Edit tour

Windows Analysis Report
http://perr.yg5sjx5kzy.com

Overview

General Information

Sample URL:	http://perr.yg5sjx5kzy.com
Analysis ID:	1392972
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Classification

Process Tree

System is w7x64

chrome.exe (PID: 3032 cmdline: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank MD5: FFA2B8E17F645BCC20F0E0201FEF83ED)

chrome.exe (PID: 2916 cmdline: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1416 --field-trial-handle=1252,i,4711991973511693927,1322772812815079145,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: FFA2B8E17F645BCC20F0E0201FEF83ED)

chrome.exe (PID: 1096 cmdline: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" "http://perr.yg5sjx5kzy.com MD5: FFA2B8E17F645BCC20F0E0201FEF83ED)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: http://perr.yg5sjx5kzy.com

Avira URL Cloud: detection malicious, Label: malware

Antivirus detection for URL or domain

Source: http://perr.yg5sjx5kzy.com/favicon.ico

Avira URL Cloud: Label: malware

Source: http://perr.yg5sjx5kzy.com/

HTTP Parser: No favicon

Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\GoogleUpdater	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_BITS_3032_1665225739	Jump to behavior

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=109.0.5414.120&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-109.0.5414.120Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: perr.yg5sjx5kzy.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: perr.yg5sjx5kzy.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://perr.yg5sjx5kzy.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: unknown

DNS traffic detected: queries for: clients2.google.com

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CONSENT=PENDING+962; SOCS=CAESHAgCEhJnd3NfMjAyMzA4MDEtMF9SQzMaAmVuIAEaBgiAi8amBg; __Secure-ENID=14.SE=LM-NkPAvbCtuNhK73uRS1U27fKMegq7R6_Ue_GnOGI1dekNKandC6Dto1fKS9ocnnyUmf2MAXGM269U9HhkgndYLxWy3FrZaGzh_yODdv1ouU12fBCNmRhMUwM3dzKbRlYRnbKhIQz9fV5WGdCRRjXQx5RGii6FbIw100Hc46oWQ6bysmy2hqA

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 15 Feb 2024 15:58:42 GMTContent-Type: text/plain; charset=utf-8Content-Length: 9Connection: keep-aliveVary: Origin, Accept-Encodingx-hola-ts: 1708012722140x-hola-conf-ver: 45Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 15 Feb 2024 15:58:42 GMTContent-Type: text/plain; charset=utf-8Content-Length: 9Connection: keep-aliveVary: Origin, Accept-Encodingx-hola-ts: 1708012722387x-hola-conf-ver: 45Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49168
Source: unknown	Network traffic detected: HTTP traffic on port 49162 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49164 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49164
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49162
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49171
Source: unknown	Network traffic detected: HTTP traffic on port 49168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49171 -> 443

Source: classification engine

Classification label: mal56.win@18/4@8/5

Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google

Jump to behavior

Source: unknown	Process created: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1416 --field-trial-handle=1252,i,4711991973511693927,1322772812815079145,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" "http://perr.yg5sjx5kzy.com
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1416 --field-trial-handle=1252,i,4711991973511693927,1322772812815079145,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\GoogleUpdater	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_BITS_3032_1665225739	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	2 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
http://perr.yg5sjx5kzy.com	100%	Avira URL Cloud	malware

Source	Detection	Scanner	Label	Link
http://perr.yg5sjx5kzy.com/favicon.ico	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
accounts.google.com	142.250.12.84	true	false	high
perr.yg5sjx5kzy.com	23.22.252.240	true	false	unknown
www.google.com	142.250.12.99	true	false	high
clients.l.google.com	172.253.126.102	true	false	high
clients2.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=109.0.5414.120&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1	false		high
http://perr.yg5sjx5kzy.com/	false		unknown
http://perr.yg5sjx5kzy.com/favicon.ico	false	Avira URL Cloud: malware	unknown
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
23.22.252.240	perr.yg5sjx5kzy.com	United States	14618	AMAZON-AESUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.253.126.102	clients.l.google.com	United States	15169	GOOGLEUS	false
142.250.12.99	www.google.com	United States	15169	GOOGLEUS	false
142.250.12.84	accounts.google.com	United States	15169	GOOGLEUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1392972
Start date and time:	2024-02-15 16:57:53 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://perr.yg5sjx5kzy.com
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	3
Number of new started drivers analysed:	2
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal56.win@18/4@8/5
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): vga.dll
Excluded IPs from analysis (whitelisted): 142.250.12.94, 34.104.35.123, 172.253.126.94
Excluded domains from analysis (whitelisted): edgedl.me.gvt1.com, update.googleapis.com, clientservices.googleapis.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: http://perr.yg5sjx5kzy.com

