMB-AAECAPQIBIABICcAAIQAwAAgAAAAAEAAAEABAAEQhJgADJABCAAAAAAAAOA-AAgeABhSWAAAAAAAAAAAAAAAAAAgQTAWJKAgAAAAAAAAAAAAAAAAAAAAgJSgiQME/d=0/dg=0/br=1/ujg=1/rs=ACT90oH2NjMhfzQ7jDjZRIqSXREuiPP_dQ/m=sb_wiz,aa,pHXghd,syzg,syzd,syzh,sy45a,sonic,TxCJfd,sy7tw,qzxzOb,IsdWVc,sy7ty,sy2mx,syga,sy3g6,sy15s,sy15r,sy15q,sy10m,sy10k,sy10l,sy10j,sys9,sys7,sy10i,sy1ji,sy1jj,sy15p,sy10x,syus,syut,syty,sydh,syck,sycn,sych,sycm,spch,sywn,sywk,sywi,sywj,sywm,syhc,sywl,sywh,sywg,sywf,syhe,sywr,SMquOb,syy7,syy5,syy6,rtH1bd,sy8w,syhm,syhp,syhj,syhk,syhn,syhi,syhx,syhv,syhu,syht,syhq,syhh,syas,sydj,sybq,sybr,sye0,sydk,sye1,sydi,syd4,syd0,syd1,sybb,syby,syax,sybu,syba,syae,syai,syab,syaf,syaj,syaa,syag,sya7,sya9,sya4,sydl,syaq,sybp,syat,sybs,syao,sybn,syap,sybo,syav,syb9,sybt,sybx,syb5,sybv,syb3,syb2,syb1,syaz,syb7,syau,sydm,syde,syd6,syda,syd7,sycp,sycq,sycw,sycv,sycj,syco,sycg,sycf,sycu,sycr,sycb,syca,syc8,syc7,syc9,syc2,syc0,syc4,syc1,syc3,syan,sycs,syh5,syhg,syha,syhb,sy8f,sy8b,sy8e,syh7,syhd,syh6,syh4,syh1,syh0,sygz,sygy,sy8i,uxMpU,sygt,sydv,sydt,sydu,sydn,sye2,sydp,sydo,syal,syc5,sydr,sydg,sy9f,sy9e,sy9d,Mlhmy,QGR0gd,aurFic,sy9o,fKUV3e,OTA3Ae,sy8y,OmgaI,EEDORb,PoEs9b,Pjplud,sy99,sy95,sy92,A1yn5d,YIZmRd,uY49fb,sy88,sy86,sy87,sy85,sy84,sy83,byfTOb,lsjVmc,LEikZe,kWgXee,Ug7Xab,U0aPgd,ovKuLd,sgY6Zb,qafBPd,ebZ3mb,dowIGb,syyg,syye,syyd,syya,syyc,d5EhJe,sy1dq,fCxEDd,sy1dp,sy10g,sy1do,sy1dn,sy15n,sy1dk,sy1dm,sy1dl,sy1dj,sy1di,sy1dh,sy1dg,sy1df,syyo,sywo,sywy,syyk,syyn,syuc,T1HOxc,syyl,syyj,syrz,zx30Y,sy1ds,sy1dr,sy1dc,sysz,sysy,syt0,syrs,syrt,syrr,syru,syrq,sys2,syrx,syrw,syrv,syrh,syrf,sysx,sysk,sysl,sysm,sysf,sys5,sysa,sys4,syrm,syrn,sys0,syri,syrj,syrd,syrl,Wo3n8,sy6zb,sy1ix,loL8vb,sy6ze,sy49g,sy3xa,ms4mZb,sy5n0,B2qlPe,sy5n2,NzU6V,sy51h,sy18u,zGLm3b,MpJwZc,UUJqVe,sy80,sOXFj,sy7z,s39S4,oGtAuc,NTMZac,nAFL3,sy8u,sy8t,q0xTif,y05UD,sy1nt,sy1n2,sy1n3,sy1n4,sy1n5,sy1n1,syqb,sy460,sy3e6,sy2eo,sy1nf,sy1ne,sy1nd,sy21o,sy1ni,sy18y,sy2en,sy1nb,sy19b,sy1nc,sy1mx,sy1n7,sy1na,sy1mv,sy2ep,sy2c5,sy461,sy45w,sy1ou,sy38j,sy1mu,sy2ev,sy1vh,sy2er,sy1vk,sy1n0,sy2ey,sy1tb,sy29h,sy1qn,sy1qo,epYOx?xjs=s3	false		unknown
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SpvAvsXfWWo.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-MoqWi0fF1M09Ccs-6QfulXvxfdg/cb=gapi.loaded_0	false	URL Reputation: safe	unknown
https://www.google.com/search/howsearchworks/?fg=1	false		unknown
https://www.google.com/search/howsearchworks/assets/0-7k4-1q.min.js	false		unknown
https://www.google.com/gen_204?atyp=csi&ei=AoUDZ6yFGqDAxc8P6qO0wAc&s=promo&rt=hpbas.5680,hpbarr.1296&zx=1728283913042&opi=89978449	false		unknown

