Edit tour

Windows Analysis Report
https://drvbylytre.mfs.gg/fzbw9Yh

Overview

General Information

Sample URL:	https://drvbylytre.mfs.gg/fzbw9Yh
Analysis ID:	637435
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

No high impact signatures.

Classification

Process Tree

System is w10x64

chrome.exe (PID: 1320 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "https://drvbylytre.mfs.gg/fzbw9Yh MD5: C139654B5C1438A95B321BB01AD63EF6)

chrome.exe (PID: 688 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1536,4363419785747754873,8297120605393942811,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1960 /prefetch:8 MD5: C139654B5C1438A95B321BB01AD63EF6)

cleanup

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic			Jump to behavior

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfmX-Goog-Update-Updater: chromecrx-85.0.4183.121Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fzbw9Yh HTTP/1.1Host: drvbylytre.mfs.ggConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/fonts/Roboto-Regular.ttf HTTP/1.1Host: drvbylytre.mfs.ggConnection: keep-aliveOrigin: https://drvbylytre.mfs.ggUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://drvbylytre.mfs.gg/fzbw9YhAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /runtime-es2017.cc42f1147b3cbeba9d3c.js HTTP/1.1Host: drvbylytre.mfs.ggConnection: keep-aliveOrigin: https://drvbylytre.mfs.ggUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://drvbylytre.mfs.gg/fzbw9YhAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /polyfills-es2017.39d4570d9e287f904b27.js HTTP/1.1Host: drvbylytre.mfs.ggConnection: keep-aliveOrigin: https://drvbylytre.mfs.ggUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://drvbylytre.mfs.gg/fzbw9YhAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /main-es2017.3f9ef6040cc18bc6c276.js HTTP/1.1Host: drvbylytre.mfs.ggConnection: keep-aliveOrigin: https://drvbylytre.mfs.ggUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://drvbylytre.mfs.gg/fzbw9YhAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripts.96290088fc75d119f910.js HTTP/1.1Host: drvbylytre.mfs.ggConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://drvbylytre.mfs.gg/fzbw9YhAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /styles.a94b4396efde6a3506b7.css HTTP/1.1Host: drvbylytre.mfs.ggConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://drvbylytre.mfs.gg/fzbw9YhAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /587-es2017.b4420bec13516f6c2500.js HTTP/1.1Host: drvbylytre.mfs.ggConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://drvbylytre.mfs.gg/fzbw9YhAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/materialicons/v129/flUhRq6tzZclQEJ-Vdg-IuiaDsNc.woff2 HTTP/1.1Host: fonts.gstatic.comConnection: keep-aliveOrigin: https://drvbylytre.mfs.ggUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://fonts.googleapis.com/css?family=Material+Icons&display=swapAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api.js?render=6LeH8pAUAAAAAL6B7Rg0Y60nbUVRlGCfQDkAuna9&onload=ngRecaptcha3Loaded HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://drvbylytre.mfs.gg/fzbw9YhAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/anchor?ar=1&k=6LeH8pAUAAAAAL6B7Rg0Y60nbUVRlGCfQDkAuna9&co=aHR0cHM6Ly9kcnZieWx5dHJlLm1mcy5nZzo0NDM.&hl=en&v=M-QqaF9xk6BpjLH22uHZRhXt&size=invisible&cb=61t16dkue8sq HTTP/1.1Host: www.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://drvbylytre.mfs.gg/fzbw9YhAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: drvbylytre.mfs.ggConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://drvbylytre.mfs.gg/fzbw9YhAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: amp_f8828c=pwd8FniwqSdORkR21fLGaG...1g4gbmlav.1g4gbmlav.0.0.0
Source: global traffic	HTTP traffic detected: GET /public/users/5d307346a440182839827719/background-images/cc715f5a-0d45-47c4-9d69-1a82d991254d.jpg HTTP/1.1Host: mf2-production.s3.us-east-2.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://drvbylytre.mfs.gg/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789

Source: 00b926ca-1438-46af-975b-08fc56d862f9.tmp.2.dr	String found in binary or memory: https://accounts.google.com
Source: craw_window.js.0.dr	String found in binary or memory: https://accounts.google.com/MergeSession
Source: 00b926ca-1438-46af-975b-08fc56d862f9.tmp.2.dr	String found in binary or memory: https://apis.google.com
Source: 00b926ca-1438-46af-975b-08fc56d862f9.tmp.2.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json.0.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 00b926ca-1438-46af-975b-08fc56d862f9.tmp.2.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: 00b926ca-1438-46af-975b-08fc56d862f9.tmp.2.dr, e0c9db8a-c57c-41df-b906-6f2ff4d66d59.tmp.2.dr	String found in binary or memory: https://dns.google
Source: History Provider Cache.0.dr	String found in binary or memory: https://drvbylytre.mfs.gg/fzbw9Yh2
Source: 00b926ca-1438-46af-975b-08fc56d862f9.tmp.2.dr	String found in binary or memory: https://fonts.googleapis.com
Source: 00b926ca-1438-46af-975b-08fc56d862f9.tmp.2.dr	String found in binary or memory: https://fonts.gstatic.com
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p
Source: 00b926ca-1438-46af-975b-08fc56d862f9.tmp.2.dr	String found in binary or memory: https://ogs.google.com
Source: craw_window.js.0.dr, manifest.json.0.dr	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: craw_window.js.0.dr, manifest.json.0.dr	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: 00b926ca-1438-46af-975b-08fc56d862f9.tmp.2.dr	String found in binary or memory: https://ssl.gstatic.com
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://www-googleapis-staging.sandbox.google.com
Source: 00b926ca-1438-46af-975b-08fc56d862f9.tmp.2.dr	String found in binary or memory: https://www.google.com
Source: manifest.json.0.dr	String found in binary or memory: https://www.google.com/
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/accounts/OAuthLogin?issueuberauth=1
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/cleardot.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/dot2.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/x2.gif
Source: craw_background.js.0.dr	String found in binary or memory: https://www.google.com/intl/en-US/chrome/blank.html
Source: 00b926ca-1438-46af-975b-08fc56d862f9.tmp.2.dr, craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://www.googleapis.com
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: 00b926ca-1438-46af-975b-08fc56d862f9.tmp.2.dr	String found in binary or memory: https://www.gstatic.com

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "https://drvbylytre.mfs.gg/fzbw9Yh
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1536,4363419785747754873,8297120605393942811,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1960 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1536,4363419785747754873,8297120605393942811,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1960 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	3 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	3 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	4 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	1 Ingress Tool Transfer	SIM Card Swap		Carrier Billing Fraud

Source	Detection	Scanner	Label	Link
https://drvbylytre.mfs.gg/fzbw9Yh	0%	Virustotal		Browse
https://drvbylytre.mfs.gg/fzbw9Yh	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label
https://drvbylytre.mfs.gg/styles.a94b4396efde6a3506b7.css	0%	Avira URL Cloud	safe
https://drvbylytre.mfs.gg/scripts.96290088fc75d119f910.js	0%	Avira URL Cloud	safe
https://dns.google	0%	URL Reputation	safe
https://drvbylytre.mfs.gg/fzbw9Yh2	0%	Avira URL Cloud	safe
https://drvbylytre.mfs.gg/main-es2017.3f9ef6040cc18bc6c276.js	0%	Avira URL Cloud	safe
https://drvbylytre.mfs.gg/assets/fonts/Roboto-Regular.ttf	0%	Avira URL Cloud	safe
https://drvbylytre.mfs.gg/favicon.ico	0%	Avira URL Cloud	safe
https://drvbylytre.mfs.gg/runtime-es2017.cc42f1147b3cbeba9d3c.js	0%	Avira URL Cloud	safe
https://drvbylytre.mfs.gg/587-es2017.b4420bec13516f6c2500.js	0%	Avira URL Cloud	safe
https://drvbylytre.mfs.gg/polyfills-es2017.39d4570d9e287f904b27.js	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
gstaticadssl.l.google.com	172.217.168.3	true	false	high
accounts.google.com	172.217.168.45	true	false	high
www.google.com	142.250.203.100	true	false	high
mf2-staging-backend.zd66itmgdh.us-east-2.elasticbeanstalk.com	3.18.40.185	true	false	high
clients.l.google.com	142.250.203.110	true	false	high
s3-r-w.us-east-2.amazonaws.com	52.219.93.58	true	false	high
mf2-production.s3.us-east-2.amazonaws.com	unknown	unknown	false	high
clients2.google.com	unknown	unknown	false	high
drvbylytre.mfs.gg	unknown	unknown	false	unknown

Name	Malicious	Antivirus Detection	Reputation
https://drvbylytre.mfs.gg/styles.a94b4396efde6a3506b7.css	false	Avira URL Cloud: safe	unknown
https://drvbylytre.mfs.gg/scripts.96290088fc75d119f910.js	false	Avira URL Cloud: safe	unknown
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1	false		high
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false		high
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LeH8pAUAAAAAL6B7Rg0Y60nbUVRlGCfQDkAuna9&co=aHR0cHM6Ly9kcnZieWx5dHJlLm1mcy5nZzo0NDM.&hl=en&v=M-QqaF9xk6BpjLH22uHZRhXt&size=invisible&cb=61t16dkue8sq	false		high
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LeH8pAUAAAAAL6B7Rg0Y60nbUVRlGCfQDkAuna9&co=aHR0cHM6Ly9kcnZieWx5dHJlLm1mcy5nZzo0NDM.&hl=en&v=M-QqaF9xk6BpjLH22uHZRhXt&size=invisible&cb=61t16dkue8sq	false		high
https://drvbylytre.mfs.gg/fzbw9Yh	false		unknown
https://drvbylytre.mfs.gg/main-es2017.3f9ef6040cc18bc6c276.js	false	Avira URL Cloud: safe	unknown
https://drvbylytre.mfs.gg/fzbw9Yh	false		unknown
https://drvbylytre.mfs.gg/assets/fonts/Roboto-Regular.ttf	false	Avira URL Cloud: safe	unknown
https://drvbylytre.mfs.gg/favicon.ico	false	Avira URL Cloud: safe	unknown
https://drvbylytre.mfs.gg/runtime-es2017.cc42f1147b3cbeba9d3c.js	false	Avira URL Cloud: safe	unknown
https://www.google.com/recaptcha/api.js?render=6LeH8pAUAAAAAL6B7Rg0Y60nbUVRlGCfQDkAuna9&onload=ngRecaptcha3Loaded	false		high
https://mf2-production.s3.us-east-2.amazonaws.com/public/users/5d307346a440182839827719/background-images/cc715f5a-0d45-47c4-9d69-1a82d991254d.jpg	false		high
https://drvbylytre.mfs.gg/587-es2017.b4420bec13516f6c2500.js	false	Avira URL Cloud: safe	unknown
https://drvbylytre.mfs.gg/polyfills-es2017.39d4570d9e287f904b27.js	false	Avira URL Cloud: safe	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.203.100	www.google.com	United States	15169	GOOGLEUS	false
142.250.203.110	clients.l.google.com	United States	15169	GOOGLEUS	false
52.219.93.58	s3-r-w.us-east-2.amazonaws.com	United States	16509	AMAZON-02US	false
172.217.168.45	accounts.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.217.168.3	gstaticadssl.l.google.com	United States	15169	GOOGLEUS	false
3.18.40.185	mf2-staging-backend.zd66itmgdh.us-east-2.elasticbeanstalk.com	United States	16509	AMAZON-02US	false

