Windows Analysis Report
https://newexra.com/lists/hd595fmsbd54c/unsubscribe/sm021tfebd0e1/zj986hw5a47dc?source=email-client-unsubscribe-button

Overview

General Information

Sample URL:	https://newexra.com/lists/hd595fmsbd54c/unsubscribe/sm021tfebd0e1/zj986hw5a47dc?source=email-client-unsubscribe-button
Analysis ID:	1428619
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Stores files to the Windows start menu directory

Uses insecure TLS / SSL version for HTTPS connection

Classification

Signatures

Source: https://newexra.com/lists/hd595fmsbd54c/unsubscribe/sm021tfebd0e1/zj986hw5a47dc?source=email-client-unsubscribe-button

HTTP Parser: No favicon

Source: https://newexra.com/lists/hd595fmsbd54c/unsubscribe/sm021tfebd0e1/zj986hw5a47dc?source=email-client-unsubscribe-button

HTTP Parser: No <meta name="author".. found

Source: https://newexra.com/lists/hd595fmsbd54c/unsubscribe/sm021tfebd0e1/zj986hw5a47dc?source=email-client-unsubscribe-button

HTTP Parser: No <meta name="copyright".. found

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49738 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 23.63.206.91:443 -> 192.168.2.5:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.63.206.91:443 -> 192.168.2.5:49728 version: TLS 1.2

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49738 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /lists/hd595fmsbd54c/unsubscribe/sm021tfebd0e1/zj986hw5a47dc?source=email-client-unsubscribe-button HTTP/1.1Host: newexra.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/css/bootstrap.min.css?av=1262687b HTTP/1.1Host: newexra.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://newexra.com/lists/hd595fmsbd54c/unsubscribe/sm021tfebd0e1/zj986hw5a47dc?source=email-client-unsubscribe-buttonAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mwsid=36229f2e381c3a9a97b92a74ef2ca6da; csrf_token=cf39fdd9949cb929647dd12186b9403ece0d7495s%3A88%3A%22M2FLT0doY0hQXzhSczl2bldIQlR3V2JwTGlaN3RpWEfPUo4wUGwKLygEsnLtbYvYvwNel07Ur1G9037BdYZtlg%3D%3D%22%3B
Source: global traffic	HTTP traffic detected: GET /assets/css/font-awesome/css/font-awesome.min.css?av=1262687b HTTP/1.1Host: newexra.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://newexra.com/lists/hd595fmsbd54c/unsubscribe/sm021tfebd0e1/zj986hw5a47dc?source=email-client-unsubscribe-buttonAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mwsid=36229f2e381c3a9a97b92a74ef2ca6da; csrf_token=cf39fdd9949cb929647dd12186b9403ece0d7495s%3A88%3A%22M2FLT0doY0hQXzhSczl2bldIQlR3V2JwTGlaN3RpWEfPUo4wUGwKLygEsnLtbYvYvwNel07Ur1G9037BdYZtlg%3D%3D%22%3B
Source: global traffic	HTTP traffic detected: GET /assets/css/ionicons/css/ionicons.min.css?av=1262687b HTTP/1.1Host: newexra.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://newexra.com/lists/hd595fmsbd54c/unsubscribe/sm021tfebd0e1/zj986hw5a47dc?source=email-client-unsubscribe-buttonAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mwsid=36229f2e381c3a9a97b92a74ef2ca6da; csrf_token=cf39fdd9949cb929647dd12186b9403ece0d7495s%3A88%3A%22M2FLT0doY0hQXzhSczl2bldIQlR3V2JwTGlaN3RpWEfPUo4wUGwKLygEsnLtbYvYvwNel07Ur1G9037BdYZtlg%3D%3D%22%3B
Source: global traffic	HTTP traffic detected: GET /assets/css/adminlte.css?av=1262687b HTTP/1.1Host: newexra.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://newexra.com/lists/hd595fmsbd54c/unsubscribe/sm021tfebd0e1/zj986hw5a47dc?source=email-client-unsubscribe-buttonAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mwsid=36229f2e381c3a9a97b92a74ef2ca6da; csrf_token=cf39fdd9949cb929647dd12186b9403ece0d7495s%3A88%3A%22M2FLT0doY0hQXzhSczl2bldIQlR3V2JwTGlaN3RpWEfPUo4wUGwKLygEsnLtbYvYvwNel07Ur1G9037BdYZtlg%3D%3D%22%3B
Source: global traffic	HTTP traffic detected: GET /frontend/assets/css/style.css?av=1262687b HTTP/1.1Host: newexra.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://newexra.com/lists/hd595fmsbd54c/unsubscribe/sm021tfebd0e1/zj986hw5a47dc?source=email-client-unsubscribe-buttonAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mwsid=36229f2e381c3a9a97b92a74ef2ca6da; csrf_token=cf39fdd9949cb929647dd12186b9403ece0d7495s%3A88%3A%22M2FLT0doY0hQXzhSczl2bldIQlR3V2JwTGlaN3RpWEfPUo4wUGwKLygEsnLtbYvYvwNel07Ur1G9037BdYZtlg%3D%3D%22%3B
Source: global traffic	HTTP traffic detected: GET /assets/css/skin-blue.css?av=1262687b HTTP/1.1Host: newexra.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://newexra.com/lists/hd595fmsbd54c/unsubscribe/sm021tfebd0e1/zj986hw5a47dc?source=email-client-unsubscribe-buttonAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mwsid=36229f2e381c3a9a97b92a74ef2ca6da; csrf_token=cf39fdd9949cb929647dd12186b9403ece0d7495s%3A88%3A%22M2FLT0doY0hQXzhSczl2bldIQlR3V2JwTGlaN3RpWEfPUo4wUGwKLygEsnLtbYvYvwNel07Ur1G9037BdYZtlg%3D%3D%22%3B
Source: global traffic	HTTP traffic detected: GET /frontend/assets/cache/1c9ce001/jquery.min.js HTTP/1.1Host: newexra.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://newexra.com/lists/hd595fmsbd54c/unsubscribe/sm021tfebd0e1/zj986hw5a47dc?source=email-client-unsubscribe-buttonAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mwsid=36229f2e381c3a9a97b92a74ef2ca6da; csrf_token=cf39fdd9949cb929647dd12186b9403ece0d7495s%3A88%3A%22M2FLT0doY0hQXzhSczl2bldIQlR3V2JwTGlaN3RpWEfPUo4wUGwKLygEsnLtbYvYvwNel07Ur1G9037BdYZtlg%3D%3D%22%3B
Source: global traffic	HTTP traffic detected: GET /frontend/assets/cache/1c9ce001/jquery-migrate.min.js HTTP/1.1Host: newexra.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://newexra.com/lists/hd595fmsbd54c/unsubscribe/sm021tfebd0e1/zj986hw5a47dc?source=email-client-unsubscribe-buttonAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mwsid=36229f2e381c3a9a97b92a74ef2ca6da; csrf_token=cf39fdd9949cb929647dd12186b9403ece0d7495s%3A88%3A%22M2FLT0doY0hQXzhSczl2bldIQlR3V2JwTGlaN3RpWEfPUo4wUGwKLygEsnLtbYvYvwNel07Ur1G9037BdYZtlg%3D%3D%22%3B
Source: global traffic	HTTP traffic detected: GET /assets/js/bootstrap.min.js?av=1262687b HTTP/1.1Host: newexra.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://newexra.com/lists/hd595fmsbd54c/unsubscribe/sm021tfebd0e1/zj986hw5a47dc?source=email-client-unsubscribe-buttonAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mwsid=36229f2e381c3a9a97b92a74ef2ca6da; csrf_token=cf39fdd9949cb929647dd12186b9403ece0d7495s%3A88%3A%22M2FLT0doY0hQXzhSczl2bldIQlR3V2JwTGlaN3RpWEfPUo4wUGwKLygEsnLtbYvYvwNel07Ur1G9037BdYZtlg%3D%3D%22%3B
Source: global traffic	HTTP traffic detected: GET /assets/js/knockout.min.js?av=1262687b HTTP/1.1Host: newexra.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://newexra.com/lists/hd595fmsbd54c/unsubscribe/sm021tfebd0e1/zj986hw5a47dc?source=email-client-unsubscribe-buttonAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mwsid=36229f2e381c3a9a97b92a74ef2ca6da; csrf_token=cf39fdd9949cb929647dd12186b9403ece0d7495s%3A88%3A%22M2FLT0doY0hQXzhSczl2bldIQlR3V2JwTGlaN3RpWEfPUo4wUGwKLygEsnLtbYvYvwNel07Ur1G9037BdYZtlg%3D%3D%22%3B
Source: global traffic	HTTP traffic detected: GET /assets/js/adminlte.js?av=1262687b HTTP/1.1Host: newexra.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://newexra.com/lists/hd595fmsbd54c/unsubscribe/sm021tfebd0e1/zj986hw5a47dc?source=email-client-unsubscribe-buttonAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mwsid=36229f2e381c3a9a97b92a74ef2ca6da; csrf_token=cf39fdd9949cb929647dd12186b9403ece0d7495s%3A88%3A%22M2FLT0doY0hQXzhSczl2bldIQlR3V2JwTGlaN3RpWEfPUo4wUGwKLygEsnLtbYvYvwNel07Ur1G9037BdYZtlg%3D%3D%22%3B
Source: global traffic	HTTP traffic detected: GET /assets/js/notify.js?av=1262687b HTTP/1.1Host: newexra.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://newexra.com/lists/hd595fmsbd54c/unsubscribe/sm021tfebd0e1/zj986hw5a47dc?source=email-client-unsubscribe-buttonAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mwsid=36229f2e381c3a9a97b92a74ef2ca6da; csrf_token=cf39fdd9949cb929647dd12186b9403ece0d7495s%3A88%3A%22M2FLT0doY0hQXzhSczl2bldIQlR3V2JwTGlaN3RpWEfPUo4wUGwKLygEsnLtbYvYvwNel07Ur1G9037BdYZtlg%3D%3D%22%3B
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /assets/js/cookie.js?av=1262687b HTTP/1.1Host: newexra.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://newexra.com/lists/hd595fmsbd54c/unsubscribe/sm021tfebd0e1/zj986hw5a47dc?source=email-client-unsubscribe-buttonAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mwsid=36229f2e381c3a9a97b92a74ef2ca6da; csrf_token=cf39fdd9949cb929647dd12186b9403ece0d7495s%3A88%3A%22M2FLT0doY0hQXzhSczl2bldIQlR3V2JwTGlaN3RpWEfPUo4wUGwKLygEsnLtbYvYvwNel07Ur1G9037BdYZtlg%3D%3D%22%3B
Source: global traffic	HTTP traffic detected: GET /assets/js/app.js?av=1262687b HTTP/1.1Host: newexra.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://newexra.com/lists/hd595fmsbd54c/unsubscribe/sm021tfebd0e1/zj986hw5a47dc?source=email-client-unsubscribe-buttonAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mwsid=36229f2e381c3a9a97b92a74ef2ca6da; csrf_token=cf39fdd9949cb929647dd12186b9403ece0d7495s%3A88%3A%22M2FLT0doY0hQXzhSczl2bldIQlR3V2JwTGlaN3RpWEfPUo4wUGwKLygEsnLtbYvYvwNel07Ur1G9037BdYZtlg%3D%3D%22%3B
Source: global traffic	HTTP traffic detected: GET /frontend/assets/js/app.js?av=1262687b HTTP/1.1Host: newexra.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://newexra.com/lists/hd595fmsbd54c/unsubscribe/sm021tfebd0e1/zj986hw5a47dc?source=email-client-unsubscribe-buttonAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mwsid=36229f2e381c3a9a97b92a74ef2ca6da; csrf_token=cf39fdd9949cb929647dd12186b9403ece0d7495s%3A88%3A%22M2FLT0doY0hQXzhSczl2bldIQlR3V2JwTGlaN3RpWEfPUo4wUGwKLygEsnLtbYvYvwNel07Ur1G9037BdYZtlg%3D%3D%22%3B
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: newexra.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://newexra.com/lists/hd595fmsbd54c/unsubscribe/sm021tfebd0e1/zj986hw5a47dc?source=email-client-unsubscribe-buttonAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mwsid=36229f2e381c3a9a97b92a74ef2ca6da; csrf_token=cf39fdd9949cb929647dd12186b9403ece0d7495s%3A88%3A%22M2FLT0doY0hQXzhSczl2bldIQlR3V2JwTGlaN3RpWEfPUo4wUGwKLygEsnLtbYvYvwNel07Ur1G9037BdYZtlg%3D%3D%22%3B
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: newexra.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mwsid=36229f2e381c3a9a97b92a74ef2ca6da; csrf_token=cf39fdd9949cb929647dd12186b9403ece0d7495s%3A88%3A%22M2FLT0doY0hQXzhSczl2bldIQlR3V2JwTGlaN3RpWEfPUo4wUGwKLygEsnLtbYvYvwNel07Ur1G9037BdYZtlg%3D%3D%22%3B

Source: unknown

DNS traffic detected: queries for: newexra.com

Source: chromecache_74.2.dr	String found in binary or memory: http://almsaeedstudio.com
Source: chromecache_73.2.dr	String found in binary or memory: http://creativecommons.org/licenses/by/4.0/
Source: chromecache_82.2.dr	String found in binary or memory: http://fontawesome.io
Source: chromecache_82.2.dr	String found in binary or memory: http://fontawesome.io/license
Source: chromecache_89.2.dr, chromecache_75.2.dr	String found in binary or memory: http://getbootstrap.com)
Source: chromecache_73.2.dr	String found in binary or memory: http://ionicons.com/
Source: chromecache_87.2.dr	String found in binary or memory: http://knockoutjs.com/
Source: chromecache_79.2.dr, chromecache_74.2.dr	String found in binary or memory: http://opensource.org/licenses/MIT
Source: chromecache_79.2.dr	String found in binary or memory: http://www.almsaeedstudio.com
Source: chromecache_87.2.dr	String found in binary or memory: http://www.json.org/json2.js
Source: chromecache_87.2.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php)
Source: chromecache_73.2.dr	String found in binary or memory: https://github.com/driftyco/ionicons
Source: chromecache_73.2.dr	String found in binary or memory: https://github.com/google/material-design-icons
Source: chromecache_76.2.dr	String found in binary or memory: https://github.com/js-cookie/js-cookie
Source: chromecache_74.2.dr	String found in binary or memory: https://github.com/lipis/bootstrap-social
Source: chromecache_89.2.dr, chromecache_75.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: chromecache_73.2.dr	String found in binary or memory: https://twitter.com/benjsperry
Source: chromecache_73.2.dr	String found in binary or memory: https://twitter.com/ionicframework
Source: chromecache_84.2.dr, chromecache_85.2.dr, chromecache_88.2.dr	String found in binary or memory: https://www.mailwizz.com)
Source: chromecache_84.2.dr, chromecache_85.2.dr, chromecache_88.2.dr	String found in binary or memory: https://www.mailwizz.com/
Source: chromecache_84.2.dr, chromecache_85.2.dr, chromecache_88.2.dr	String found in binary or memory: https://www.mailwizz.com/license/

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703

Source: unknown	HTTPS traffic detected: 23.63.206.91:443 -> 192.168.2.5:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.63.206.91:443 -> 192.168.2.5:49728 version: TLS 1.2

Source: classification engine

Classification label: clean1.win@16/41@6/4

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2508 --field-trial-handle=2476,i,7506934698310214352,14515741543659021388,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://newexra.com/lists/hd595fmsbd54c/unsubscribe/sm021tfebd0e1/zj986hw5a47dc?source=email-client-unsubscribe-button"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2508 --field-trial-handle=2476,i,7506934698310214352,14515741543659021388,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
239.255.255.250	unknown	Reserved	unknown	unknown	false
91.202.233.192	newexra.com	Russian Federation	9009	M247GB	false
74.125.136.106	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.5

Contacted Domains

Name	IP	Active
bg.microsoft.map.fastly.net	199.232.210.172	true
newexra.com	91.202.233.192	true
www.google.com	74.125.136.106	true
fp2e7a.wpc.phicdn.net	192.229.211.108	true

Contacted URLs

Name	Malicious	Reputation
https://newexra.com/lists/hd595fmsbd54c/unsubscribe/sm021tfebd0e1/zj986hw5a47dc?source=email-client-unsubscribe-button	false	unknown
https://newexra.com/assets/css/ionicons/css/ionicons.min.css?av=1262687b	false	unknown
https://newexra.com/assets/js/bootstrap.min.js?av=1262687b	false	unknown
https://newexra.com/assets/css/skin-blue.css?av=1262687b	false	unknown
https://newexra.com/assets/css/bootstrap.min.css?av=1262687b	false	unknown
https://newexra.com/frontend/assets/cache/1c9ce001/jquery-migrate.min.js	false	unknown
https://newexra.com/frontend/assets/js/app.js?av=1262687b	false	unknown
https://newexra.com/assets/js/knockout.min.js?av=1262687b	false	unknown
https://newexra.com/frontend/assets/css/style.css?av=1262687b	false	unknown
https://newexra.com/favicon.ico	false	unknown
https://newexra.com/assets/js/cookie.js?av=1262687b	false	unknown
https://newexra.com/assets/css/font-awesome/css/font-awesome.min.css?av=1262687b	false	unknown
https://newexra.com/assets/js/adminlte.js?av=1262687b	false	unknown
https://newexra.com/assets/css/adminlte.css?av=1262687b	false	unknown
https://newexra.com/assets/js/notify.js?av=1262687b	false	unknown
https://newexra.com/frontend/assets/cache/1c9ce001/jquery.min.js	false	unknown
https://newexra.com/assets/js/app.js?av=1262687b	false	unknown

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 19 07:26:14 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	0C5860ED8229AE2D2D7859D926AB8CF6	219BE093776F0EC957951D014D79777EE107B918	F0F53CBA65B217269A6F334D5FB6B8161EC51CDD8280566F2DCD3B3C35D290CD
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 19 07:26:14 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	A02E61EC1CED577B4500EDCFABD6AE4F	F9F29D35631067BFB53314A8F4FA16D19F379755	0F1DC145E708D05C4306D61A9429B0C54F5C721D1A266804E9135B4B785C50C3
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	CB00F17EE15CB59A772A823AD1953D9D	1DBD8ED1DCB4DFB38C00F139FA9FE8C2D690CB29	0183A26BC2C13953CB3F91458D6851EF2E116066B1D6BBCD2CD2496338893CA4
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 19 07:26:14 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	285A16A99EBEAFC4D7EBABD387589B99	6962352C35B694C1852F8219B3B6108DB0166E7F	0C3766CDE3EC5ED9FB59761F325176556B55C08E56FB5DC0713F44765428AD04
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 19 07:26:14 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	C5AAF07B7CD0D89B120CA383591139FD	15DF407817B9135EC4C5FE97B8B273D33DCAA98F	E3D39387718E7DC8AE3B145ACC0035C8D415ADB9B14DF6B84C404D689A755813
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 19 07:26:14 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	296FCFFC1EA85B9AA73E601B4C97E8AE	BA4D5435210BF6045B2A28F9AB8C3154F9E1CF9E	D13BE5F7FDC1906CE84B4EE461973E954FE6F62D83F9C24667738AA0DC7E10B4
Chrome Cache Entry: 73	Unicode text, UTF-8 text, with very long lines (50806)	0D6763B67616CB9183F3931313D42971	F0459300E39155DF7AA5E94B3BDB8C8594F49A60	DE2BBD8E0B32F53A53C1729BEDB350CEA59E9115FBA4F2BED8E2E3DD1F76D9FA
Chrome Cache Entry: 74	ASCII text	315A0BDC202C9B2FE19CFC42EA04D764	D04F2D715A73CA562CAA2544EA885A932F20E185	7E794BC4608F3355CA991E021119E82FB87DFEA7057A6ACFC88DCBB2E9642082
Chrome Cache Entry: 75	ASCII text, with very long lines (28941)	BA847811448EF90D98D272AECCEF2A95	5814E91BB6276F4DE8B7951C965F2F190A03978D	898D05A17F2CFC5120DDCDBA47A885C378C0B466F30F0700E502757E24B403A1
Chrome Cache Entry: 76	ASCII text	449DD3907404CEAD5D8BA6203B3550DC	C9BB690411C3F46145F8EA137E6783929D8C27AA	3585A42757908BA2ACE27F41B01256F6CF4FFB9679F7AC0FF8957817D5CCFDE1
Chrome Cache Entry: 77	ASCII text, with very long lines (65447)	8FB8FEE4FCC3CC86FF6C724154C49C42	B82D238D4E31FDF618BAE8AC11A6C812C03DD0D4	FF1523FB7389539C84C65ABA19260648793BB4F5E29329D2EE8804BC37A3FE6E
Chrome Cache Entry: 78	ASCII text	B94B3FB60C559DB34B7AE821C9368B5F	1D389CC788030FEDB24E709E7D1330EC3789D18F	2FEFBAF4D062DF56D0335279167BE66E487540EA9DD8DB745A226D64BE95F239
Chrome Cache Entry: 79	ASCII text, with very long lines (9373)	ADD5B3F0900365F3B4240664DA17760E	7CBD53BFCF830E7C150D6BB55EFCC2832E7543E7	42338BC162A705B04953FC72340216DBEFB55CF12EC1A6E7CAD04E5E680E26BC
Chrome Cache Entry: 80	ASCII text, with very long lines (13326)	A36B8E9CBFB4A675225AA408C4D15C0C	FCD46DE9C99E71ED586A850D877FD3B01E8269FD	16EB18D9C6303CDD50AC58DB5B2B116C5DCC4C43C89424F268F6D13FC599FB19
Chrome Cache Entry: 81	ASCII text	8EB135311DE8119732EBCF00BB775364	6B6ACD0D3B7E1D27C8130899DCA581CB9A415FE9	AC6BC213C9EF74C63BE52C04725427833977BDFCFF9975974C494B47D4CE5FE2
Chrome Cache Entry: 82	ASCII text, with very long lines (27303)	4FBD15CB6047AF93373F4F895639C8BF	12D6861075DE8E293265FF6FF03B1F3ADCB44C76	DDD92F10AD162C7449EFF0ACAF40598C05B1111739587EDB75E5326B6697C5D5
Chrome Cache Entry: 83	ASCII text, with no line terminators	4485A2BAFD72B3EB2371C9B1286BBDF3	502BABAD61CDB4D2CFA39D15AE3D23395E9AD97B	9C6EF9763E8B7231452141B50CEC16E9281C6E18E11298FE1DE104E9B6E9406F
Chrome Cache Entry: 84	Unicode text, UTF-8 text	9A19754FBD746AE6B603286C3A971E55	C45B906EC95326202C2A8E13545B5C17E92BBDC7	D1416DC4293EAAE9E4AAC8D5267FB0D5DCB35D9DBC44B63278F75750A1F9CC22
Chrome Cache Entry: 85	ASCII text	92F929C4BC5B25C73B8288922E6BDDBA	8FC728C33DCB01BDDA4F2FC005DC2D65778E0723	6FB1A7F0EF69A34D10191D7AFA3899746645013F058EAC4B4E4D0B3AFAD6B4B3
Chrome Cache Entry: 86	MS Windows icon resource - 1 icon, 16x16, 2 colors	FF82D748B4ADD52E4DD7C8F0B58B89F2	EA69CEBF29F461D7831368697F303EA4F0C69A2D	DE88C1F678413736E858B27974CD5D2181B3DF891B8999DD93835384B0CA2D8F
Chrome Cache Entry: 87	ASCII text, with very long lines (597)	0B0128AB9E61554877CBB24986C24F04	30F5C25060787C4FB0FD4A45EE48D82C683145DA	E8957BB182A5047B07BEA0A49FD22B11614B1AB9AC5B8286FCB2259F48658E73
Chrome Cache Entry: 88	ASCII text	3ADE0B17B1B7C3D1C27ABA12CEEDA1D3	F8C1FE63C016A077E1545D123EB4DB8E8A690C6D	CF55D95AD63C72F2EEB219DA669CC848CC3022FA4A4798D62ED19ED342460CBE
Chrome Cache Entry: 89	ASCII text, with very long lines (65366)	8A7442CA6BEDD62CEC4881040B9A9E83	E2D2B846E9EA72A1985458A3748AAB4E01A8FB3A	E9503448692B738DD260FBD7F7CABF2E11F09B600FA97E6EB3A56EBA5B1A7E9B
Chrome Cache Entry: 90	MS Windows icon resource - 1 icon, 16x16, 2 colors	FF82D748B4ADD52E4DD7C8F0B58B89F2	EA69CEBF29F461D7831368697F303EA4F0C69A2D	DE88C1F678413736E858B27974CD5D2181B3DF891B8999DD93835384B0CA2D8F

Source: https://newexra.com/lists/hd595fmsbd54c/unsubscribe/sm021tfebd0e1/zj986hw5a47dc?source=email-client-unsubscribe-button

HTTP Parser: No favicon

Source: https://newexra.com/lists/hd595fmsbd54c/unsubscribe/sm021tfebd0e1/zj986hw5a47dc?source=email-client-unsubscribe-button

HTTP Parser: No <meta name="author".. found

Source: https://newexra.com/lists/hd595fmsbd54c/unsubscribe/sm021tfebd0e1/zj986hw5a47dc?source=email-client-unsubscribe-button

HTTP Parser: No <meta name="copyright".. found

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49738 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 23.63.206.91:443 -> 192.168.2.5:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.63.206.91:443 -> 192.168.2.5:49728 version: TLS 1.2

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49738 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /lists/hd595fmsbd54c/unsubscribe/sm021tfebd0e1/zj986hw5a47dc?source=email-client-unsubscribe-button HTTP/1.1Host: newexra.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/css/bootstrap.min.css?av=1262687b HTTP/1.1Host: newexra.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://newexra.com/lists/hd595fmsbd54c/unsubscribe/sm021tfebd0e1/zj986hw5a47dc?source=email-client-unsubscribe-buttonAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mwsid=36229f2e381c3a9a97b92a74ef2ca6da; csrf_token=cf39fdd9949cb929647dd12186b9403ece0d7495s%3A88%3A%22M2FLT0doY0hQXzhSczl2bldIQlR3V2JwTGlaN3RpWEfPUo4wUGwKLygEsnLtbYvYvwNel07Ur1G9037BdYZtlg%3D%3D%22%3B
Source: global traffic	HTTP traffic detected: GET /assets/css/font-awesome/css/font-awesome.min.css?av=1262687b HTTP/1.1Host: newexra.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://newexra.com/lists/hd595fmsbd54c/unsubscribe/sm021tfebd0e1/zj986hw5a47dc?source=email-client-unsubscribe-buttonAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mwsid=36229f2e381c3a9a97b92a74ef2ca6da; csrf_token=cf39fdd9949cb929647dd12186b9403ece0d7495s%3A88%3A%22M2FLT0doY0hQXzhSczl2bldIQlR3V2JwTGlaN3RpWEfPUo4wUGwKLygEsnLtbYvYvwNel07Ur1G9037BdYZtlg%3D%3D%22%3B
Source: global traffic	HTTP traffic detected: GET /assets/css/ionicons/css/ionicons.min.css?av=1262687b HTTP/1.1Host: newexra.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://newexra.com/lists/hd595fmsbd54c/unsubscribe/sm021tfebd0e1/zj986hw5a47dc?source=email-client-unsubscribe-buttonAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mwsid=36229f2e381c3a9a97b92a74ef2ca6da; csrf_token=cf39fdd9949cb929647dd12186b9403ece0d7495s%3A88%3A%22M2FLT0doY0hQXzhSczl2bldIQlR3V2JwTGlaN3RpWEfPUo4wUGwKLygEsnLtbYvYvwNel07Ur1G9037BdYZtlg%3D%3D%22%3B
Source: global traffic	HTTP traffic detected: GET /assets/css/adminlte.css?av=1262687b HTTP/1.1Host: newexra.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://newexra.com/lists/hd595fmsbd54c/unsubscribe/sm021tfebd0e1/zj986hw5a47dc?source=email-client-unsubscribe-buttonAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mwsid=36229f2e381c3a9a97b92a74ef2ca6da; csrf_token=cf39fdd9949cb929647dd12186b9403ece0d7495s%3A88%3A%22M2FLT0doY0hQXzhSczl2bldIQlR3V2JwTGlaN3RpWEfPUo4wUGwKLygEsnLtbYvYvwNel07Ur1G9037BdYZtlg%3D%3D%22%3B
Source: global traffic	HTTP traffic detected: GET /frontend/assets/css/style.css?av=1262687b HTTP/1.1Host: newexra.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://newexra.com/lists/hd595fmsbd54c/unsubscribe/sm021tfebd0e1/zj986hw5a47dc?source=email-client-unsubscribe-buttonAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mwsid=36229f2e381c3a9a97b92a74ef2ca6da; csrf_token=cf39fdd9949cb929647dd12186b9403ece0d7495s%3A88%3A%22M2FLT0doY0hQXzhSczl2bldIQlR3V2JwTGlaN3RpWEfPUo4wUGwKLygEsnLtbYvYvwNel07Ur1G9037BdYZtlg%3D%3D%22%3B
Source: global traffic	HTTP traffic detected: GET /assets/css/skin-blue.css?av=1262687b HTTP/1.1Host: newexra.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://newexra.com/lists/hd595fmsbd54c/unsubscribe/sm021tfebd0e1/zj986hw5a47dc?source=email-client-unsubscribe-buttonAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mwsid=36229f2e381c3a9a97b92a74ef2ca6da; csrf_token=cf39fdd9949cb929647dd12186b9403ece0d7495s%3A88%3A%22M2FLT0doY0hQXzhSczl2bldIQlR3V2JwTGlaN3RpWEfPUo4wUGwKLygEsnLtbYvYvwNel07Ur1G9037BdYZtlg%3D%3D%22%3B
Source: global traffic	HTTP traffic detected: GET /frontend/assets/cache/1c9ce001/jquery.min.js HTTP/1.1Host: newexra.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://newexra.com/lists/hd595fmsbd54c/unsubscribe/sm021tfebd0e1/zj986hw5a47dc?source=email-client-unsubscribe-buttonAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mwsid=36229f2e381c3a9a97b92a74ef2ca6da; csrf_token=cf39fdd9949cb929647dd12186b9403ece0d7495s%3A88%3A%22M2FLT0doY0hQXzhSczl2bldIQlR3V2JwTGlaN3RpWEfPUo4wUGwKLygEsnLtbYvYvwNel07Ur1G9037BdYZtlg%3D%3D%22%3B
Source: global traffic	HTTP traffic detected: GET /frontend/assets/cache/1c9ce001/jquery-migrate.min.js HTTP/1.1Host: newexra.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://newexra.com/lists/hd595fmsbd54c/unsubscribe/sm021tfebd0e1/zj986hw5a47dc?source=email-client-unsubscribe-buttonAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mwsid=36229f2e381c3a9a97b92a74ef2ca6da; csrf_token=cf39fdd9949cb929647dd12186b9403ece0d7495s%3A88%3A%22M2FLT0doY0hQXzhSczl2bldIQlR3V2JwTGlaN3RpWEfPUo4wUGwKLygEsnLtbYvYvwNel07Ur1G9037BdYZtlg%3D%3D%22%3B
