Windows Analysis Report
http://smenet.org/ViewSwitcher/SwitchView?mobile=True&returnUrl=http://xx6v1x.caobatours.com#YXRvbC5vbmxpbmVAY2FhLmNvLnVr

Overview

General Information

Sample URL: http://smenet.org/ViewSwitcher/SwitchView?mobile=True&returnUrl=http://xx6v1x.caobatours.com#YXRvbC5vbmxpbmVAY2FhLmNvLnVr
Analysis ID: 1271053
Infos:

Detection

Score: 0
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

No high impact signatures.

Classification

There are no high impact signatures.

Source: https://yylinvaant.bureaurid.tech/?email=YXRvbC5vbmxpbmVAY2FhLmNvLnVr HTTP Parser: No favicon
Source: https://yylinvaant.bureaurid.tech/?email=YXRvbC5vbmxpbmVAY2FhLmNvLnVr HTTP Parser: No favicon
Source: https://yylinvaant.bureaurid.tech/?email=YXRvbC5vbmxpbmVAY2FhLmNvLnVr HTTP Parser: No favicon
Source: https://yylinvaant.bureaurid.tech/?email=YXRvbC5vbmxpbmVAY2FhLmNvLnVr HTTP Parser: No favicon
Source: https://yylinvaant.bureaurid.tech/?email=YXRvbC5vbmxpbmVAY2FhLmNvLnVr HTTP Parser: No favicon
Source: https://yylinvaant.bureaurid.tech/?email=YXRvbC5vbmxpbmVAY2FhLmNvLnVr HTTP Parser: No favicon
Source: https://yylinvaant.bureaurid.tech/?email=YXRvbC5vbmxpbmVAY2FhLmNvLnVr HTTP Parser: No favicon
Source: https://yylinvaant.bureaurid.tech/?email=YXRvbC5vbmxpbmVAY2FhLmNvLnVr HTTP Parser: No favicon
Source: https://yylinvaant.bureaurid.tech/?email=YXRvbC5vbmxpbmVAY2FhLmNvLnVr HTTP Parser: No favicon
Source: https://yylinvaant.bureaurid.tech/?email=YXRvbC5vbmxpbmVAY2FhLmNvLnVr HTTP Parser: No favicon
Source: https://yylinvaant.bureaurid.tech/?email=YXRvbC5vbmxpbmVAY2FhLmNvLnVr HTTP Parser: No favicon
Source: https://yylinvaant.bureaurid.tech/?email=YXRvbC5vbmxpbmVAY2FhLmNvLnVr HTTP Parser: No favicon
Source: unknown HTTPS traffic detected: 40.126.32.140:443 -> 192.168.11.20:50188 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.126.32.140:443 -> 192.168.11.20:50189 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.126.32.140:443 -> 192.168.11.20:50189 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.126.32.140:443 -> 192.168.11.20:50190 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.126.32.140:443 -> 192.168.11.20:54679 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.23.104.113:443 -> 192.168.11.20:62000 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.223.46.67:443 -> 192.168.11.20:62001 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.184.217.20:443 -> 192.168.11.20:62452 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.184.217.20:443 -> 192.168.11.20:62453 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.184.217.20:443 -> 192.168.11.20:59716 version: TLS 1.2
Source: global traffic HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=94.0.4606.61&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-94.0.4606.61Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /ViewSwitcher/SwitchView?mobile=True&returnUrl=http://xx6v1x.caobatours.com HTTP/1.1Host: smenet.orgConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="94", "Google Chrome";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /ViewSwitcher/SwitchView?mobile=True&returnUrl=http://xx6v1x.caobatours.com HTTP/1.1Host: www.smenet.orgConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="94", "Google Chrome";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ARRAffinity=4f614c86e9b5e6193efc0ca76334e75894cd3a64871780a2020181bb53745290; ARRAffinitySameSite=4f614c86e9b5e6193efc0ca76334e75894cd3a64871780a2020181bb53745290
Source: global traffic HTTP traffic detected: GET /?email=YXRvbC5vbmxpbmVAY2FhLmNvLnVr HTTP/1.1Host: yylinvaant.bureaurid.techConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Google Chrome";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: http://xx6v1x.caobatours.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /assets/style.css HTTP/1.1Host: yylinvaant.bureaurid.techConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Google Chrome";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://yylinvaant.bureaurid.tech/?email=YXRvbC5vbmxpbmVAY2FhLmNvLnVrAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=12b7a0fb2c4e8907d90ed7ccac6c1276
Source: global traffic HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: yylinvaant.bureaurid.techConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Google Chrome";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://yylinvaant.bureaurid.tech/?email=YXRvbC5vbmxpbmVAY2FhLmNvLnVrAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=12b7a0fb2c4e8907d90ed7ccac6c1276
Source: global traffic HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: yylinvaant.bureaurid.techConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=12b7a0fb2c4e8907d90ed7ccac6c1276
Source: global traffic HTTP traffic detected: GET /?email=YXRvbC5vbmxpbmVAY2FhLmNvLnVr HTTP/1.1Host: yylinvaant.bureaurid.techConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Chromium";v="94", "Google Chrome";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://yylinvaant.bureaurid.tech/?email=YXRvbC5vbmxpbmVAY2FhLmNvLnVrAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=12b7a0fb2c4e8907d90ed7ccac6c1276
Source: global traffic HTTP traffic detected: GET /assets/style.css HTTP/1.1Host: yylinvaant.bureaurid.techConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Google Chrome";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://yylinvaant.bureaurid.tech/?email=YXRvbC5vbmxpbmVAY2FhLmNvLnVrAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=12b7a0fb2c4e8907d90ed7ccac6c1276
Source: global traffic HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: yylinvaant.bureaurid.techConnection: keep-alivePragma: no-cacheCache-Control: no-cachesec-ch-ua: "Chromium";v="94", "Google Chrome";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://yylinvaant.bureaurid.tech/?email=YXRvbC5vbmxpbmVAY2FhLmNvLnVrAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=12b7a0fb2c4e8907d90ed7ccac6c1276
Source: global traffic HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: yylinvaant.bureaurid.techConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=12b7a0fb2c4e8907d90ed7ccac6c1276