IP
192.168.2.1
127.0.0.1

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	637435
Start date and time: 01/06/202212:24:43	2022-06-01 12:24:43 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 4m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://drvbylytre.mfs.gg/fzbw9Yh
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean0.win@22/82@7/9
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	451603
Entropy (8bit):	5.009711072558331
Encrypted:	false
SSDEEP:	12288:ZHfRTyGZ6lup8Cfrvq4JBPKh+FBlESBw4p6:NfOCzvRKhGvwJ
MD5:	A78AD14E77147E7DE3647E61964C0335
SHA1:	CECC3DD41F4CEA0192B24300C71E1911BD4FCE45
SHA-256:	0D6803758FF8F87081FAFD62E90F0950DFB2DD7991E9607FE76A8F92D0E893FA
SHA-512:	DDE24D5AD50D68FC91E9E325D31E66EF8F624B6BB3A07D14FFED1104D3AB5F4EF1D7969A5CDE0DFBB19CB31C506F7DE97AF67C2F244F7E7E8E10648EA8321101
Malicious:	false
Reputation:	low
Preview:	BDic.... ....6...."..Z..4g....6.2...{/...3...5....AF 1363.AF nm.AF pt.AF n1.AF p.AF tc.AF SM.AF M.AF S.AF MS.AF MNR.AF GDS.AF MNT.AF MH.AF MR.AF SZMR.AF MJ.AF MT.AF MY.AF MRZ.AF MN.AF MG.AF RM.AF N.AF MV.AF XM.AF DSM.AF SD.AF G.AF R.AF MNX.AF MRS.AF MD.AF MNRB.AF B.AF ZSMR.AF PM.AF SMNGJ.AF SMN.AF ZMR.AF SMGB.AF MZR.AF GM.AF SMR.AF SMDG.AF RMZ.AF ZM.AF MDG.AF MDT.AF SMNXT.AF SDY.AF LSDG.AF LGDS.AF GLDS.AF UY.AF U.AF DSGNX.AF GNDSX.AF DSG.AF Y.AF GS.AF IEMS.AF YP.AF ZGDRS.AF XGNVDS.AF UT.AF GNDS.AF GVDS.AF MYPS.AF XGNDS.AF TPRY.AF MDSG.AF ZGSDR.AF DYSG.AF PMYTNS.AF AGDS.AF DRZGS.AF PY.AF GSPMDY.AF EGVDS.AF SL.AF GNXDS.AF DSBG.AF IM.AF I.AF MDGS.AF SMY.AF DSGN.AF DSLG.AF GMDS.AF MDSBG.AF SGD.AF IY.AF P.AF DSMG.AF BLZGDRS.AF TR.AF AGSD.AF ZGBDRSL.AF PTRY.AF ASDGV.AF ASM.AF ICANGSD.AF ICAM.AF IKY.AF AMS.AF PMYTRS.AF BZGVDRS.AF SDRBZG.AF GVMDS.AF PSM.AF DGLS.AF GNVXDS.AF AGDSL.AF DGS.AF XDSGNV.AF BZGDRS.AF AM.AF AS.AF A.AF LDSG.AF AGVDS.AF SDG.AF LDSMG.AF EDSMG.AF EY.AF DRSMZG.AF PRYT.AF LZ

Name	Source	Malicious	Antivirus Detection	Reputation
https://dns.google	00b926ca-1438-46af-975b-08fc56d862f9.tmp.2.dr, e0c9db8a-c57c-41df-b906-6f2ff4d66d59.tmp.2.dr	false	URL Reputation: safe	unknown
https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p	craw_window.js.0.dr, craw_background.js.0.dr	false		high
https://www.google.com/intl/en-US/chrome/blank.html	craw_background.js.0.dr	false		high
https://ogs.google.com	00b926ca-1438-46af-975b-08fc56d862f9.tmp.2.dr	false		high
https://drvbylytre.mfs.gg/fzbw9Yh2	History Provider Cache.0.dr	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/cleardot.gif	craw_window.js.0.dr	false		high
https://payments.google.com/payments/v4/js/integrator.js	craw_window.js.0.dr, manifest.json.0.dr	false		high
https://sandbox.google.com/payments/v4/js/integrator.js	craw_window.js.0.dr, manifest.json.0.dr	false		high
https://www.google.com/images/x2.gif	craw_window.js.0.dr	false		high
https://accounts.google.com/MergeSession	craw_window.js.0.dr	false		high
https://www.google.com	00b926ca-1438-46af-975b-08fc56d862f9.tmp.2.dr	false		high
https://www.google.com/images/dot2.gif	craw_window.js.0.dr	false		high
https://accounts.google.com	00b926ca-1438-46af-975b-08fc56d862f9.tmp.2.dr	false		high
https://clients2.googleusercontent.com	00b926ca-1438-46af-975b-08fc56d862f9.tmp.2.dr	false		high
https://apis.google.com	00b926ca-1438-46af-975b-08fc56d862f9.tmp.2.dr	false		high
https://www.google.com/accounts/OAuthLogin?issueuberauth=1	craw_window.js.0.dr	false		high
https://www.google.com/	manifest.json.0.dr	false		high
https://www-googleapis-staging.sandbox.google.com	craw_window.js.0.dr, craw_background.js.0.dr	false		high
https://clients2.google.com	00b926ca-1438-46af-975b-08fc56d862f9.tmp.2.dr	false		high
https://clients2.google.com/service/update2/crx	manifest.json.0.dr	false		high