Name	Source	Malicious	Antivirus Detection	Reputation
https://ogs.google.com/	chromecache_532.2.dr	false	0%, Virustotal, Browse	unknown
https://stats.g.doubleclick.net/g/collect	chromecache_383.2.dr, chromecache_303.2.dr, chromecache_505.2.dr, chromecache_567.2.dr, chromecache_399.2.dr, chromecache_276.2.dr	false	URL Reputation: safe	unknown
http://www.broofa.com	chromecache_381.2.dr, chromecache_583.2.dr, chromecache_514.2.dr, chromecache_385.2.dr, chromecache_363.2.dr, chromecache_397.2.dr	false	URL Reputation: safe	unknown
https://gsap.com	chromecache_323.2.dr, chromecache_434.2.dr	false	0%, Virustotal, Browse	unknown
https://ogs.google.com/widget/callout	chromecache_532.2.dr	false	0%, Virustotal, Browse	unknown
https://blog.google/outreach-initiatives/sustainability/helping-monarch-butterflies-2024/	chromecache_286.2.dr, chromecache_425.2.dr	false		unknown
https://www.google.com	chromecache_276.2.dr, chromecache_417.2.dr	false	0%, Virustotal, Browse	unknown
https://www.youtube.com/iframe_api	chromecache_572.2.dr, chromecache_383.2.dr, chromecache_505.2.dr, chromecache_417.2.dr	false	0%, Virustotal, Browse	unknown
https://ogs.google.com/widget/callout?eom=1	chromecache_337.2.dr, chromecache_550.2.dr	false	URL Reputation: safe	unknown
https://github.com/shoelace-style/shoelace/blob/next/LICENSE.md	chromecache_362.2.dr	false		unknown
https://www.google.com/tools/feedback	chromecache_495.2.dr, chromecache_440.2.dr	false		unknown
https://blog.google/outreach-initiatives/public-policy/	chromecache_286.2.dr, chromecache_425.2.dr	false		unknown
https://www.google.com/_/og/promos/	chromecache_337.2.dr	false		unknown
https://github.com/shoelace-style/shoelace/blob/next/src/internal/slot.ts	chromecache_362.2.dr	false		unknown
https://blog.google/outreach-initiatives/sustainability/google-clean-energy-asia-pacific/	chromecache_286.2.dr, chromecache_425.2.dr	false		unknown
https://blog.google/outreach-initiatives/sustainability/google-pixel-nest-fitbit-plastic-free-packag	chromecache_286.2.dr, chromecache_425.2.dr	false		unknown
https://cct.google/taggy/agent.js	chromecache_572.2.dr, chromecache_383.2.dr, chromecache_303.2.dr, chromecache_329.2.dr, chromecache_352.2.dr, chromecache_505.2.dr, chromecache_567.2.dr, chromecache_399.2.dr, chromecache_276.2.dr, chromecache_417.2.dr	false	URL Reputation: safe	unknown
https://blog.google/outreach-initiatives/sustainability/	chromecache_425.2.dr	false		unknown
https://blog.google/outreach-initiatives/sustainability/google-wildfire-boundary-maps-europe-africa/	chromecache_286.2.dr, chromecache_425.2.dr	false	URL Reputation: safe	unknown
https://blog.google/outreach-initiatives/sustainability/google-ai-project-greenlight/	chromecache_286.2.dr, chromecache_425.2.dr	false	URL Reputation: safe	unknown
https://fonts.google.com/license/googlerestricted	chromecache_386.2.dr	false	URL Reputation: safe	unknown
https://blog.google/outreach-initiatives/sustainability/new-ways-were-advancing-our-clean-energy-com	chromecache_286.2.dr, chromecache_425.2.dr	false		unknown
https://gsap.com/standard-license	chromecache_323.2.dr, chromecache_434.2.dr	false		unknown
https://www.google.com/intl/en/about/products	chromecache_337.2.dr	false		unknown
https://www.google.com/log?format=json&hasfast=true	chromecache_381.2.dr, chromecache_583.2.dr, chromecache_397.2.dr	false		unknown
https://lens.google.com	chromecache_381.2.dr, chromecache_583.2.dr, chromecache_397.2.dr	false	URL Reputation: safe	unknown

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	dropped
Size (bytes):	322864
Entropy (8bit):	3.7253988995392264
Encrypted:	false
SSDEEP:	3072:yp8owIBMCofb1byXaFQLC8OEzCxpapWt4:TI9iBb7EOEqEct4
MD5:	61F4CE1795C76A236FA455EFBB5980F8
SHA1:	06FB72DCB6136A460335059C883A4C973A9BEC8A
SHA-256:	91D63A003F5DDD872C2A2AFF6CF4BEE11053DB924EA94D501012BA4C2473DF5D
SHA-512:	299DC3098C56155C275674978F77A788EE1AE6E20301794A1493C54B9A460E0807879EBC34BE8796E1B95D10A9446AFB8BFF8BD033ABA0DBD0885719378A5B7E
Malicious:	false
Reputation:	low
Preview:	RIFF(...WEBPVP8L..../..D..u!...B.m..........f..,.D.K.V.0^:P.....m.....fp...."..EY.I[.i2..:6.tm..@mcj7-..c..{...F.J....ZfS...4....h.r.&."...c9.CY.-..(..Er....\........E.........D.?.../k....GJ.J.H.*.P...Zq....0..2.J.:B..AZ.t&..uz.8-.N.I..I..mk.....}...[.m{.i..y...W.b.bW...ff.%fZ.^d.......T8...8.bF..K....u...l.......T .6...S.@..Nt.'i.8.W.J.....pV.......Fp....`[..e.&M....,..?""...?.M$..<.R.d.l.E.....y.1..M..v...!v<..U;S....3...}.3.Xw.R.....f7.Q..D...`%..^..}Y...q....iY.Le..D.y2SJ.I...zm.Vm[r..s.s.}...df.K...........,yQ...CZl1..3.w..s...m..^..1.>..._.fJ.rf.........c......2f&I....w.=..........'.N.......................................................................................................................................................................................................................................................................................................................................................................................