Source: global traffic HTTP traffic detected: GET /?email=YXRvbC5vbmxpbmVAY2FhLmNvLnVr HTTP/1.1Host: yylinvaant.bureaurid.techConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Chromium";v="94", "Google Chrome";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://yylinvaant.bureaurid.tech/?email=YXRvbC5vbmxpbmVAY2FhLmNvLnVrAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=12b7a0fb2c4e8907d90ed7ccac6c1276
Source: global traffic HTTP traffic detected: GET /assets/style.css HTTP/1.1Host: yylinvaant.bureaurid.techConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Google Chrome";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://yylinvaant.bureaurid.tech/?email=YXRvbC5vbmxpbmVAY2FhLmNvLnVrAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=12b7a0fb2c4e8907d90ed7ccac6c1276
Source: global traffic HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: yylinvaant.bureaurid.techConnection: keep-alivePragma: no-cacheCache-Control: no-cachesec-ch-ua: "Chromium";v="94", "Google Chrome";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://yylinvaant.bureaurid.tech/?email=YXRvbC5vbmxpbmVAY2FhLmNvLnVrAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=12b7a0fb2c4e8907d90ed7ccac6c1276
Source: global traffic HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: yylinvaant.bureaurid.techConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=12b7a0fb2c4e8907d90ed7ccac6c1276
Source: global traffic HTTP traffic detected: GET /ViewSwitcher/SwitchView?mobile=True&returnUrl=http://xx6v1x.caobatours.com HTTP/1.1Host: smenet.orgConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /ViewSwitcher/SwitchView?mobile=True&returnUrl=http://xx6v1x.caobatours.com HTTP/1.1Host: www.smenet.orgConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: xx6v1x.caobatours.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: unknown DNS traffic detected: queries for: clients2.google.com
Source: global traffic TCP traffic: 192.168.11.20:62190 -> 239.255.255.250:1900
Source: global traffic TCP traffic: 192.168.11.20:62190 -> 239.255.255.250:1900
Source: global traffic TCP traffic: 192.168.11.20:62190 -> 239.255.255.250:1900
Source: global traffic TCP traffic: 192.168.11.20:62190 -> 239.255.255.250:1900
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKConnection: Keep-AliveKeep-Alive: timeout=5, max=100content-type: text/html; charset=UTF-8content-length: 159content-encoding: gzipvary: Accept-Encodingdate: Tue, 11 Jul 2023 15:41:27 GMTserver: LiteSpeedData Raw: 1f 8b 08 00 00 00 00 00 00 03 5d 8f 41 0a c2 30 14 44 f7 85 de e1 13 17 b5 54 92 bd 69 ea 59 be 69 20 1f 63 12 92 b4 b5 b7 97 6a 15 71 35 30 0c f3 66 fa ac 13 c5 32 40 5d 01 00 cc 98 c0 62 b6 a0 60 21 3f 86 85 bb a0 b1 50 f0 7c b3 e5 3b a5 9d 41 bf c7 36 e1 c9 44 87 da 1c d9 81 9d 80 b1 56 fe d4 39 f2 b7 87 62 b6 94 98 cf 42 ac ab 23 3f 23 fa c2 af 53 32 38 25 1a 79 31 da 8a 8b b9 23 39 c5 76 c8 3f ff c3 78 f5 75 4d d3 7d 57 b4 b2 ae 7a b1 1f 79 02 d1 28 84 1f d1 00 00 00 Data Ascii: ]A0DTiYi cjq50f2@]b`!?P|;A6DV9bB#?#S28%y1#9v?xuM}Wzy(
Source: unknown Network traffic detected: HTTP traffic on port 64991 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 62001 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57982 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59425
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51592
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59193
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60657
Source: unknown Network traffic detected: HTTP traffic on port 59497 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 62000 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50190 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58756 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59716
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59715
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50188
Source: unknown Network traffic detected: HTTP traffic on port 62451 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50189
Source: unknown Network traffic detected: HTTP traffic on port 54678 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50190
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57982
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 62000
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 62001
Source: unknown Network traffic detected: HTTP traffic on port 59716 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50889 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 61113
Source: unknown Network traffic detected: HTTP traffic on port 61649 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60657 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60550 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 61113 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57669
Source: unknown Network traffic detected: HTTP traffic on port 50189 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 62452 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 54679
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 54678
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58756
Source: unknown Network traffic detected: HTTP traffic on port 54679 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 64034 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60550
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 61649
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59497
Source: unknown Network traffic detected: HTTP traffic on port 59193 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53030
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 64991
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 64034
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 62451
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 62452
Source: unknown Network traffic detected: HTTP traffic on port 51592 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 62453
Source: unknown Network traffic detected: HTTP traffic on port 59715 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50889
Source: unknown Network traffic detected: HTTP traffic on port 62453 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50188 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 53030 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 61217
Source: unknown Network traffic detected: HTTP traffic on port 57669 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 53082
Source: unknown Network traffic detected: HTTP traffic on port 53082 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 59425 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 61217 -> 443
Source: unknown HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19042.0.0; IDCRL-cfg 16.000.29143.3; App svchost.exe, 10.0.19041.546, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4725Host: login.live.com
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.140
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.140
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.140
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.140
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.140
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.140
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.140
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.140
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.140
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.140
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.140
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.140
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.140
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.140
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.140
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.140
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.140
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.140
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.140
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.140
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.140
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.140
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.140
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.140
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.140
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.140
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.140
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.140
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.140
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.140
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.140
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.140
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.140
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.140
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.140
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.140
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.140
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.140
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.140
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.140
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.140
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.140
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.140
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.140
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.140
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.140
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.140
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.140
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.140
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.140
Source: unknown HTTPS traffic detected: 40.126.32.140:443 -> 192.168.11.20:50188 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.126.32.140:443 -> 192.168.11.20:50189 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.126.32.140:443 -> 192.168.11.20:50189 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.126.32.140:443 -> 192.168.11.20:50190 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.126.32.140:443 -> 192.168.11.20:54679 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.23.104.113:443 -> 192.168.11.20:62000 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.223.46.67:443 -> 192.168.11.20:62001 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.184.217.20:443 -> 192.168.11.20:62452 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.184.217.20:443 -> 192.168.11.20:62453 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.184.217.20:443 -> 192.168.11.20:59716 version: TLS 1.2
Source: classification engine Classification label: clean0.win@32/0@7/8
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1676,5534151309402295221,11728340676976103501,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2024 /prefetch:8
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" "http://smenet.org/ViewSwitcher/SwitchView?mobile=True&returnUrl=http://xx6v1x.caobatours.com#YXRvbC5vbmxpbmVAY2FhLmNvLnVr
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1676,5534151309402295221,11728340676976103501,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2024 /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1271053 URL: http://smenet.org/ViewSwitc... Startdate: 11/07/2023 Architecture: WINDOWS Score: 0 14 yylinvaant.bureaurid.tech 2->14 16 xx6v1x.caobatours.com 2->16 18 6 other IPs or domains 2->18 6 chrome.exe 2->6         started        9 chrome.exe 2->9         started        process3 dnsIp4 20 192.168.11.20, 1900, 443, 49251 unknown unknown 6->20 22 239.255.255.250, 1900 unknown Reserved 6->22 11 chrome.exe 6->11         started        process5 dnsIp6 24 yylinvaant.bureaurid.tech 199.192.25.226, 443, 50889, 51592 NAMECHEAP-NETUS United States 11->24 26 smenet.org 40.69.190.41, 443, 51171, 61217 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 11->26 28 4 other IPs or domains 11->28
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
142.250.185.77
 accounts.google.com United States
15169 GOOGLEUS false
142.250.186.68
 www.google.com United States
15169 GOOGLEUS false
216.58.212.142
 clients.l.google.com United States
15169 GOOGLEUS false
40.69.190.41
 smenet.org United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
185.244.151.84
 xx6v1x.caobatours.com Netherlands
60117 HSAE false
199.192.25.226
 yylinvaant.bureaurid.tech United States
22612 NAMECHEAP-NETUS false
239.255.255.250
 unknown Reserved
unknown unknown false