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 1, 2022 12:25:52.680826902 CEST	60350	53	192.168.2.6	8.8.8.8
Jun 1, 2022 12:25:52.705810070 CEST	53	60350	8.8.8.8	192.168.2.6
Jun 1, 2022 12:25:52.708971977 CEST	61116	53	192.168.2.6	8.8.8.8
Jun 1, 2022 12:25:52.709204912 CEST	50958	53	192.168.2.6	8.8.8.8
Jun 1, 2022 12:25:52.735411882 CEST	53	50958	8.8.8.8	192.168.2.6
Jun 1, 2022 12:25:52.736047029 CEST	53	61116	8.8.8.8	192.168.2.6
Jun 1, 2022 12:25:56.201049089 CEST	51666	53	192.168.2.6	8.8.8.8
Jun 1, 2022 12:25:56.217989922 CEST	53	51666	8.8.8.8	192.168.2.6
Jun 1, 2022 12:25:56.352844000 CEST	51667	443	192.168.2.6	172.217.168.3
Jun 1, 2022 12:25:56.381724119 CEST	443	51667	172.217.168.3	192.168.2.6
Jun 1, 2022 12:25:56.381783962 CEST	443	51667	172.217.168.3	192.168.2.6
Jun 1, 2022 12:25:56.381843090 CEST	443	51667	172.217.168.3	192.168.2.6
Jun 1, 2022 12:25:56.497616053 CEST	51667	443	192.168.2.6	172.217.168.3
Jun 1, 2022 12:25:56.524532080 CEST	51667	443	192.168.2.6	172.217.168.3
Jun 1, 2022 12:25:56.537774086 CEST	51667	443	192.168.2.6	172.217.168.3
Jun 1, 2022 12:25:56.580955029 CEST	443	51667	172.217.168.3	192.168.2.6
Jun 1, 2022 12:25:56.587982893 CEST	51667	443	192.168.2.6	172.217.168.3
Jun 1, 2022 12:25:56.590449095 CEST	51667	443	192.168.2.6	172.217.168.3
Jun 1, 2022 12:25:56.591094971 CEST	51667	443	192.168.2.6	172.217.168.3
Jun 1, 2022 12:25:56.608366966 CEST	443	51667	172.217.168.3	192.168.2.6
Jun 1, 2022 12:25:56.608513117 CEST	443	51667	172.217.168.3	192.168.2.6
Jun 1, 2022 12:25:56.608572960 CEST	443	51667	172.217.168.3	192.168.2.6
Jun 1, 2022 12:25:56.608627081 CEST	443	51667	172.217.168.3	192.168.2.6
Jun 1, 2022 12:25:56.608679056 CEST	443	51667	172.217.168.3	192.168.2.6
Jun 1, 2022 12:25:56.608730078 CEST	443	51667	172.217.168.3	192.168.2.6
Jun 1, 2022 12:25:56.608783007 CEST	443	51667	172.217.168.3	192.168.2.6
Jun 1, 2022 12:25:56.608836889 CEST	443	51667	172.217.168.3	192.168.2.6
Jun 1, 2022 12:25:56.608889103 CEST	443	51667	172.217.168.3	192.168.2.6
Jun 1, 2022 12:25:56.608941078 CEST	443	51667	172.217.168.3	192.168.2.6
Jun 1, 2022 12:25:56.608959913 CEST	51667	443	192.168.2.6	172.217.168.3
Jun 1, 2022 12:25:56.608994961 CEST	443	51667	172.217.168.3	192.168.2.6
Jun 1, 2022 12:25:56.609050035 CEST	443	51667	172.217.168.3	192.168.2.6
Jun 1, 2022 12:25:56.609123945 CEST	51667	443	192.168.2.6	172.217.168.3
Jun 1, 2022 12:25:56.609186888 CEST	51667	443	192.168.2.6	172.217.168.3
Jun 1, 2022 12:25:56.609258890 CEST	51667	443	192.168.2.6	172.217.168.3
Jun 1, 2022 12:25:56.609322071 CEST	51667	443	192.168.2.6	172.217.168.3
Jun 1, 2022 12:25:56.613706112 CEST	443	51667	172.217.168.3	192.168.2.6
Jun 1, 2022 12:25:56.614051104 CEST	51667	443	192.168.2.6	172.217.168.3
Jun 1, 2022 12:25:56.616655111 CEST	443	51667	172.217.168.3	192.168.2.6
Jun 1, 2022 12:25:56.620258093 CEST	443	51667	172.217.168.3	192.168.2.6
Jun 1, 2022 12:25:56.620507002 CEST	51667	443	192.168.2.6	172.217.168.3
Jun 1, 2022 12:25:56.624701023 CEST	443	51667	172.217.168.3	192.168.2.6
Jun 1, 2022 12:25:56.628393888 CEST	443	51667	172.217.168.3	192.168.2.6
Jun 1, 2022 12:25:56.628437042 CEST	443	51667	172.217.168.3	192.168.2.6
Jun 1, 2022 12:25:56.628494978 CEST	443	51667	172.217.168.3	192.168.2.6
Jun 1, 2022 12:25:56.628539085 CEST	443	51667	172.217.168.3	192.168.2.6
Jun 1, 2022 12:25:56.628663063 CEST	51667	443	192.168.2.6	172.217.168.3
Jun 1, 2022 12:25:56.628772974 CEST	51667	443	192.168.2.6	172.217.168.3
Jun 1, 2022 12:25:56.659193039 CEST	51667	443	192.168.2.6	172.217.168.3
Jun 1, 2022 12:25:56.997253895 CEST	57038	443	192.168.2.6	142.250.203.100
Jun 1, 2022 12:25:57.028465986 CEST	443	57038	142.250.203.100	192.168.2.6
Jun 1, 2022 12:25:57.028963089 CEST	57038	443	192.168.2.6	142.250.203.100
Jun 1, 2022 12:25:57.059892893 CEST	443	57038	142.250.203.100	192.168.2.6
Jun 1, 2022 12:25:57.059943914 CEST	443	57038	142.250.203.100	192.168.2.6
Jun 1, 2022 12:25:57.059982061 CEST	443	57038	142.250.203.100	192.168.2.6
Jun 1, 2022 12:25:57.060020924 CEST	443	57038	142.250.203.100	192.168.2.6
Jun 1, 2022 12:25:57.060269117 CEST	57038	443	192.168.2.6	142.250.203.100
Jun 1, 2022 12:25:57.061466932 CEST	57038	443	192.168.2.6	142.250.203.100
Jun 1, 2022 12:25:57.094305992 CEST	57038	443	192.168.2.6	142.250.203.100
Jun 1, 2022 12:25:57.137056112 CEST	443	57038	142.250.203.100	192.168.2.6
Jun 1, 2022 12:25:57.137636900 CEST	57038	443	192.168.2.6	142.250.203.100
Jun 1, 2022 12:25:57.650177002 CEST	57038	443	192.168.2.6	142.250.203.100
Jun 1, 2022 12:25:57.680607080 CEST	443	57038	142.250.203.100	192.168.2.6
Jun 1, 2022 12:25:57.680668116 CEST	443	57038	142.250.203.100	192.168.2.6
Jun 1, 2022 12:25:57.680710077 CEST	443	57038	142.250.203.100	192.168.2.6
Jun 1, 2022 12:25:57.685921907 CEST	57038	443	192.168.2.6	142.250.203.100
Jun 1, 2022 12:25:57.726943016 CEST	57038	443	192.168.2.6	142.250.203.100
Jun 1, 2022 12:25:57.732685089 CEST	51667	443	192.168.2.6	172.217.168.3
Jun 1, 2022 12:25:57.733131886 CEST	443	57038	142.250.203.100	192.168.2.6
Jun 1, 2022 12:25:57.733386993 CEST	57038	443	192.168.2.6	142.250.203.100
Jun 1, 2022 12:25:57.734757900 CEST	51667	443	192.168.2.6	172.217.168.3
Jun 1, 2022 12:25:57.750614882 CEST	443	51667	172.217.168.3	192.168.2.6
Jun 1, 2022 12:25:57.750670910 CEST	443	51667	172.217.168.3	192.168.2.6
Jun 1, 2022 12:25:57.750710011 CEST	443	51667	172.217.168.3	192.168.2.6
Jun 1, 2022 12:25:57.750755072 CEST	443	51667	172.217.168.3	192.168.2.6
Jun 1, 2022 12:25:57.750832081 CEST	443	51667	172.217.168.3	192.168.2.6
Jun 1, 2022 12:25:57.750875950 CEST	443	51667	172.217.168.3	192.168.2.6
Jun 1, 2022 12:25:57.750919104 CEST	443	51667	172.217.168.3	192.168.2.6
Jun 1, 2022 12:25:57.750991106 CEST	443	51667	172.217.168.3	192.168.2.6
Jun 1, 2022 12:25:57.751061916 CEST	443	51667	172.217.168.3	192.168.2.6
Jun 1, 2022 12:25:57.751105070 CEST	443	51667	172.217.168.3	192.168.2.6
Jun 1, 2022 12:25:57.751163006 CEST	443	51667	172.217.168.3	192.168.2.6
Jun 1, 2022 12:25:57.751195908 CEST	443	51667	172.217.168.3	192.168.2.6
Jun 1, 2022 12:25:57.751266003 CEST	51667	443	192.168.2.6	172.217.168.3
Jun 1, 2022 12:25:57.751547098 CEST	51667	443	192.168.2.6	172.217.168.3
Jun 1, 2022 12:25:57.751743078 CEST	51667	443	192.168.2.6	172.217.168.3
Jun 1, 2022 12:25:57.751763105 CEST	51667	443	192.168.2.6	172.217.168.3
Jun 1, 2022 12:25:57.751836061 CEST	51667	443	192.168.2.6	172.217.168.3
Jun 1, 2022 12:25:57.751889944 CEST	51667	443	192.168.2.6	172.217.168.3
Jun 1, 2022 12:25:57.752681971 CEST	443	51667	172.217.168.3	192.168.2.6
Jun 1, 2022 12:25:57.752726078 CEST	443	51667	172.217.168.3	192.168.2.6
Jun 1, 2022 12:25:57.752763987 CEST	443	51667	172.217.168.3	192.168.2.6
Jun 1, 2022 12:25:57.752804041 CEST	443	51667	172.217.168.3	192.168.2.6
Jun 1, 2022 12:25:57.752881050 CEST	443	51667	172.217.168.3	192.168.2.6
Jun 1, 2022 12:25:57.753108025 CEST	51667	443	192.168.2.6	172.217.168.3
Jun 1, 2022 12:25:57.753174067 CEST	51667	443	192.168.2.6	172.217.168.3
Jun 1, 2022 12:25:57.754947901 CEST	443	51667	172.217.168.3	192.168.2.6
Jun 1, 2022 12:25:57.754996061 CEST	443	51667	172.217.168.3	192.168.2.6
Jun 1, 2022 12:25:57.755048037 CEST	443	51667	172.217.168.3	192.168.2.6
Jun 1, 2022 12:25:57.755103111 CEST	443	51667	172.217.168.3	192.168.2.6
Jun 1, 2022 12:25:57.755302906 CEST	51667	443	192.168.2.6	172.217.168.3
Jun 1, 2022 12:25:57.755382061 CEST	51667	443	192.168.2.6	172.217.168.3
Jun 1, 2022 12:25:57.757206917 CEST	443	51667	172.217.168.3	192.168.2.6
Jun 1, 2022 12:25:57.757278919 CEST	443	51667	172.217.168.3	192.168.2.6
Jun 1, 2022 12:25:57.757323980 CEST	443	51667	172.217.168.3	192.168.2.6
Jun 1, 2022 12:25:57.757369995 CEST	443	51667	172.217.168.3	192.168.2.6
Jun 1, 2022 12:25:57.757441998 CEST	51667	443	192.168.2.6	172.217.168.3
Jun 1, 2022 12:25:57.757502079 CEST	51667	443	192.168.2.6	172.217.168.3
Jun 1, 2022 12:25:57.760118008 CEST	443	51667	172.217.168.3	192.168.2.6
Jun 1, 2022 12:25:57.785590887 CEST	51667	443	192.168.2.6	172.217.168.3
Jun 1, 2022 12:25:57.925157070 CEST	52089	53	192.168.2.6	8.8.8.8
Jun 1, 2022 12:25:57.943797112 CEST	53	52089	8.8.8.8	192.168.2.6
Jun 1, 2022 12:25:58.996598959 CEST	52091	443	192.168.2.6	142.250.203.110
Jun 1, 2022 12:25:59.026957035 CEST	443	52091	142.250.203.110	192.168.2.6
Jun 1, 2022 12:25:59.027328014 CEST	52091	443	192.168.2.6	142.250.203.110
Jun 1, 2022 12:25:59.056128025 CEST	443	52091	142.250.203.110	192.168.2.6
Jun 1, 2022 12:25:59.056178093 CEST	443	52091	142.250.203.110	192.168.2.6
Jun 1, 2022 12:25:59.056216002 CEST	443	52091	142.250.203.110	192.168.2.6
Jun 1, 2022 12:25:59.056256056 CEST	443	52091	142.250.203.110	192.168.2.6
Jun 1, 2022 12:25:59.056601048 CEST	52091	443	192.168.2.6	142.250.203.110
Jun 1, 2022 12:25:59.057969093 CEST	52091	443	192.168.2.6	142.250.203.110
Jun 1, 2022 12:25:59.111033916 CEST	52091	443	192.168.2.6	142.250.203.110
Jun 1, 2022 12:25:59.111308098 CEST	52091	443	192.168.2.6	142.250.203.110
Jun 1, 2022 12:25:59.141457081 CEST	443	52091	142.250.203.110	192.168.2.6
Jun 1, 2022 12:25:59.144309044 CEST	52091	443	192.168.2.6	142.250.203.110
Jun 1, 2022 12:25:59.153678894 CEST	443	52091	142.250.203.110	192.168.2.6
Jun 1, 2022 12:25:59.158956051 CEST	443	52091	142.250.203.110	192.168.2.6
Jun 1, 2022 12:25:59.158996105 CEST	443	52091	142.250.203.110	192.168.2.6
Jun 1, 2022 12:25:59.159025908 CEST	443	52091	142.250.203.110	192.168.2.6
Jun 1, 2022 12:25:59.211632013 CEST	443	52091	142.250.203.110	192.168.2.6
Jun 1, 2022 12:25:59.226233006 CEST	52091	443	192.168.2.6	142.250.203.110
Jun 1, 2022 12:25:59.226309061 CEST	52091	443	192.168.2.6	142.250.203.110
Jun 1, 2022 12:25:59.349714994 CEST	54489	53	192.168.2.6	8.8.8.8
Jun 1, 2022 12:25:59.375593901 CEST	53	54489	8.8.8.8	192.168.2.6
Jun 1, 2022 12:25:59.451051950 CEST	52698	53	192.168.2.6	8.8.8.8
Jun 1, 2022 12:25:59.470293045 CEST	53	52698	8.8.8.8	192.168.2.6
Jun 1, 2022 12:26:12.743872881 CEST	51667	443	192.168.2.6	172.217.168.3
Jun 1, 2022 12:26:12.786547899 CEST	443	51667	172.217.168.3	192.168.2.6
Jun 1, 2022 12:26:14.145965099 CEST	52091	443	192.168.2.6	142.250.203.110
Jun 1, 2022 12:26:14.187933922 CEST	443	52091	142.250.203.110	192.168.2.6

Timestamp	kBytes transferred	Direction	Data
2022-06-01 10:25:53 UTC	0	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfm X-Goog-Update-Updater: chromecrx-85.0.4183.121 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-06-01 10:25:53 UTC	1	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-T19uxhZbEOuqhHOUUU6CFw' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 01 Jun 2022 10:25:53 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 5630 X-Daystart: 12353 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-06-01 10:25:53 UTC	2	IN	Data Raw: 33 36 64 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 35 36 33 30 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 31 32 33 35 33 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 36d<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="5630" elapsed_seconds="12353"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2022-06-01 10:25:53 UTC	2	IN	Data Raw: 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 2e 63 72 78 22 20 66 70 3d 22 31 2e 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 61 70 Data Ascii: mhkkegccagdldgiimedpiccmgmieda.crx" fp="1.81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app><ap
2022-06-01 10:25:53 UTC	3	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-06-01 10:25:53 UTC	0	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-06-01 10:25:53 UTC	1	OUT	Data Raw: 20 Data Ascii:
2022-06-01 10:25:53 UTC	3	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 01 Jun 2022 10:25:53 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-9TuSSBzJ8nFcf57iZr48lg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'nonce-9TuSSBzJ8nFcf57iZr48lg' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-06-01 10:25:53 UTC	4	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2022-06-01 10:25:53 UTC	4	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-06-01 10:25:56 UTC	2833	OUT	GET /recaptcha/api.js?render=6LeH8pAUAAAAAL6B7Rg0Y60nbUVRlGCfQDkAuna9&onload=ngRecaptcha3Loaded HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://drvbylytre.mfs.gg/fzbw9Yh Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-06-01 10:25:56 UTC	2833	IN	HTTP/1.1 200 OK Expires: Wed, 01 Jun 2022 10:25:56 GMT Date: Wed, 01 Jun 2022 10:25:56 GMT Cache-Control: private, max-age=300 Content-Type: text/javascript; charset=UTF-8 Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-06-01 10:25:56 UTC	2834	IN	Data Raw: 33 62 31 0d 0a 2f 2a 20 50 4c 45 41 53 45 20 44 4f 20 4e 4f 54 20 43 4f 50 59 20 41 4e 44 20 50 41 53 54 45 20 54 48 49 53 20 43 4f 44 45 2e 20 2a 2f 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 77 3d 77 69 6e 64 6f 77 2c 43 3d 27 5f 5f 5f 67 72 65 63 61 70 74 63 68 61 5f 63 66 67 27 2c 63 66 67 3d 77 5b 43 5d 3d 77 5b 43 5d 7c 7c 7b 7d 2c 4e 3d 27 67 72 65 63 61 70 74 63 68 61 27 3b 76 61 72 20 67 72 3d 77 5b 4e 5d 3d 77 5b 4e 5d 7c 7c 7b 7d 3b 67 72 2e 72 65 61 64 79 3d 67 72 2e 72 65 61 64 79 7c 7c 66 75 6e 63 74 69 6f 6e 28 66 29 7b 28 63 66 67 5b 27 66 6e 73 27 5d 3d 63 66 67 5b 27 66 6e 73 27 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 66 29 3b 7d 3b 77 5b 27 5f 5f 72 65 63 61 70 74 63 68 61 5f 61 70 69 27 5d 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 Data Ascii: 3b1/* PLEASE DO NOT COPY AND PASTE THIS CODE. */(function(){var w=window,C='___grecaptcha_cfg',cfg=w[C]=w[C]\|\|{},N='grecaptcha';var gr=w[N]=w[N]\|\|{};gr.ready=gr.ready\|\|function(f){(cfg['fns']=cfg['fns']\|\|[]).push(f);};w['__recaptcha_api']='https://www.g
2022-06-01 10:25:56 UTC	2834	IN	Data Raw: 79 6d 6f 75 73 27 3b 70 6f 2e 69 6e 74 65 67 72 69 74 79 3d 27 73 68 61 33 38 34 2d 2f 69 51 33 70 50 35 5a 70 34 66 44 31 72 67 75 69 56 67 55 63 41 33 51 4a 44 69 62 4f 5a 76 65 75 64 69 6e 34 58 38 79 48 64 66 52 69 32 51 71 65 73 5a 2f 46 6e 4f 34 66 34 56 6a 65 44 38 2f 27 3b 76 61 72 20 65 3d 64 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 27 73 63 72 69 70 74 5b 6e 6f 6e 63 65 5d 27 29 2c 6e 3d 65 26 26 28 65 5b 27 6e 6f 6e 63 65 27 5d 7c 7c 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 27 6e 6f 6e 63 65 27 29 29 3b 69 66 28 6e 29 7b 70 6f 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 27 6e 6f 6e 63 65 27 2c 6e 29 3b 7d 76 61 72 20 73 3d 64 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 27 73 63 72 69 70 74 27 29 5b 30 5d 3b 73 2e 70 Data Ascii: ymous';po.integrity='sha384-/iQ3pP5Zp4fD1rguiVgUcA3QJDibOZveudin4X8yHdfRi2QqesZ/FnO4f4VjeD8/';var e=d.querySelector('script[nonce]'),n=e&&(e['nonce']\|\|e.getAttribute('nonce'));if(n){po.setAttribute('nonce',n);}var s=d.getElementsByTagName('script')[0];s.p
2022-06-01 10:25:56 UTC	2835	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-06-01 10:25:58 UTC	2909	OUT	GET /favicon.ico HTTP/1.1 Host: drvbylytre.mfs.gg Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://drvbylytre.mfs.gg/fzbw9Yh Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: amp_f8828c=pwd8FniwqSdORkR21fLGaG...1g4gbmlav.1g4gbmlav.0.0.0
2022-06-01 10:25:58 UTC	2910	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Type: image/x-icon Date: Wed, 01 Jun 2022 10:25:58 GMT ETag: "628e3280-1536" Last-Modified: Wed, 25 May 2022 13:43:28 GMT Server: nginx/1.16.1 Content-Length: 5430 Connection: Close
2022-06-01 10:25:58 UTC	2910	IN	Data Raw: 00 00 01 00 02 00 10 10 00 00 01 00 20 00 68 04 00 00 26 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 8e 04 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 5d 2c 2a 3d 5d 2c 2a c8 5c 2c 29 fd 5c 2c 29 ff 5c 2c 29 ff 5c 2c 29 ff 5c 2c 29 ff 5c 2c 29 ff 5c 2c 29 ff 5c 2c 29 ff 5c 2c 29 ff 5c 2c 29 ff 5c 2b 29 ff 5c 2c 29 fd 5d 2c 2a c8 5d 2c 2a 3d 5f 2e 2c c8 5f 2e 2c ff 5f 2e 2c ff 5f 2e 2b ff 5f 2e 2c ff 5f 2e 2c ff 5f 2e 2c ff 5f 2e 2b ff 5f 2e 2c ff 5f 2e 2c ff 5f 2e 2c ff 5f 2e 2b ff 5f 2e 2c ff 5f 2e 2c ff 5f 2e 2b ff 5f 2e 2c c8 61 31 2e fc 61 31 2e ff 61 31 2e ff 60 2f 2d ff 5f 2d 2b ff 60 2f 2c ff 61 31 2e ff 61 31 2e ff 61 31 2e ff 61 31 2e ff 61 30 2d ff 5f 2d 2a ff 60 Data Ascii: h& ( ],=],\,)\,)\,)\,)\,)\,)\,)\,)\,)\,)\+)\,)],],=_.,_.,_.,_.+_.,_.,_.,_.+_.,_.,_.,_.+_.,_.,_.+_.,a1.a1.a1.`/-_-+`/,a1.a1.a1.a1.a0-_-*`

Timestamp	kBytes transferred	Direction	Data
2022-06-01 10:25:53 UTC	4	OUT	GET /fzbw9Yh HTTP/1.1 Host: drvbylytre.mfs.gg Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-06-01 10:25:53 UTC	5	IN	HTTP/1.1 200 OK Access-Control-Allow-Headers: Server-Timing Access-Control-Allow-Origin: * Cache-Control: no-cache Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0 Content-Type: text/html; charset=utf-8 Date: Wed, 01 Jun 2022 10:25:53 GMT ETag: W/"301d-j+IP6QW1WVMz1DqWvIRMLGy+4DQ" Expires: Wed, 01 Jun 2022 10:25:52 GMT Server: nginx/1.16.1 Server-Timing: nginx_request_time;dur=0.103 Server-Timing: nginx_upstream_connect_time;dur=0.000 Server-Timing: nginx_upstream_header_time;dur=0.100 Timing-Allow-Origin: * X-Request-Id: 880b9e2d-e104-4773-899d-6504f75d5b5b Content-Length: 12317 Connection: Close
2022-06-01 10:25:53 UTC	5	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4d 79 20 46 6f 72 6d 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 62 61 73 65 20 68 72 65 66 3d 22 2f 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 79 70 65 3d 22 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>My Form</title> <base href="/"> <meta name="viewport" content="width=device-width, initial-scale=1"> <meta name="robots" content="noindex"> <link rel="icon" type="