Source: global traffic	HTTP traffic detected: GET /assets/js/bootstrap.min.js?av=1262687b HTTP/1.1Host: newexra.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://newexra.com/lists/hd595fmsbd54c/unsubscribe/sm021tfebd0e1/zj986hw5a47dc?source=email-client-unsubscribe-buttonAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mwsid=36229f2e381c3a9a97b92a74ef2ca6da; csrf_token=cf39fdd9949cb929647dd12186b9403ece0d7495s%3A88%3A%22M2FLT0doY0hQXzhSczl2bldIQlR3V2JwTGlaN3RpWEfPUo4wUGwKLygEsnLtbYvYvwNel07Ur1G9037BdYZtlg%3D%3D%22%3B
Source: global traffic	HTTP traffic detected: GET /assets/js/knockout.min.js?av=1262687b HTTP/1.1Host: newexra.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://newexra.com/lists/hd595fmsbd54c/unsubscribe/sm021tfebd0e1/zj986hw5a47dc?source=email-client-unsubscribe-buttonAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mwsid=36229f2e381c3a9a97b92a74ef2ca6da; csrf_token=cf39fdd9949cb929647dd12186b9403ece0d7495s%3A88%3A%22M2FLT0doY0hQXzhSczl2bldIQlR3V2JwTGlaN3RpWEfPUo4wUGwKLygEsnLtbYvYvwNel07Ur1G9037BdYZtlg%3D%3D%22%3B
Source: global traffic	HTTP traffic detected: GET /assets/js/adminlte.js?av=1262687b HTTP/1.1Host: newexra.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://newexra.com/lists/hd595fmsbd54c/unsubscribe/sm021tfebd0e1/zj986hw5a47dc?source=email-client-unsubscribe-buttonAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mwsid=36229f2e381c3a9a97b92a74ef2ca6da; csrf_token=cf39fdd9949cb929647dd12186b9403ece0d7495s%3A88%3A%22M2FLT0doY0hQXzhSczl2bldIQlR3V2JwTGlaN3RpWEfPUo4wUGwKLygEsnLtbYvYvwNel07Ur1G9037BdYZtlg%3D%3D%22%3B
Source: global traffic	HTTP traffic detected: GET /assets/js/notify.js?av=1262687b HTTP/1.1Host: newexra.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://newexra.com/lists/hd595fmsbd54c/unsubscribe/sm021tfebd0e1/zj986hw5a47dc?source=email-client-unsubscribe-buttonAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mwsid=36229f2e381c3a9a97b92a74ef2ca6da; csrf_token=cf39fdd9949cb929647dd12186b9403ece0d7495s%3A88%3A%22M2FLT0doY0hQXzhSczl2bldIQlR3V2JwTGlaN3RpWEfPUo4wUGwKLygEsnLtbYvYvwNel07Ur1G9037BdYZtlg%3D%3D%22%3B
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /assets/js/cookie.js?av=1262687b HTTP/1.1Host: newexra.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://newexra.com/lists/hd595fmsbd54c/unsubscribe/sm021tfebd0e1/zj986hw5a47dc?source=email-client-unsubscribe-buttonAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mwsid=36229f2e381c3a9a97b92a74ef2ca6da; csrf_token=cf39fdd9949cb929647dd12186b9403ece0d7495s%3A88%3A%22M2FLT0doY0hQXzhSczl2bldIQlR3V2JwTGlaN3RpWEfPUo4wUGwKLygEsnLtbYvYvwNel07Ur1G9037BdYZtlg%3D%3D%22%3B
Source: global traffic	HTTP traffic detected: GET /assets/js/app.js?av=1262687b HTTP/1.1Host: newexra.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://newexra.com/lists/hd595fmsbd54c/unsubscribe/sm021tfebd0e1/zj986hw5a47dc?source=email-client-unsubscribe-buttonAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mwsid=36229f2e381c3a9a97b92a74ef2ca6da; csrf_token=cf39fdd9949cb929647dd12186b9403ece0d7495s%3A88%3A%22M2FLT0doY0hQXzhSczl2bldIQlR3V2JwTGlaN3RpWEfPUo4wUGwKLygEsnLtbYvYvwNel07Ur1G9037BdYZtlg%3D%3D%22%3B
Source: global traffic	HTTP traffic detected: GET /frontend/assets/js/app.js?av=1262687b HTTP/1.1Host: newexra.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://newexra.com/lists/hd595fmsbd54c/unsubscribe/sm021tfebd0e1/zj986hw5a47dc?source=email-client-unsubscribe-buttonAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mwsid=36229f2e381c3a9a97b92a74ef2ca6da; csrf_token=cf39fdd9949cb929647dd12186b9403ece0d7495s%3A88%3A%22M2FLT0doY0hQXzhSczl2bldIQlR3V2JwTGlaN3RpWEfPUo4wUGwKLygEsnLtbYvYvwNel07Ur1G9037BdYZtlg%3D%3D%22%3B
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: newexra.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://newexra.com/lists/hd595fmsbd54c/unsubscribe/sm021tfebd0e1/zj986hw5a47dc?source=email-client-unsubscribe-buttonAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mwsid=36229f2e381c3a9a97b92a74ef2ca6da; csrf_token=cf39fdd9949cb929647dd12186b9403ece0d7495s%3A88%3A%22M2FLT0doY0hQXzhSczl2bldIQlR3V2JwTGlaN3RpWEfPUo4wUGwKLygEsnLtbYvYvwNel07Ur1G9037BdYZtlg%3D%3D%22%3B
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: newexra.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mwsid=36229f2e381c3a9a97b92a74ef2ca6da; csrf_token=cf39fdd9949cb929647dd12186b9403ece0d7495s%3A88%3A%22M2FLT0doY0hQXzhSczl2bldIQlR3V2JwTGlaN3RpWEfPUo4wUGwKLygEsnLtbYvYvwNel07Ur1G9037BdYZtlg%3D%3D%22%3B

Source: unknown

DNS traffic detected: queries for: newexra.com

Source: chromecache_74.2.dr	String found in binary or memory: http://almsaeedstudio.com
Source: chromecache_73.2.dr	String found in binary or memory: http://creativecommons.org/licenses/by/4.0/
Source: chromecache_82.2.dr	String found in binary or memory: http://fontawesome.io
Source: chromecache_82.2.dr	String found in binary or memory: http://fontawesome.io/license
Source: chromecache_89.2.dr, chromecache_75.2.dr	String found in binary or memory: http://getbootstrap.com)
Source: chromecache_73.2.dr	String found in binary or memory: http://ionicons.com/
Source: chromecache_87.2.dr	String found in binary or memory: http://knockoutjs.com/
Source: chromecache_79.2.dr, chromecache_74.2.dr	String found in binary or memory: http://opensource.org/licenses/MIT
Source: chromecache_79.2.dr	String found in binary or memory: http://www.almsaeedstudio.com
Source: chromecache_87.2.dr	String found in binary or memory: http://www.json.org/json2.js
Source: chromecache_87.2.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php)
Source: chromecache_73.2.dr	String found in binary or memory: https://github.com/driftyco/ionicons
Source: chromecache_73.2.dr	String found in binary or memory: https://github.com/google/material-design-icons
Source: chromecache_76.2.dr	String found in binary or memory: https://github.com/js-cookie/js-cookie
Source: chromecache_74.2.dr	String found in binary or memory: https://github.com/lipis/bootstrap-social
Source: chromecache_89.2.dr, chromecache_75.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: chromecache_73.2.dr	String found in binary or memory: https://twitter.com/benjsperry
Source: chromecache_73.2.dr	String found in binary or memory: https://twitter.com/ionicframework
Source: chromecache_84.2.dr, chromecache_85.2.dr, chromecache_88.2.dr	String found in binary or memory: https://www.mailwizz.com)
Source: chromecache_84.2.dr, chromecache_85.2.dr, chromecache_88.2.dr	String found in binary or memory: https://www.mailwizz.com/
Source: chromecache_84.2.dr, chromecache_85.2.dr, chromecache_88.2.dr	String found in binary or memory: https://www.mailwizz.com/license/

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703

Source: unknown	HTTPS traffic detected: 23.63.206.91:443 -> 192.168.2.5:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.63.206.91:443 -> 192.168.2.5:49728 version: TLS 1.2

Source: classification engine

Classification label: clean1.win@16/41@6/4

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2508 --field-trial-handle=2476,i,7506934698310214352,14515741543659021388,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://newexra.com/lists/hd595fmsbd54c/unsubscribe/sm021tfebd0e1/zj986hw5a47dc?source=email-client-unsubscribe-button"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2508 --field-trial-handle=2476,i,7506934698310214352,14515741543659021388,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

ID:	1428619
Product:	CloudBasic
Start time:	10:25:22
Start date:	19.04.2024
Cookbook:	browseurl.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Windows Analysis Report
https://newexra.com/lists/hd595fmsbd54c/unsubscribe/sm021tfebd0e1/zj986hw5a47dc?source=email-client-unsubscribe-button

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report https://newexra.com/lists/hd595fmsbd54c/unsubscribe/sm021tfebd0e1/zj986hw5a47dc?source=email-client-unsubscribe-button

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
https://newexra.com/lists/hd595fmsbd54c/unsubscribe/sm021tfebd0e1/zj986hw5a47dc?source=email-client-unsubscribe-button