Private

IP
192.168.11.20

Contacted Domains

Name IP Active
accounts.google.com 142.250.185.77 true
xx6v1x.caobatours.com 185.244.151.84 true
yylinvaant.bureaurid.tech 199.192.25.226 true
www.google.com 142.250.186.68 true
clients.l.google.com 216.58.212.142 true
smenet.org 40.69.190.41 true
clients2.google.com unknown unknown
www.smenet.org unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://www.smenet.org/ViewSwitcher/SwitchView?mobile=True&returnUrl=http://xx6v1x.caobatours.com false
  • Avira URL Cloud: safe
 unknown
http://www.smenet.org/ViewSwitcher/SwitchView?mobile=True&returnUrl=http://xx6v1x.caobatours.com false
  • Avira URL Cloud: safe
 unknown
http://smenet.org/ViewSwitcher/SwitchView?mobile=True&returnUrl=http://xx6v1x.caobatours.com false
  • Avira URL Cloud: safe
 unknown
https://yylinvaant.bureaurid.tech/favicon.ico false
  • Avira URL Cloud: safe
 unknown
https://smenet.org/ViewSwitcher/SwitchView?mobile=True&returnUrl=http://xx6v1x.caobatours.com false
  • Avira URL Cloud: safe
 unknown
http://xx6v1x.caobatours.com/ false
  • Avira URL Cloud: safe
 unknown
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard false
    		high
    https://yylinvaant.bureaurid.tech/assets/style.css false
    • Avira URL Cloud: safe
    		 unknown
    https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=94.0.4606.61&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 false
      		high