Process:	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	9
Entropy (8bit):	2.94770277922009
Encrypted:	false
SSDEEP:	3:Obn:Obn
MD5:	9D1EAD73E678FA2F51A70A933B0BF017
SHA1:	D205CBD6783332A212C5AE92D73C77178C2D2F28
SHA-256:	0019DFC4B32D63C1392AA264AED2253C1E0C2FB09216F8E2CC269BBFB8BB49B5
SHA-512:	935B3D516E996F6D25948BA8A54C1B7F70F7F0E3F517E36481FDF0196C2C5CFC2841F86E891F3DF9517746B7FB605DB47CDDED1B8FF78D9482DDAA621DB43A34
Malicious:	false
Reputation:	low
URL:	http://perr.yg5sjx5kzy.com/
Preview:	Not Found

Chrome Cache Entry: 71

Download File

Process:	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	9
Entropy (8bit):	2.94770277922009
Encrypted:	false
SSDEEP:	3:Obn:Obn
MD5:	9D1EAD73E678FA2F51A70A933B0BF017
SHA1:	D205CBD6783332A212C5AE92D73C77178C2D2F28
SHA-256:	0019DFC4B32D63C1392AA264AED2253C1E0C2FB09216F8E2CC269BBFB8BB49B5
SHA-512:	935B3D516E996F6D25948BA8A54C1B7F70F7F0E3F517E36481FDF0196C2C5CFC2841F86E891F3DF9517746B7FB605DB47CDDED1B8FF78D9482DDAA621DB43A34
Malicious:	false
Reputation:	low
URL:	http://perr.yg5sjx5kzy.com/favicon.ico
Preview:	Not Found

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 15, 2024 16:58:40.562074900 CET	49162	443	192.168.2.22	172.253.126.102
Feb 15, 2024 16:58:40.562098026 CET	443	49162	172.253.126.102	192.168.2.22
Feb 15, 2024 16:58:40.562397957 CET	49162	443	192.168.2.22	172.253.126.102
Feb 15, 2024 16:58:40.563621044 CET	49164	443	192.168.2.22	142.250.12.84
Feb 15, 2024 16:58:40.563630104 CET	443	49164	142.250.12.84	192.168.2.22
Feb 15, 2024 16:58:40.563734055 CET	49164	443	192.168.2.22	142.250.12.84
Feb 15, 2024 16:58:40.576874971 CET	49162	443	192.168.2.22	172.253.126.102
Feb 15, 2024 16:58:40.576886892 CET	443	49162	172.253.126.102	192.168.2.22
Feb 15, 2024 16:58:40.584311008 CET	49164	443	192.168.2.22	142.250.12.84
Feb 15, 2024 16:58:40.584333897 CET	443	49164	142.250.12.84	192.168.2.22
Feb 15, 2024 16:58:40.832652092 CET	443	49162	172.253.126.102	192.168.2.22
Feb 15, 2024 16:58:40.832746029 CET	443	49164	142.250.12.84	192.168.2.22
Feb 15, 2024 16:58:40.839108944 CET	49162	443	192.168.2.22	172.253.126.102
Feb 15, 2024 16:58:40.839128017 CET	443	49162	172.253.126.102	192.168.2.22
Feb 15, 2024 16:58:40.839421988 CET	49164	443	192.168.2.22	142.250.12.84
Feb 15, 2024 16:58:40.839437008 CET	443	49164	142.250.12.84	192.168.2.22
Feb 15, 2024 16:58:40.839853048 CET	443	49162	172.253.126.102	192.168.2.22
Feb 15, 2024 16:58:40.839924097 CET	49162	443	192.168.2.22	172.253.126.102
Feb 15, 2024 16:58:40.841300964 CET	443	49162	172.253.126.102	192.168.2.22
Feb 15, 2024 16:58:40.841332912 CET	443	49164	142.250.12.84	192.168.2.22
Feb 15, 2024 16:58:40.841352940 CET	49162	443	192.168.2.22	172.253.126.102
Feb 15, 2024 16:58:40.841386080 CET	49164	443	192.168.2.22	142.250.12.84
Feb 15, 2024 16:58:40.842818022 CET	49162	443	192.168.2.22	172.253.126.102
Feb 15, 2024 16:58:40.842901945 CET	443	49162	172.253.126.102	192.168.2.22
Feb 15, 2024 16:58:40.842952013 CET	49162	443	192.168.2.22	172.253.126.102
Feb 15, 2024 16:58:40.843101978 CET	49164	443	192.168.2.22	142.250.12.84
Feb 15, 2024 16:58:40.843187094 CET	443	49164	142.250.12.84	192.168.2.22
Feb 15, 2024 16:58:40.843311071 CET	49164	443	192.168.2.22	142.250.12.84
Feb 15, 2024 16:58:40.843322992 CET	443	49164	142.250.12.84	192.168.2.22
Feb 15, 2024 16:58:40.885921955 CET	443	49162	172.253.126.102	192.168.2.22
Feb 15, 2024 16:58:41.018994093 CET	443	49162	172.253.126.102	192.168.2.22
Feb 15, 2024 16:58:41.019061089 CET	49162	443	192.168.2.22	172.253.126.102
Feb 15, 2024 16:58:41.019081116 CET	443	49162	172.253.126.102	192.168.2.22
Feb 15, 2024 16:58:41.019284010 CET	443	49162	172.253.126.102	192.168.2.22
Feb 15, 2024 16:58:41.019345045 CET	49162	443	192.168.2.22	172.253.126.102
Feb 15, 2024 16:58:41.019817114 CET	49162	443	192.168.2.22	172.253.126.102
Feb 15, 2024 16:58:41.019826889 CET	443	49162	172.253.126.102	192.168.2.22
Feb 15, 2024 16:58:41.041775942 CET	443	49164	142.250.12.84	192.168.2.22
Feb 15, 2024 16:58:41.041852951 CET	49164	443	192.168.2.22	142.250.12.84
Feb 15, 2024 16:58:41.041867018 CET	443	49164	142.250.12.84	192.168.2.22
Feb 15, 2024 16:58:41.042169094 CET	443	49164	142.250.12.84	192.168.2.22
Feb 15, 2024 16:58:41.042231083 CET	49164	443	192.168.2.22	142.250.12.84
Feb 15, 2024 16:58:41.042674065 CET	49164	443	192.168.2.22	142.250.12.84
Feb 15, 2024 16:58:41.042704105 CET	443	49164	142.250.12.84	192.168.2.22
Feb 15, 2024 16:58:41.966586113 CET	49165	80	192.168.2.22	23.22.252.240
Feb 15, 2024 16:58:41.967530012 CET	49166	80	192.168.2.22	23.22.252.240
Feb 15, 2024 16:58:42.081979990 CET	80	49165	23.22.252.240	192.168.2.22
Feb 15, 2024 16:58:42.082046032 CET	49165	80	192.168.2.22	23.22.252.240
Feb 15, 2024 16:58:42.082506895 CET	49165	80	192.168.2.22	23.22.252.240
Feb 15, 2024 16:58:42.082532883 CET	80	49166	23.22.252.240	192.168.2.22
Feb 15, 2024 16:58:42.082595110 CET	49166	80	192.168.2.22	23.22.252.240
Feb 15, 2024 16:58:42.197499037 CET	80	49165	23.22.252.240	192.168.2.22
Feb 15, 2024 16:58:42.198343992 CET	80	49165	23.22.252.240	192.168.2.22
Feb 15, 2024 16:58:42.328804970 CET	49165	80	192.168.2.22	23.22.252.240
Feb 15, 2024 16:58:42.445281029 CET	80	49165	23.22.252.240	192.168.2.22
Feb 15, 2024 16:58:42.652633905 CET	49165	80	192.168.2.22	23.22.252.240
Feb 15, 2024 16:58:45.071852922 CET	49168	443	192.168.2.22	142.250.12.99
Feb 15, 2024 16:58:45.071899891 CET	443	49168	142.250.12.99	192.168.2.22
Feb 15, 2024 16:58:45.071949005 CET	49168	443	192.168.2.22	142.250.12.99
Feb 15, 2024 16:58:45.073189974 CET	49168	443	192.168.2.22	142.250.12.99
Feb 15, 2024 16:58:45.073214054 CET	443	49168	142.250.12.99	192.168.2.22
Feb 15, 2024 16:58:45.300926924 CET	443	49168	142.250.12.99	192.168.2.22
Feb 15, 2024 16:58:45.301398993 CET	49168	443	192.168.2.22	142.250.12.99
Feb 15, 2024 16:58:45.301434040 CET	443	49168	142.250.12.99	192.168.2.22
Feb 15, 2024 16:58:45.303069115 CET	443	49168	142.250.12.99	192.168.2.22
Feb 15, 2024 16:58:45.303138971 CET	49168	443	192.168.2.22	142.250.12.99
Feb 15, 2024 16:58:45.310712099 CET	49168	443	192.168.2.22	142.250.12.99
Feb 15, 2024 16:58:45.310801029 CET	443	49168	142.250.12.99	192.168.2.22
Feb 15, 2024 16:58:45.514462948 CET	49168	443	192.168.2.22	142.250.12.99
Feb 15, 2024 16:58:45.514493942 CET	443	49168	142.250.12.99	192.168.2.22
Feb 15, 2024 16:58:45.723351002 CET	49168	443	192.168.2.22	142.250.12.99
Feb 15, 2024 16:58:55.289669991 CET	443	49168	142.250.12.99	192.168.2.22
Feb 15, 2024 16:58:55.289805889 CET	443	49168	142.250.12.99	192.168.2.22
Feb 15, 2024 16:58:55.289994955 CET	49168	443	192.168.2.22	142.250.12.99
Feb 15, 2024 16:58:56.706296921 CET	49168	443	192.168.2.22	142.250.12.99
Feb 15, 2024 16:58:56.706366062 CET	443	49168	142.250.12.99	192.168.2.22
Feb 15, 2024 16:59:27.078368902 CET	49166	80	192.168.2.22	23.22.252.240
Feb 15, 2024 16:59:27.194587946 CET	80	49166	23.22.252.240	192.168.2.22
Feb 15, 2024 16:59:27.452744007 CET	49165	80	192.168.2.22	23.22.252.240
Feb 15, 2024 16:59:27.567646980 CET	80	49165	23.22.252.240	192.168.2.22
Feb 15, 2024 16:59:42.195470095 CET	80	49166	23.22.252.240	192.168.2.22
Feb 15, 2024 16:59:42.195548058 CET	49166	80	192.168.2.22	23.22.252.240
Feb 15, 2024 16:59:42.707132101 CET	49166	80	192.168.2.22	23.22.252.240
Feb 15, 2024 16:59:42.822005987 CET	80	49166	23.22.252.240	192.168.2.22
Feb 15, 2024 16:59:44.875612974 CET	49171	443	192.168.2.22	142.250.12.99
Feb 15, 2024 16:59:44.875649929 CET	443	49171	142.250.12.99	192.168.2.22
Feb 15, 2024 16:59:44.875744104 CET	49171	443	192.168.2.22	142.250.12.99
Feb 15, 2024 16:59:44.875994921 CET	49171	443	192.168.2.22	142.250.12.99
Feb 15, 2024 16:59:44.876007080 CET	443	49171	142.250.12.99	192.168.2.22
Feb 15, 2024 16:59:45.096304893 CET	443	49171	142.250.12.99	192.168.2.22
Feb 15, 2024 16:59:45.138211966 CET	49171	443	192.168.2.22	142.250.12.99
Feb 15, 2024 16:59:45.138236046 CET	443	49171	142.250.12.99	192.168.2.22
Feb 15, 2024 16:59:45.139349937 CET	443	49171	142.250.12.99	192.168.2.22
Feb 15, 2024 16:59:45.140657902 CET	49171	443	192.168.2.22	142.250.12.99
Feb 15, 2024 16:59:45.140830040 CET	443	49171	142.250.12.99	192.168.2.22
Feb 15, 2024 16:59:45.341628075 CET	49171	443	192.168.2.22	142.250.12.99
Feb 15, 2024 16:59:47.443836927 CET	80	49165	23.22.252.240	192.168.2.22
Feb 15, 2024 16:59:47.443913937 CET	49165	80	192.168.2.22	23.22.252.240
Feb 15, 2024 16:59:48.712754011 CET	49165	80	192.168.2.22	23.22.252.240
Feb 15, 2024 16:59:48.827858925 CET	80	49165	23.22.252.240	192.168.2.22
Feb 15, 2024 16:59:55.133169889 CET	443	49171	142.250.12.99	192.168.2.22
Feb 15, 2024 16:59:55.133255959 CET	443	49171	142.250.12.99	192.168.2.22
Feb 15, 2024 16:59:55.133375883 CET	49171	443	192.168.2.22	142.250.12.99
Feb 15, 2024 16:59:56.708288908 CET	49171	443	192.168.2.22	142.250.12.99
Feb 15, 2024 16:59:56.708307028 CET	443	49171	142.250.12.99	192.168.2.22

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 15, 2024 16:58:40.429892063 CET	54719	53	192.168.2.22	8.8.8.8
Feb 15, 2024 16:58:40.430052042 CET	49881	53	192.168.2.22	8.8.8.8
Feb 15, 2024 16:58:40.430401087 CET	54998	53	192.168.2.22	8.8.8.8
Feb 15, 2024 16:58:40.430562019 CET	52781	53	192.168.2.22	8.8.8.8
Feb 15, 2024 16:58:40.532151937 CET	53	54821	8.8.8.8	192.168.2.22
Feb 15, 2024 16:58:40.532634974 CET	53	54719	8.8.8.8	192.168.2.22
Feb 15, 2024 16:58:40.533164024 CET	53	52781	8.8.8.8	192.168.2.22
Feb 15, 2024 16:58:40.533423901 CET	53	49881	8.8.8.8	192.168.2.22
Feb 15, 2024 16:58:40.536398888 CET	53	54998	8.8.8.8	192.168.2.22
Feb 15, 2024 16:58:41.217354059 CET	53	65510	8.8.8.8	192.168.2.22
Feb 15, 2024 16:58:41.859236956 CET	56475	53	192.168.2.22	8.8.8.8
Feb 15, 2024 16:58:41.859802008 CET	49384	53	192.168.2.22	8.8.8.8
Feb 15, 2024 16:58:41.961456060 CET	53	56475	8.8.8.8	192.168.2.22
Feb 15, 2024 16:58:41.962034941 CET	53	49384	8.8.8.8	192.168.2.22
Feb 15, 2024 16:58:44.967659950 CET	58095	53	192.168.2.22	8.8.8.8
Feb 15, 2024 16:58:44.967850924 CET	54261	53	192.168.2.22	8.8.8.8
Feb 15, 2024 16:58:45.069428921 CET	53	58095	8.8.8.8	192.168.2.22
Feb 15, 2024 16:58:45.070278883 CET	53	54261	8.8.8.8	192.168.2.22
Feb 15, 2024 16:58:58.186594963 CET	53	54422	8.8.8.8	192.168.2.22
Feb 15, 2024 16:59:05.176163912 CET	53	59447	8.8.8.8	192.168.2.22
Feb 15, 2024 16:59:16.129868031 CET	53	64687	8.8.8.8	192.168.2.22
Feb 15, 2024 16:59:34.670897961 CET	53	63950	8.8.8.8	192.168.2.22
Feb 15, 2024 16:59:40.314253092 CET	53	49226	8.8.8.8	192.168.2.22

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Feb 15, 2024 16:58:40.429892063 CET	192.168.2.22	8.8.8.8	0x900e	Standard query (0)	clients2.google.com	A (IP address)	IN (0x0001)	false
Feb 15, 2024 16:58:40.430052042 CET	192.168.2.22	8.8.8.8	0x2d3a	Standard query (0)	clients2.google.com	65	IN (0x0001)	false
Feb 15, 2024 16:58:40.430401087 CET	192.168.2.22	8.8.8.8	0xa6f0	Standard query (0)	accounts.google.com	A (IP address)	IN (0x0001)	false
Feb 15, 2024 16:58:40.430562019 CET	192.168.2.22	8.8.8.8	0xcab5	Standard query (0)	accounts.google.com	65	IN (0x0001)	false
Feb 15, 2024 16:58:41.859236956 CET	192.168.2.22	8.8.8.8	0x93a3	Standard query (0)	perr.yg5sjx5kzy.com	A (IP address)	IN (0x0001)	false
Feb 15, 2024 16:58:41.859802008 CET	192.168.2.22	8.8.8.8	0x5ed0	Standard query (0)	perr.yg5sjx5kzy.com	65	IN (0x0001)	false
Feb 15, 2024 16:58:44.967659950 CET	192.168.2.22	8.8.8.8	0x1792	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Feb 15, 2024 16:58:44.967850924 CET	192.168.2.22	8.8.8.8	0xf3e8	Standard query (0)	www.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Feb 15, 2024 16:58:40.532634974 CET	8.8.8.8	192.168.2.22	0x900e	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 15, 2024 16:58:40.532634974 CET	8.8.8.8	192.168.2.22	0x900e	No error (0)	clients.l.google.com		172.253.126.102	A (IP address)	IN (0x0001)	false
Feb 15, 2024 16:58:40.532634974 CET	8.8.8.8	192.168.2.22	0x900e	No error (0)	clients.l.google.com		172.253.126.138	A (IP address)	IN (0x0001)	false
Feb 15, 2024 16:58:40.532634974 CET	8.8.8.8	192.168.2.22	0x900e	No error (0)	clients.l.google.com		172.253.126.101	A (IP address)	IN (0x0001)	false
Feb 15, 2024 16:58:40.532634974 CET	8.8.8.8	192.168.2.22	0x900e	No error (0)	clients.l.google.com		172.253.126.113	A (IP address)	IN (0x0001)	false
Feb 15, 2024 16:58:40.532634974 CET	8.8.8.8	192.168.2.22	0x900e	No error (0)	clients.l.google.com		172.253.126.139	A (IP address)	IN (0x0001)	false
Feb 15, 2024 16:58:40.532634974 CET	8.8.8.8	192.168.2.22	0x900e	No error (0)	clients.l.google.com		172.253.126.100	A (IP address)	IN (0x0001)	false
Feb 15, 2024 16:58:40.533423901 CET	8.8.8.8	192.168.2.22	0x2d3a	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 15, 2024 16:58:40.536398888 CET	8.8.8.8	192.168.2.22	0xa6f0	No error (0)	accounts.google.com		142.250.12.84	A (IP address)	IN (0x0001)	false
Feb 15, 2024 16:58:41.961456060 CET	8.8.8.8	192.168.2.22	0x93a3	No error (0)	perr.yg5sjx5kzy.com		23.22.252.240	A (IP address)	IN (0x0001)	false
Feb 15, 2024 16:58:41.961456060 CET	8.8.8.8	192.168.2.22	0x93a3	No error (0)	perr.yg5sjx5kzy.com		34.237.179.253	A (IP address)	IN (0x0001)	false
Feb 15, 2024 16:58:45.069428921 CET	8.8.8.8	192.168.2.22	0x1792	No error (0)	www.google.com		142.250.12.99	A (IP address)	IN (0x0001)	false
Feb 15, 2024 16:58:45.069428921 CET	8.8.8.8	192.168.2.22	0x1792	No error (0)	www.google.com		142.250.12.106	A (IP address)	IN (0x0001)	false
Feb 15, 2024 16:58:45.069428921 CET	8.8.8.8	192.168.2.22	0x1792	No error (0)	www.google.com		142.250.12.147	A (IP address)	IN (0x0001)	false
Feb 15, 2024 16:58:45.069428921 CET	8.8.8.8	192.168.2.22	0x1792	No error (0)	www.google.com		142.250.12.105	A (IP address)	IN (0x0001)	false
Feb 15, 2024 16:58:45.069428921 CET	8.8.8.8	192.168.2.22	0x1792	No error (0)	www.google.com		142.250.12.104	A (IP address)	IN (0x0001)	false
Feb 15, 2024 16:58:45.069428921 CET	8.8.8.8	192.168.2.22	0x1792	No error (0)	www.google.com		142.250.12.103	A (IP address)	IN (0x0001)	false
Feb 15, 2024 16:58:45.070278883 CET	8.8.8.8	192.168.2.22	0xf3e8	No error (0)	www.google.com			65	IN (0x0001)	false

HTTP Request Dependency Graph

clients2.google.com

accounts.google.com

perr.yg5sjx5kzy.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49165	23.22.252.240	80	2916	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Feb 15, 2024 16:58:42.082506895 CET	434	OUT	GET / HTTP/1.1 Host: perr.yg5sjx5kzy.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Feb 15, 2024 16:58:42.198343992 CET	249	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 15 Feb 2024 15:58:42 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 9 Connection: keep-alive Vary: Origin, Accept-Encoding x-hola-ts: 1708012722140 x-hola-conf-ver: 45 Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found
Feb 15, 2024 16:58:42.328804970 CET	382	OUT	GET /favicon.ico HTTP/1.1 Host: perr.yg5sjx5kzy.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://perr.yg5sjx5kzy.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Feb 15, 2024 16:58:42.445281029 CET	249	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 15 Feb 2024 15:58:42 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 9 Connection: keep-alive Vary: Origin, Accept-Encoding x-hola-ts: 1708012722387 x-hola-conf-ver: 45 Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found
Feb 15, 2024 16:59:27.452744007 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.22	49166	23.22.252.240	80	2916	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Feb 15, 2024 16:59:27.078368902 CET	6	OUT	Data Raw: 00 Data Ascii:

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49162	172.253.126.102	443	2916	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-15 15:58:40 UTC	732	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=109.0.5414.120&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda X-Goog-Update-Updater: chromecrx-109.0.5414.120 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-15 15:58:41 UTC	732	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-XXF0NCe_qgz1zpTL7R4G3w' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 15 Feb 2024 15:58:40 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 6254 X-Daystart: 28720 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-15 15:58:41 UTC	520	IN	Data Raw: 32 63 39 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 36 32 35 34 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 32 38 37 32 30 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 2c9<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="6254" elapsed_seconds="28720"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2024-02-15 15:58:41 UTC	200	IN	Data Raw: 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 2f 67 75 70 64 61 74 65 3e 0d 0a Data Ascii: 723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app></gupdate>
2024-02-15 15:58:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.22	49164	142.250.12.84	443	2916	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-15 15:58:40 UTC	785	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: CONSENT=PENDING+962; SOCS=CAESHAgCEhJnd3NfMjAyMzA4MDEtMF9SQzMaAmVuIAEaBgiAi8amBg; __Secure-ENID=14.SE=LM-NkPAvbCtuNhK73uRS1U27fKMegq7R6_Ue_GnOGI1dekNKandC6Dto1fKS9ocnnyUmf2MAXGM269U9HhkgndYLxWy3FrZaGzh_yODdv1ouU12fBCNmRhMUwM3dzKbRlYRnbKhIQz9fV5WGdCRRjXQx5RGii6FbIw100Hc46oWQ6bysmy2hqA
2024-02-15 15:58:40 UTC	1	OUT	Data Raw: 20 Data Ascii:
2024-02-15 15:58:41 UTC	1799	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 15 Feb 2024 15:58:40 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-R89qrPCKsKzAj9bwrJuMhA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport/allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin reporting-endpoints: default="/_/IdentityListAccountsHttp/web-reports?context=eJzjMtDikmJw1pBiOHxtB5Meyy0mIyCe2_2UaSEQH4x7znQUiHf4eLA4pc9gDQFiIR6ODS93rGMTODDp6BVmALaoF84" Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-15 15:58:41 UTC	23	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2024-02-15 15:58:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	16:58:37
Start date:	15/02/2024
Path:	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Imagebase:	0x13fb80000
File size:	3'151'128 bytes
MD5 hash:	FFA2B8E17F645BCC20F0E0201FEF83ED
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	16:58:39
Start date:	15/02/2024
Path:	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1416 --field-trial-handle=1252,i,4711991973511693927,1322772812815079145,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x13fb80000
File size:	3'151'128 bytes
MD5 hash:	FFA2B8E17F645BCC20F0E0201FEF83ED
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	16:58:41
Start date:	15/02/2024
Path:	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" "http://perr.yg5sjx5kzy.com
Imagebase:	0x13fb80000
File size:	3'151'128 bytes
MD5 hash:	FFA2B8E17F645BCC20F0E0201FEF83ED
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://perr.yg5sjx5kzy.com

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: chrome.exePID: 3032, Parent PID: 1996

General

Chronological Activities

Analysis Process: chrome.exePID: 2916, Parent PID: 3032

General

Chronological Activities

Analysis Process: chrome.exePID: 1096, Parent PID: 1996

General

Chronological Activities

Disassembly

Windows Analysis Report
http://perr.yg5sjx5kzy.com