Timestamp	kBytes transferred	Direction	Data
2022-06-01 10:25:53 UTC	17	OUT	GET /assets/fonts/Roboto-Regular.ttf HTTP/1.1 Host: drvbylytre.mfs.gg Connection: keep-alive Origin: https://drvbylytre.mfs.gg User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://drvbylytre.mfs.gg/fzbw9Yh Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-06-01 10:25:53 UTC	18	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cache-Control: max-age=604800 Content-Type: application/octet-stream Date: Wed, 01 Jun 2022 10:25:53 GMT ETag: "628e3280-29d08" Last-Modified: Wed, 25 May 2022 13:43:28 GMT Server: nginx/1.16.1 Content-Length: 171272 Connection: Close
2022-06-01 10:25:53 UTC	18	IN	Data Raw: 00 01 00 00 00 12 01 00 00 04 00 20 47 44 45 46 b4 42 b0 82 00 02 27 48 00 00 02 62 47 50 4f 53 ff 1a 12 d7 00 02 29 ac 00 00 5d cc 47 53 55 42 eb 82 e4 59 00 02 87 78 00 00 15 90 4f 53 2f 32 97 82 b1 a8 00 02 09 6c 00 00 00 60 63 6d 61 70 01 77 58 1e 00 02 0e e4 00 00 12 46 63 76 74 20 2b a8 07 9d 00 02 24 34 00 00 00 54 66 70 67 6d 77 f8 60 ab 00 02 21 2c 00 00 01 bc 67 61 73 70 00 08 00 13 00 02 27 3c 00 00 00 0c 67 6c 79 66 26 ba 0b f4 00 00 01 2c 00 01 e9 6c 68 64 6d 78 55 7a 60 7a 00 02 09 cc 00 00 05 18 68 65 61 64 fc 6a d2 7a 00 01 f4 d8 00 00 00 36 68 68 65 61 0a ba 0a ae 00 02 09 48 00 00 00 24 68 6d 74 78 ae 72 8f 97 00 01 f5 10 00 00 14 38 6c 6f 63 61 80 77 ff bb 00 01 ea b8 00 00 0a 1e 6d 61 78 70 07 3e 03 09 00 01 ea 98 00 00 00 20 6e 61 6d Data Ascii: GDEFB'HbGPOS)]GSUBYxOS/2l`cmapwXFcvt +$4Tfpgmw`!,gasp'<glyf&,lhdmxUz`zheadjz6hheaH$hmtxr8locawmaxp> nam
2022-06-01 10:25:53 UTC	34	IN	Data Raw: 03 51 83 7d 7b 41 32 9a 3d 56 26 10 24 b9 11 60 04 80 02 42 36 49 3d 00 00 01 00 8e 05 16 03 2e 05 a5 00 03 00 19 b2 01 04 05 11 12 39 00 b0 02 2f b1 00 10 b0 0a 2b 58 21 d8 1b f4 59 30 31 01 21 35 21 03 2e fd 60 02 a0 05 16 8f 00 02 00 82 03 c0 02 7c 05 c4 00 0b 00 16 00 31 00 b0 00 45 58 b0 03 2f 1b b1 03 1e 3e 59 b0 0c d0 b0 0c 2f b1 09 02 b0 0a 2b 58 21 d8 1b f4 59 b0 03 10 b1 12 02 b0 0a 2b 58 21 d8 1b f4 59 30 31 13 34 36 33 32 16 15 14 06 23 22 26 17 32 36 35 34 26 23 22 06 14 16 82 95 6a 68 93 93 68 69 96 ff 36 4a 4a 36 37 4b 4b 04 c0 68 9c 9b 69 6a 96 96 16 47 39 3a 4b 4f 6c 4a 00 02 00 61 00 00 03 f5 04 f3 00 0b 00 0f 00 48 00 b0 09 2f b0 00 45 58 b0 0d 2f 1b b1 0d 12 3e 59 b0 09 10 b0 00 d0 b0 09 10 b1 06 01 b0 0a 2b 58 21 d8 1b f4 59 b0 03 d0 Data Ascii: Q}{A2=V&$`B6I=.9/+X!Y01!5!.`\|1EX/>Y/+X!Y+X!Y014632#"&2654&#"jhhi6JJ67KKhijG9:KOlJaH/EX/>Y+X!Y
2022-06-01 10:25:53 UTC	47	IN	Data Raw: b0 0a 2b 58 21 d8 1b f4 59 b2 06 25 28 11 12 39 b2 0e 0c 00 11 12 39 b0 00 10 b1 18 01 b0 0a 2b 58 21 d8 1b f4 59 b0 0c 10 b1 1f 01 b0 0a 2b 58 21 d8 1b f4 59 30 31 01 32 16 15 14 06 07 16 16 15 14 06 23 22 27 11 23 11 34 36 36 01 34 26 23 22 06 07 11 16 16 33 32 36 35 34 26 27 23 35 33 32 36 02 5d c1 eb 62 58 7b 83 f9 cd b5 78 ba 7a cf 01 67 88 6b 6c 96 01 2c 90 5e 86 9a 8c 6d 96 55 78 7e 05 c4 db ae 5b 98 2e 2d c3 82 cd ef 5f fe 35 05 b1 6c bc 6b fe 7b 66 87 8e 6b fc c3 34 3f a0 81 76 a5 03 98 77 00 00 01 00 2e fe 60 03 df 04 3a 00 08 00 38 b2 00 09 0a 11 12 39 00 b0 00 45 58 b0 01 2f 1b b1 01 1a 3e 59 b0 00 45 58 b0 07 2f 1b b1 07 1a 3e 59 b0 00 45 58 b0 04 2f 1b b1 04 14 3e 59 b2 00 07 04 11 12 39 30 31 01 01 33 01 11 23 11 01 33 02 0a 01 18 bd fe 85 Data Ascii: +X!Y%(99+X!Y+X!Y012#"'#4664&#"32654&'#5326]bX{xzgkl,^mUx~[.-_5lk{fk4?vw.`:89EX/>YEX/>YEX/>Y9013#3
2022-06-01 10:25:53 UTC	63	IN	Data Raw: 45 58 b0 13 2f 1b b1 13 12 3e 59 b2 09 05 08 11 12 39 b0 09 2f b1 04 01 b0 0a 2b 58 21 d8 1b f4 59 b0 09 10 b0 23 d0 b0 0d d0 b0 04 10 b0 1e d0 b0 18 d0 b0 0b 10 b1 26 01 b0 0a 2b 58 21 d8 1b f4 59 30 31 21 11 36 37 21 11 23 11 33 11 21 01 21 01 33 32 16 17 11 23 11 26 26 27 23 07 11 23 11 27 23 22 06 07 11 01 33 01 21 02 c5 01 4f fe 62 c1 c1 03 59 fe 79 04 b3 fe 78 1b f4 ec 03 c1 01 7c 9a 85 16 c0 0e 87 9e 82 04 02 15 10 01 1a fd bb 01 78 b3 69 fd 6c 05 b0 fd 7c 02 84 fd 7a d4 d8 fe 82 01 78 90 82 02 25 fd 99 02 75 17 7b 8d fe 7c 03 2a 01 e8 00 02 00 9b 00 00 07 3b 04 3a 00 21 00 25 00 98 b2 1e 26 27 11 12 39 b0 1e 10 b0 25 d0 00 b0 00 45 58 b0 07 2f 1b b1 07 1a 3e 59 b0 00 45 58 b0 0b 2f 1b b1 0b 1a 3e 59 b0 00 45 58 b0 00 2f 1b b1 00 12 3e 59 b0 00 45 Data Ascii: EX/>Y9/+X!Y#&+X!Y01!67!#3!!32#&&'##'#"3!ObYyx\|xil\|zx%u{\|*;:!%&'9%EX/>YEX/>YEX/>YE
2022-06-01 10:25:53 UTC	79	IN	Data Raw: ea 4e 65 62 55 49 4e 66 65 53 00 00 01 00 6c 00 99 02 20 03 b5 00 06 00 10 00 b0 05 2f b2 02 07 05 11 12 39 b0 02 2f 30 31 01 01 23 01 35 01 33 01 1e 01 02 8d fe d9 01 27 8d 02 26 fe 73 01 84 13 01 85 00 01 00 59 00 98 02 0e 03 b5 00 06 00 10 00 b0 00 2f b2 03 07 00 11 12 39 b0 03 2f 30 31 13 01 15 01 23 01 01 e7 01 27 fe d9 8e 01 02 fe fe 03 b5 fe 7b 13 fe 7b 01 8e 01 8f 00 01 00 3b 00 6e 03 6a 05 22 00 03 00 09 00 b0 00 2f b0 02 2f 30 31 37 27 01 17 a3 68 02 c7 68 6e 42 04 72 42 00 ff ff 00 36 02 9b 02 bb 05 b0 03 07 02 20 00 00 02 9b 00 13 00 b0 00 45 58 b0 09 2f 1b b1 09 1e 3e 59 b0 0d d0 30 31 00 00 01 00 7a 02 8b 02 f8 05 ba 00 0f 00 54 b2 0a 10 11 11 12 39 00 b0 00 45 58 b0 00 2f 1b b1 00 1e 3e 59 b0 00 45 58 b0 03 2f 1b b1 03 1e 3e 59 b0 00 45 58 Data Ascii: NebUINfeSl /9/01#53'&sY/9/01#'{{;nj"//017'hhnBrB6 EX/>Y01zT9EX/>YEX/>YEX
2022-06-01 10:25:53 UTC	95	IN	Data Raw: b0 0a 2b 58 21 d8 1b f4 59 30 31 01 21 35 21 15 21 11 36 33 32 16 15 14 06 23 35 32 36 35 34 26 23 22 07 11 23 01 8a fe 9c 03 89 fe 94 97 9c d4 e2 e5 e0 8d 7f 7d 80 9d 96 b9 03 f4 99 99 fe d7 31 d0 c4 be be 97 6d 78 83 79 32 fd ce 00 01 00 60 ff f0 04 30 04 9d 00 1e 00 80 b2 03 1f 20 11 12 39 00 b0 00 45 58 b0 0b 2f 1b b1 0b 1c 3e 59 b0 00 45 58 b0 03 2f 1b b1 03 12 3e 59 b2 0f 0b 03 11 12 39 b0 0b 10 b1 12 01 b0 0a 2b 58 21 d8 1b f4 59 b2 16 0b 03 11 12 39 7c b0 16 2f 18 b2 a0 16 01 5d b4 60 16 70 16 02 5d b2 30 16 01 71 b4 60 16 70 16 02 71 b1 17 01 b0 0a 2b 58 21 d8 1b f4 59 b0 03 10 b1 1b 01 b0 0a 2b 58 21 d8 1b f4 59 b2 1e 03 0b 11 12 39 30 31 01 06 06 23 22 00 11 35 34 36 36 33 32 16 17 23 26 26 23 22 06 07 21 15 21 16 16 33 32 36 37 04 30 14 fc d1 Data Ascii: +X!Y01!5!!632#52654&#"#}1mxy2`0 9EX/>YEX/>Y9+X!Y9\|/]`p]0q`pq+X!Y+X!Y901#"546632#&&#"!!32670
2022-06-01 10:25:53 UTC	111	IN	Data Raw: 9b 00 00 01 55 04 3a 00 06 00 8d 00 00 00 01 00 8a ff ec 03 f9 04 9d 00 21 00 66 00 b0 00 45 58 b0 15 2f 1b b1 15 1c 3e 59 b0 00 45 58 b0 10 2f 1b b1 10 12 3e 59 b0 00 45 58 b0 1f 2f 1b b1 1f 12 3e 59 b1 02 01 b0 0a 2b 58 21 d8 1b f4 59 b2 19 1f 15 11 12 39 b0 19 2f b4 1f 19 2f 19 02 5d b0 08 b0 0a 2b 58 d8 1b dc 59 b0 19 10 b0 0a d0 b0 15 10 b1 0d 01 b0 0a 2b 58 21 d8 1b f4 59 30 31 25 16 33 32 36 35 34 26 23 23 35 13 26 23 22 03 11 23 11 36 36 33 32 16 17 01 16 16 15 14 06 23 22 27 01 c3 52 58 61 72 88 87 54 ed 4e 63 d3 04 b8 01 c5 c9 6b c3 65 fe ee a9 b6 d7 b5 77 68 b5 33 7b 63 62 55 89 01 27 3e fe f5 fd 06 02 f5 d2 d6 55 62 fe b6 0f a3 86 ac cc 31 00 00 02 00 78 ff eb 04 89 04 a1 00 0b 00 19 00 3b 00 b0 00 45 58 b0 08 2f 1b b1 08 1c 3e 59 b0 00 45 58 Data Ascii: U:!fEX/>YEX/>YEX/>Y+X!Y9//]+XY+X!Y01%32654&##5&#"#6632#"'RXarTNckewh3{cbU'>Ub1x;EX/>YEX
2022-06-01 10:25:53 UTC	127	IN	Data Raw: 58 04 8d 02 26 01 de 00 00 00 07 01 ba 01 6c fe a4 ff ff 00 8a 00 00 04 58 06 1e 02 26 01 de 00 00 01 07 00 9f 00 ae 00 1f 00 14 00 b0 00 45 58 b0 06 2f 1b b1 06 1c 3e 59 b1 0f 06 f4 30 31 ff ff 00 60 ff f0 04 5a 05 cb 02 26 01 dd 00 00 01 07 00 70 00 85 00 26 00 13 00 b0 00 45 58 b0 0a 2f 1b b1 0a 1c 3e 59 b0 1d dc 30 31 00 ff ff 00 60 ff f0 04 5a 05 f6 02 26 01 dd 00 00 01 07 00 a1 00 b2 00 1f 00 14 00 b0 00 45 58 b0 0a 2f 1b b1 0a 1c 3e 59 b1 1f 08 f4 30 31 ff ff 00 60 ff f0 04 5a 06 1d 02 26 01 dd 00 00 01 07 00 a6 01 07 00 1e 00 17 00 b0 00 45 58 b0 0a 2f 1b b1 0a 1c 3e 59 b1 1e 06 f4 b0 22 d0 30 31 00 ff ff 00 8a 00 00 04 25 06 1e 02 26 01 da 00 00 01 07 00 75 01 27 00 1e 00 14 00 b0 00 45 58 b0 05 2f 1b b1 05 1c 3e 59 b1 19 06 f4 30 31 ff ff 00 8a Data Ascii: X&lX&EX/>Y01`Z&p&EX/>Y01`Z&EX/>Y01`Z&EX/>Y"01%&u'EX/>Y01
2022-06-01 10:25:53 UTC	143	IN	Data Raw: 13 00 b0 00 45 58 b0 08 2f 1b b1 08 1c 3e 59 b0 0b dc 30 31 00 ff ff 00 22 ff ec 04 0b 05 cb 02 26 02 01 00 00 01 06 00 70 3a 26 00 13 00 b0 00 45 58 b0 11 2f 1b b1 11 1c 3e 59 b0 13 dc 30 31 00 ff ff 00 60 00 00 05 06 04 8d 02 06 01 f1 00 00 ff ff 00 97 ff f0 05 35 04 8d 00 26 01 e3 00 00 00 07 01 e2 01 e8 00 00 ff ff 00 09 00 00 05 f1 06 00 02 26 02 73 00 00 00 07 00 75 02 9e 00 00 ff ff 00 60 ff c7 04 5a 06 1e 02 26 02 75 00 00 00 07 00 75 01 7d 00 1e ff ff 00 43 fd ff 03 dd 04 9d 02 26 01 d9 00 00 00 07 01 ba 01 29 fe a0 ff ff 00 31 00 00 05 f1 06 1e 02 26 01 d5 00 00 00 07 00 44 01 a2 00 1e ff ff 00 31 00 00 05 f1 06 1e 02 26 01 d5 00 00 00 07 00 75 02 31 00 1e ff ff 00 31 00 00 05 f1 05 e3 02 26 01 d5 00 00 00 07 00 6a 01 6b 00 1e ff ff 00 0d 00 00 Data Ascii: EX/>Y01"&p:&EX/>Y01`5&&su`Z&uu}C&)1&D1&u11&jk
2022-06-01 10:25:53 UTC	159	IN	Data Raw: 01 02 2b 02 2b 00 01 02 2d 02 2d 00 01 02 30 02 33 00 01 02 5f 02 63 00 01 02 7a 02 e2 00 01 02 e5 03 8b 00 01 03 8d 03 a4 00 01 03 a6 03 b2 00 01 03 b4 03 bd 00 01 03 bf 03 da 00 01 03 de 03 de 00 01 03 e0 03 e7 00 01 03 e9 03 eb 00 01 03 ee 03 f2 00 01 03 f4 04 7c 00 01 04 7f 04 7f 00 01 04 82 04 83 00 01 04 85 04 86 00 01 04 88 04 8b 00 01 04 95 04 d0 00 01 04 d2 04 f1 00 01 04 f3 04 fa 00 01 04 fc 04 fd 00 01 05 07 05 0d 00 01 00 01 00 02 00 00 00 0c 00 00 00 2c 00 01 00 0e 00 a8 00 a8 00 a9 00 a9 00 aa 00 aa 00 ab 00 ab 00 ac 00 ac 01 24 01 25 01 26 01 27 00 01 00 05 00 79 00 a4 00 ad 00 ad 01 ba 00 00 00 01 00 00 00 0a 00 32 00 4c 00 04 44 46 4c 54 00 1a 63 79 72 6c 00 1a 67 72 65 6b 00 1a 6c 61 74 6e 00 1a 00 04 00 00 00 00 ff ff 00 02 00 00 00 01 Data Ascii: ++--03_cz\|,$%&'y2LDFLTcyrlgreklatn
2022-06-01 10:25:54 UTC	179	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0f 00 00 00 00 00 00 00 00 00 00 ff 95 ff d7 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ea 00 00 00 00 00 00 00 00 00 00 00 00 ff eb 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff e6 ff e1 ff e9 ff e5 ff e9 00 00 00 00 ff e7 ff d8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff c0 00 00 ff a3 00 00 00 00 00 00 00 00 ff bf ff e3 ff d8 ff bf ff d9 ff a2 ff b7 ff cb ff ec ff a0 00 11 00 12 ff ab ff c6 ff e2 ff f0 00 0d 00 00 00 00 00 00 ff e9 00 11 00 00 ff f3 00 00 ff 2d Data Ascii: -

Timestamp	kBytes transferred	Direction	Data
2022-06-01 10:25:53 UTC	44	OUT	GET /runtime-es2017.cc42f1147b3cbeba9d3c.js HTTP/1.1 Host: drvbylytre.mfs.gg Connection: keep-alive Origin: https://drvbylytre.mfs.gg User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://drvbylytre.mfs.gg/fzbw9Yh Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-06-01 10:25:54 UTC	175	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cache-Control: max-age=2592000 Content-Type: application/javascript Date: Wed, 01 Jun 2022 10:25:53 GMT ETag: "628e3250-fcd" Last-Modified: Wed, 25 May 2022 13:42:40 GMT Server: nginx/1.16.1 Content-Length: 4045 Connection: Close
2022-06-01 10:25:54 UTC	175	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 65 2c 74 3d 7b 7d 2c 72 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 6e 28 65 29 7b 76 61 72 20 6f 3d 72 5b 65 5d 3b 69 66 28 76 6f 69 64 20 30 21 3d 3d 6f 29 72 65 74 75 72 6e 20 6f 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 75 3d 72 5b 65 5d 3d 7b 69 64 3a 65 2c 6c 6f 61 64 65 64 3a 21 31 2c 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 72 65 74 75 72 6e 20 74 5b 65 5d 2e 63 61 6c 6c 28 75 2e 65 78 70 6f 72 74 73 2c 75 2c 75 2e 65 78 70 6f 72 74 73 2c 6e 29 2c 75 2e 6c 6f 61 64 65 64 3d 21 30 2c 75 2e 65 78 70 6f 72 74 73 7d 6e 2e 6d 3d 74 2c 65 3d 5b 5d 2c 6e 2e 4f 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 72 2c 6f 2c 75 29 7b 69 66 28 21 72 29 7b 76 61 72 20 69 3d 31 2f 30 3b 66 6f 72 28 64 Data Ascii: !function(){"use strict";var e,t={},r={};function n(e){var o=r[e];if(void 0!==o)return o.exports;var u=r[e]={id:e,loaded:!1,exports:{}};return t[e].call(u.exports,u,u.exports,n),u.loaded=!0,u.exports}n.m=t,e=[],n.O=function(t,r,o,u){if(!r){var i=1/0;for(d

Timestamp	kBytes transferred	Direction	Data
2022-06-01 10:25:53 UTC	45	OUT	GET /polyfills-es2017.39d4570d9e287f904b27.js HTTP/1.1 Host: drvbylytre.mfs.gg Connection: keep-alive Origin: https://drvbylytre.mfs.gg User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://drvbylytre.mfs.gg/fzbw9Yh Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-06-01 10:25:54 UTC	192	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cache-Control: max-age=2592000 Content-Type: application/javascript Date: Wed, 01 Jun 2022 10:25:53 GMT ETag: "628e3250-9246" Last-Modified: Wed, 25 May 2022 13:42:40 GMT Server: nginx/1.16.1 Content-Length: 37446 Connection: Close
2022-06-01 10:25:54 UTC	192	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 69 67 68 74 79 66 6f 72 6d 73 5f 66 72 6f 6e 74 65 6e 64 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 69 67 68 74 79 66 6f 72 6d 73 5f 66 72 6f 6e 74 65 6e 64 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 34 32 39 5d 2c 7b 37 32 37 37 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 21 66 75 6e 63 74 69 6f 6e 28 65 29 7b 63 6f 6e 73 74 20 74 3d 65 2e 70 65 72 66 6f 72 6d 61 6e 63 65 3b 66 75 6e 63 74 69 6f 6e 20 6e 28 65 29 7b 74 26 26 74 2e 6d 61 72 6b 26 26 74 2e 6d 61 72 6b 28 65 29 7d 66 75 6e 63 74 69 6f 6e 20 6f 28 65 2c 6e 29 7b 74 26 26 74 2e 6d 65 61 73 75 72 65 26 26 74 2e 6d 65 61 73 75 72 65 28 65 2c 6e 29 7d 6e 28 22 5a 6f 6e 65 22 29 3b 63 6f 6e 73 Data Ascii: "use strict";(self.webpackChunk_mightyforms_frontend=self.webpackChunk_mightyforms_frontend\|\|[]).push([[429],{7277:function(){!function(e){const t=e.performance;function n(e){t&&t.mark&&t.mark(e)}function o(e,n){t&&t.measure&&t.measure(e,n)}n("Zone");cons
2022-06-01 10:25:54 UTC	208	IN	Data Raw: 3d 21 30 29 2c 6f 2e 72 65 6a 65 63 74 69 6f 6e 3d 73 2c 6f 2e 70 72 6f 6d 69 73 65 3d 65 2c 6f 2e 7a 6f 6e 65 3d 74 2e 63 75 72 72 65 6e 74 2c 6f 2e 74 61 73 6b 3d 74 2e 63 75 72 72 65 6e 74 54 61 73 6b 2c 61 2e 70 75 73 68 28 6f 29 2c 6e 2e 73 63 68 65 64 75 6c 65 4d 69 63 72 6f 54 61 73 6b 28 29 7d 7d 7d 72 65 74 75 72 6e 20 65 7d 63 6f 6e 73 74 20 53 3d 73 28 22 72 65 6a 65 63 74 69 6f 6e 48 61 6e 64 6c 65 64 48 61 6e 64 6c 65 72 22 29 3b 66 75 6e 63 74 69 6f 6e 20 44 28 65 29 7b 69 66 28 30 3d 3d 3d 65 5b 67 5d 29 7b 74 72 79 7b 63 6f 6e 73 74 20 6e 3d 74 5b 53 5d 3b 6e 26 26 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 6e 26 26 6e 2e 63 61 6c 6c 28 74 68 69 73 2c 7b 72 65 6a 65 63 74 69 6f 6e 3a 65 5b 5f 5d 2c 70 72 6f 6d 69 73 65 3a 65 Data Ascii: =!0),o.rejection=s,o.promise=e,o.zone=t.current,o.task=t.currentTask,a.push(o),n.scheduleMicroTask()}}}return e}const S=s("rejectionHandledHandler");function D(e){if(0===e[g]){try{const n=t[S];n&&"function"==typeof n&&n.call(this,{rejection:e[_],promise:e
2022-06-01 10:25:54 UTC	256	IN	Data Raw: 72 5d 3d 69 7d 63 6f 6e 73 74 20 69 3d 65 2e 45 76 65 6e 74 54 61 72 67 65 74 3b 69 26 26 69 2e 70 72 6f 74 6f 74 79 70 65 26 26 74 2e 70 61 74 63 68 45 76 65 6e 74 54 61 72 67 65 74 28 65 2c 5b 69 26 26 69 2e 70 72 6f 74 6f 74 79 70 65 5d 29 7d 28 65 2c 6e 29 3b 63 6f 6e 73 74 20 6f 3d 65 2e 58 4d 4c 48 74 74 70 52 65 71 75 65 73 74 45 76 65 6e 74 54 61 72 67 65 74 3b 6f 26 26 6f 2e 70 72 6f 74 6f 74 79 70 65 26 26 6e 2e 70 61 74 63 68 45 76 65 6e 74 54 61 72 67 65 74 28 65 2c 5b 6f 2e 70 72 6f 74 6f 74 79 70 65 5d 29 7d 29 2c 5a 6f 6e 65 2e 5f 5f 6c 6f 61 64 5f 70 61 74 63 68 28 22 4d 75 74 61 74 69 6f 6e 4f 62 73 65 72 76 65 72 22 2c 28 65 2c 74 2c 6e 29 3d 3e 7b 43 28 22 4d 75 74 61 74 69 6f 6e 4f 62 73 65 72 76 65 72 22 29 2c 43 28 22 57 65 62 4b 69 Data Ascii: r]=i}const i=e.EventTarget;i&&i.prototype&&t.patchEventTarget(e,[i&&i.prototype])}(e,n);const o=e.XMLHttpRequestEventTarget;o&&o.prototype&&n.patchEventTarget(e,[o.prototype])}),Zone.__load_patch("MutationObserver",(e,t,n)=>{C("MutationObserver"),C("WebKi

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://drvbylytre.mfs.gg/fzbw9Yh

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic

C:\Users\user\AppData\Local\Google\Chrome\User Data\20374963-2855-4294-a9f0-79f3967cd4cb.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\2758f155-7837-4aeb-aa6d-cf0fcf36aa1a.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\5e6ce59d-df61-4946-a238-3df8ae9a6770.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\00b926ca-1438-46af-975b-08fc56d862f9.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\4d1f8a5e-29e4-42a4-a77c-1b3d4cf25f57.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\7f74a8d2-89c9-4afd-a6a1-8a9bf27b33fc.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\000003.log

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG.old (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Provider Cache

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network Persistent State (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Preferences (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\GPUCache\data_1

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Network Persistent State (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\e0c9db8a-c57c-41df-b906-6f2ff4d66d59.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\TransportSecurity (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\b93b8dc4-53e4-41ff-95d2-9825e487101c.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\c798146a-fe3b-4a90-9dc9-f57073bb9f06.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000004.dbtmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\CURRENT (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\f643eff9-742b-43df-802d-9878a7bebcd7.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Last Browser

C:\Users\user\AppData\Local\Google\Chrome\User Data\Last Version

C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Module Info Cache (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\b1403bf4-ec3e-4766-9bcf-6fffa2d67363.tmp

C:\Users\user\AppData\Local\Temp\c05a3141-9d8d-40f2-8145-d24704268464.tmp

Windows Analysis Report
https://drvbylytre.mfs.gg/fzbw9Yh

Timestamp	kBytes transferred	Direction	Data
2022-06-01 10:25:53 UTC	46	OUT	GET /scripts.96290088fc75d119f910.js HTTP/1.1 Host: drvbylytre.mfs.gg Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://drvbylytre.mfs.gg/fzbw9Yh Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-06-01 10:25:54 UTC	261	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cache-Control: max-age=2592000 Content-Type: application/javascript Date: Wed, 01 Jun 2022 10:25:54 GMT ETag: "628e324f-7965" Last-Modified: Wed, 25 May 2022 13:42:39 GMT Server: nginx/1.16.1 Content-Length: 31077 Connection: Close
2022-06-01 10:25:54 UTC	261	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 74 29 7b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 74 28 29 3a 77 69 6e 64 6f 77 2e 69 6e 74 6c 54 65 6c 49 6e 70 75 74 3d 74 28 29 7d 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 69 28 74 2c 69 29 7b 66 6f 72 28 76 61 72 20 65 3d 30 3b 65 3c 69 2e 6c 65 6e 67 74 68 3b 65 2b 2b 29 7b 76 61 72 20 61 3d 69 5b 65 5d 3b 61 2e 65 6e 75 6d 65 72 61 62 6c 65 3d 61 2e 65 6e 75 6d 65 72 61 62 6c 65 7c 7c 21 31 2c 61 2e 63 6f 6e 66 69 67 75 72 61 62 6c 65 3d 21 30 2c 22 76 61 6c 75 65 22 69 6e 20 61 26 Data Ascii: !function(t){"object"==typeof module&&module.exports?module.exports=t():window.intlTelInput=t()}(function(t){"use strict";return function(){function i(t,i){for(var e=0;e<i.length;e++){var a=i[e];a.enumerable=a.enumerable\|\|!1,a.configurable=!0,"value"in a&
2022-06-01 10:25:54 UTC	277	IN	Data Raw: 73 65 6c 65 63 74 65 64 46 6c 61 67 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 74 61 62 69 6e 64 65 78 22 2c 22 30 22 29 2c 74 68 69 73 2e 75 3d 74 68 69 73 2e 5f 65 32 28 22 64 69 76 22 2c 7b 63 6c 61 73 73 3a 22 69 74 69 5f 5f 61 72 72 6f 77 22 7d 2c 74 68 69 73 2e 73 65 6c 65 63 74 65 64 46 6c 61 67 29 2c 74 68 69 73 2e 6d 3d 74 68 69 73 2e 5f 65 32 28 22 75 6c 22 2c 7b 63 6c 61 73 73 3a 22 69 74 69 5f 5f 63 6f 75 6e 74 72 79 2d 6c 69 73 74 20 69 74 69 5f 5f 68 69 64 65 22 2c 69 64 3a 22 69 74 69 2d 22 2e 63 6f 6e 63 61 74 28 74 68 69 73 2e 69 64 2c 22 5f 5f 63 6f 75 6e 74 72 79 2d 6c 69 73 74 62 6f 78 22 29 2c 72 6f 6c 65 3a 22 6c 69 73 74 62 6f 78 22 2c 22 61 72 69 61 2d 6c 61 62 65 6c 22 3a 22 4c 69 73 74 20 6f 66 20 63 6f 75 6e 74 72 69 65 73 22 Data Ascii: selectedFlag.setAttribute("tabindex","0"),this.u=this._e2("div",{class:"iti__arrow"},this.selectedFlag),this.m=this._e2("ul",{class:"iti__country-list iti__hide",id:"iti-".concat(this.id,"__country-listbox"),role:"listbox","aria-label":"List of countries"

Timestamp	kBytes transferred	Direction	Data
2022-06-01 10:25:53 UTC	46	OUT	GET /styles.a94b4396efde6a3506b7.css HTTP/1.1 Host: drvbylytre.mfs.gg Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://drvbylytre.mfs.gg/fzbw9Yh Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-06-01 10:25:54 UTC	291	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cache-Control: max-age=2592000 Content-Type: text/css Date: Wed, 01 Jun 2022 10:25:54 GMT ETag: "628e324f-19b73" Last-Modified: Wed, 25 May 2022 13:42:39 GMT Server: nginx/1.16.1 Content-Length: 105331 Connection: Close
2022-06-01 10:25:54 UTC	292	IN	Data Raw: 2e 6d 61 74 2d 62 61 64 67 65 2d 63 6f 6e 74 65 6e 74 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 36 30 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 52 6f 62 6f 74 6f 2c 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 2c 73 61 6e 73 2d 73 65 72 69 66 7d 2e 6d 61 74 2d 62 61 64 67 65 2d 73 6d 61 6c 6c 20 2e 6d 61 74 2d 62 61 64 67 65 2d 63 6f 6e 74 65 6e 74 7b 66 6f 6e 74 2d 73 69 7a 65 3a 39 70 78 7d 2e 6d 61 74 2d 62 61 64 67 65 2d 6c 61 72 67 65 20 2e 6d 61 74 2d 62 61 64 67 65 2d 63 6f 6e 74 65 6e 74 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 34 70 78 7d 2e 6d 61 74 2d 68 31 2c 2e 6d 61 74 2d 68 65 61 64 6c 69 6e 65 2c 2e 6d 61 74 2d 74 79 70 6f 67 72 61 70 68 79 20 68 31 7b 66 6f 6e 74 3a 34 30 30 20 32 34 70 78 2f 33 32 70 78 Data Ascii: .mat-badge-content{font-weight:600;font-size:12px;font-family:Roboto,Helvetica Neue,sans-serif}.mat-badge-small .mat-badge-content{font-size:9px}.mat-badge-large .mat-badge-content{font-size:24px}.mat-h1,.mat-headline,.mat-typography h1{font:400 24px/32px
2022-06-01 10:25:54 UTC	307	IN	Data Raw: 32 31 70 78 20 32 70 78 20 72 67 62 61 28 30 2c 30 2c 30 2c 2e 31 34 29 2c 30 20 35 70 78 20 32 36 70 78 20 34 70 78 20 72 67 62 61 28 30 2c 30 2c 30 2c 2e 31 32 29 7d 2e 6d 61 74 2d 65 6c 65 76 61 74 69 6f 6e 2d 7a 31 35 7b 62 6f 78 2d 73 68 61 64 6f 77 3a 30 20 38 70 78 20 39 70 78 20 2d 35 70 78 20 72 67 62 61 28 30 2c 30 2c 30 2c 2e 32 29 2c 30 20 31 35 70 78 20 32 32 70 78 20 32 70 78 20 72 67 62 61 28 30 2c 30 2c 30 2c 2e 31 34 29 2c 30 20 36 70 78 20 32 38 70 78 20 35 70 78 20 72 67 62 61 28 30 2c 30 2c 30 2c 2e 31 32 29 7d 2e 6d 61 74 2d 65 6c 65 76 61 74 69 6f 6e 2d 7a 31 36 7b 62 6f 78 2d 73 68 61 64 6f 77 3a 30 20 38 70 78 20 31 30 70 78 20 2d 35 70 78 20 72 67 62 61 28 30 2c 30 2c 30 2c 2e 32 29 2c 30 20 31 36 70 78 20 32 34 70 78 20 32 70 78 Data Ascii: 21px 2px rgba(0,0,0,.14),0 5px 26px 4px rgba(0,0,0,.12)}.mat-elevation-z15{box-shadow:0 8px 9px -5px rgba(0,0,0,.2),0 15px 22px 2px rgba(0,0,0,.14),0 6px 28px 5px rgba(0,0,0,.12)}.mat-elevation-z16{box-shadow:0 8px 10px -5px rgba(0,0,0,.2),0 16px 24px 2px
2022-06-01 10:25:54 UTC	371	IN	Data Raw: 76 65 7b 63 6f 6c 6f 72 3a 23 66 66 66 3b 6f 70 61 63 69 74 79 3a 2e 34 7d 2e 6d 61 74 2d 63 68 69 70 2e 6d 61 74 2d 73 74 61 6e 64 61 72 64 2d 63 68 69 70 2e 6d 61 74 2d 63 68 69 70 2d 73 65 6c 65 63 74 65 64 2e 6d 61 74 2d 61 63 63 65 6e 74 20 2e 6d 61 74 2d 72 69 70 70 6c 65 2d 65 6c 65 6d 65 6e 74 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 30 2c 30 25 2c 31 30 30 25 2c 2e 31 29 7d 2e 6d 61 74 2d 74 61 62 6c 65 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 7d 2e 6d 61 74 2d 74 61 62 6c 65 2d 73 74 69 63 6b 79 2c 2e 6d 61 74 2d 74 61 62 6c 65 20 74 62 6f 64 79 2c 2e 6d 61 74 2d 74 61 62 6c 65 20 74 66 6f 6f 74 2c 2e 6d 61 74 2d 74 61 62 6c 65 20 74 68 65 61 64 2c 5b 6d 61 74 2d 66 6f 6f 74 65 72 2d 72 6f 77 5d 2c 5b 6d 61 74 Data Ascii: ve{color:#fff;opacity:.4}.mat-chip.mat-standard-chip.mat-chip-selected.mat-accent .mat-ripple-element{background-color:hsla(0,0%,100%,.1)}.mat-table{background:#fff}.mat-table-sticky,.mat-table tbody,.mat-table tfoot,.mat-table thead,[mat-footer-row],[mat
2022-06-01 10:25:54 UTC	387	IN	Data Raw: 6e 6e 65 72 2e 6d 61 74 2d 61 63 63 65 6e 74 20 63 69 72 63 6c 65 2c 2e 6d 61 74 2d 73 70 69 6e 6e 65 72 20 63 69 72 63 6c 65 7b 73 74 72 6f 6b 65 3a 23 32 36 32 64 35 37 7d 2e 6d 61 74 2d 70 72 6f 67 72 65 73 73 2d 73 70 69 6e 6e 65 72 2e 6d 61 74 2d 77 61 72 6e 20 63 69 72 63 6c 65 2c 2e 6d 61 74 2d 73 70 69 6e 6e 65 72 2e 6d 61 74 2d 77 61 72 6e 20 63 69 72 63 6c 65 7b 73 74 72 6f 6b 65 3a 23 66 34 34 33 33 36 7d 2e 6d 61 74 2d 72 61 64 69 6f 2d 6f 75 74 65 72 2d 63 69 72 63 6c 65 7b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 72 67 62 61 28 30 2c 30 2c 30 2c 2e 35 34 29 7d 2e 6d 61 74 2d 72 61 64 69 6f 2d 62 75 74 74 6f 6e 2e 6d 61 74 2d 70 72 69 6d 61 72 79 2e 6d 61 74 2d 72 61 64 69 6f 2d 63 68 65 63 6b 65 64 20 2e 6d 61 74 2d 72 61 64 69 6f 2d 6f 75 74 Data Ascii: nner.mat-accent circle,.mat-spinner circle{stroke:#262d57}.mat-progress-spinner.mat-warn circle,.mat-spinner.mat-warn circle{stroke:#f44336}.mat-radio-outer-circle{border-color:rgba(0,0,0,.54)}.mat-radio-button.mat-primary.mat-radio-checked .mat-radio-out
2022-06-01 10:25:54 UTC	403	IN	Data Raw: 65 72 2d 70 61 67 69 6e 61 74 69 6f 6e 2d 64 69 73 61 62 6c 65 64 20 2e 6d 61 74 2d 74 61 62 2d 68 65 61 64 65 72 2d 70 61 67 69 6e 61 74 69 6f 6e 2d 63 68 65 76 72 6f 6e 2c 2e 6d 61 74 2d 74 61 62 2d 6e 61 76 2d 62 61 72 2e 6d 61 74 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 70 72 69 6d 61 72 79 3e 2e 6d 61 74 2d 74 61 62 2d 68 65 61 64 65 72 20 2e 6d 61 74 2d 74 61 62 2d 68 65 61 64 65 72 2d 70 61 67 69 6e 61 74 69 6f 6e 2d 64 69 73 61 62 6c 65 64 20 2e 6d 61 74 2d 74 61 62 2d 68 65 61 64 65 72 2d 70 61 67 69 6e 61 74 69 6f 6e 2d 63 68 65 76 72 6f 6e 7b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 30 2c 30 25 2c 31 30 30 25 2c 2e 34 29 7d 2e 6d 61 74 2d 74 61 62 2d 67 72 6f 75 70 2e 6d 61 74 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 70 72 69 6d 61 72 79 3e Data Ascii: er-pagination-disabled .mat-tab-header-pagination-chevron,.mat-tab-nav-bar.mat-background-primary>.mat-tab-header .mat-tab-header-pagination-disabled .mat-tab-header-pagination-chevron{border-color:hsla(0,0%,100%,.4)}.mat-tab-group.mat-background-primary>
2022-06-01 10:25:54 UTC	531	IN	Data Raw: 31 2e 35 65 6d 7d 2e 6f 77 6c 2d 64 74 2d 63 6f 6e 74 72 6f 6c 2d 61 72 72 6f 77 2d 62 75 74 74 6f 6e 5b 64 69 73 61 62 6c 65 64 5d 7b 63 6f 6c 6f 72 3a 72 67 62 61 28 30 2c 30 2c 30 2c 2e 34 29 3b 63 75 72 73 6f 72 3a 64 65 66 61 75 6c 74 7d 2e 6f 77 6c 2d 64 74 2d 63 6f 6e 74 72 6f 6c 2d 61 72 72 6f 77 2d 62 75 74 74 6f 6e 20 73 76 67 7b 77 69 64 74 68 3a 35 30 25 3b 68 65 69 67 68 74 3a 35 30 25 3b 66 69 6c 6c 3a 63 75 72 72 65 6e 74 43 6f 6c 6f 72 7d 2e 6f 77 6c 2d 64 74 2d 69 6e 6c 69 6e 65 2d 63 6f 6e 74 61 69 6e 65 72 2c 2e 6f 77 6c 2d 64 74 2d 70 6f 70 75 70 2d 63 6f 6e 74 61 69 6e 65 72 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 77 69 64 74 68 3a 31 38 2e 35 65 6d 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 30 20 35 70 78 20 35 70 78 20 2d Data Ascii: 1.5em}.owl-dt-control-arrow-button[disabled]{color:rgba(0,0,0,.4);cursor:default}.owl-dt-control-arrow-button svg{width:50%;height:50%;fill:currentColor}.owl-dt-inline-container,.owl-dt-popup-container{position:relative;width:18.5em;box-shadow:0 5px 5px -
2022-06-01 10:25:54 UTC	547	IN	Data Raw: 74 3a 31 30 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 2d 33 31 36 30 70 78 20 30 7d 2e 69 74 69 5f 5f 66 6c 61 67 2e 69 74 69 5f 5f 6d 65 7b 68 65 69 67 68 74 3a 31 30 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 2d 33 31 38 32 70 78 20 30 7d 2e 69 74 69 5f 5f 66 6c 61 67 2e 69 74 69 5f 5f 6d 66 7b 68 65 69 67 68 74 3a 31 34 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 2d 33 32 30 34 70 78 20 30 7d 2e 69 74 69 5f 5f 66 6c 61 67 2e 69 74 69 5f 5f 6d 67 7b 68 65 69 67 68 74 3a 31 34 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 2d 33 32 32 36 70 78 20 30 7d 2e 69 74 69 5f 5f 66 6c 61 67 2e 69 74 69 5f 5f 6d 68 7b 68 65 69 67 68 74 3a 31 31 70 78 3b 62 61 63 6b Data Ascii: t:10px;background-position:-3160px 0}.iti__flag.iti__me{height:10px;background-position:-3182px 0}.iti__flag.iti__mf{height:14px;background-position:-3204px 0}.iti__flag.iti__mg{height:14px;background-position:-3226px 0}.iti__flag.iti__mh{height:11px;back