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 7, 2024 08:50:36.836728096 CEST	192.168.2.6	1.1.1.1	0x4710	Standard query (0)	url.za.m.mimecastprotect.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 08:50:36.836885929 CEST	192.168.2.6	1.1.1.1	0x18a	Standard query (0)	url.za.m.mimecastprotect.com	65	IN (0x0001)	false
Oct 7, 2024 08:50:38.571583986 CEST	192.168.2.6	1.1.1.1	0x8eba	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 08:50:38.572530985 CEST	192.168.2.6	1.1.1.1	0x1a22	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 7, 2024 08:50:54.729729891 CEST	192.168.2.6	1.1.1.1	0x3635	Standard query (0)	irp.cdn-website.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 08:50:54.729990959 CEST	192.168.2.6	1.1.1.1	0xc685	Standard query (0)	irp.cdn-website.com	65	IN (0x0001)	false
Oct 7, 2024 08:50:57.763062954 CEST	192.168.2.6	1.1.1.1	0x1f72	Standard query (0)	jordanharris.co.za	A (IP address)	IN (0x0001)	false
Oct 7, 2024 08:50:57.763448000 CEST	192.168.2.6	1.1.1.1	0x913	Standard query (0)	jordanharris.co.za	65	IN (0x0001)	false
Oct 7, 2024 08:51:01.968930006 CEST	192.168.2.6	1.1.1.1	0xb2c2	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 08:51:01.968930006 CEST	192.168.2.6	1.1.1.1	0xbced	Standard query (0)	google.com	65	IN (0x0001)	false
Oct 7, 2024 08:51:05.263887882 CEST	192.168.2.6	1.1.1.1	0x40ca	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 08:51:05.264265060 CEST	192.168.2.6	1.1.1.1	0x58f8	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 7, 2024 08:51:06.537153959 CEST	192.168.2.6	1.1.1.1	0x83ba	Standard query (0)	ogs.google.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 08:51:06.537307978 CEST	192.168.2.6	1.1.1.1	0xf8c7	Standard query (0)	ogs.google.com	65	IN (0x0001)	false
Oct 7, 2024 08:51:06.538269997 CEST	192.168.2.6	1.1.1.1	0x868	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 08:51:06.538429976 CEST	192.168.2.6	1.1.1.1	0x5aaa	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Oct 7, 2024 08:51:07.511238098 CEST	192.168.2.6	1.1.1.1	0xf71b	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 08:51:07.511548996 CEST	192.168.2.6	1.1.1.1	0x3092	Standard query (0)	play.google.com	65	IN (0x0001)	false
Oct 7, 2024 08:51:07.741715908 CEST	192.168.2.6	1.1.1.1	0x1c1a	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 08:51:07.742304087 CEST	192.168.2.6	1.1.1.1	0xfc9f	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Oct 7, 2024 08:51:08.499208927 CEST	192.168.2.6	1.1.1.1	0xbb6d	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 08:51:08.499408960 CEST	192.168.2.6	1.1.1.1	0x8837	Standard query (0)	play.google.com	65	IN (0x0001)	false
Oct 7, 2024 08:51:14.523969889 CEST	192.168.2.6	1.1.1.1	0x10f0	Standard query (0)	sustainability.google	A (IP address)	IN (0x0001)	false
Oct 7, 2024 08:51:14.524292946 CEST	192.168.2.6	1.1.1.1	0xd0fa	Standard query (0)	sustainability.google	65	IN (0x0001)	false
Oct 7, 2024 08:51:18.618467093 CEST	192.168.2.6	1.1.1.1	0xc907	Standard query (0)	sustainability.google	A (IP address)	IN (0x0001)	false
Oct 7, 2024 08:51:18.618680000 CEST	192.168.2.6	1.1.1.1	0x5bbf	Standard query (0)	sustainability.google	65	IN (0x0001)	false
Oct 7, 2024 08:51:19.332725048 CEST	192.168.2.6	1.1.1.1	0x6265	Standard query (0)	googletagmanager.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 08:51:19.335427046 CEST	192.168.2.6	1.1.1.1	0xa399	Standard query (0)	googletagmanager.com	65	IN (0x0001)	false
Oct 7, 2024 08:51:19.469441891 CEST	192.168.2.6	1.1.1.1	0x9338	Standard query (0)	lh3.googleusercontent.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 08:51:19.469641924 CEST	192.168.2.6	1.1.1.1	0x4ff9	Standard query (0)	lh3.googleusercontent.com	65	IN (0x0001)	false
Oct 7, 2024 08:51:21.119251966 CEST	192.168.2.6	1.1.1.1	0x54fb	Standard query (0)	lh3.googleusercontent.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 08:51:21.119807005 CEST	192.168.2.6	1.1.1.1	0x5062	Standard query (0)	lh3.googleusercontent.com	65	IN (0x0001)	false
Oct 7, 2024 08:51:22.641166925 CEST	192.168.2.6	1.1.1.1	0x5f9b	Standard query (0)	www.blog.google	A (IP address)	IN (0x0001)	false
Oct 7, 2024 08:51:22.641408920 CEST	192.168.2.6	1.1.1.1	0x44be	Standard query (0)	www.blog.google	65	IN (0x0001)	false
Oct 7, 2024 08:51:24.257520914 CEST	192.168.2.6	1.1.1.1	0x1c78	Standard query (0)	blog.google	A (IP address)	IN (0x0001)	false
Oct 7, 2024 08:51:24.257520914 CEST	192.168.2.6	1.1.1.1	0xf93b	Standard query (0)	blog.google	65	IN (0x0001)	false
Oct 7, 2024 08:51:25.034953117 CEST	192.168.2.6	1.1.1.1	0xb101	Standard query (0)	blog.google	A (IP address)	IN (0x0001)	false
Oct 7, 2024 08:51:25.035733938 CEST	192.168.2.6	1.1.1.1	0x6b28	Standard query (0)	blog.google	65	IN (0x0001)	false
Oct 7, 2024 08:51:28.440224886 CEST	192.168.2.6	1.1.1.1	0xcfbf	Standard query (0)	csp.withgoogle.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 08:51:28.441060066 CEST	192.168.2.6	1.1.1.1	0xe920	Standard query (0)	csp.withgoogle.com	65	IN (0x0001)	false
Oct 7, 2024 08:51:31.590048075 CEST	192.168.2.6	1.1.1.1	0x909a	Standard query (0)	mail.google.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 08:51:31.590332985 CEST	192.168.2.6	1.1.1.1	0x990c	Standard query (0)	mail.google.com	65	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 7, 2024 08:50:36.844198942 CEST	1.1.1.1	192.168.2.6	0x4710	No error (0)	url.za.m.mimecastprotect.com		41.74.192.103	A (IP address)	IN (0x0001)	false
Oct 7, 2024 08:50:36.844198942 CEST	1.1.1.1	192.168.2.6	0x4710	No error (0)	url.za.m.mimecastprotect.com		41.74.196.103	A (IP address)	IN (0x0001)	false
Oct 7, 2024 08:50:38.578502893 CEST	1.1.1.1	192.168.2.6	0x8eba	No error (0)	www.google.com		142.250.181.228	A (IP address)	IN (0x0001)	false
Oct 7, 2024 08:50:38.579269886 CEST	1.1.1.1	192.168.2.6	0x1a22	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 7, 2024 08:50:47.974438906 CEST	1.1.1.1	192.168.2.6	0x7e68	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 08:50:47.974438906 CEST	1.1.1.1	192.168.2.6	0x7e68	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Oct 7, 2024 08:50:54.749104023 CEST	1.1.1.1	192.168.2.6	0x3635	No error (0)	irp.cdn-website.com		13.32.99.71	A (IP address)	IN (0x0001)	false
Oct 7, 2024 08:50:54.749104023 CEST	1.1.1.1	192.168.2.6	0x3635	No error (0)	irp.cdn-website.com		13.32.99.102	A (IP address)	IN (0x0001)	false
Oct 7, 2024 08:50:54.749104023 CEST	1.1.1.1	192.168.2.6	0x3635	No error (0)	irp.cdn-website.com		13.32.99.60	A (IP address)	IN (0x0001)	false
Oct 7, 2024 08:50:54.749104023 CEST	1.1.1.1	192.168.2.6	0x3635	No error (0)	irp.cdn-website.com		13.32.99.94	A (IP address)	IN (0x0001)	false
Oct 7, 2024 08:50:58.673922062 CEST	1.1.1.1	192.168.2.6	0x1f72	No error (0)	jordanharris.co.za		156.38.230.238	A (IP address)	IN (0x0001)	false
Oct 7, 2024 08:51:01.975882053 CEST	1.1.1.1	192.168.2.6	0xb2c2	No error (0)	google.com		216.58.212.174	A (IP address)	IN (0x0001)	false
Oct 7, 2024 08:51:01.976000071 CEST	1.1.1.1	192.168.2.6	0xbced	No error (0)	google.com			65	IN (0x0001)	false
Oct 7, 2024 08:51:05.270589113 CEST	1.1.1.1	192.168.2.6	0x40ca	No error (0)	www.google.com		216.58.206.68	A (IP address)	IN (0x0001)	false
Oct 7, 2024 08:51:05.270952940 CEST	1.1.1.1	192.168.2.6	0x58f8	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 7, 2024 08:51:06.543822050 CEST	1.1.1.1	192.168.2.6	0x83ba	No error (0)	ogs.google.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 08:51:06.543822050 CEST	1.1.1.1	192.168.2.6	0x83ba	No error (0)	www3.l.google.com		142.250.185.206	A (IP address)	IN (0x0001)	false
Oct 7, 2024 08:51:06.543936014 CEST	1.1.1.1	192.168.2.6	0xf8c7	No error (0)	ogs.google.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 08:51:06.545058966 CEST	1.1.1.1	192.168.2.6	0x868	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 08:51:06.545058966 CEST	1.1.1.1	192.168.2.6	0x868	No error (0)	plus.l.google.com		216.58.212.174	A (IP address)	IN (0x0001)	false
Oct 7, 2024 08:51:06.545327902 CEST	1.1.1.1	192.168.2.6	0x5aaa	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 08:51:07.517930984 CEST	1.1.1.1	192.168.2.6	0xf71b	No error (0)	play.google.com		216.58.206.46	A (IP address)	IN (0x0001)	false
Oct 7, 2024 08:51:07.748806953 CEST	1.1.1.1	192.168.2.6	0x1c1a	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 08:51:07.748806953 CEST	1.1.1.1	192.168.2.6	0x1c1a	No error (0)	plus.l.google.com		142.250.186.46	A (IP address)	IN (0x0001)	false
Oct 7, 2024 08:51:07.750046015 CEST	1.1.1.1	192.168.2.6	0xfc9f	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 08:51:08.505907059 CEST	1.1.1.1	192.168.2.6	0xbb6d	No error (0)	play.google.com		142.250.184.238	A (IP address)	IN (0x0001)	false
Oct 7, 2024 08:51:14.572494030 CEST	1.1.1.1	192.168.2.6	0x10f0	No error (0)	sustainability.google		216.239.34.21	A (IP address)	IN (0x0001)	false
Oct 7, 2024 08:51:14.572494030 CEST	1.1.1.1	192.168.2.6	0x10f0	No error (0)	sustainability.google		216.239.32.21	A (IP address)	IN (0x0001)	false
Oct 7, 2024 08:51:14.572494030 CEST	1.1.1.1	192.168.2.6	0x10f0	No error (0)	sustainability.google		216.239.38.21	A (IP address)	IN (0x0001)	false
Oct 7, 2024 08:51:14.572494030 CEST	1.1.1.1	192.168.2.6	0x10f0	No error (0)	sustainability.google		216.239.36.21	A (IP address)	IN (0x0001)	false
Oct 7, 2024 08:51:18.774691105 CEST	1.1.1.1	192.168.2.6	0xc907	No error (0)	sustainability.google		216.239.32.21	A (IP address)	IN (0x0001)	false
Oct 7, 2024 08:51:18.774691105 CEST	1.1.1.1	192.168.2.6	0xc907	No error (0)	sustainability.google		216.239.34.21	A (IP address)	IN (0x0001)	false
Oct 7, 2024 08:51:18.774691105 CEST	1.1.1.1	192.168.2.6	0xc907	No error (0)	sustainability.google		216.239.36.21	A (IP address)	IN (0x0001)	false
Oct 7, 2024 08:51:18.774691105 CEST	1.1.1.1	192.168.2.6	0xc907	No error (0)	sustainability.google		216.239.38.21	A (IP address)	IN (0x0001)	false
Oct 7, 2024 08:51:19.339358091 CEST	1.1.1.1	192.168.2.6	0x6265	No error (0)	googletagmanager.com		142.250.185.104	A (IP address)	IN (0x0001)	false
Oct 7, 2024 08:51:19.476609945 CEST	1.1.1.1	192.168.2.6	0x9338	No error (0)	lh3.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 08:51:19.476609945 CEST	1.1.1.1	192.168.2.6	0x9338	No error (0)	googlehosted.l.googleusercontent.com		142.250.185.161	A (IP address)	IN (0x0001)	false
Oct 7, 2024 08:51:19.479113102 CEST	1.1.1.1	192.168.2.6	0x4ff9	No error (0)	lh3.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 08:51:21.125951052 CEST	1.1.1.1	192.168.2.6	0x54fb	No error (0)	lh3.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 08:51:21.125951052 CEST	1.1.1.1	192.168.2.6	0x54fb	No error (0)	googlehosted.l.googleusercontent.com		216.58.206.33	A (IP address)	IN (0x0001)	false
Oct 7, 2024 08:51:21.126657963 CEST	1.1.1.1	192.168.2.6	0x5062	No error (0)	lh3.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 08:51:22.779294968 CEST	1.1.1.1	192.168.2.6	0x5f9b	No error (0)	www.blog.google	ghs-svc-https-sni.ghs-ssl.googlehosted.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 08:51:22.779294968 CEST	1.1.1.1	192.168.2.6	0x5f9b	No error (0)	ghs-svc-https-sni.ghs-ssl.googlehosted.com		172.217.18.19	A (IP address)	IN (0x0001)	false
Oct 7, 2024 08:51:22.811224937 CEST	1.1.1.1	192.168.2.6	0x44be	No error (0)	www.blog.google	ghs-svc-https-sni.ghs-ssl.googlehosted.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 08:51:24.264085054 CEST	1.1.1.1	192.168.2.6	0x1c78	No error (0)	blog.google		216.239.36.21	A (IP address)	IN (0x0001)	false
Oct 7, 2024 08:51:24.264085054 CEST	1.1.1.1	192.168.2.6	0x1c78	No error (0)	blog.google		216.239.32.21	A (IP address)	IN (0x0001)	false
Oct 7, 2024 08:51:24.264085054 CEST	1.1.1.1	192.168.2.6	0x1c78	No error (0)	blog.google		216.239.34.21	A (IP address)	IN (0x0001)	false
Oct 7, 2024 08:51:24.264085054 CEST	1.1.1.1	192.168.2.6	0x1c78	No error (0)	blog.google		216.239.38.21	A (IP address)	IN (0x0001)	false
Oct 7, 2024 08:51:25.043185949 CEST	1.1.1.1	192.168.2.6	0xb101	No error (0)	blog.google		216.239.32.21	A (IP address)	IN (0x0001)	false
Oct 7, 2024 08:51:25.043185949 CEST	1.1.1.1	192.168.2.6	0xb101	No error (0)	blog.google		216.239.36.21	A (IP address)	IN (0x0001)	false
Oct 7, 2024 08:51:25.043185949 CEST	1.1.1.1	192.168.2.6	0xb101	No error (0)	blog.google		216.239.38.21	A (IP address)	IN (0x0001)	false
Oct 7, 2024 08:51:25.043185949 CEST	1.1.1.1	192.168.2.6	0xb101	No error (0)	blog.google		216.239.34.21	A (IP address)	IN (0x0001)	false
Oct 7, 2024 08:51:27.284307957 CEST	1.1.1.1	192.168.2.6	0xcd6b	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Oct 7, 2024 08:51:27.284307957 CEST	1.1.1.1	192.168.2.6	0xcd6b	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Oct 7, 2024 08:51:28.446921110 CEST	1.1.1.1	192.168.2.6	0xcfbf	No error (0)	csp.withgoogle.com		142.250.185.81	A (IP address)	IN (0x0001)	false
Oct 7, 2024 08:51:31.598382950 CEST	1.1.1.1	192.168.2.6	0x909a	No error (0)	mail.google.com		172.217.18.101	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 08:50:54.757361889 CEST	470	OUT	GET /ff7d1c02/files/uploaded/courire.html HTTP/1.1 Host: irp.cdn-website.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Oct 7, 2024 08:50:55.376826048 CEST	902	IN	HTTP/1.1 200 OK Content-Type: text/html Content-Length: 255 Connection: keep-alive Date: Sun, 06 Oct 2024 05:07:46 GMT Last-Modified: Sun, 06 Oct 2024 04:49:33 GMT Etag: "5440cd193fca03aea01906d8b9dd7c4e" X-Amz-Server-Side-Encryption: AES256 X-Amz-Version-Id: WGBDRXWjpOok1i4lOfPlF3JdRpEFgWrC Accept-Ranges: bytes Server: AmazonS3 Via: 1.1 a54cda8ccda3480314f451558e4dd062.cloudfront.net (CloudFront) Alt-Svc: h3=":443"; ma=86400 Age: 92590 Cache-Control: max-age=31536000 Access-Control-Allow-Origin: * X-Cache: Hit from cloudfront X-Amz-Cf-Pop: FRA60-P3 X-Amz-Cf-Id: Zx3qaTo21xZB8kJASwA4YbLC-ExpD1FTXCEz-3c4C5fyK_JF7VeM-g== Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 52 65 64 69 72 65 63 74 69 6f 6e 20 61 75 74 6f 6d 61 74 69 71 75 65 20 65 6e 20 48 54 4d 4c 3c 2f 74 69 74 6c 65 3e 0a 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 32 3b 20 55 52 4c 3d 68 74 74 70 73 3a 2f 2f 6a 6f 72 64 61 6e 68 61 72 72 69 73 2e 63 6f 2e 7a 61 2f 6b 79 63 2f 69 6e 64 65 78 2e 70 68 70 22 3e 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 3e 0a 20 3c 70 3e 59 6f 75 20 77 69 6c 6c 20 62 65 20 72 65 64 69 72 65 63 74 65 64 20 74 6f 20 61 20 6e 65 77 20 70 61 67 65 20 69 6e 20 32 20 73 65 63 6f 6e 64 73 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 0a 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><title>Redirection automatique en HTML</title><meta http-equiv="refresh" content="2; URL=https://jordanharris.co.za/kyc/index.php"></head><body> <p>You will be redirected to a new page in 2 seconds.</p></body></html>
Oct 7, 2024 08:50:55.508469105 CEST	418	OUT	GET /favicon.ico HTTP/1.1 Host: irp.cdn-website.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://irp.cdn-website.com/ff7d1c02/files/uploaded/courire.html Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Oct 7, 2024 08:50:55.901618004 CEST	679	IN	HTTP/1.1 403 Forbidden Content-Type: application/xml Transfer-Encoding: chunked Connection: keep-alive Date: Mon, 07 Oct 2024 06:50:55 GMT Server: AmazonS3 X-Cache: Error from cloudfront Via: 1.1 a54cda8ccda3480314f451558e4dd062.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA60-P3 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: VQF2krwbOQ3dATGltv_trAALH7fIr3pTXp_-HAvUusONHYzU02mxMQ== cache-control: max-age=31536000 Data Raw: 66 33 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 45 72 72 6f 72 3e 3c 43 6f 64 65 3e 41 63 63 65 73 73 44 65 6e 69 65 64 3c 2f 43 6f 64 65 3e 3c 4d 65 73 73 61 67 65 3e 41 63 63 65 73 73 20 44 65 6e 69 65 64 3c 2f 4d 65 73 73 61 67 65 3e 3c 52 65 71 75 65 73 74 49 64 3e 44 58 4a 39 5a 56 51 56 4e 37 42 36 37 58 50 46 3c 2f 52 65 71 75 65 73 74 49 64 3e 3c 48 6f 73 74 49 64 3e 42 69 38 51 4e 73 72 71 64 34 72 5a 72 6b 38 71 39 4e 65 55 4c 62 75 46 68 4a 4b 69 76 7a 53 64 41 79 70 54 32 46 44 73 6f 67 71 64 34 6a 41 52 57 76 47 50 44 4b 55 4a 35 65 37 61 64 70 63 63 4d 4e 36 46 63 4e 46 4e 41 6d 67 3d 3c 2f 48 6f 73 74 49 64 3e 3c 2f 45 72 72 6f 72 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: f3<?xml version="1.0" encoding="UTF-8"?><Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>DXJ9ZVQVN7B67XPF</RequestId><HostId>Bi8QNsrqd4rZrk8q9NeULbuFhJKivzSdAypT2FDsogqd4jARWvGPDKUJ5e7adpccMN6FcNFNAmg=</HostId></Error>0
Oct 7, 2024 08:51:40.963928938 CEST	6	OUT	Data Raw: 00 Data Ascii:

Timestamp	Bytes transferred	Direction	Data
2024-10-07 06:50:35 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 71 73 61 68 65 36 70 32 76 6b 53 4a 4a 76 48 2f 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 32 38 36 32 35 30 63 36 36 39 65 66 38 34 30 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: qsahe6p2vkSJJvH/.1Context: b286250c669ef840
2024-10-07 06:50:35 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-10-07 06:50:35 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 71 73 61 68 65 36 70 32 76 6b 53 4a 4a 76 48 2f 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 32 38 36 32 35 30 63 36 36 39 65 66 38 34 30 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 63 4a 53 48 68 6a 36 30 6a 4f 77 4c 47 35 61 47 48 6c 65 49 79 55 45 37 66 34 55 75 49 2f 73 65 4a 52 4e 34 33 44 50 56 52 6f 47 56 45 38 45 55 37 6a 4e 73 44 65 6c 64 54 4a 5a 63 4d 54 31 57 65 48 38 46 64 48 45 4c 63 43 64 63 48 6d 4d 67 6f 43 6f 74 56 39 31 62 72 33 39 78 71 61 48 74 70 56 7a 6b 6f 58 63 41 41 58 61 4c 53 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: qsahe6p2vkSJJvH/.2Context: b286250c669ef840<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAcJSHhj60jOwLG5aGHleIyUE7f4UuI/seJRN43DPVRoGVE8EU7jNsDeldTJZcMT1WeH8FdHELcCdcHmMgoCotV91br39xqaHtpVzkoXcAAXaLS
2024-10-07 06:50:35 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 71 73 61 68 65 36 70 32 76 6b 53 4a 4a 76 48 2f 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 32 38 36 32 35 30 63 36 36 39 65 66 38 34 30 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: qsahe6p2vkSJJvH/.3Context: b286250c669ef840<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-10-07 06:50:35 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-10-07 06:50:35 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 34 59 53 36 57 6c 4f 4c 53 45 57 44 54 36 47 64 6e 68 6e 64 4f 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 4YS6WlOLSEWDT6GdnhndOw.0Payload parsing failed.

Timestamp	Bytes transferred	Direction	Data
2024-10-07 06:50:38 UTC	726	OUT	GET /s/25ZWCQ1LLnt4mw7QuPhvFGTIX4?domain=irp.cdn-website.com HTTP/1.1 Host: url.za.m.mimecastprotect.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-07 06:50:38 UTC	2264	IN	HTTP/1.1 307 Temporary Redirect Date: Mon, 07 Oct 2024 06:50:38 GMT Content-Length: 0 Connection: close Location: https://url.za.m.mimecastprotect.com/r/wuG_Hmu-qGrinRrKXpVqYn9ubRI6PgFF5gOZFbaE03YTSCxwJQuTaUilSO0Ql01qv-WVYM962IzyC9WwI7hjfpdrK6JEInQPt_UFAgtPMlZ5Kh0irrTem8VBo48nymVJNQxFWqLBZgqWby5RbSHfChuBM4rddmOiEiKIcaWxH-wYzNSeTIhN3wHyhqL8pX7iDtbWwCLbpepcPfmWtkCfWpw_owLs0VMZhmhmXlC09IrHMDPhr7GVc4eR-BxU4Sdes0aVqvCNSURbHYP4rYFre0UWcghtrz8KDjUdkZTeSmztbtbhP-UjQXsmSuIL6ZWn173Y2YplVJ0xvaNVK7MjO-ND6jXmpgWYPgikDiHVtN8dq3RK7eEng4kJvi0fPQ5SKw6OJqbTKIxL_rJmlGlllveec6p5m6iNysO8PHbLzBrq7kBe7FJYvItoSBZN0EXNOm79iasJkXZIoeH1GeiACWGLKEql1YnwYBIaWlDzDO9p1_HiLcMT4j0YBqwn8tAdzqdn-bWT_dBPiBfes8zgSL-YtaE-BlcBTnsYjx3Jh3Bp0-Xd3IqIVswpLF2FqKkkM3gV8CEuB0By6Bq80je5xnuXJvYZr9e_PA4BHNYguXtrn6FrlThzdJCzSYgiAFTcekjNjK_a2HzMxo55RU8No6M3JMBk08iBx8zAw2A9a9_DB4mjL_Cuu-12hOu_tfM0wf9gANNBup3Ji0UoM3Ew9Yp16UkBFk7w-KyLleaBkZsi2MuYT6xaTU0sju9tA0E0MExKbXRRiBdIe4sNDD3ks2zI_F5-p52MYF_cZLblZ3uF2NWY9vNRoW5Ei2Y5diVh8nuvWq9919gN4hldDcpXS7qXIvu8I6O1E5q-j9-c3cgG7faBLt9Ij_4Ahf9QeFnL3ygKFSKfFiH4tuoUPHJSWHpuRIBN0HQ5u19QSB7uoBqaicyb_T0rclsY2rEEZlgetpWVZ61zZPVNQSG [TRUNCATED] Cache-control: no-store Pragma: no-cache X-Robots-Tag: noindex, nofollow

Timestamp	Bytes transferred	Direction	Data
2024-10-07 06:50:38 UTC	2700	OUT	GET /r/wuG_Hmu-qGrinRrKXpVqYn9ubRI6PgFF5gOZFbaE03YTSCxwJQuTaUilSO0Ql01qv-WVYM962IzyC9WwI7hjfpdrK6JEInQPt_UFAgtPMlZ5Kh0irrTem8VBo48nymVJNQxFWqLBZgqWby5RbSHfChuBM4rddmOiEiKIcaWxH-wYzNSeTIhN3wHyhqL8pX7iDtbWwCLbpepcPfmWtkCfWpw_owLs0VMZhmhmXlC09IrHMDPhr7GVc4eR-BxU4Sdes0aVqvCNSURbHYP4rYFre0UWcghtrz8KDjUdkZTeSmztbtbhP-UjQXsmSuIL6ZWn173Y2YplVJ0xvaNVK7MjO-ND6jXmpgWYPgikDiHVtN8dq3RK7eEng4kJvi0fPQ5SKw6OJqbTKIxL_rJmlGlllveec6p5m6iNysO8PHbLzBrq7kBe7FJYvItoSBZN0EXNOm79iasJkXZIoeH1GeiACWGLKEql1YnwYBIaWlDzDO9p1_HiLcMT4j0YBqwn8tAdzqdn-bWT_dBPiBfes8zgSL-YtaE-BlcBTnsYjx3Jh3Bp0-Xd3IqIVswpLF2FqKkkM3gV8CEuB0By6Bq80je5xnuXJvYZr9e_PA4BHNYguXtrn6FrlThzdJCzSYgiAFTcekjNjK_a2HzMxo55RU8No6M3JMBk08iBx8zAw2A9a9_DB4mjL_Cuu-12hOu_tfM0wf9gANNBup3Ji0UoM3Ew9Yp16UkBFk7w-KyLleaBkZsi2MuYT6xaTU0sju9tA0E0MExKbXRRiBdIe4sNDD3ks2zI_F5-p52MYF_cZLblZ3uF2NWY9vNRoW5Ei2Y5diVh8nuvWq9919gN4hldDcpXS7qXIvu8I6O1E5q-j9-c3cgG7faBLt9Ij_4Ahf9QeFnL3ygKFSKfFiH4tuoUPHJSWHpuRIBN0HQ5u19QSB7uoBqaicyb_T0rclsY2rEEZlgetpWVZ61zZPVNQSGmh9OApkO1zBsVLzkGURe0Tl0X28EBqDxi7vVVffMuM [TRUNCATED] Host: url.za.m.mimecastprotect.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-07 06:50:54 UTC	334	IN	HTTP/1.1 307 Temporary Redirect Date: Mon, 07 Oct 2024 06:50:54 GMT Content-Length: 0 Connection: close Location: http://irp.cdn-website.com/ff7d1c02/files/uploaded/courire.html Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Cache-control: no-store Pragma: no-cache X-Robots-Tag: noindex, nofollow

Timestamp	Bytes transferred	Direction	Data
2024-10-07 06:50:39 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 06:50:39 UTC	540	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 06:50:39 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public Last-Modified: Fri, 04 Oct 2024 23:21:50 GMT ETag: "0x8DCE4CB535A72FA" x-ms-request-id: 4dad204e-401e-005b-4bf5-169c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T065039Z-1657d5bbd482lxwq1dp2t1zwkc00000002yg000000001qch x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 06:50:39 UTC	15844	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-10-07 06:50:39 UTC	16384	IN	Data Raw: 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e Data Ascii: "0" /> </L> <R> <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" />
2024-10-07 06:50:39 UTC	16384	IN	Data Raw: 20 20 3c 53 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 53 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 38 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 Data Ascii: <ST> <S T="1" /> </ST></R><$!#>10820v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-781
2024-10-07 06:50:39 UTC	16384	IN	Data Raw: 20 54 3d 22 55 36 34 22 20 49 3d 22 38 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 45 76 65 6e 74 73 5f 41 76 67 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 Data Ascii: T="U64" I="8" O="false" N="Events_Avg"> <S T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32"
2024-10-07 06:50:39 UTC	16384	IN	Data Raw: 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f Data Ascii: "0" O="false" N="Count_CreateCard_ValidPersona_False"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Co
2024-10-07 06:50:39 UTC	16384	IN	Data Raw: 20 20 20 20 3c 53 20 54 3d 22 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a Data Ascii: <S T="31" /> </C> </C> <C T="U32" I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C>
2024-10-07 06:50:39 UTC	16384	IN	Data Raw: 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 Data Ascii: <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMillisec
2024-10-07 06:50:39 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e Data Ascii: R> <V V="0" T="I32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIn
2024-10-07 06:50:39 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: R> </O> </F> <F T="6"> <O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L>
2024-10-07 06:50:39 UTC	16384	IN	Data Raw: 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c Data Ascii: T="6"> <O T="EQ"> <L> <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://url.za.m.mimecastprotect.com/s/25ZWCQ1LLnt4mw7QuPhvFGTIX4?domain=irp.cdn-website.com

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 229

Chrome Cache Entry: 230

Chrome Cache Entry: 231

Chrome Cache Entry: 232

Chrome Cache Entry: 233

Chrome Cache Entry: 234

Chrome Cache Entry: 235

Chrome Cache Entry: 236

Chrome Cache Entry: 237

Chrome Cache Entry: 238

Chrome Cache Entry: 239

Chrome Cache Entry: 240

Chrome Cache Entry: 241

Chrome Cache Entry: 242

Chrome Cache Entry: 243

Chrome Cache Entry: 244

Chrome Cache Entry: 245

Chrome Cache Entry: 246

Chrome Cache Entry: 247

Chrome Cache Entry: 248

Chrome Cache Entry: 249

Chrome Cache Entry: 250

Chrome Cache Entry: 251

Chrome Cache Entry: 252

Chrome Cache Entry: 253

Chrome Cache Entry: 254

Chrome Cache Entry: 255

Chrome Cache Entry: 256

Windows Analysis Report
https://url.za.m.mimecastprotect.com/s/25ZWCQ1LLnt4mw7QuPhvFGTIX4?domain=irp.cdn-website.com

Timestamp	Bytes transferred	Direction	Data
2024-10-07 06:50:40 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 06:50:40 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 06:50:40 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 4545068c-701e-0050-0e05-176767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T065040Z-1657d5bbd48jwrqbupe3ktsx9w000000037000000000ftz3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 06:50:40 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Timestamp	Bytes transferred	Direction	Data
2024-10-07 06:50:40 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 06:50:40 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 06:50:40 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: c62b5fc1-401e-0067-3a60-1709c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T065040Z-1657d5bbd48vhs7r2p1ky7cs5w00000003hg00000000041s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 06:50:40 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Timestamp	Bytes transferred	Direction	Data
2024-10-07 06:50:40 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 06:50:40 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 06:50:40 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: b27588a3-a01e-003d-6001-1798d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T065040Z-1657d5bbd48xlwdx82gahegw40000000039g0000000080uc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 06:50:40 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Timestamp	Bytes transferred	Direction	Data
2024-10-07 06:50:40 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 06:50:40 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 06:50:40 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 8aaf7b13-d01e-0028-46fd-167896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T065040Z-1657d5bbd4824mj9d6vp65b6n4000000037g00000000dttd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 06:50:40 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Timestamp	Bytes transferred	Direction	Data
2024-10-07 06:50:40 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 06:50:40 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 06:50:40 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: d4448e94-101e-00a2-2703-179f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T065040Z-1657d5bbd48f7nlxc7n5fnfzh000000002s00000000080gx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 06:50:40 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Timestamp	Bytes transferred	Direction	Data
2024-10-07 06:50:41 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-07 06:50:41 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF45) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=208501 Date: Mon, 07 Oct 2024 06:50:41 GMT Connection: close X-CID: 2

Timestamp	Bytes transferred	Direction	Data
2024-10-07 06:50:41 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 06:50:41 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 06:50:41 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 87fc294c-201e-0051-40f3-167340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T065041Z-1657d5bbd48t66tjar5xuq22r8000000032g000000007ndm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 06:50:41 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Timestamp	Bytes transferred	Direction	Data
2024-10-07 06:50:41 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 06:50:41 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 06:50:41 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 15158de7-401e-0029-4b00-179b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T065041Z-1657d5bbd48cpbzgkvtewk0wu00000000360000000008fq6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 06:50:41 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Timestamp	Bytes transferred	Direction	Data
2024-10-07 06:50:41 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 06:50:41 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 06:50:41 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 73fc0cc0-d01e-008e-5fee-16387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T065041Z-1657d5bbd48lknvp09v995n79000000002rg00000000bdsg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 06:50:41 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Timestamp	Bytes transferred	Direction	Data
2024-10-07 06:50:41 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 06:50:41 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 06:50:41 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 3ea0840d-701e-0053-1012-173a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T065041Z-1657d5bbd48xlwdx82gahegw4000000003ag000000006rxt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 06:50:41 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />