Edit tour

Windows Analysis Report
https://mail.oilreviewmiddleeast.com/link.php?M=532162&N=675&L=518&F=H/

Overview

General Information

Sample URL:	https://mail.oilreviewmiddleeast.com/link.php?M=532162&N=675&L=518&F=H/
Analysis ID:	1542559
Tags:	urlscan
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Javascript checks online IP of machine

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64

chrome.exe (PID: 3332 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5980 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2412 --field-trial-handle=2092,i,299084196662118440,4847638521169811279,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5060 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://mail.oilreviewmiddleeast.com/link.php?M=532162&N=675&L=518&F=H/" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

HTTP traffic detected: POST /magazines/save_data.php HTTP/1.1Host: oilreviewmiddleeast.comConnection: keep-aliveContent-Length: 724sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryrwDhAZpwCAcfPH2XAccept: */*Origin: https://oilreviewmiddleeast.comSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/spread/?page=19Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AWSALB=Z3ZynZnqfF67xSsmVq98UWHfR9W+OX/9dFN5+Su17TMWFHxrrGz3QBcwwGtBql4Lk1qTScasFyqymRSSc7je6wQFpvqr2WYna5ON8+rxMOBeEbFVBw5OiSLCrJWp; AWSALBCORS=Z3ZynZnqfF67xSsmVq98UWHfR9W+OX/9dFN5+Su17TMWFHxrrGz3QBcwwGtBql4Lk1qTScasFyqymRSSc7je6wQFpvqr2WYna5ON8+rxMOBeEbFVBw5OiSLCrJWp

Source: https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/?page=2	HTTP Parser: document.addeventlistener("domcontentloaded", function () { // get url var currenturl = window.location.href; // get ip address fetch("https://api.ipify.org?format=json") .then((response) => response.json()) .then((data) => { var ipaddress = data.ip; let date = new date(); let year = date.getfullyear(); let month = date.getmonth() + 1; let day = date.getdate(); let formtteddate = [year, month, day].join("/"); console.log(formtteddate); var hours = ("0" + date.gethours()).slice(-2); var minutes = ("0" + date.getminutes()).slice(-2); var seconds = ("0" + date.getseconds()).slice(-2); // concatenate the time parts in the desired format var newcurrenttime = hours + ":" + minutes + ":" + seconds; console.log(newcurrenttime); // let currenturl = 'http://trme.acpjoomladev.acp.local/magazines/orme_2023_11_16/mobile/?page=11';...
Source: https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/spread/?page=19	HTTP Parser: document.addeventlistener("domcontentloaded", function () { // get url var currenturl = window.location.href; // get ip address fetch("https://api.ipify.org?format=json") .then((response) => response.json()) .then((data) => { var ipaddress = data.ip; let date = new date(); let year = date.getfullyear(); let month = date.getmonth() + 1; let day = date.getdate(); let formtteddate = [year, month, day].join("/"); console.log(formtteddate); var hours = ("0" + date.gethours()).slice(-2); var minutes = ("0" + date.getminutes()).slice(-2); var seconds = ("0" + date.getseconds()).slice(-2); // concatenate the time parts in the desired format var newcurrenttime = hours + ":" + minutes + ":" + seconds; console.log(newcurrenttime); // let currenturl = 'http://trme.acpjoomladev.acp.local/magazines/orme_2023_11_16/mobile/?page=11';...
Source: https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/?page=19	HTTP Parser: document.addeventlistener("domcontentloaded", function () { // get url var currenturl = window.location.href; // get ip address fetch("https://api.ipify.org?format=json") .then((response) => response.json()) .then((data) => { var ipaddress = data.ip; let date = new date(); let year = date.getfullyear(); let month = date.getmonth() + 1; let day = date.getdate(); let formtteddate = [year, month, day].join("/"); console.log(formtteddate); var hours = ("0" + date.gethours()).slice(-2); var minutes = ("0" + date.getminutes()).slice(-2); var seconds = ("0" + date.getseconds()).slice(-2); // concatenate the time parts in the desired format var newcurrenttime = hours + ":" + minutes + ":" + seconds; console.log(newcurrenttime); // let currenturl = 'http://trme.acpjoomladev.acp.local/magazines/orme_2023_11_16/mobile/?page=11';...

Source: https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/spread/?page=19	HTTP Parser: No favicon
Source: https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/?page=19	HTTP Parser: No favicon
Source: https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/?page=19	HTTP Parser: No favicon
Source: https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/?page=19	HTTP Parser: No favicon
Source: https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/?page=19	HTTP Parser: No favicon
Source: https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/?page=19	HTTP Parser: No favicon
Source: https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/?page=19	HTTP Parser: No favicon
Source: https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/?page=19	HTTP Parser: No favicon
Source: https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/?page=19	HTTP Parser: No favicon
Source: https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/?page=19	HTTP Parser: No favicon
Source: https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/?page=19	HTTP Parser: No favicon
Source: https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/?page=19	HTTP Parser: No favicon
Source: https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/?page=19	HTTP Parser: No favicon
Source: https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/?page=19	HTTP Parser: No favicon
Source: https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/?page=19	HTTP Parser: No favicon
Source: https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/?page=19	HTTP Parser: No favicon
Source: https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/?page=19	HTTP Parser: No favicon
Source: https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/?page=19	HTTP Parser: No favicon
Source: https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/?page=19	HTTP Parser: No favicon
Source: https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/?page=19	HTTP Parser: No favicon
Source: https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/?page=19	HTTP Parser: No favicon
Source: https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/?page=19	HTTP Parser: No favicon
Source: https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/?page=2	HTTP Parser: No favicon
Source: https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/?page=2	HTTP Parser: No favicon
Source: https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/?page=2	HTTP Parser: No favicon
Source: https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/?page=2	HTTP Parser: No favicon
Source: https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/?page=2	HTTP Parser: No favicon
Source: https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/?page=2	HTTP Parser: No favicon
Source: https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/?page=2	HTTP Parser: No favicon
Source: https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/?page=2	HTTP Parser: No favicon
Source: https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/?page=2	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49804 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49891 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: chromecache_207.2.dr, chromecache_252.2.dr	String found in binary or memory: Math.round(q);t["gtm.videoElapsedTime"]=Math.round(f);t["gtm.videoPercent"]=r;t["gtm.videoVisible"]=u;return t},rk:function(){e=pb()},zd:function(){d()}}};var Yb=ka(["data-gtm-yt-inspected-"]),qD=["www.youtube.com","www.youtube-nocookie.com"],rD,sD=!1; equals www.youtube.com (Youtube)
Source: chromecache_207.2.dr, chromecache_252.2.dr	String found in binary or memory: c?"runIfCanceled":"runIfUncanceled",[]);if(!g.length)return!0;var k=XA(a,c,e);S(121);if(k["gtm.elementUrl"]==="https://www.facebook.com/tr/")return S(122),!0;if(d&&f){for(var m=Ab(b,g.length),n=0;n<g.length;++n)g[n](k,m);return m.done}for(var p=0;p<g.length;++p)g[p](k,function(){});return!0},$A=function(){var a=[],b=function(c){return db(a,function(d){return d.form===c})};return{store:function(c,d){var e=b(c);e?e.button=d:a.push({form:c,button:d})},get:function(c){var d=b(c);return d?d.button:null}}}, equals www.facebook.com (Facebook)
Source: chromecache_207.2.dr, chromecache_252.2.dr	String found in binary or memory: if(!(e\|\|f\|\|g\|\|k.length\|\|m.length))return;var p={Ah:e,yh:f,zh:g,ii:k,ji:m,Pe:n,Ib:b},q=C.YT;if(q)return q.ready&&q.ready(d),b;var r=C.onYouTubeIframeAPIReady;C.onYouTubeIframeAPIReady=function(){r&&r();d()};F(function(){for(var u=E.getElementsByTagName("script"),v=u.length,t=0;t<v;t++){var w=u[t].getAttribute("src");if(BD(w,"iframe_api")\|\|BD(w,"player_api"))return b}for(var x=E.getElementsByTagName("iframe"),y=x.length,A=0;A<y;A++)if(!sD&&zD(x[A],p.Pe))return oc("https://www.youtube.com/iframe_api"), equals www.youtube.com (Youtube)
Source: chromecache_207.2.dr, chromecache_252.2.dr	String found in binary or memory: var DC=function(a,b,c,d,e){var f=uA("fsl",c?"nv.mwt":"mwt",0),g;g=c?uA("fsl","nv.ids",[]):uA("fsl","ids",[]);if(!g.length)return!0;var k=zA(a,"gtm.formSubmit",g),m=a.action;m&&m.tagName&&(m=a.cloneNode(!1).action);S(121);if(m==="https://www.facebook.com/tr/")return S(122),!0;k["gtm.elementUrl"]=m;k["gtm.formCanceled"]=c;a.getAttribute("name")!=null&&(k["gtm.interactedFormName"]=a.getAttribute("name"));e&&(k["gtm.formSubmitElement"]=e,k["gtm.formSubmitElementText"]=e.value);if(d&&f){if(!gz(k,iz(b, equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: mail.oilreviewmiddleeast.com
Source: global traffic	DNS traffic detected: DNS query: oilreviewmiddleeast.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: unpkg.com
Source: global traffic	DNS traffic detected: DNS query: cdn-eu.pagesense.io
Source: global traffic	DNS traffic detected: DNS query: api.ipify.org

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Type: application/xmlTransfer-Encoding: chunkedConnection: closeServer: AmazonS3Date: Fri, 25 Oct 2024 22:55:18 GMTX-Cache: Error from cloudfrontVia: 1.1 3f52d342c56014599dee37446f6c9f2e.cloudfront.net (CloudFront)X-Amz-Cf-Pop: FRA56-P2X-Amz-Cf-Id: uHI16EWGXN5QwTWMG8re_S3LQedBitzRojX-Vi5rNakJSSLIUkUXIQ==
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Type: application/xmlTransfer-Encoding: chunkedConnection: closeServer: AmazonS3Date: Fri, 25 Oct 2024 22:55:25 GMTX-Cache: Error from cloudfrontVia: 1.1 666eddda46892ed48d8d771b6142ac24.cloudfront.net (CloudFront)X-Amz-Cf-Pop: FRA56-P2X-Amz-Cf-Id: 7MjvCauHKjq6KtWUqhOpCqIKl3OChG8KHIp9LUtP1GtqpJWa9pXu3A==
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Type: application/xmlTransfer-Encoding: chunkedConnection: closeServer: AmazonS3Date: Fri, 25 Oct 2024 22:55:29 GMTX-Cache: Error from cloudfrontVia: 1.1 cb4c4a25e4ef534686959996782c8476.cloudfront.net (CloudFront)X-Amz-Cf-Pop: FRA56-P2X-Amz-Cf-Id: Mfgarc680fVTClaqTc-QPUU52cRskvb6hOD9bWYV3W57SexFZ__rgw==
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closeDate: Fri, 25 Oct 2024 22:56:05 GMTSet-Cookie: AWSALB=Ulq8E/+gzpqj6NokyOxVC/5UY/aXZ7QZf19l2ekc5FLkk2BPDKRz/7OJdyNlTSsLophx6wUG8n7Hc3fIBw2LNRCVYKCl+4XIdaMxeUPvIAxYbmlvLkj6/fe8rULe; Expires=Fri, 01 Nov 2024 22:56:05 GMT; Path=/Set-Cookie: AWSALBCORS=Ulq8E/+gzpqj6NokyOxVC/5UY/aXZ7QZf19l2ekc5FLkk2BPDKRz/7OJdyNlTSsLophx6wUG8n7Hc3fIBw2LNRCVYKCl+4XIdaMxeUPvIAxYbmlvLkj6/fe8rULe; Expires=Fri, 01 Nov 2024 22:56:05 GMT; Path=/; SameSite=None; SecureServer: nginx/1.18.0 (Ubuntu)Vary: Accept-EncodingX-Cache: Error from cloudfrontVia: 1.1 f2c65205154aaf89a2c7bbc8fe8fdaba.cloudfront.net (CloudFront)X-Amz-Cf-Pop: FRA56-P4Alt-Svc: h3=":443"; ma=86400X-Amz-Cf-Id: 2hDPQkK8lq8XPZMBjyN3_SNlWajxyUIm6dL9uanzgtFFRTTr69y6ag==X-Frame-Options: SAMEORIGINX-Content-Type-Options: nosniffStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadVary: Origin
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Type: application/xmlTransfer-Encoding: chunkedConnection: closeServer: AmazonS3Date: Fri, 25 Oct 2024 22:56:19 GMTX-Cache: Error from cloudfrontVia: 1.1 018ffb575888f1c9ec960e3e977c042e.cloudfront.net (CloudFront)X-Amz-Cf-Pop: FRA56-P2X-Amz-Cf-Id: 98vLYMJg3bPVN-NFDEY2o4XGMfh_vRnYzrPg-I5hgZIR7lLzobIxCw==

Source: chromecache_336.2.dr	String found in binary or memory: http://deconf.com/advanced-google-analytics-joomla/
Source: chromecache_252.2.dr	String found in binary or memory: https://adservice.google.com/pagead/regclk?
Source: chromecache_206.2.dr, chromecache_278.2.dr	String found in binary or memory: https://ampcid.google.com/v1/publisher:getClientId
Source: chromecache_207.2.dr, chromecache_252.2.dr	String found in binary or memory: https://cct.google/taggy/agent.js
Source: chromecache_336.2.dr	String found in binary or memory: https://cdn-eu.pagesense.io/js/alaincharles/2ec214dae0b1407d93446c488847ff27.js
Source: chromecache_252.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com
Source: chromecache_207.2.dr, chromecache_252.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=tcfe
Source: chromecache_207.2.dr, chromecache_252.2.dr	String found in binary or memory: https://stats.g.doubleclick.net/g/collect
Source: chromecache_278.2.dr	String found in binary or memory: https://stats.g.doubleclick.net/j/collect
Source: chromecache_206.2.dr, chromecache_278.2.dr	String found in binary or memory: https://tagassistant.google.com/
Source: chromecache_207.2.dr, chromecache_252.2.dr	String found in binary or memory: https://td.doubleclick.net
Source: chromecache_206.2.dr, chromecache_278.2.dr	String found in binary or memory: https://www.google-analytics.com/debug/bootstrap?id=
Source: chromecache_206.2.dr, chromecache_278.2.dr	String found in binary or memory: https://www.google-analytics.com/gtm/js?id=
Source: chromecache_206.2.dr, chromecache_278.2.dr	String found in binary or memory: https://www.google.%/ads/ga-audiences
Source: chromecache_252.2.dr	String found in binary or memory: https://www.google.com
Source: chromecache_206.2.dr, chromecache_278.2.dr	String found in binary or memory: https://www.google.com/ads/ga-audiences
Source: chromecache_207.2.dr, chromecache_252.2.dr	String found in binary or memory: https://www.googleadservices.com
Source: chromecache_252.2.dr	String found in binary or memory: https://www.googletagmanager.com
Source: chromecache_206.2.dr, chromecache_278.2.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=
Source: chromecache_207.2.dr, chromecache_252.2.dr	String found in binary or memory: https://www.merchant-center-analytics.goog
Source: chromecache_207.2.dr, chromecache_252.2.dr	String found in binary or memory: https://www.youtube.com/iframe_api

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2412 --field-trial-handle=2092,i,299084196662118440,4847638521169811279,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://mail.oilreviewmiddleeast.com/link.php?M=532162&N=675&L=518&F=H/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2412 --field-trial-handle=2092,i,299084196662118440,4847638521169811279,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label
https://stats.g.doubleclick.net/g/collect	0%	URL Reputation	safe
https://ampcid.google.com/v1/publisher:getClientId	0%	URL Reputation	safe
https://stats.g.doubleclick.net/j/collect	0%	URL Reputation	safe

IP	Domain	Country	ASN	ASN Name	Malicious
52.222.236.129	oilreviewmiddleeast.com	United States	16509	AMAZON-02US	false
104.17.248.203	unknown	United States	13335	CLOUDFLARENETUS	false
18.66.102.19	unknown	United States	3	MIT-GATEWAYSUS	false
104.26.13.205	api.ipify.org	United States	13335	CLOUDFLARENETUS	false
52.222.236.123	unknown	United States	16509	AMAZON-02US	false
149.106.168.53	mail.oilreviewmiddleeast.com	United States	19999	UNIONASNUS	false
104.17.246.203	unpkg.com	United States	13335	CLOUDFLARENETUS	false
18.66.102.65	d1da88slxvkrhp.cloudfront.net	United States	3	MIT-GATEWAYSUS	false
104.26.12.205	unknown	United States	13335	CLOUDFLARENETUS	false
52.222.236.78	unknown	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.186.164	www.google.com	United States	15169	GOOGLEUS	false
52.222.236.37	unknown	United States	16509	AMAZON-02US	false
172.67.74.152	unknown	United States	13335	CLOUDFLARENETUS	false

IP
192.168.2.7
192.168.2.5

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Name	IP	Active	Malicious	Reputation
oilreviewmiddleeast.com	52.222.236.129	true	false	unknown
d1da88slxvkrhp.cloudfront.net	18.66.102.65	true	false	unknown
mail.oilreviewmiddleeast.com	149.106.168.53	true	false	unknown
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	unknown
www.google.com	142.250.186.164	true	false	unknown
api.ipify.org	104.26.13.205	true	false	unknown
unpkg.com	104.17.246.203	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	unknown
cdn-eu.pagesense.io	unknown	unknown	false	unknown

Name	Malicious	Reputation
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/1/annots/1306.png	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/4/img/3.jpg	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/23/23.svg	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/11.html	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31//?page=19	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/11/annots/515.png	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/11/img/1.jpg	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/1/annots/1330.png	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/spread/fonts/FuturaBT-Heavy_6m.woff	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/fonts/Futura-CondensedBold_xa.woff	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/7/img/2.jpg	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/25.html	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/4/4.svg	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/fonts/Futura-Light_dh.woff	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/spread/19/19.svg	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/22/annots/775.png	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/fonts/Times-Italic_kw.woff	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/10/img/1.jpg	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/23.html	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/6/img/2.jpg	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/28/28.svg	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/fonts/Archivo-Bold_g3.woff	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/fonts/Minion-Regular_x7.woff	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/6.html	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/13/annots/548.png	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/fonts/FuturaBT-Heavy_ku.woff	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/fonts/Avenir-Medium_jj.woff	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/5/5.svg	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/?page=2	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/fonts/Archivo-ExtraBold_m9.woff	false	unknown
http://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/?page=19	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/fonts/Futura-Light_h0.woff	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/21/img/1.jpg	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/spread/fonts/Times-Italic_7m.woff	false	unknown
https://mail.oilreviewmiddleeast.com/link.php?M=532162&N=675&L=518&F=H/	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/1/img/4.jpg	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/1/annots/1309.png	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/17/17.svg	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/28/img/2.jpg	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/fonts/NewsGothic-Bold_11y.woff	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/spread/18.html	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/fonts/Futura-Light_nm.woff	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/27/annots/890.png	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/13.html	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/18/img/2.jpg	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/20.html	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/6/6.svg	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/1/1.svg	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/10/img/2.jpg	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/2/annots/123.png	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/2/annots/1345.png	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/fonts/Avenir-Heavy_ji.woff	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/26/annots/875.png	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/fonts/FuturaBT-Heavy_xg.woff	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/7/img/3.jpg	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/17/img/2.jpg	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/fonts/Minion-Regular_dm.woff	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/fonts/Futura-Light_ib.woff	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/18.html	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/fonts/Minion-Regular_g4.woff	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/25/img/2.jpg	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/2.html	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/fonts/ZapfDingbats_jg.woff	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/26/26.svg	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/fonts/Glasgow-Medium_i8.woff	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/spread/fonts/Glasgow-Xlight_79.woff	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/22.html	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/15/annots/615.png	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/17.html	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/13/img/1.jpg	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/25/annots/845.png	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/6/img/3.jpg	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/16/img/2.jpg	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/2/annots/1351.png	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/18/annots/682.png	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/24/shade/1.png	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/13/shade/1.png	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/2/annots/1363.png	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/fonts/DIN-Medium_11x.woff	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/16/16.svg	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/3/img/2.jpg	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/spread/?page=19	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/fonts/Impact_11-.woff	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/fonts/Glasgow-Xlight_xc.woff	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/spread/19.html	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/24/annots/788.png	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/fonts/Glasgow-DemiBold_i7.woff	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/15/15.svg	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/spread/18/18.svg	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/20/img/1.jpg	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/fonts/Avenir-Black_jh.woff	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/3/img/1.jpg	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/fonts/Glasgow-Xlight_i9.woff	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/fonts/Glasgow-Xlight_f-.woff	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/24/shade/2.png	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/fonts/Glasgow-Xlight_dk.woff	false	unknown
https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/7/7.svg	false	unknown

Name	Source	Malicious	Antivirus Detection	Reputation
https://stats.g.doubleclick.net/g/collect	chromecache_207.2.dr, chromecache_252.2.dr	false	URL Reputation: safe	unknown
https://ampcid.google.com/v1/publisher:getClientId	chromecache_206.2.dr, chromecache_278.2.dr	false	URL Reputation: safe	unknown
https://stats.g.doubleclick.net/j/collect	chromecache_278.2.dr	false	URL Reputation: safe	unknown

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1542559
Start date and time:	2024-10-26 00:54:16 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://mail.oilreviewmiddleeast.com/link.php?M=532162&N=675&L=518&F=H/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean1.win@16/552@32/16
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 25 21:55:14 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.981304212241532
Encrypted:	false
SSDEEP:	48:8yQdKPRWTqPRy7ppHHidAKZdA19ehwiZUklqehgy+3:8qRWiRSpv3y
MD5:	D524DFBA290EAD1A7FDF017417E5F77F
SHA1:	419FA1CCC11FD44B385C58BC563E5CD43503ED5B
SHA-256:	ECE164141CDE5B9B8DE0C729100B4150CB470E08D0C950AC6068578A6882F7D1
SHA-512:	380A827FAE210BC4CD0C6FAEF6E1CC289D19B038754201451E20D44ACA8B046E4F7247B5CC084C31A252D24674CDE73F407E887A0E43FFEF7CA56C5271B30055
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....C^0.0'..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IYY.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VYY.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VYY.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VYY............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VYY............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............X......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 26, 2024 00:55:14.832304001 CEST	192.168.2.5	1.1.1.1	0x7efd	Standard query (0)	mail.oilreviewmiddleeast.com	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:55:14.833599091 CEST	192.168.2.5	1.1.1.1	0xb9a9	Standard query (0)	mail.oilreviewmiddleeast.com	65	IN (0x0001)	false
Oct 26, 2024 00:55:16.058254004 CEST	192.168.2.5	1.1.1.1	0x2c23	Standard query (0)	oilreviewmiddleeast.com	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:55:16.058442116 CEST	192.168.2.5	1.1.1.1	0xca2	Standard query (0)	oilreviewmiddleeast.com	65	IN (0x0001)	false
Oct 26, 2024 00:55:17.960304022 CEST	192.168.2.5	1.1.1.1	0xc1c8	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:55:17.960649967 CEST	192.168.2.5	1.1.1.1	0x3937	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 26, 2024 00:55:17.999923944 CEST	192.168.2.5	1.1.1.1	0x109	Standard query (0)	unpkg.com	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:55:18.000096083 CEST	192.168.2.5	1.1.1.1	0x82ae	Standard query (0)	unpkg.com	65	IN (0x0001)	false
Oct 26, 2024 00:55:18.000912905 CEST	192.168.2.5	1.1.1.1	0x1c58	Standard query (0)	cdn-eu.pagesense.io	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:55:18.001058102 CEST	192.168.2.5	1.1.1.1	0xbd0	Standard query (0)	cdn-eu.pagesense.io	65	IN (0x0001)	false
Oct 26, 2024 00:55:19.873333931 CEST	192.168.2.5	1.1.1.1	0xd90a	Standard query (0)	unpkg.com	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:55:19.873605013 CEST	192.168.2.5	1.1.1.1	0xc9b8	Standard query (0)	unpkg.com	65	IN (0x0001)	false
Oct 26, 2024 00:55:19.900239944 CEST	192.168.2.5	1.1.1.1	0x129d	Standard query (0)	oilreviewmiddleeast.com	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:55:19.900994062 CEST	192.168.2.5	1.1.1.1	0x1693	Standard query (0)	oilreviewmiddleeast.com	65	IN (0x0001)	false
Oct 26, 2024 00:55:20.073863983 CEST	192.168.2.5	1.1.1.1	0x8beb	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:55:20.074040890 CEST	192.168.2.5	1.1.1.1	0x8335	Standard query (0)	api.ipify.org	65	IN (0x0001)	false
Oct 26, 2024 00:55:20.982821941 CEST	192.168.2.5	1.1.1.1	0x6ee2	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:55:20.983407974 CEST	192.168.2.5	1.1.1.1	0x59b4	Standard query (0)	api.ipify.org	65	IN (0x0001)	false
Oct 26, 2024 00:55:27.495863914 CEST	192.168.2.5	1.1.1.1	0xf1ca	Standard query (0)	oilreviewmiddleeast.com	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:55:27.496135950 CEST	192.168.2.5	1.1.1.1	0xa061	Standard query (0)	oilreviewmiddleeast.com	65	IN (0x0001)	false
Oct 26, 2024 00:56:17.522047043 CEST	192.168.2.5	1.1.1.1	0x2c8f	Standard query (0)	oilreviewmiddleeast.com	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:56:17.524612904 CEST	192.168.2.5	1.1.1.1	0xd82a	Standard query (0)	oilreviewmiddleeast.com	65	IN (0x0001)	false
Oct 26, 2024 00:56:17.525065899 CEST	192.168.2.5	1.1.1.1	0x93f1	Standard query (0)	oilreviewmiddleeast.com	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:56:17.525335073 CEST	192.168.2.5	1.1.1.1	0x307	Standard query (0)	oilreviewmiddleeast.com	65	IN (0x0001)	false
Oct 26, 2024 00:56:19.211232901 CEST	192.168.2.5	1.1.1.1	0x2871	Standard query (0)	cdn-eu.pagesense.io	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:56:19.211492062 CEST	192.168.2.5	1.1.1.1	0xd466	Standard query (0)	cdn-eu.pagesense.io	65	IN (0x0001)	false
Oct 26, 2024 00:56:20.460930109 CEST	192.168.2.5	1.1.1.1	0x57eb	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:56:20.461317062 CEST	192.168.2.5	1.1.1.1	0x46cd	Standard query (0)	api.ipify.org	65	IN (0x0001)	false
Oct 26, 2024 00:56:23.400648117 CEST	192.168.2.5	1.1.1.1	0x2b91	Standard query (0)	oilreviewmiddleeast.com	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:56:23.402348995 CEST	192.168.2.5	1.1.1.1	0x3149	Standard query (0)	oilreviewmiddleeast.com	65	IN (0x0001)	false
Oct 26, 2024 00:56:23.403806925 CEST	192.168.2.5	1.1.1.1	0xdfcb	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:56:23.404659033 CEST	192.168.2.5	1.1.1.1	0x3d6f	Standard query (0)	api.ipify.org	65	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 26, 2024 00:55:14.874181032 CEST	1.1.1.1	192.168.2.5	0x7efd	No error (0)	mail.oilreviewmiddleeast.com		149.106.168.53	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:55:16.089221954 CEST	1.1.1.1	192.168.2.5	0x2c23	No error (0)	oilreviewmiddleeast.com		52.222.236.129	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:55:16.089221954 CEST	1.1.1.1	192.168.2.5	0x2c23	No error (0)	oilreviewmiddleeast.com		52.222.236.37	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:55:16.089221954 CEST	1.1.1.1	192.168.2.5	0x2c23	No error (0)	oilreviewmiddleeast.com		52.222.236.123	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:55:16.089221954 CEST	1.1.1.1	192.168.2.5	0x2c23	No error (0)	oilreviewmiddleeast.com		52.222.236.78	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:55:17.969748974 CEST	1.1.1.1	192.168.2.5	0xc1c8	No error (0)	www.google.com		142.250.186.164	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:55:17.970485926 CEST	1.1.1.1	192.168.2.5	0x3937	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 26, 2024 00:55:18.009116888 CEST	1.1.1.1	192.168.2.5	0x82ae	No error (0)	unpkg.com			65	IN (0x0001)	false
Oct 26, 2024 00:55:18.009377956 CEST	1.1.1.1	192.168.2.5	0x109	No error (0)	unpkg.com		104.17.246.203	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:55:18.009377956 CEST	1.1.1.1	192.168.2.5	0x109	No error (0)	unpkg.com		104.17.247.203	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:55:18.009377956 CEST	1.1.1.1	192.168.2.5	0x109	No error (0)	unpkg.com		104.17.249.203	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:55:18.009377956 CEST	1.1.1.1	192.168.2.5	0x109	No error (0)	unpkg.com		104.17.245.203	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:55:18.009377956 CEST	1.1.1.1	192.168.2.5	0x109	No error (0)	unpkg.com		104.17.248.203	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:55:18.021343946 CEST	1.1.1.1	192.168.2.5	0xbd0	No error (0)	cdn-eu.pagesense.io	d1da88slxvkrhp.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 26, 2024 00:55:18.021857023 CEST	1.1.1.1	192.168.2.5	0x1c58	No error (0)	cdn-eu.pagesense.io	d1da88slxvkrhp.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 26, 2024 00:55:18.021857023 CEST	1.1.1.1	192.168.2.5	0x1c58	No error (0)	d1da88slxvkrhp.cloudfront.net		18.66.102.65	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:55:18.021857023 CEST	1.1.1.1	192.168.2.5	0x1c58	No error (0)	d1da88slxvkrhp.cloudfront.net		18.66.102.19	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:55:18.021857023 CEST	1.1.1.1	192.168.2.5	0x1c58	No error (0)	d1da88slxvkrhp.cloudfront.net		18.66.102.95	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:55:18.021857023 CEST	1.1.1.1	192.168.2.5	0x1c58	No error (0)	d1da88slxvkrhp.cloudfront.net		18.66.102.52	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:55:19.882342100 CEST	1.1.1.1	192.168.2.5	0xd90a	No error (0)	unpkg.com		104.17.248.203	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:55:19.882342100 CEST	1.1.1.1	192.168.2.5	0xd90a	No error (0)	unpkg.com		104.17.245.203	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:55:19.882342100 CEST	1.1.1.1	192.168.2.5	0xd90a	No error (0)	unpkg.com		104.17.249.203	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:55:19.882342100 CEST	1.1.1.1	192.168.2.5	0xd90a	No error (0)	unpkg.com		104.17.246.203	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:55:19.882342100 CEST	1.1.1.1	192.168.2.5	0xd90a	No error (0)	unpkg.com		104.17.247.203	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:55:19.885488987 CEST	1.1.1.1	192.168.2.5	0xc9b8	No error (0)	unpkg.com			65	IN (0x0001)	false
Oct 26, 2024 00:55:19.920782089 CEST	1.1.1.1	192.168.2.5	0x129d	No error (0)	oilreviewmiddleeast.com		52.222.236.129	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:55:19.920782089 CEST	1.1.1.1	192.168.2.5	0x129d	No error (0)	oilreviewmiddleeast.com		52.222.236.37	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:55:19.920782089 CEST	1.1.1.1	192.168.2.5	0x129d	No error (0)	oilreviewmiddleeast.com		52.222.236.78	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:55:19.920782089 CEST	1.1.1.1	192.168.2.5	0x129d	No error (0)	oilreviewmiddleeast.com		52.222.236.123	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:55:20.083121061 CEST	1.1.1.1	192.168.2.5	0x8beb	No error (0)	api.ipify.org		104.26.13.205	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:55:20.083121061 CEST	1.1.1.1	192.168.2.5	0x8beb	No error (0)	api.ipify.org		172.67.74.152	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:55:20.083121061 CEST	1.1.1.1	192.168.2.5	0x8beb	No error (0)	api.ipify.org		104.26.12.205	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:55:20.086230040 CEST	1.1.1.1	192.168.2.5	0x8335	No error (0)	api.ipify.org			65	IN (0x0001)	false
Oct 26, 2024 00:55:20.991889000 CEST	1.1.1.1	192.168.2.5	0x6ee2	No error (0)	api.ipify.org		172.67.74.152	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:55:20.991889000 CEST	1.1.1.1	192.168.2.5	0x6ee2	No error (0)	api.ipify.org		104.26.12.205	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:55:20.991889000 CEST	1.1.1.1	192.168.2.5	0x6ee2	No error (0)	api.ipify.org		104.26.13.205	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:55:20.993484974 CEST	1.1.1.1	192.168.2.5	0x59b4	No error (0)	api.ipify.org			65	IN (0x0001)	false
Oct 26, 2024 00:55:26.481297970 CEST	1.1.1.1	192.168.2.5	0xcec	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 26, 2024 00:55:26.481297970 CEST	1.1.1.1	192.168.2.5	0xcec	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:55:27.516654968 CEST	1.1.1.1	192.168.2.5	0xf1ca	No error (0)	oilreviewmiddleeast.com		52.222.236.37	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:55:27.516654968 CEST	1.1.1.1	192.168.2.5	0xf1ca	No error (0)	oilreviewmiddleeast.com		52.222.236.129	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:55:27.516654968 CEST	1.1.1.1	192.168.2.5	0xf1ca	No error (0)	oilreviewmiddleeast.com		52.222.236.123	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:55:27.516654968 CEST	1.1.1.1	192.168.2.5	0xf1ca	No error (0)	oilreviewmiddleeast.com		52.222.236.78	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:55:28.317404032 CEST	1.1.1.1	192.168.2.5	0x754e	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 26, 2024 00:55:28.317404032 CEST	1.1.1.1	192.168.2.5	0x754e	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:55:43.252000093 CEST	1.1.1.1	192.168.2.5	0xb944	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 26, 2024 00:55:43.252000093 CEST	1.1.1.1	192.168.2.5	0xb944	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:56:06.327114105 CEST	1.1.1.1	192.168.2.5	0xa96	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 26, 2024 00:56:06.327114105 CEST	1.1.1.1	192.168.2.5	0xa96	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:56:17.541484118 CEST	1.1.1.1	192.168.2.5	0x2c8f	No error (0)	oilreviewmiddleeast.com		52.222.236.123	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:56:17.541484118 CEST	1.1.1.1	192.168.2.5	0x2c8f	No error (0)	oilreviewmiddleeast.com		52.222.236.78	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:56:17.541484118 CEST	1.1.1.1	192.168.2.5	0x2c8f	No error (0)	oilreviewmiddleeast.com		52.222.236.129	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:56:17.541484118 CEST	1.1.1.1	192.168.2.5	0x2c8f	No error (0)	oilreviewmiddleeast.com		52.222.236.37	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:56:17.550400972 CEST	1.1.1.1	192.168.2.5	0x93f1	No error (0)	oilreviewmiddleeast.com		52.222.236.37	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:56:17.550400972 CEST	1.1.1.1	192.168.2.5	0x93f1	No error (0)	oilreviewmiddleeast.com		52.222.236.129	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:56:17.550400972 CEST	1.1.1.1	192.168.2.5	0x93f1	No error (0)	oilreviewmiddleeast.com		52.222.236.78	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:56:17.550400972 CEST	1.1.1.1	192.168.2.5	0x93f1	No error (0)	oilreviewmiddleeast.com		52.222.236.123	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:56:19.229779005 CEST	1.1.1.1	192.168.2.5	0x2871	No error (0)	cdn-eu.pagesense.io	d1da88slxvkrhp.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 26, 2024 00:56:19.229779005 CEST	1.1.1.1	192.168.2.5	0x2871	No error (0)	d1da88slxvkrhp.cloudfront.net		18.66.102.19	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:56:19.229779005 CEST	1.1.1.1	192.168.2.5	0x2871	No error (0)	d1da88slxvkrhp.cloudfront.net		18.66.102.65	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:56:19.229779005 CEST	1.1.1.1	192.168.2.5	0x2871	No error (0)	d1da88slxvkrhp.cloudfront.net		18.66.102.95	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:56:19.229779005 CEST	1.1.1.1	192.168.2.5	0x2871	No error (0)	d1da88slxvkrhp.cloudfront.net		18.66.102.52	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:56:19.230571985 CEST	1.1.1.1	192.168.2.5	0xd466	No error (0)	cdn-eu.pagesense.io	d1da88slxvkrhp.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 26, 2024 00:56:20.470818043 CEST	1.1.1.1	192.168.2.5	0x57eb	No error (0)	api.ipify.org		104.26.12.205	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:56:20.470818043 CEST	1.1.1.1	192.168.2.5	0x57eb	No error (0)	api.ipify.org		172.67.74.152	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:56:20.470818043 CEST	1.1.1.1	192.168.2.5	0x57eb	No error (0)	api.ipify.org		104.26.13.205	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:56:20.470850945 CEST	1.1.1.1	192.168.2.5	0x46cd	No error (0)	api.ipify.org			65	IN (0x0001)	false
Oct 26, 2024 00:56:23.413080931 CEST	1.1.1.1	192.168.2.5	0xdfcb	No error (0)	api.ipify.org		104.26.12.205	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:56:23.413080931 CEST	1.1.1.1	192.168.2.5	0xdfcb	No error (0)	api.ipify.org		104.26.13.205	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:56:23.413080931 CEST	1.1.1.1	192.168.2.5	0xdfcb	No error (0)	api.ipify.org		172.67.74.152	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:56:23.413398981 CEST	1.1.1.1	192.168.2.5	0x3d6f	No error (0)	api.ipify.org			65	IN (0x0001)	false
Oct 26, 2024 00:56:23.431788921 CEST	1.1.1.1	192.168.2.5	0x2b91	No error (0)	oilreviewmiddleeast.com		52.222.236.78	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:56:23.431788921 CEST	1.1.1.1	192.168.2.5	0x2b91	No error (0)	oilreviewmiddleeast.com		52.222.236.129	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:56:23.431788921 CEST	1.1.1.1	192.168.2.5	0x2b91	No error (0)	oilreviewmiddleeast.com		52.222.236.123	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:56:23.431788921 CEST	1.1.1.1	192.168.2.5	0x2b91	No error (0)	oilreviewmiddleeast.com		52.222.236.37	A (IP address)	IN (0x0001)	false
Oct 26, 2024 00:56:26.485136986 CEST	1.1.1.1	192.168.2.5	0xaa3a	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 26, 2024 00:56:26.485136986 CEST	1.1.1.1	192.168.2.5	0xaa3a	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
Oct 26, 2024 00:55:27.524986982 CEST	696	OUT	GET /magazines/orme_2024_07_31/desktop/?page=19 HTTP/1.1 Host: oilreviewmiddleeast.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _ga=GA1.2.1403005052.1729896920; _gid=GA1.2.1691096596.1729896920; _gat=1; AWSALB=wZ6grmVvm2TVBypsDIVx8T0P8icpPlBtf8jx02+/lczP+IPPiyE+3lAgEO0FXULw4kRaOVjFjfCXymzrmkM/TDBpD12rYGKv5lsrHnrxmecfam8xrn8GLVf3Feff
Oct 26, 2024 00:55:28.361289024 CEST	659	IN	HTTP/1.1 301 Moved Permanently Server: CloudFront Date: Fri, 25 Oct 2024 22:55:28 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Location: https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/desktop/?page=19 X-Cache: Redirect from cloudfront Via: 1.1 5519a8cb450b567e8b7111ae986a9b4c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P4 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: vmdjqV87ONS2sPoLjSjwu7mZofAyZVS_Zw8uBZiCxHk-9b13Tw1RiA== Vary: Origin Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 43 6c 6f 75 64 46 72 6f 6e 74 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>CloudFront</center></body></html>
Oct 26, 2024 00:56:13.367455006 CEST	6	OUT	Data Raw: 00 Data Ascii:

Timestamp	Bytes transferred	Direction	Data
2024-10-25 22:55:15 UTC	705	OUT	GET /link.php?M=532162&N=675&L=518&F=H/ HTTP/1.1 Host: mail.oilreviewmiddleeast.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-25 22:55:16 UTC	283	IN	HTTP/1.1 302 Found Date: Fri, 25 Oct 2024 22:55:15 GMT Server: Apache/2.4.41 (Ubuntu) X-Frame-Options: SAMEORIGIN Location: https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/spread/?page=19 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://mail.oilreviewmiddleeast.com/link.php?M=532162&N=675&L=518&F=H/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 131

Chrome Cache Entry: 132

Chrome Cache Entry: 133

Chrome Cache Entry: 134

Chrome Cache Entry: 135

Chrome Cache Entry: 136

Chrome Cache Entry: 137

Chrome Cache Entry: 138

Chrome Cache Entry: 139

Chrome Cache Entry: 140

Chrome Cache Entry: 141

Chrome Cache Entry: 142

Chrome Cache Entry: 143

Chrome Cache Entry: 144

Chrome Cache Entry: 145

Chrome Cache Entry: 146

Chrome Cache Entry: 147

Chrome Cache Entry: 148

Chrome Cache Entry: 149

Chrome Cache Entry: 150

Chrome Cache Entry: 151

Windows Analysis Report
https://mail.oilreviewmiddleeast.com/link.php?M=532162&N=675&L=518&F=H/

Timestamp	Bytes transferred	Direction	Data
2024-10-25 22:55:17 UTC	707	OUT	GET /magazines/orme_2024_07_31/spread/?page=19 HTTP/1.1 Host: oilreviewmiddleeast.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-25 22:55:17 UTC	880	IN	HTTP/1.1 200 OK Content-Type: text/html Transfer-Encoding: chunked Connection: close Date: Fri, 25 Oct 2024 22:55:17 GMT Vary: Accept-Encoding Content-Encoding: gzip Set-Cookie: AWSALB=6fTD3Z4yTk+RCTZNbQT0s2Qhiv3jSNvgCOn/yqIpymUN5AeD7sRXhkLtIItSsNOWOPcTd8RsMYChOXTELRLvLLcQ9Pz5DTmSUrA7RKeJr5Oq7USOilBzxmvEzebC; Expires=Fri, 01 Nov 2024 22:55:17 GMT; Path=/ Set-Cookie: AWSALBCORS=6fTD3Z4yTk+RCTZNbQT0s2Qhiv3jSNvgCOn/yqIpymUN5AeD7sRXhkLtIItSsNOWOPcTd8RsMYChOXTELRLvLLcQ9Pz5DTmSUrA7RKeJr5Oq7USOilBzxmvEzebC; Expires=Fri, 01 Nov 2024 22:55:17 GMT; Path=/; SameSite=None; Secure Server: nginx/1.18.0 (Ubuntu) Accept-Ranges: bytes X-Cache: Miss from cloudfront Via: 1.1 f9c16664a13e70e73a4e280c7a0f2266.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P4 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: t-C78fsEhtc3d2kyvnrsB0qSCOM6qzhZA1C7zhwQYB3x8-VI6UPhRA== Vary: Origin
2024-10-25 22:55:17 UTC	13940	IN	Data Raw: 33 36 36 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 7d fb 7f db 36 92 f8 ef fd 2b 18 f6 76 4d 25 7a fa 91 87 1c 27 eb 3a 4e e3 fb 38 8f 6f ec ec b6 eb fa db a3 24 48 62 42 91 5a 92 b2 e3 34 fe df 6f 1e 00 08 92 a0 24 c7 e9 5d b3 d7 6c 37 11 c1 01 30 18 0c e6 85 01 f8 f8 ce b3 d7 07 a7 3f bf 39 74 a6 d9 2c 7c f2 dd 63 fc c7 49 b3 ab 50 ec b9 97 c1 28 9b f6 9d 5e b7 fb 97 5d 67 2a 82 c9 34 93 4f ee 93 ef be 73 e0 cf e3 a9 f0 47 4f e8 27 3d de 69 b5 9c 8b cd 76 af dd 75 5a 2d a3 7c 26 32 df 89 fc 19 34 7a 11 88 cb 79 9c 64 ae 33 8c a3 4c 44 99 ec 67 6f 24 2e 82 a1 68 d1 43 d3 09 a2 20 0b fc b0 95 0e 7d 40 a5 e7 96 1b 1b 4e fd 24 15 50 79 91 8d 5b 0f 5d a7 63 00 64 41 16 8a 27 8f 3b fc 6f 5e 4e c3 72 b2 ab 39 a0 91 89 8f 59 67 98 a6 46 c3 9d bb ce b1 7f 15 2f Data Ascii: 366c}6+vM%z':N8o$HbBZ4o$]l70?9t,\|cIP(^]g*4OsGO'=ivuZ-\|&24zyd3LDgo$.hC }@N$Py[]cdA';o^Nr9YgF/
2024-10-25 22:55:17 UTC	188	IN	Data Raw: 62 36 0d 0a f8 e5 05 23 92 54 01 91 28 b8 39 32 b5 a0 8c be ab c6 51 0f 98 c7 7e e4 af 7a d0 00 9d 90 60 5e 0f 80 54 70 99 80 1a 08 38 d7 22 13 f4 72 96 96 43 bb dd 81 ff 52 ff 42 fc 4a fa 7b 3e c5 be 72 35 3f 13 d9 34 1e f5 1d f7 cd eb 93 53 37 67 28 bc ec a3 af 11 51 e5 d7 5f c9 cc 30 11 77 69 36 53 72 bb 17 c3 21 b0 d9 18 ec 83 2b e4 35 82 bf 31 e3 22 03 22 df 62 ed 2a c7 22 7d ea 0d c2 95 fb 5a 79 c8 3e bf df 77 e9 37 93 8d 35 58 a8 4b b7 fa e6 25 c5 3b ca eb 2a 2d e6 8a cf 8b 3b 73 8f 3b 38 5f 30 9c c7 9d 69 36 0b 9f fc 37 a7 1c 9a c1 c7 f5 00 00 0d 0a Data Ascii: b6#T(92Q~z`^Tp8"rCRBJ{>r5?4S7g(Q_0wi6Sr!+51""b"}Zy>w75XK%;-;s;8_0i67
2024-10-25 22:55:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2024-10-25 22:55:18 UTC	598	OUT	GET /ionicons@7.1.0/dist/ionicons/ionicons.esm.js HTTP/1.1 Host: unpkg.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://oilreviewmiddleeast.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://oilreviewmiddleeast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-25 22:55:18 UTC	574	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 22:55:18 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close access-control-allow-origin: * cache-control: public, max-age=31536000 last-modified: Sat, 26 Oct 1985 08:15:00 GMT etag: W/"154-Yvf53JjVJOVZ9ojnyzM7GNGGCvg" via: 1.1 fly.io fly-request-id: 01JAYYKDZ531ZGHKS9003119KH-dfw CF-Cache-Status: HIT Age: 133854 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 8d85cb1e1bfd2e64-DFW
2024-10-25 22:55:18 UTC	347	IN	Data Raw: 31 35 34 0d 0a 69 6d 70 6f 72 74 7b 70 20 61 73 20 69 2c 62 20 61 73 20 6f 7d 66 72 6f 6d 22 2e 2f 70 2d 64 31 35 65 63 33 30 37 2e 6a 73 22 3b 28 28 29 3d 3e 7b 63 6f 6e 73 74 20 6f 3d 69 6d 70 6f 72 74 2e 6d 65 74 61 2e 75 72 6c 2c 73 3d 7b 7d 3b 72 65 74 75 72 6e 22 22 21 3d 3d 6f 26 26 28 73 2e 72 65 73 6f 75 72 63 65 73 55 72 6c 3d 6e 65 77 20 55 52 4c 28 22 2e 22 2c 6f 29 2e 68 72 65 66 29 2c 69 28 73 29 7d 29 28 29 2e 74 68 65 6e 28 28 69 3d 3e 6f 28 5b 5b 22 70 2d 31 63 30 62 32 63 34 37 22 2c 5b 5b 31 2c 22 69 6f 6e 2d 69 63 6f 6e 22 2c 7b 6d 6f 64 65 3a 5b 31 30 32 35 5d 2c 63 6f 6c 6f 72 3a 5b 31 5d 2c 69 6f 73 3a 5b 31 5d 2c 6d 64 3a 5b 31 5d 2c 66 6c 69 70 52 74 6c 3a 5b 34 2c 22 66 6c 69 70 2d 72 74 6c 22 5d 2c 6e 61 6d 65 3a 5b 35 31 33 5d Data Ascii: 154import{p as i,b as o}from"./p-d15ec307.js";(()=>{const o=import.meta.url,s={};return""!==o&&(s.resourcesUrl=new URL(".",o).href),i(s)})().then((i=>o([["p-1c0b2c47",[[1,"ion-icon",{mode:[1025],color:[1],ios:[1],md:[1],flipRtl:[4,"flip-rtl"],name:[513]
2024-10-25 22:55:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2024-10-25 22:55:18 UTC	892	OUT	GET /magazines/orme_2024_07_31/spread/config.js HTTP/1.1 Host: oilreviewmiddleeast.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/spread/?page=19 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AWSALB=6fTD3Z4yTk+RCTZNbQT0s2Qhiv3jSNvgCOn/yqIpymUN5AeD7sRXhkLtIItSsNOWOPcTd8RsMYChOXTELRLvLLcQ9Pz5DTmSUrA7RKeJr5Oq7USOilBzxmvEzebC; AWSALBCORS=6fTD3Z4yTk+RCTZNbQT0s2Qhiv3jSNvgCOn/yqIpymUN5AeD7sRXhkLtIItSsNOWOPcTd8RsMYChOXTELRLvLLcQ9Pz5DTmSUrA7RKeJr5Oq7USOilBzxmvEzebC
2024-10-25 22:55:19 UTC	1088	IN	HTTP/1.1 200 OK Content-Type: text/javascript Content-Length: 981 Connection: close Date: Fri, 25 Oct 2024 22:40:35 GMT Set-Cookie: AWSALB=Z3ZynZnqfF67xSsmVq98UWHfR9W+OX/9dFN5+Su17TMWFHxrrGz3QBcwwGtBql4Lk1qTScasFyqymRSSc7je6wQFpvqr2WYna5ON8+rxMOBeEbFVBw5OiSLCrJWp; Expires=Fri, 01 Nov 2024 22:40:35 GMT; Path=/ Set-Cookie: AWSALBCORS=Z3ZynZnqfF67xSsmVq98UWHfR9W+OX/9dFN5+Su17TMWFHxrrGz3QBcwwGtBql4Lk1qTScasFyqymRSSc7je6wQFpvqr2WYna5ON8+rxMOBeEbFVBw5OiSLCrJWp; Expires=Fri, 01 Nov 2024 22:40:35 GMT; Path=/; SameSite=None; Secure Server: nginx/1.18.0 (Ubuntu) Last-Modified: Wed, 31 Jul 2024 17:23:34 GMT ETag: "3d5-61e8e5a927180" Accept-Ranges: bytes Vary: Accept-Encoding,Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 2c29bb35ddacc1dc2616fe65bdf5122e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P4 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: 0jutrJhxsgbI9X78aXaujnWYFnnnRYnSNnhJJxH1qFFQbqyJKn9zNw== Age: 883 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin
2024-10-25 22:55:19 UTC	981	IN	Data Raw: 49 44 52 56 69 65 77 65 72 2e 63 6f 6e 66 69 67 20 3d 20 7b 22 70 61 67 65 63 6f 75 6e 74 22 3a 33 36 2c 22 74 69 74 6c 65 22 3a 22 4f 52 4d 45 20 35 20 32 30 32 34 20 46 69 6e 61 6c 2e 70 64 66 22 2c 22 61 75 74 68 6f 72 22 3a 22 72 61 68 75 6c 2e 70 75 74 68 65 6e 76 65 65 64 75 22 2c 22 73 75 62 6a 65 63 74 22 3a 22 22 2c 22 6b 65 79 77 6f 72 64 73 22 3a 22 22 2c 22 63 72 65 61 74 6f 72 22 3a 22 50 53 63 72 69 70 74 35 2e 64 6c 6c 20 56 65 72 73 69 6f 6e 20 35 2e 32 2e 32 22 2c 22 70 72 6f 64 75 63 65 72 22 3a 22 41 63 72 6f 62 61 74 20 44 69 73 74 69 6c 6c 65 72 20 32 34 2e 30 20 28 57 69 6e 64 6f 77 73 29 22 2c 22 63 72 65 61 74 69 6f 6e 64 61 74 65 22 3a 22 44 3a 32 30 32 34 30 37 33 31 31 33 34 37 31 34 2b 30 31 27 30 30 27 22 2c 22 6d 6f 64 64 61 Data Ascii: IDRViewer.config = {"pagecount":36,"title":"ORME 5 2024 Final.pdf","author":"rahul.puthenveedu","subject":"","keywords":"","creator":"PScript5.dll Version 5.2.2","producer":"Acrobat Distiller 24.0 (Windows)","creationdate":"D:20240731134714+01'00'","modda

Timestamp	Bytes transferred	Direction	Data
2024-10-25 22:55:18 UTC	577	OUT	GET /js/alaincharles/2ec214dae0b1407d93446c488847ff27.js HTTP/1.1 Host: cdn-eu.pagesense.io Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://oilreviewmiddleeast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-25 22:55:19 UTC	357	IN	HTTP/1.1 403 Forbidden Content-Type: application/xml Transfer-Encoding: chunked Connection: close Server: AmazonS3 Date: Fri, 25 Oct 2024 22:55:18 GMT X-Cache: Error from cloudfront Via: 1.1 3f52d342c56014599dee37446f6c9f2e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P2 X-Amz-Cf-Id: uHI16EWGXN5QwTWMG8re_S3LQedBitzRojX-Vi5rNakJSSLIUkUXIQ==
2024-10-25 22:55:19 UTC	261	IN	Data Raw: 66 66 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 45 72 72 6f 72 3e 3c 43 6f 64 65 3e 41 63 63 65 73 73 44 65 6e 69 65 64 3c 2f 43 6f 64 65 3e 3c 4d 65 73 73 61 67 65 3e 41 63 63 65 73 73 20 44 65 6e 69 65 64 3c 2f 4d 65 73 73 61 67 65 3e 3c 52 65 71 75 65 73 74 49 64 3e 53 4d 4a 56 37 50 32 46 56 4e 31 51 42 4e 36 43 3c 2f 52 65 71 75 65 73 74 49 64 3e 3c 48 6f 73 74 49 64 3e 4e 45 2b 38 51 41 53 4d 75 31 63 4d 48 69 53 57 71 32 66 36 61 45 4e 43 45 74 45 6a 76 33 58 77 6f 4a 4d 4c 51 38 2b 30 52 38 4e 51 75 43 38 7a 50 66 42 42 79 58 56 64 6f 58 56 6a 4a 48 6d 51 5a 52 79 32 47 39 7a 44 79 35 41 53 33 53 6f 59 69 77 73 61 4c 77 3d 3d 3c 2f 48 6f 73 74 49 64 3e 3c 2f 45 72 Data Ascii: ff<?xml version="1.0" encoding="UTF-8"?><Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>SMJV7P2FVN1QBN6C</RequestId><HostId>NE+8QASMu1cMHiSWq2f6aENCEtEjv3XwoJMLQ8+0R8NQuC8zPfBByXVdoXVjJHmQZRy2G9zDy5AS3SoYiwsaLw==</HostId></Er
2024-10-25 22:55:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2024-10-25 22:55:19 UTC	626	OUT	GET /ionicons@7.1.0/dist/ionicons/p-d15ec307.js HTTP/1.1 Host: unpkg.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://oilreviewmiddleeast.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://unpkg.com/ionicons@7.1.0/dist/ionicons/ionicons.esm.js Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-25 22:55:19 UTC	575	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 22:55:19 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close access-control-allow-origin: * cache-control: public, max-age=31536000 last-modified: Sat, 26 Oct 1985 08:15:00 GMT etag: W/"21d1-dJ29Zq7KcbnJnZUTvF7HPfVtDCE" via: 1.1 fly.io fly-request-id: 01JAWA090H7FY9H2JCXW50EJBQ-dfw CF-Cache-Status: HIT Age: 222554 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 8d85cb244b642860-DFW
2024-10-25 22:55:19 UTC	794	IN	Data Raw: 32 31 64 31 0d 0a 6c 65 74 20 65 2c 74 2c 6e 3d 21 31 3b 63 6f 6e 73 74 20 6c 3d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 3f 77 69 6e 64 6f 77 3a 7b 7d 2c 73 3d 6c 2e 64 6f 63 75 6d 65 6e 74 7c 7c 7b 68 65 61 64 3a 7b 7d 7d 2c 6f 3d 7b 74 3a 30 2c 6c 3a 22 22 2c 6a 6d 70 3a 65 3d 3e 65 28 29 2c 72 61 66 3a 65 3d 3e 72 65 71 75 65 73 74 41 6e 69 6d 61 74 69 6f 6e 46 72 61 6d 65 28 65 29 2c 61 65 6c 3a 28 65 2c 74 2c 6e 2c 6c 29 3d 3e 65 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 74 2c 6e 2c 6c 29 2c 72 65 6c 3a 28 65 2c 74 2c 6e 2c 6c 29 3d 3e 65 2e 72 65 6d 6f 76 65 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 74 2c 6e 2c 6c 29 2c 63 65 3a 28 65 2c 74 29 3d 3e 6e 65 77 20 43 75 73 74 6f 6d 45 76 65 6e 74 28 65 Data Ascii: 21d1let e,t,n=!1;const l="undefined"!=typeof window?window:{},s=l.document\|\|{head:{}},o={t:0,l:"",jmp:e=>e(),raf:e=>requestAnimationFrame(e),ael:(e,t,n,l)=>e.addEventListener(t,n,l),rel:(e,t,n,l)=>e.removeEventListener(t,n,l),ce:(e,t)=>new CustomEvent(e
2024-10-25 22:55:19 UTC	1369	IN	Data Raw: 7c 74 2e 63 6c 61 73 73 3b 65 26 26 28 74 2e 63 6c 61 73 73 3d 22 6f 62 6a 65 63 74 22 21 3d 74 79 70 65 6f 66 20 65 3f 65 3a 4f 62 6a 65 63 74 2e 6b 65 79 73 28 65 29 2e 66 69 6c 74 65 72 28 28 74 3d 3e 65 5b 74 5d 29 29 2e 6a 6f 69 6e 28 22 20 22 29 29 7d 7d 63 6f 6e 73 74 20 75 3d 68 28 65 2c 6e 75 6c 6c 29 3b 72 65 74 75 72 6e 20 75 2e 75 3d 74 2c 63 2e 6c 65 6e 67 74 68 3e 30 26 26 28 75 2e 24 3d 63 29 2c 75 2e 68 3d 73 2c 75 7d 2c 68 3d 28 65 2c 74 29 3d 3e 28 7b 74 3a 30 2c 70 3a 65 2c 69 3a 74 2c 6d 3a 6e 75 6c 6c 2c 24 3a 6e 75 6c 6c 2c 75 3a 6e 75 6c 6c 2c 68 3a 6e 75 6c 6c 7d 29 2c 64 3d 7b 7d 2c 70 3d 28 65 2c 74 2c 6e 2c 73 2c 69 2c 63 29 3d 3e 7b 69 66 28 6e 21 3d 3d 73 29 7b 6c 65 74 20 75 3d 44 28 65 2c 74 29 2c 61 3d 74 2e 74 6f 4c 6f 77 Data Ascii: \|t.class;e&&(t.class="object"!=typeof e?e:Object.keys(e).filter((t=>e[t])).join(" "))}}const u=h(e,null);return u.u=t,c.length>0&&(u.$=c),u.h=s,u},h=(e,t)=>({t:0,p:e,i:t,m:null,$:null,u:null,h:null}),d={},p=(e,t,n,s,i,c)=>{if(n!==s){let u=D(e,t),a=t.toLow
2024-10-25 22:55:19 UTC	1369	IN	Data Raw: 7d 2c 67 3d 28 74 2c 6e 2c 6c 29 3d 3e 7b 63 6f 6e 73 74 20 6f 3d 6e 2e 24 5b 6c 5d 3b 6c 65 74 20 69 2c 63 2c 72 3d 30 3b 69 66 28 6e 75 6c 6c 21 3d 3d 6f 2e 69 29 69 3d 6f 2e 6d 3d 73 2e 63 72 65 61 74 65 54 65 78 74 4e 6f 64 65 28 6f 2e 69 29 3b 65 6c 73 65 20 69 66 28 69 3d 6f 2e 6d 3d 73 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 6f 2e 70 29 2c 62 28 6e 75 6c 6c 2c 6f 2c 21 31 29 2c 6e 75 6c 6c 21 3d 65 26 26 69 5b 22 73 2d 73 69 22 5d 21 3d 3d 65 26 26 69 2e 63 6c 61 73 73 4c 69 73 74 2e 61 64 64 28 69 5b 22 73 2d 73 69 22 5d 3d 65 29 2c 6f 2e 24 29 66 6f 72 28 72 3d 30 3b 72 3c 6f 2e 24 2e 6c 65 6e 67 74 68 3b 2b 2b 72 29 63 3d 67 28 74 2c 6f 2c 72 29 2c 63 26 26 69 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 63 29 3b 72 65 74 75 72 6e 20 69 7d 2c 6b Data Ascii: },g=(t,n,l)=>{const o=n.$[l];let i,c,r=0;if(null!==o.i)i=o.m=s.createTextNode(o.i);else if(i=o.m=s.createElement(o.p),b(null,o,!1),null!=e&&i["s-si"]!==e&&i.classList.add(i["s-si"]=e),o.$)for(r=0;r<o.$.length;++r)c=g(t,o,r),c&&i.appendChild(c);return i},k
2024-10-25 22:55:19 UTC	1369	IN	Data Raw: 30 2c 6c 2e 6c 65 6e 67 74 68 2d 31 29 29 3a 65 2e 69 21 3d 3d 6f 26 26 28 6e 2e 64 61 74 61 3d 6f 29 7d 2c 43 3d 65 3d 3e 7b 65 2e 75 26 26 65 2e 75 2e 72 65 66 26 26 65 2e 75 2e 72 65 66 28 6e 75 6c 6c 29 2c 65 2e 24 26 26 65 2e 24 2e 6d 61 70 28 43 29 7d 2c 4d 3d 65 3d 3e 5f 28 65 29 2e 67 2c 4f 3d 28 65 2c 74 29 3d 3e 7b 74 26 26 21 65 2e 6b 26 26 74 5b 22 73 2d 70 22 5d 26 26 74 5b 22 73 2d 70 22 5d 2e 70 75 73 68 28 6e 65 77 20 50 72 6f 6d 69 73 65 28 28 74 3d 3e 65 2e 6b 3d 74 29 29 29 7d 2c 78 3d 28 65 2c 74 29 3d 3e 7b 69 66 28 65 2e 74 7c 3d 31 36 2c 21 28 34 26 65 2e 74 29 29 72 65 74 75 72 6e 20 4f 28 65 2c 65 2e 53 29 2c 6e 65 28 28 28 29 3d 3e 4c 28 65 2c 74 29 29 29 3b 65 2e 74 7c 3d 35 31 32 7d 2c 4c 3d 28 65 2c 74 29 3d 3e 7b 63 6f 6e 73 Data Ascii: 0,l.length-1)):e.i!==o&&(n.data=o)},C=e=>{e.u&&e.u.ref&&e.u.ref(null),e.$&&e.$.map(C)},M=e=>_(e).g,O=(e,t)=>{t&&!e.k&&t["s-p"]&&t["s-p"].push(new Promise((t=>e.k=t)))},x=(e,t)=>{if(e.t\|=16,!(4&e.t))return O(e,e.S),ne((()=>L(e,t)));e.t\|=512},L=(e,t)=>{cons
2024-10-25 22:55:19 UTC	1369	IN	Data Raw: 28 28 29 3d 3e 78 28 65 2c 21 31 29 29 29 2c 65 2e 74 26 3d 2d 35 31 37 7d 2c 52 3d 28 29 3d 3e 7b 57 28 73 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 29 2c 74 65 28 28 28 29 3d 3e 28 65 3d 3e 7b 63 6f 6e 73 74 20 74 3d 6f 2e 63 65 28 22 61 70 70 6c 6f 61 64 22 2c 7b 64 65 74 61 69 6c 3a 7b 6e 61 6d 65 73 70 61 63 65 3a 22 69 6f 6e 69 63 6f 6e 73 22 7d 7d 29 3b 72 65 74 75 72 6e 20 65 2e 64 69 73 70 61 74 63 68 45 76 65 6e 74 28 74 29 2c 74 7d 29 28 6c 29 29 29 7d 2c 54 3d 28 65 2c 74 2c 6e 29 3d 3e 7b 69 66 28 65 26 26 65 5b 74 5d 29 74 72 79 7b 72 65 74 75 72 6e 20 65 5b 74 5d 28 6e 29 7d 63 61 74 63 68 28 65 29 7b 47 28 65 29 7d 7d 2c 55 3d 28 65 2c 74 29 3d 3e 65 26 26 65 2e 74 68 65 6e 3f 65 2e 74 68 65 6e 28 74 29 3a 74 28 29 2c 57 3d 65 3d 3e Data Ascii: (()=>x(e,!1))),e.t&=-517},R=()=>{W(s.documentElement),te((()=>(e=>{const t=o.ce("appload",{detail:{namespace:"ionicons"}});return e.dispatchEvent(t),t})(l)))},T=(e,t,n)=>{if(e&&e[t])try{return e[t](n)}catch(e){G(e)}},U=(e,t)=>e&&e.then?e.then(t):t(),W=e=>
2024-10-25 22:55:19 UTC	1369	IN	Data Raw: 74 73 2c 75 3d 73 2e 68 65 61 64 2c 66 3d 75 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 22 6d 65 74 61 5b 63 68 61 72 73 65 74 5d 22 29 2c 79 3d 73 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 74 79 6c 65 22 29 2c 24 3d 5b 5d 3b 6c 65 74 20 68 2c 64 3d 21 30 3b 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 28 6f 2c 74 29 2c 6f 2e 6c 3d 6e 65 77 20 55 52 4c 28 74 2e 72 65 73 6f 75 72 63 65 73 55 72 6c 7c 7c 22 2e 2f 22 2c 73 2e 62 61 73 65 55 52 49 29 2e 68 72 65 66 2c 65 2e 6d 61 70 28 28 65 3d 3e 7b 65 5b 31 5d 2e 6d 61 70 28 28 74 3d 3e 7b 63 6f 6e 73 74 20 6c 3d 7b 74 3a 74 5b 30 5d 2c 6f 3a 74 5b 31 5d 2c 4c 3a 74 5b 32 5d 2c 52 3a 74 5b 33 5d 7d 3b 6c 2e 4c 3d 74 5b 32 5d 2c 6c 2e 4d 3d 5b 5d 2c 6c 2e 50 3d 7b 7d 3b 63 6f 6e 73 74 20 73 3d 6c 2e 6f Data Ascii: ts,u=s.head,f=u.querySelector("meta[charset]"),y=s.createElement("style"),$=[];let h,d=!0;Object.assign(o,t),o.l=new URL(t.resourcesUrl\|\|"./",s.baseURI).href,e.map((e=>{e[1].map((t=>{const l={t:t[0],o:t[1],L:t[2],R:t[3]};l.L=t[2],l.M=[],l.P={};const s=l.o
2024-10-25 22:55:19 UTC	1026	IN	Data Raw: 29 2c 72 2e 64 65 66 69 6e 65 28 73 2c 41 28 75 2c 6c 2c 31 29 29 29 7d 29 29 7d 29 29 2c 79 2e 69 6e 6e 65 72 48 54 4d 4c 3d 6e 2b 22 7b 76 69 73 69 62 69 6c 69 74 79 3a 68 69 64 64 65 6e 7d 2e 68 79 64 72 61 74 65 64 7b 76 69 73 69 62 69 6c 69 74 79 3a 69 6e 68 65 72 69 74 7d 22 2c 79 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 73 74 79 6c 65 73 22 2c 22 22 29 2c 75 2e 69 6e 73 65 72 74 42 65 66 6f 72 65 28 79 2c 66 3f 66 2e 6e 65 78 74 53 69 62 6c 69 6e 67 3a 75 2e 66 69 72 73 74 43 68 69 6c 64 29 2c 64 3d 21 31 2c 24 2e 6c 65 6e 67 74 68 3f 24 2e 6d 61 70 28 28 65 3d 3e 65 2e 63 6f 6e 6e 65 63 74 65 64 43 61 6c 6c 62 61 63 6b 28 29 29 29 3a 6f 2e 6a 6d 70 28 28 28 29 3d 3e 68 3d 73 65 74 54 69 6d 65 6f 75 74 28 52 2c 33 30 29 29 29 7d Data Ascii: ),r.define(s,A(u,l,1)))}))})),y.innerHTML=n+"{visibility:hidden}.hydrated{visibility:inherit}",y.setAttribute("data-styles",""),u.insertBefore(y,f?f.nextSibling:u.firstChild),d=!1,$.length?$.map((e=>e.connectedCallback())):o.jmp((()=>h=setTimeout(R,30)))}
2024-10-25 22:55:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2024-10-25 22:55:19 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-25 22:55:19 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF70) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=150583 Date: Fri, 25 Oct 2024 22:55:19 GMT Connection: close X-CID: 2

Timestamp	Bytes transferred	Direction	Data
2024-10-25 22:55:20 UTC	377	OUT	GET /ionicons@7.1.0/dist/ionicons/ionicons.esm.js HTTP/1.1 Host: unpkg.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-25 22:55:20 UTC	574	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 22:55:20 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close access-control-allow-origin: * cache-control: public, max-age=31536000 last-modified: Sat, 26 Oct 1985 08:15:00 GMT etag: W/"154-Yvf53JjVJOVZ9ojnyzM7GNGGCvg" via: 1.1 fly.io fly-request-id: 01JAYYKDZ531ZGHKS9003119KH-dfw CF-Cache-Status: HIT Age: 133856 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 8d85cb29c8412caa-DFW
2024-10-25 22:55:20 UTC	347	IN	Data Raw: 31 35 34 0d 0a 69 6d 70 6f 72 74 7b 70 20 61 73 20 69 2c 62 20 61 73 20 6f 7d 66 72 6f 6d 22 2e 2f 70 2d 64 31 35 65 63 33 30 37 2e 6a 73 22 3b 28 28 29 3d 3e 7b 63 6f 6e 73 74 20 6f 3d 69 6d 70 6f 72 74 2e 6d 65 74 61 2e 75 72 6c 2c 73 3d 7b 7d 3b 72 65 74 75 72 6e 22 22 21 3d 3d 6f 26 26 28 73 2e 72 65 73 6f 75 72 63 65 73 55 72 6c 3d 6e 65 77 20 55 52 4c 28 22 2e 22 2c 6f 29 2e 68 72 65 66 29 2c 69 28 73 29 7d 29 28 29 2e 74 68 65 6e 28 28 69 3d 3e 6f 28 5b 5b 22 70 2d 31 63 30 62 32 63 34 37 22 2c 5b 5b 31 2c 22 69 6f 6e 2d 69 63 6f 6e 22 2c 7b 6d 6f 64 65 3a 5b 31 30 32 35 5d 2c 63 6f 6c 6f 72 3a 5b 31 5d 2c 69 6f 73 3a 5b 31 5d 2c 6d 64 3a 5b 31 5d 2c 66 6c 69 70 52 74 6c 3a 5b 34 2c 22 66 6c 69 70 2d 72 74 6c 22 5d 2c 6e 61 6d 65 3a 5b 35 31 33 5d Data Ascii: 154import{p as i,b as o}from"./p-d15ec307.js";(()=>{const o=import.meta.url,s={};return""!==o&&(s.resourcesUrl=new URL(".",o).href),i(s)})().then((i=>o([["p-1c0b2c47",[[1,"ion-icon",{mode:[1025],color:[1],ios:[1],md:[1],flipRtl:[4,"flip-rtl"],name:[513]
2024-10-25 22:55:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2024-10-25 22:55:20 UTC	569	OUT	GET /?format=json HTTP/1.1 Host: api.ipify.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://oilreviewmiddleeast.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://oilreviewmiddleeast.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-25 22:55:20 UTC	249	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 22:55:20 GMT Content-Type: application/json Content-Length: 23 Connection: close Access-Control-Allow-Origin: * Vary: Origin cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 8d85cb2b087d2e4e-DFW
2024-10-25 22:55:20 UTC	23	IN	Data Raw: 7b 22 69 70 22 3a 22 31 37 33 2e 32 35 34 2e 32 35 30 2e 38 31 22 7d Data Ascii: {"ip":"173.254.250.81"}

Timestamp	Bytes transferred	Direction	Data
2024-10-25 22:55:20 UTC	667	OUT	GET /magazines/orme_2024_07_31/spread/config.js HTTP/1.1 Host: oilreviewmiddleeast.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AWSALB=Z3ZynZnqfF67xSsmVq98UWHfR9W+OX/9dFN5+Su17TMWFHxrrGz3QBcwwGtBql4Lk1qTScasFyqymRSSc7je6wQFpvqr2WYna5ON8+rxMOBeEbFVBw5OiSLCrJWp; AWSALBCORS=Z3ZynZnqfF67xSsmVq98UWHfR9W+OX/9dFN5+Su17TMWFHxrrGz3QBcwwGtBql4Lk1qTScasFyqymRSSc7je6wQFpvqr2WYna5ON8+rxMOBeEbFVBw5OiSLCrJWp
2024-10-25 22:55:21 UTC	1088	IN	HTTP/1.1 200 OK Content-Type: text/javascript Content-Length: 981 Connection: close Date: Fri, 25 Oct 2024 22:40:35 GMT Set-Cookie: AWSALB=Z3ZynZnqfF67xSsmVq98UWHfR9W+OX/9dFN5+Su17TMWFHxrrGz3QBcwwGtBql4Lk1qTScasFyqymRSSc7je6wQFpvqr2WYna5ON8+rxMOBeEbFVBw5OiSLCrJWp; Expires=Fri, 01 Nov 2024 22:40:35 GMT; Path=/ Set-Cookie: AWSALBCORS=Z3ZynZnqfF67xSsmVq98UWHfR9W+OX/9dFN5+Su17TMWFHxrrGz3QBcwwGtBql4Lk1qTScasFyqymRSSc7je6wQFpvqr2WYna5ON8+rxMOBeEbFVBw5OiSLCrJWp; Expires=Fri, 01 Nov 2024 22:40:35 GMT; Path=/; SameSite=None; Secure Server: nginx/1.18.0 (Ubuntu) Last-Modified: Wed, 31 Jul 2024 17:23:34 GMT ETag: "3d5-61e8e5a927180" Accept-Ranges: bytes Vary: Accept-Encoding,Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 803246727539350977d724c9e4a027c6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P4 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: jIdkK79fylld-maRXN1nVyngjgpoUJ4wEq4Kz2x-BH9iMmT43TYmTg== Age: 885 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin
2024-10-25 22:55:21 UTC	981	IN	Data Raw: 49 44 52 56 69 65 77 65 72 2e 63 6f 6e 66 69 67 20 3d 20 7b 22 70 61 67 65 63 6f 75 6e 74 22 3a 33 36 2c 22 74 69 74 6c 65 22 3a 22 4f 52 4d 45 20 35 20 32 30 32 34 20 46 69 6e 61 6c 2e 70 64 66 22 2c 22 61 75 74 68 6f 72 22 3a 22 72 61 68 75 6c 2e 70 75 74 68 65 6e 76 65 65 64 75 22 2c 22 73 75 62 6a 65 63 74 22 3a 22 22 2c 22 6b 65 79 77 6f 72 64 73 22 3a 22 22 2c 22 63 72 65 61 74 6f 72 22 3a 22 50 53 63 72 69 70 74 35 2e 64 6c 6c 20 56 65 72 73 69 6f 6e 20 35 2e 32 2e 32 22 2c 22 70 72 6f 64 75 63 65 72 22 3a 22 41 63 72 6f 62 61 74 20 44 69 73 74 69 6c 6c 65 72 20 32 34 2e 30 20 28 57 69 6e 64 6f 77 73 29 22 2c 22 63 72 65 61 74 69 6f 6e 64 61 74 65 22 3a 22 44 3a 32 30 32 34 30 37 33 31 31 33 34 37 31 34 2b 30 31 27 30 30 27 22 2c 22 6d 6f 64 64 61 Data Ascii: IDRViewer.config = {"pagecount":36,"title":"ORME 5 2024 Final.pdf","author":"rahul.puthenveedu","subject":"","keywords":"","creator":"PScript5.dll Version 5.2.2","producer":"Acrobat Distiller 24.0 (Windows)","creationdate":"D:20240731134714+01'00'","modda

Timestamp	Bytes transferred	Direction	Data
2024-10-25 22:55:20 UTC	886	OUT	GET /magazines/orme_2024_07_31/spread/19.html HTTP/1.1 Host: oilreviewmiddleeast.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://oilreviewmiddleeast.com/magazines/orme_2024_07_31/spread/?page=19 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AWSALB=Z3ZynZnqfF67xSsmVq98UWHfR9W+OX/9dFN5+Su17TMWFHxrrGz3QBcwwGtBql4Lk1qTScasFyqymRSSc7je6wQFpvqr2WYna5ON8+rxMOBeEbFVBw5OiSLCrJWp; AWSALBCORS=Z3ZynZnqfF67xSsmVq98UWHfR9W+OX/9dFN5+Su17TMWFHxrrGz3QBcwwGtBql4Lk1qTScasFyqymRSSc7je6wQFpvqr2WYna5ON8+rxMOBeEbFVBw5OiSLCrJWp
2024-10-25 22:55:21 UTC	857	IN	HTTP/1.1 200 OK Content-Type: text/html Transfer-Encoding: chunked Connection: close Date: Fri, 25 Oct 2024 22:55:21 GMT Server: nginx/1.18.0 (Ubuntu) Vary: Accept-Encoding Vary: Accept-Encoding Set-Cookie: AWSALB=fw3Q6qPnJ+RxOINfZaRb76ofPf778WkSXh8kx72KsNRgpC7jF/pn5M5nUlAsSe1jcn3oCTbS9vCKQlqBk0DSEEAIomhCK4Zu0iGfdO5GK8dyG3mV/xrNjh/OicTc; Expires=Fri, 01 Nov 2024 22:55:21 GMT; Path=/ Set-Cookie: AWSALBCORS=fw3Q6qPnJ+RxOINfZaRb76ofPf778WkSXh8kx72KsNRgpC7jF/pn5M5nUlAsSe1jcn3oCTbS9vCKQlqBk0DSEEAIomhCK4Zu0iGfdO5GK8dyG3mV/xrNjh/OicTc; Expires=Fri, 01 Nov 2024 22:55:21 GMT; Path=/; SameSite=None; Secure X-Cache: Miss from cloudfront Via: 1.1 3431ec594cac61983aae2d9ffaf23980.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P4 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: Hbk-ImOt6pObQGtD9PJu2x0U5Q93KOYNAbIK4JJP9qPWQsU1hhNBJw== Vary: Origin
2024-10-25 22:55:21 UTC	7573	IN	Data Raw: 31 64 38 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 22 20 2f 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 20 30 3b 22 3e 0a 0a 3c 64 69 76 20 69 64 3d 22 70 31 39 22 20 73 74 79 6c 65 3d 22 6f 76 65 72 66 6c 6f 77 3a 20 68 69 64 64 65 6e 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 72 65 6c 61 74 69 76 65 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 77 68 69 74 65 3b 20 77 69 64 74 68 3a 20 31 30 30 30 70 78 3b 20 68 65 69 Data Ascii: 1d8d<!DOCTYPE html><html><head><meta http-equiv="X-UA-Compatible" content="IE=Edge" /><meta charset="utf-8" /></head><body style="margin: 0;"><div id="p19" style="overflow: hidden; position: relative; background-color: white; width: 1000px; hei
2024-10-25 22:55:21 UTC	13601	IN	Data Raw: 33 35 31 39 0d 0a 75 5f 31 39 7b 6c 65 66 74 3a 38 33 39 70 78 3b 62 6f 74 74 6f 6d 3a 32 36 30 70 78 3b 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 2d 30 2e 30 32 70 78 3b 77 6f 72 64 2d 73 70 61 63 69 6e 67 3a 30 2e 30 31 70 78 3b 7d 0a 23 74 32 76 5f 31 39 7b 6c 65 66 74 3a 38 33 32 70 78 3b 62 6f 74 74 6f 6d 3a 32 34 38 70 78 3b 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 2d 30 2e 30 32 70 78 3b 77 6f 72 64 2d 73 70 61 63 69 6e 67 3a 30 2e 30 31 70 78 3b 7d 0a 23 74 32 77 5f 31 39 7b 6c 65 66 74 3a 38 33 32 70 78 3b 62 6f 74 74 6f 6d 3a 32 33 36 70 78 3b 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 2d 30 2e 30 35 70 78 3b 77 6f 72 64 2d 73 70 61 63 69 6e 67 3a 30 2e 30 34 70 78 3b 7d 0a 23 74 32 78 5f 31 39 7b 6c 65 66 74 3a 38 33 32 70 78 3b 62 6f Data Ascii: 3519u_19{left:839px;bottom:260px;letter-spacing:-0.02px;word-spacing:0.01px;}#t2v_19{left:832px;bottom:248px;letter-spacing:-0.02px;word-spacing:0.01px;}#t2w_19{left:832px;bottom:236px;letter-spacing:-0.05px;word-spacing:0.04px;}#t2x_19{left:832px;bo
2024-10-25 22:55:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0