Timestamp	kBytes transferred	Direction	Data
2022-06-01 10:25:55 UTC	2673	OUT	GET /587-es2017.b4420bec13516f6c2500.js HTTP/1.1 Host: drvbylytre.mfs.gg Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://drvbylytre.mfs.gg/fzbw9Yh Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-06-01 10:25:56 UTC	2799	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cache-Control: max-age=2592000 Content-Type: application/javascript Date: Wed, 01 Jun 2022 10:25:56 GMT ETag: "628e324f-100e8" Last-Modified: Wed, 25 May 2022 13:42:39 GMT Server: nginx/1.16.1 Content-Length: 65768 Connection: Close
2022-06-01 10:25:56 UTC	2799	IN	Data Raw: 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 69 67 68 74 79 66 6f 72 6d 73 5f 66 72 6f 6e 74 65 6e 64 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 69 67 68 74 79 66 6f 72 6d 73 5f 66 72 6f 6e 74 65 6e 64 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 35 38 37 5d 2c 7b 31 32 35 38 37 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 75 6e 63 74 69 6f 6e 20 65 28 74 29 7b 72 65 74 75 72 6e 28 65 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 26 26 22 73 79 6d 62 6f 6c 22 3d 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 3f 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 79 70 65 Data Ascii: (self.webpackChunk_mightyforms_frontend=self.webpackChunk_mightyforms_frontend\|\|[]).push([[587],{12587:function(e){e.exports=function(){"use strict";function e(t){return(e="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return type
2022-06-01 10:25:56 UTC	2815	IN	Data Raw: 2e 70 72 6f 74 6f 74 79 70 65 2e 75 6e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 5f 61 64 64 4f 70 65 72 61 74 69 6f 6e 28 22 24 75 6e 73 65 74 22 2c 65 2c 22 2d 22 29 2c 74 68 69 73 7d 2c 72 65 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 61 64 64 4f 70 65 72 61 74 69 6f 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 74 68 69 73 2e 75 73 65 72 50 72 6f 70 65 72 74 69 65 73 4f 70 65 72 61 74 69 6f 6e 73 2c 6f 65 29 3f 41 2e 65 72 72 6f 72 28 22 54 68 69 73 20 69 64 65 6e 74 69 66 79 20 61 6c 72 65 61 64 79 20 63 6f 6e 74 61 69 6e 73 20 61 20 24 63 6c 65 61 72 41 6c 6c 20 6f 70 65 72 61 74 69 6f 6e 2c 20 73 Data Ascii: .prototype.unset=function(e){return this._addOperation("$unset",e,"-"),this},re.prototype._addOperation=function(e,t,n){Object.prototype.hasOwnProperty.call(this.userPropertiesOperations,oe)?A.error("This identify already contains a $clearAll operation, s
2022-06-01 10:25:56 UTC	2817	IN	Data Raw: 34 31 31 30 31 29 2c 66 3d 6f 28 66 2c 76 2c 64 2c 68 2c 65 5b 69 2b 31 34 5d 2c 31 37 2c 2d 31 35 30 32 30 30 32 32 39 30 29 2c 64 3d 72 28 64 2c 68 3d 6f 28 68 2c 66 2c 76 2c 64 2c 65 5b 69 2b 31 35 5d 2c 32 32 2c 31 32 33 36 35 33 35 33 32 39 29 2c 66 2c 76 2c 65 5b 69 2b 31 5d 2c 35 2c 2d 31 36 35 37 39 36 35 31 30 29 2c 76 3d 72 28 76 2c 64 2c 68 2c 66 2c 65 5b 69 2b 36 5d 2c 39 2c 2d 31 30 36 39 35 30 31 36 33 32 29 2c 66 3d 72 28 66 2c 76 2c 64 2c 68 2c 65 5b 69 2b 31 31 5d 2c 31 34 2c 36 34 33 37 31 37 37 31 33 29 2c 68 3d 72 28 68 2c 66 2c 76 2c 64 2c 65 5b 69 5d 2c 32 30 2c 2d 33 37 33 38 39 37 33 30 32 29 2c 64 3d 72 28 64 2c 68 2c 66 2c 76 2c 65 5b 69 2b 35 5d 2c 35 2c 2d 37 30 31 35 35 38 36 39 31 29 2c 76 3d 72 28 76 2c 64 2c 68 2c 66 2c 65 Data Ascii: 41101),f=o(f,v,d,h,e[i+14],17,-1502002290),d=r(d,h=o(h,f,v,d,e[i+15],22,1236535329),f,v,e[i+1],5,-165796510),v=r(v,d,h,f,e[i+6],9,-1069501632),f=r(f,v,d,h,e[i+11],14,643717713),h=r(h,f,v,d,e[i],20,-373897302),d=r(d,h,f,v,e[i+5],5,-701558691),v=r(v,d,h,f,e
2022-06-01 10:25:56 UTC	2835	IN	Data Raw: 50 6c 75 73 22 5d 2c 5b 75 2c 68 5d 5d 2c 5b 2f 61 6e 64 72 6f 69 64 2e 2b 5b 3b 5c 2f 5d 5c 73 2a 28 52 43 54 5b 5c 64 5c 77 5d 2b 29 5c 73 2b 62 75 69 6c 64 2f 69 5d 2c 5b 73 2c 5b 63 2c 22 52 43 41 22 5d 2c 5b 75 2c 66 5d 5d 2c 5b 2f 61 6e 64 72 6f 69 64 2e 2b 5b 3b 5c 2f 5c 73 5d 2b 28 56 65 6e 75 65 5b 5c 64 5c 73 5d 7b 32 2c 37 7d 29 5c 73 2b 62 75 69 6c 64 2f 69 5d 2c 5b 73 2c 5b 63 2c 22 44 65 6c 6c 22 5d 2c 5b 75 2c 66 5d 5d 2c 5b 2f 61 6e 64 72 6f 69 64 2e 2b 5b 3b 5c 2f 5d 5c 73 2a 28 51 5b 54 7c 4d 5d 5b 5c 64 5c 77 5d 2b 29 5c 73 2b 62 75 69 6c 64 2f 69 5d 2c 5b 73 2c 5b 63 2c 22 56 65 72 69 7a 6f 6e 22 5d 2c 5b 75 2c 66 5d 5d 2c 5b 2f 61 6e 64 72 6f 69 64 2e 2b 5b 3b 5c 2f 5d 5c 73 2b 28 42 61 72 6e 65 73 5b 26 5c 73 5d 2b 4e 6f 62 6c 65 5c Data Ascii: Plus"],[u,h]],[/android.+[;\/]\s(RCT[\d\w]+)\s+build/i],[s,[c,"RCA"],[u,f]],[/android.+[;\/\s]+(Venue[\d\s]{2,7})\s+build/i],[s,[c,"Dell"],[u,f]],[/android.+[;\/]\s(Q[T\|M][\d\w]+)\s+build/i],[s,[c,"Verizon"],[u,f]],[/android.+[;\/]\s+(Barnes[&\s]+Noble\
2022-06-01 10:25:56 UTC	2851	IN	Data Raw: 29 29 3b 65 2e 69 64 65 6e 74 69 66 79 28 6e 29 7d 7d 3b 53 65 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 67 65 74 52 65 66 65 72 72 65 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 64 6f 63 75 6d 65 6e 74 2e 72 65 66 65 72 72 65 72 7d 2c 53 65 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 67 65 74 55 72 6c 50 61 72 61 6d 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6c 6f 63 61 74 69 6f 6e 2e 73 65 61 72 63 68 7d 2c 53 65 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 73 61 76 65 47 63 6c 69 64 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 43 28 22 67 63 6c 69 64 22 2c 65 29 3b 69 66 28 21 52 28 74 29 29 7b 76 61 72 20 6e 3d 7b 67 63 6c 69 64 3a 74 7d 3b 72 65 74 75 72 6e 20 43 65 28 74 68 69 73 2c 6e 29 2c 6e 7d 7d 2c 53 65 2e 70 72 6f 74 6f Data Ascii: ));e.identify(n)}};Se.prototype._getReferrer=function(){return document.referrer},Se.prototype._getUrlParams=function(){return location.search},Se.prototype._saveGclid=function(e){var t=C("gclid",e);if(!R(t)){var n={gclid:t};return Ce(this,n),n}},Se.proto

Target ID:	0
Start time:	12:25:48
Start date:	01/06/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "https://drvbylytre.mfs.gg/fzbw9Yh
Imagebase:	0x7ff6220c0000
File size:	2150896 bytes
MD5 hash:	C139654B5C1438A95B321BB01AD63EF6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Target ID:	2
Start time:	12:25:50
Start date:	01/06/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1536,4363419785747754873,8297120605393942811,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1960 /prefetch:8
Imagebase:	0x7ff6220c0000
File size:	2150896 bytes
MD5 hash:	C139654B5C1438A95B321BB01AD63EF6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre