Edit tour

Windows Analysis Report
dzfp_24912000000008328502_20240419143854.xml

Overview

General Information

Sample name:	dzfp_24912000000008328502_20240419143854.xml
Analysis ID:	1428801
MD5:	d10bbe9e8c81b87eca5a1ab73f914a83
SHA1:	06a4d8c23e532f77afd5ab292b54d0f6d13b99d5
SHA256:	bdc41f332cbb3d9be9714b9d68f86a20ba4e50aa3134a47ab2500aa80566b131
Infos:

Detection

Score:	22
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Maps a DLL or memory area into another process

Creates a process in suspended mode (likely to inject code)

IP address seen in connection with other malware

Potential browser exploit detected (process start blacklist hit)

Sigma detected: Use Short Name Path in Command Line

Classification

Process Tree

System is w10x64

MSOXMLED.EXE (PID: 7108 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\user\Desktop\dzfp_24912000000008328502_20240419143854.xml" MD5: A2E6E2A1C125973A4967540FD08C9AF0)

iexplore.exe (PID: 6432 cmdline: "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\user\Desktop\dzfp_24912000000008328502_20240419143854.xml MD5: CFE2E6942AC1B72981B3105E22D3224E)

iexplore.exe (PID: 6236 cmdline: "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6432 CREDAT:17410 /prefetch:2 MD5: 6F0F06D6AB125A99E43335427066A4A1)

ie_to_edge_stub.exe (PID: 2032 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=10446 MD5: 89CF8972D683795DAB6901BC9456675D)

msedge.exe (PID: 7080 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=10446 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7344 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1996,i,10698612074870062609,12499821732164552685,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

ssvagent.exe (PID: 6772 cmdline: "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new MD5: F9A898A606E7F5A1CD7CFFA8079253A0)

msedge.exe (PID: 7404 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=10446 --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7756 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2728 --field-trial-handle=2184,i,11594580017313890881,4442214113381102987,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8484 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=5952 --field-trial-handle=2184,i,11594580017313890881,4442214113381102987,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

identity_helper.exe (PID: 8692 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6480 --field-trial-handle=2184,i,11594580017313890881,4442214113381102987,262144 /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

identity_helper.exe (PID: 8712 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6480 --field-trial-handle=2184,i,11594580017313890881,4442214113381102987,262144 /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

msedge.exe (PID: 9192 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8616 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1216 --field-trial-handle=2072,i,11293785848732824400,2409551121586848513,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 6212 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 9000 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2208 --field-trial-handle=2080,i,7567095657503735584,18263680576250926807,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cleanup

Sigma Signatures

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new, CommandLine: "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new, CommandLine|base64offset|contains: w, Image: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe, NewProcessName: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe, OriginalFileName: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe, ParentCommandLine: "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6432 CREDAT:17410 /prefetch:2, ParentImage: C:\Program Files (x86)\Internet Explorer\iexplore.exe, ParentProcessId: 6236, ParentProcessName: iexplore.exe, ProcessCommandLine: "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new, ProcessId: 6772, ProcessName: ssvagent.exe

Sigma detected: Modification of IE Registry Settings

Source: Registry Key set

Author: frack113: Data: Details: 1, EventID: 13, EventType: SetValue, Image: C:\Program Files\Internet Explorer\iexplore.exe, ProcessId: 6432, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\SecuritySafe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe

Source: Joe Sandbox View	IP Address: 152.195.19.97 152.195.19.97
Source: Joe Sandbox View	IP Address: 131.253.33.239 131.253.33.239
Source: Joe Sandbox View	IP Address: 162.159.61.3 162.159.61.3
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox View	IP Address: 13.107.213.41 13.107.213.41

Source: unknown	TCP traffic detected without corresponding DNS query: 74.125.138.95
Source: unknown	TCP traffic detected without corresponding DNS query: 74.125.138.95
Source: unknown	TCP traffic detected without corresponding DNS query: 74.125.138.95
Source: unknown	TCP traffic detected without corresponding DNS query: 74.125.138.95
Source: unknown	TCP traffic detected without corresponding DNS query: 74.125.138.95
Source: unknown	TCP traffic detected without corresponding DNS query: 74.125.138.95
Source: unknown	TCP traffic detected without corresponding DNS query: 74.125.138.95
Source: unknown	TCP traffic detected without corresponding DNS query: 74.125.138.95
Source: unknown	TCP traffic detected without corresponding DNS query: 74.125.138.95
Source: unknown	TCP traffic detected without corresponding DNS query: 74.125.138.95
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.239
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.239
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.239
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.239
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.239
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.239
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.239
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.239
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.239
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.239
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /crx/blobs/AfQPRnlBHVf9QbAmjPnmJQnDwEcerxafOq8p01cAfJ5QoFk2s6gAMnMY_23BNiizXK2e-3smriJGTe2WOZO9s5X2xejbvoKpPILOKN2-0t9ZbrurACaLAMZSmuXX9slHldVQ07B5bvw6KCm_x6CONA/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_76_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=R83mlHRCqeHRG9T0loza5cz3U8zjuZzQy2wVvoSHGHw%3D&st=2021-01-01T00%3A00%3A00Z&se=2024-06-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1714141286&P2=404&P3=2&P4=NO%2b6Bn%2bUYXbBnY6dYtTlRt3KqVFy1SE%2f%2bDQLdSHmdlSyTHjFSwheDWL%2fqw%2fiu7ngPF4Cj0wvB1OGdhA%2fBw2v0Q%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: qwTGFoeAiJncXOGOzNl7VSSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8

Source: msapplication.xml1.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0xef46244e,0x01da9264</date><accdate>0xef4883cc,0x01da9264</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml6.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0xef51f8b3,0x01da9264</date><accdate>0xef56bf57,0x01da9264</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml8.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0xef5b8371,0x01da9264</date><accdate>0xef5dee31,0x01da9264</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)

Source: unknown

DNS traffic detected: queries for: clients2.googleusercontent.com

Source: unknown

HTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message

Source: msapplication.xml.1.dr	String found in binary or memory: http://www.amazon.com/
Source: msapplication.xml2.1.dr	String found in binary or memory: http://www.google.com/
Source: msapplication.xml3.1.dr	String found in binary or memory: http://www.live.com/
Source: msapplication.xml4.1.dr	String found in binary or memory: http://www.nytimes.com/
Source: msapplication.xml5.1.dr	String found in binary or memory: http://www.reddit.com/
Source: msapplication.xml6.1.dr	String found in binary or memory: http://www.twitter.com/
Source: msapplication.xml7.1.dr	String found in binary or memory: http://www.wikipedia.com/
Source: msapplication.xml8.1.dr	String found in binary or memory: http://www.youtube.com/
Source: Network Persistent State0.8.dr	String found in binary or memory: https://chrome.cloudflare-dns.com
Source: manifest.json0.8.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json0.8.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: 6ff4db96-2905-40ef-9026-65080ecdfbf8.tmp.9.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json.8.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 6ff4db96-2905-40ef-9026-65080ecdfbf8.tmp.9.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: manifest.json.8.dr	String found in binary or memory: https://docs.google.com/
Source: manifest.json.8.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json.8.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json.8.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json.8.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json.8.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json.8.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json.8.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json.8.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json.8.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json.8.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json.8.dr	String found in binary or memory: https://drive.google.com/
Source: 000003.log5.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: content_new.js.8.dr, content.js.8.dr	String found in binary or memory: https://www.google.com/chrome
Source: 6ff4db96-2905-40ef-9026-65080ecdfbf8.tmp.9.dr	String found in binary or memory: https://www.googleapis.com
Source: Top Sites.8.dr	String found in binary or memory: https://www.office.com/
Source: Top Sites.8.dr	String found in binary or memory: https://www.office.com/Office

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: classification engine

Classification label: sus22.evad.winXML@57/304@8/8

Source: C:\Program Files\Internet Explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery

Jump to behavior

Source: C:\Program Files\Internet Explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DF901DF1FC86737961.TMP

Jump to behavior

Source: C:\Program Files\Internet Explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Login Data.8.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE	Section loaded: appvisvsubsystems32.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE	Section loaded: c2r32.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: uxtheme.dll	Jump to behavior

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868			Jump to behavior

Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE	Process created: C:\Program Files\Internet Explorer\iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\user\Desktop\dzfp_24912000000008328502_20240419143854.xml			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=10446			Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	111 Process Injection	1 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	111 Process Injection	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	Security Account Manager	2 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label
https://chrome.cloudflare-dns.com	0%	URL Reputation	safe
https://chrome.cloudflare-dns.com/dns-query	0%	URL Reputation	safe
http://www.wikipedia.com/	0%	URL Reputation	safe

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	172.64.41.3	true	false	unknown
part-0013.t-0009.t-msedge.net	13.107.213.41	true	false	unknown
googlehosted.l.googleusercontent.com	142.250.9.132	true	false	high
sni1gl.wpc.nucdn.net	152.195.19.97	true	false	unknown
clients2.googleusercontent.com	unknown	unknown	false	high

Name	Malicious	Antivirus Detection	Reputation
https://chrome.cloudflare-dns.com/dns-query	false	URL Reputation: safe	unknown
https://clients2.googleusercontent.com/crx/blobs/AfQPRnlBHVf9QbAmjPnmJQnDwEcerxafOq8p01cAfJ5QoFk2s6gAMnMY_23BNiizXK2e-3smriJGTe2WOZO9s5X2xejbvoKpPILOKN2-0t9ZbrurACaLAMZSmuXX9slHldVQ07B5bvw6KCm_x6CONA/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_76_1_0.crx	false		high

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.office.com/	Top Sites.8.dr	false		high
https://chrome.cloudflare-dns.com	Network Persistent State0.8.dr	false	URL Reputation: safe	unknown
http://www.nytimes.com/	msapplication.xml4.1.dr	false		high
https://drive-daily-2.corp.google.com/	manifest.json.8.dr	false		high
https://drive-autopush.corp.google.com/	manifest.json.8.dr	false		high
https://drive-daily-4.corp.google.com/	manifest.json.8.dr	false		high
https://www.office.com/Office	Top Sites.8.dr	false		high
http://www.amazon.com/	msapplication.xml.1.dr	false		high
http://www.twitter.com/	msapplication.xml6.1.dr	false		high
https://drive-daily-1.corp.google.com/	manifest.json.8.dr	false		high
https://drive-daily-5.corp.google.com/	manifest.json.8.dr	false		high
https://docs.google.com/	manifest.json.8.dr	false		high
https://drive-staging.corp.google.com/	manifest.json.8.dr	false		high
https://www.google.com/chrome	content_new.js.8.dr, content.js.8.dr	false		high
https://drive-daily-6.corp.google.com/	manifest.json.8.dr	false		high
https://drive.google.com/	manifest.json.8.dr	false		high
https://drive-daily-0.corp.google.com/	manifest.json.8.dr	false		high
http://www.youtube.com/	msapplication.xml8.1.dr	false		high
https://chromewebstore.google.com/	manifest.json0.8.dr	false		high
http://www.wikipedia.com/	msapplication.xml7.1.dr	false	URL Reputation: safe	unknown
https://drive-preprod.corp.google.com/	manifest.json.8.dr	false		high
https://clients2.googleusercontent.com	6ff4db96-2905-40ef-9026-65080ecdfbf8.tmp.9.dr	false		high
http://www.live.com/	msapplication.xml3.1.dr	false		high
https://chrome.google.com/webstore/	manifest.json0.8.dr	false		high
http://www.reddit.com/	msapplication.xml5.1.dr	false		high
http://www.google.com/	msapplication.xml2.1.dr	false		high
https://drive-daily-3.corp.google.com/	manifest.json.8.dr	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
152.195.19.97	sni1gl.wpc.nucdn.net	United States	15133	EDGECASTUS	false
131.253.33.239	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
13.107.213.41	part-0013.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
74.125.138.95	unknown	United States	15169	GOOGLEUS	false
142.250.9.132	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1428801
Start date and time:	2024-04-19 16:20:27 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	dzfp_24912000000008328502_20240419143854.xml
Detection:	SUS
Classification:	sus22.evad.winXML@57/304@8/8
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .xml

Time	Type	Description
15:21:30	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868 "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
15:21:38	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868 "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
162.159.61.3	SenPalia.exe	Get hash	malicious	Unknown	Browse
	SenPalia.exe	Get hash	malicious	Unknown	Browse
	ppop_verification_request.zip	Get hash	malicious	Unknown	Browse
	EpsilonFruit.exe	Get hash	malicious	Pafish	Browse
	nsis-installer.exe	Get hash	malicious	Unknown	Browse
	nsis-installer.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	https://ecouterrepondeurvocal.pro/35-hnJZib	Get hash	malicious	Unknown	Browse
	7TOBanrkqU.exe	Get hash	malicious	Unknown	Browse
239.255.255.250	https://royaltattoo.in/js/kalexander@yourlawyer.com	Get hash	malicious	Phisher	Browse
	https://www.dropbox.com/l/scl/AADwcgxTbjuvzakz6kszZMzP6RXavhxhixQ	Get hash	malicious	HTMLPhisher	Browse
	https://cionfacttalleriproj.norwayeast.cloudapp.azure.com/?finanzas.busqueda?q=Secretar%C3%ADa+de+Administraci%C3%B3n+y+Finanzas?30337974_3097_705331937556-157889157889770732479410588494105884	Get hash	malicious	HTMLPhisher	Browse
	https://cosantinexi.com/	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse
	https://diversityjobs.com/employer/company/1665/Worthington-Industries-Inc	Get hash	malicious	Unknown	Browse
	https://app.box.com/s/ktl5qtvf2us1megbgmjabwqaxcdy69b5	Get hash	malicious	Unknown	Browse
	https://dt.r24dmp.de/	Get hash	malicious	Unknown	Browse
	https://bestprizerhere.life/?u=3w8p605&o=pn1kfzq&t=pshtb_redirectUrl_body	Get hash	malicious	GRQ Scam	Browse
	http://bestprizerhere.life/	Get hash	malicious	Unknown	Browse
	https://cionfacttalleriproj.norwayeast.cloudapp.azure.com/?finanzas.busqueda?q=Secretar%C3%ADa+de+Administraci%C3%B3n+y+Finanzas?30337974_3097_705331937556-157889157889770732479410588494105884	Get hash	malicious	HTMLPhisher	Browse
13.107.213.41	Quotation.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zM
13.107.213.41	http://www.serviceadg.com	Get hash	malicious	Unknown	Browse	fr.linkedin.com/company/service-adg
152.195.19.97	https://cosantinexi.com/	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse
	https://tracker.club-os.com/campaign/click?msgId=f8ea317d963149a518aa35e03e5541f797badf3c&target=splendidanimations.com%2F%40%2FBigge/aDRmd79087aDRmd79087aDRmd/ZHN3ZWF6YUBiaWdnZS5jb20=	Get hash	malicious	HTMLPhisher	Browse
	https://tracker.club-os.com/campaign/click?msgId=f8ea317d963149a518aa35e03e5541f797badf3c&target=splendidanimations.com%2F%40%2FC2educate/aEFQv26188aEFQv26188aEFQv/anVsaWUubG9uZ2lub0BjMmVkdWNhdGUuY29t	Get hash	malicious	HTMLPhisher	Browse
	http://t.cm.morganstanley.com/r/?id=h1b92d14%2C134cc33c%2C1356be32&p1=www.saiengroup.com%2Fteaz%2F648c482b60b3906833c9304bab170add%2FJBVNhz%2FYW15LmNoZW5AZG91YmxlbGluZS5jb20=	Get hash	malicious	HTMLPhisher	Browse
	https://tukix.net/qp9sKz1A43Pt/news/d1022596bf248601809305df44e8f1f4////dGNvb3BlckBod25lbmVyZ3kuY29t	Get hash	malicious	HTMLPhisher	Browse
	https://tracker.club-os.com/campaign/click?msgId=f8ea317d963149a518aa35e03e5541f797badf3c&target=splendidanimations.com%2F%40%2FQuantexa/IpoXF42991IpoXF42991IpoXF/bWFzc2ltb2JvcnJlbGxpQHF1YW50ZXhhLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse
	https://bookmarkover.com/Ma2V2aW4ud2F0dEBzZWN1cml0eWJlbmVmaXQuY29t	Get hash	malicious	HTMLPhisher	Browse
	https://ised-isde.canada.ca/cc/lgcy/lsc.html?&_convId=&act=&corpId=9933379&f=&key=&p=&refUrl=http://0.damdavy.com.ng/(+)/Courtney/()%3E%3E-)/8E26uat3tG010p4Lu=678()a=221()TO=106/8305326/Y291cnRuZXkubmVsc29uQGxjYXR0ZXJ0b24uY29tCg==/##	Get hash	malicious	HTMLPhisher	Browse
	Consignee-returns-spreadsheet.xls	Get hash	malicious	Unknown	Browse
	https://r20.rs6.net/tn.jsp?f=001hdorddfRVpfBhjmCzZP_M9e3n-9HvwH5WndewdVBwOCaKywXuTP72YftDf8G7EZegNKDuHDStGd0F_YqHq-dwkMezptPaVTW7z3GmrsquDjOTUdJWUiPwtfYdeAV_V719niRmATzLmr1i2Q4VD5Hjq7GD9AIQnalZTS2xJ4NBmEjoOsyfi4JfmCXpI8wp394l5knVxHSX1M-okruwnPJWWbuauOcxTMO&c=&ch=#YmdyYWltZUBuZXhwb2ludC5jb20=	Get hash	malicious	Unknown	Browse
131.253.33.239	file.exe	Get hash	malicious	Unknown	Browse
	http://woollamau.com	Get hash	malicious	Unknown	Browse
	BraveBrowserSetup-BRV010.exe	Get hash	malicious	Unknown	Browse
	QpZhH052mS.exe	Get hash	malicious	Amadey, RedLine, RisePro Stealer	Browse
	SecuriteInfo.com.Win32.TrojanX-gen.27824.18326.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse
	SecuriteInfo.com.TScope.Malware-Cryptor.SB.26060.13321.exe	Get hash	malicious	RisePro Stealer	Browse
	https://stackauth-bainlk.cz/save/sharefile/	Get hash	malicious	Unknown	Browse
	lmiXXjKzpz.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse
	S8asBCa2u0.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse
	TO92l1miUY	Get hash	malicious	Unknown	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
part-0013.t-0009.t-msedge.net	http://monacolife.net	Get hash	malicious	Unknown	Browse	13.107.246.41
	https://www.joesandbox.com/login	Get hash	malicious	Unknown	Browse	13.107.246.41
	https://librospy.com/	Get hash	malicious	Unknown	Browse	13.107.213.41
	https://sdcoes.net/LandingPage/Index/122/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.41
	https://6a5ff6af4b0fe3e6f0bd452927dfb55b352fdd2d1bab6d1e7de2b641e2.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	13.107.213.41
	https://18apmic18.z13.web.core.windows.net/	Get hash	malicious	TechSupportScam	Browse	13.107.213.41
	Payment Receipt .html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.41
	http://wzxqi.theknittingdoula.com/ghoopuh/lopwiuiye	Get hash	malicious	HTMLPhisher	Browse	13.107.246.41
	https://nwcchicago-my.sharepoint.com/:b:/p/jpsanavaitis/EZA36vHeUQxCnJ96O418g94BWiWpCx4SyNTLHION5X1T7g?e=N00DO7	Get hash	malicious	HTMLPhisher	Browse	13.107.213.41
	https://dinamicconsultores.app.questorpublico.com.br/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.41
chrome.cloudflare-dns.com	SenPalia.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	SenPalia.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	EpsilonFruit.exe	Get hash	malicious	Pafish	Browse	162.159.61.3
	BetaUnfrated.exe	Get hash	malicious	Pafish	Browse	172.64.41.3
	nsis-installer.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	nsis-installer.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	https://ecouterrepondeurvocal.pro/35-hnJZib	Get hash	malicious	Unknown	Browse	162.159.61.3
	806aab44-6c03-4577-a3c4-83aa13dc7875.tmp	Get hash	malicious	Unknown	Browse	172.64.41.3
sni1gl.wpc.nucdn.net	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	https://ecouterrepondeurvocal.pro/35-hnJZib	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	Payslip-9583.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	http://woollamau.com	Get hash	malicious	Unknown	Browse	152.195.19.97
	http://woollamau.com	Get hash	malicious	Unknown	Browse	152.195.19.97
	O28gzBGj5H.svg	Get hash	malicious	Unknown	Browse	152.195.19.97
	JG822Ei50X.exe	Get hash	malicious	Neshta	Browse	152.195.19.97
	hKi4HPB9nO.exe	Get hash	malicious	Gocoder, Mimikatz	Browse	152.195.19.97

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	ul5RjxwWTK.elf	Get hash	malicious	Unknown	Browse	20.1.13.62
	order.exe	Get hash	malicious	Unknown	Browse	52.109.6.53
	https://diversityjobs.com/employer/company/1665/Worthington-Industries-Inc	Get hash	malicious	Unknown	Browse	52.162.201.54
	mCS7AR9pKm.elf	Get hash	malicious	Mirai, Okiru	Browse	20.174.35.247
	SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Get hash	malicious	Remcos, DBatLoader	Browse	13.107.137.11
	Gantt_Excel_Pro_Daily_Free1.xlsm	Get hash	malicious	Unknown	Browse	13.107.246.40
	https://jll2.sharepoint.com/:f:/t/WorkplaceStrategy274/EqyxzpLxD8lEhSn1hXMNtKMBbmoik8-xeuIbHrYk7cgngA?e=5%3a2wyFQq&at=9&xsdata=MDV8MDJ8cGF0cmljaWEucmliZWlyb0Bub3ZvYmFuY28ucHR8NjlmMTdkMWU5YzBjNDFkN2UwZmIwOGRjNTNjN2YwZTV8MTAzMzgwNDgxOTNhNDI5OGFiZWEzNTk2YWU4OGIwNWV8MHwwfDYzODQ3NzM2NTQwMjI0OTQwNXxVbmtub3dufFRXRnBiR1pzYjNkOGV5SldJam9pTUM0d0xqQXdNREFpTENKUUlqb2lWMmx1TXpJaUxDSkJUaUk2SWsxaGFXd2lMQ0pYVkNJNk1uMD18MHx8fA%3d%3d&sdata=T2RkZHdHdHpwUXkxSG5Kd2Noc1RHVUc3YVNLVE1sOWZUTXdVZitYYXh6Yz0%3d	Get hash	malicious	HTMLPhisher	Browse	13.107.136.10
	http://monacolife.net	Get hash	malicious	Unknown	Browse	13.107.246.41
	https://www.joesandbox.com/login	Get hash	malicious	Unknown	Browse	13.107.246.41
CLOUDFLARENETUS	SenPalia.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	Copy of Poseidon Marine 4th monthly Stores Apr 2024 R3 .xls.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	172.67.74.152
	https://royaltattoo.in/js/kalexander@yourlawyer.com	Get hash	malicious	Phisher	Browse	104.17.25.14
	SenPalia.exe	Get hash	malicious	Unknown	Browse	104.21.7.115
	ppop_verification_request.zip	Get hash	malicious	Unknown	Browse	162.159.61.3
	https://www.dropbox.com/l/scl/AADwcgxTbjuvzakz6kszZMzP6RXavhxhixQ	Get hash	malicious	HTMLPhisher	Browse	172.64.150.44
	eOU2MVDmTd.exe	Get hash	malicious	CredGrabber, Meduza Stealer, PureLog Stealer, zgRAT	Browse	172.67.74.152
	https://cosantinexi.com/	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	104.17.2.184
	https://diversityjobs.com/employer/company/1665/Worthington-Industries-Inc	Get hash	malicious	Unknown	Browse	104.16.117.116
	W4tW72sfAD.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	104.21.57.61
CLOUDFLARENETUS	SenPalia.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	Copy of Poseidon Marine 4th monthly Stores Apr 2024 R3 .xls.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	172.67.74.152
	https://royaltattoo.in/js/kalexander@yourlawyer.com	Get hash	malicious	Phisher	Browse	104.17.25.14
	SenPalia.exe	Get hash	malicious	Unknown	Browse	104.21.7.115
	ppop_verification_request.zip	Get hash	malicious	Unknown	Browse	162.159.61.3
	https://www.dropbox.com/l/scl/AADwcgxTbjuvzakz6kszZMzP6RXavhxhixQ	Get hash	malicious	HTMLPhisher	Browse	172.64.150.44
	eOU2MVDmTd.exe	Get hash	malicious	CredGrabber, Meduza Stealer, PureLog Stealer, zgRAT	Browse	172.67.74.152
	https://cosantinexi.com/	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	104.17.2.184
	https://diversityjobs.com/employer/company/1665/Worthington-Industries-Inc	Get hash	malicious	Unknown	Browse	104.16.117.116
	W4tW72sfAD.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	104.21.57.61
MICROSOFT-CORP-MSN-AS-BLOCKUS	ul5RjxwWTK.elf	Get hash	malicious	Unknown	Browse	20.1.13.62
	order.exe	Get hash	malicious	Unknown	Browse	52.109.6.53
	https://diversityjobs.com/employer/company/1665/Worthington-Industries-Inc	Get hash	malicious	Unknown	Browse	52.162.201.54
	mCS7AR9pKm.elf	Get hash	malicious	Mirai, Okiru	Browse	20.174.35.247
	SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Get hash	malicious	Remcos, DBatLoader	Browse	13.107.137.11
	Gantt_Excel_Pro_Daily_Free1.xlsm	Get hash	malicious	Unknown	Browse	13.107.246.40
	https://jll2.sharepoint.com/:f:/t/WorkplaceStrategy274/EqyxzpLxD8lEhSn1hXMNtKMBbmoik8-xeuIbHrYk7cgngA?e=5%3a2wyFQq&at=9&xsdata=MDV8MDJ8cGF0cmljaWEucmliZWlyb0Bub3ZvYmFuY28ucHR8NjlmMTdkMWU5YzBjNDFkN2UwZmIwOGRjNTNjN2YwZTV8MTAzMzgwNDgxOTNhNDI5OGFiZWEzNTk2YWU4OGIwNWV8MHwwfDYzODQ3NzM2NTQwMjI0OTQwNXxVbmtub3dufFRXRnBiR1pzYjNkOGV5SldJam9pTUM0d0xqQXdNREFpTENKUUlqb2lWMmx1TXpJaUxDSkJUaUk2SWsxaGFXd2lMQ0pYVkNJNk1uMD18MHx8fA%3d%3d&sdata=T2RkZHdHdHpwUXkxSG5Kd2Noc1RHVUc3YVNLVE1sOWZUTXdVZitYYXh6Yz0%3d	Get hash	malicious	HTMLPhisher	Browse	13.107.136.10
	http://monacolife.net	Get hash	malicious	Unknown	Browse	13.107.246.41
	https://www.joesandbox.com/login	Get hash	malicious	Unknown	Browse	13.107.246.41
EDGECASTUS	https://cosantinexi.com/	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	152.195.19.97
	malw_sampl	Get hash	malicious	Unknown	Browse	192.229.211.108
	New Voicemail_Daiichi-Sankyo.html	Get hash	malicious	HTMLPhisher	Browse	152.199.4.44
	http://monacolife.net	Get hash	malicious	Unknown	Browse	152.199.5.152
	https://www.joesandbox.com/login	Get hash	malicious	Unknown	Browse	152.199.5.152
	https://cvn7.sa.com/invoice.html?app=	Get hash	malicious	HTMLPhisher	Browse	152.199.4.44
	Payment Receipt .html	Get hash	malicious	HTMLPhisher	Browse	72.21.91.237
	https://tracker.club-os.com/campaign/click?msgId=f8ea317d963149a518aa35e03e5541f797badf3c&target=splendidanimations.com%2F%40%2FBigge/aDRmd79087aDRmd79087aDRmd/ZHN3ZWF6YUBiaWdnZS5jb20=	Get hash	malicious	HTMLPhisher	Browse	152.195.19.97
	https://www.canva.com/design/DAGCxF7mFTo/x_4mk65cpl5G5aJF2UYVbw/view?utm_content=DAGCxF7mFTo&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	HTMLPhisher	Browse	152.199.4.44
	http://t.cm.morganstanley.com/r/?id=h1b92d14,134cc33c,1356be32&p1=esi-doc.one/YWGTytNgAkCXj6A/c451eb59da652ea3e0bb7f8bf62dc775/c451eb59da652ea3e0bb7f8bf62dc775/c451eb59da652ea3e0bb7f8bf62dc775/bXNvbG9yemFub0Bsc2ZjdS5vcmc=&d=DwMGaQ	Get hash	malicious	HTMLPhisher	Browse	152.199.4.44

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.8046022951415335
Encrypted:	false
SSDEEP:	24:suZOWcCXPRS4QAUs/KBy3TYI42Apvl6wheXpktCH2Yn4KgISQggggFpz1k9PAYHu:HBRh+sCBykteatiBn4KWi1+Ne
MD5:	DA597791BE3B6E732F0BC8B20E38EE62
SHA1:	1125C45D285C360542027D7554A5C442288974DE
SHA-256:	5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
SHA-512:	D8DC8358727590A1ED74DC70356AEDC0499552C2DC0CD4F7A01853DD85CEB3AEAD5FBDC7C75D7DA36DB6AF2448CE5ABDFF64CEBDCA3533ECAD953C061A9B338E
Malicious:	false
Preview:	...... .... .........(... ...@..... ...................................................................................................................................................................................................N...Sz..R...R...P...N..L..H..DG..........................................................................................R6..U...U...S...R...P...N..L..I..F..B...7...............................................................................S6..V...V...U...S...R...P...N..L..I..F..C...?..:z......................................................................O...W...V...V...U...S...R...P...N..L..I..E..C...?...;..{7..q2$..............................................................T..D..]...S)..p6..J...R...P...N..L..I..E..B..>..;..z7..p2..f,X.........................................................A..O#..N!..N!..N!..P$..q:...P...N..K..I..E..A..=..9..x5..n0..e,...5...................................................Ea.Z,..T$..T$..T

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8098
Entropy (8bit):	5.801689522670229
Encrypted:	false
SSDEEP:	192:asNAw0keiRUz8QMkZW+u6qRAq1k8SPxVLZ7VTiq:asNA1OWxHZ46q3QxVNZTiq
MD5:	9C29482F0FCA0BE3CEC1EB2B4E5E5F1E
SHA1:	DEAEA29B68351CBC5444DC2B5893AF8CA41CA7E5
SHA-256:	540702E18FC17A4BEC42016E55C27B53AC7593D817FA4D3B3859351E70CF2BC2
SHA-512:	D5F19B1DC98B939FF25B4B8647AA19C0E44BAD931E59239B6D632FD4CE33B2FD800DC6E2B94245579EAEA23E0CB099DFF385A643DCA0288E5043D788AFE6ACA3
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_mig

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	17524
Entropy (8bit):	4.340063035506032
Encrypted:	false
SSDEEP:	192:wiuFhk5un5EpDdblzKaz+OJGbiIBJofNbr5/dn82/jqmo3qAi:rq25unWZd9dvJGiIBJoh387oAi
MD5:	03710426AB25AD1280E197F61249F9DE
SHA1:	F5E7A6FD42503AE4758BC36C8DD78D98EFB35047
SHA-256:	21E63F7C77896ED2B5F115957F2448E0A9E2DD738D7D487E471217421F6A93E1
SHA-512:	213CB55B8573335D1384AE704FF4267F224376056F71548660F9B2FDAA1203D8ABDDB787900AAF5D1E0AC6E5BE261F713BDBEFB67643D08E8D3672512A1AF588
Malicious:	false
Preview:	(function()..{.. var XHTML = "http://www.w3.org/1999/xhtml";.. .. // Time slicing constants.. var LIMIT = 10; // Maximum number of nodes to process before checking time.. var DURATION = 200; // Maximum amount of time (ms) to process before unblocking UI.. var DELAY = 15; // Amount of time (ms) to unblock UI.... // Tree building state.. var iterator;.. var nextNode;.. var root;.. var rootFirstChild;.. var time;.. .. // Template References.. var attrTemplate, attrName, attrValue;.. var elmStartTemplate, elmStartName;.. var elmEndTemplate, elmEndName;.. var cdataTemplate, cdataValue;.. var commentTemplate, commentValue;.. var style; .. .. // Only invoke this script if it was injected by our parser. Test for a condition that is.. // impossible for a markup to create - two direct children of the document... var secondRootElement = document.documentElement.nextElementSibling;.. if (secondRootElement == null

File type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (830)
Entropy (8bit):	5.398453568283088
TrID:	Generic XML (ASCII) (5005/1) 100.00%
File name:	dzfp_24912000000008328502_20240419143854.xml
File size:	5'774 bytes
MD5:	d10bbe9e8c81b87eca5a1ab73f914a83
SHA1:	06a4d8c23e532f77afd5ab292b54d0f6d13b99d5
SHA256:	bdc41f332cbb3d9be9714b9d68f86a20ba4e50aa3134a47ab2500aa80566b131
SHA512:	b3e7d5909ccbb0344648280560614fdc73ffda0452d362da52e9322b2a00e5ba0d989613a7ecc560c1521f81e950cff6203af2b824299ff27d19634a04bde304
SSDEEP:	96:Gi5bajt/7bDD1wZ+ilLeIElX1MigYw6FuhUQG5A2ttxqVTp+Vy:GubmpbDD1wJlLeIElX1MiG6gqy
TLSH:	23C1864AE2FC4859D38A16A725759301CFE0719B52D0002AFD8F6AA91F85BA01B1FF77
File Content Preview:	<?xml version="1.0" encoding="utf-8" standalone="yes"?>.<EInvoice>. <Header>. <EIid>24912000000008328502</EIid>. <EInvoiceTag>SWEI2102</EInvoiceTag>. <Version>0.32</Version>. <InherentLabel>. <InIssuType>.

Has Summary Info:
Application Name:
Encrypted Document:	False
Contains Word Document Stream:	False
Contains Workbook/Book Stream:	False
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	True

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report dzfp_24912000000008328502_20240419143854.xml

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

System Summary

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\06a70737-864b-4546-8b1a-1d8c88628647.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\3fa66b0b-bf8e-4063-a590-d3f6b4b4830b.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\4629279e-b6ec-431f-bde1-2f35278d8ba4.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\62ef9b08-3af3-425f-a516-5ec99499cd84.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\9ac9227f-3399-4bc8-ac8b-3d846f3ad9c8.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\6db0f0e0-6274-4f85-8b7d-c0d12abd4eb8.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66227DE0-1BA8.pma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66227DE1-1CEC.pma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66227DF2-23E8.pma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66227DFA-1844.pma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\12694d3f-c08e-4cf9-b86e-35d1a8081f8b.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\35f4b563-c4e9-4e49-a848-f6a8e8827ce5.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000001.dbtmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\CURRENT (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AssistanceHome\AssistanceHomeSQLite

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_1

Windows Analysis Report
dzfp_24912000000008328502_20240419143854.xml

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 19, 2024 16:21:25.416330099 CEST	65375	53	192.168.2.4	1.1.1.1
Apr 19, 2024 16:21:25.416512966 CEST	55115	53	192.168.2.4	1.1.1.1
Apr 19, 2024 16:21:25.521538019 CEST	53	65375	1.1.1.1	192.168.2.4
Apr 19, 2024 16:21:25.521562099 CEST	53	55115	1.1.1.1	192.168.2.4
Apr 19, 2024 16:21:29.170640945 CEST	50768	53	192.168.2.4	1.1.1.1
Apr 19, 2024 16:21:29.170880079 CEST	64273	53	192.168.2.4	1.1.1.1
Apr 19, 2024 16:21:29.171192884 CEST	54565	53	192.168.2.4	1.1.1.1
Apr 19, 2024 16:21:29.171309948 CEST	49571	53	192.168.2.4	1.1.1.1
Apr 19, 2024 16:21:29.227767944 CEST	50525	53	192.168.2.4	1.1.1.1
Apr 19, 2024 16:21:29.227946043 CEST	53238	53	192.168.2.4	1.1.1.1
Apr 19, 2024 16:21:29.275470018 CEST	53	64273	1.1.1.1	192.168.2.4
Apr 19, 2024 16:21:29.275567055 CEST	53	50768	1.1.1.1	192.168.2.4
Apr 19, 2024 16:21:29.275645971 CEST	53	54565	1.1.1.1	192.168.2.4
Apr 19, 2024 16:21:29.276122093 CEST	53	49571	1.1.1.1	192.168.2.4
Apr 19, 2024 16:21:29.333389997 CEST	53	53238	1.1.1.1	192.168.2.4
Apr 19, 2024 16:21:29.333461046 CEST	53	50525	1.1.1.1	192.168.2.4
Apr 19, 2024 16:21:30.694955111 CEST	53144	443	192.168.2.4	162.159.61.3
Apr 19, 2024 16:21:30.801506996 CEST	443	53144	162.159.61.3	192.168.2.4
Apr 19, 2024 16:21:30.802288055 CEST	443	53144	162.159.61.3	192.168.2.4
Apr 19, 2024 16:21:30.802305937 CEST	443	53144	162.159.61.3	192.168.2.4
Apr 19, 2024 16:21:30.803195953 CEST	53144	443	192.168.2.4	162.159.61.3
Apr 19, 2024 16:21:30.804601908 CEST	53144	443	192.168.2.4	162.159.61.3
Apr 19, 2024 16:21:30.804867029 CEST	53144	443	192.168.2.4	162.159.61.3
Apr 19, 2024 16:21:30.805495024 CEST	53144	443	192.168.2.4	162.159.61.3
Apr 19, 2024 16:21:30.805654049 CEST	53144	443	192.168.2.4	162.159.61.3
Apr 19, 2024 16:21:30.909898996 CEST	443	53144	162.159.61.3	192.168.2.4
Apr 19, 2024 16:21:30.909919977 CEST	443	53144	162.159.61.3	192.168.2.4
Apr 19, 2024 16:21:30.909929991 CEST	443	53144	162.159.61.3	192.168.2.4
Apr 19, 2024 16:21:30.909941912 CEST	443	53144	162.159.61.3	192.168.2.4
Apr 19, 2024 16:21:30.910152912 CEST	443	53144	162.159.61.3	192.168.2.4
Apr 19, 2024 16:21:30.910552979 CEST	53144	443	192.168.2.4	162.159.61.3
Apr 19, 2024 16:21:30.910751104 CEST	53144	443	192.168.2.4	162.159.61.3
Apr 19, 2024 16:21:30.912039995 CEST	443	53144	162.159.61.3	192.168.2.4
Apr 19, 2024 16:21:30.913337946 CEST	443	53144	162.159.61.3	192.168.2.4
Apr 19, 2024 16:21:30.913662910 CEST	443	53144	162.159.61.3	192.168.2.4
Apr 19, 2024 16:21:30.913825989 CEST	53144	443	192.168.2.4	162.159.61.3
Apr 19, 2024 16:21:31.014729977 CEST	443	53144	162.159.61.3	192.168.2.4
Apr 19, 2024 16:21:31.059626102 CEST	53144	443	192.168.2.4	162.159.61.3
Apr 19, 2024 16:21:43.310199022 CEST	53144	443	192.168.2.4	162.159.61.3
Apr 19, 2024 16:21:43.310376883 CEST	53144	443	192.168.2.4	162.159.61.3
Apr 19, 2024 16:21:43.415641069 CEST	443	53144	162.159.61.3	192.168.2.4
Apr 19, 2024 16:21:43.416317940 CEST	443	53144	162.159.61.3	192.168.2.4
Apr 19, 2024 16:21:43.416692972 CEST	443	53144	162.159.61.3	192.168.2.4
Apr 19, 2024 16:21:43.417115927 CEST	53144	443	192.168.2.4	162.159.61.3
Apr 19, 2024 16:21:44.220690012 CEST	53144	443	192.168.2.4	162.159.61.3
Apr 19, 2024 16:21:44.221438885 CEST	53144	443	192.168.2.4	162.159.61.3
Apr 19, 2024 16:21:44.222759962 CEST	60256	443	192.168.2.4	172.64.41.3
Apr 19, 2024 16:21:44.326606989 CEST	443	53144	162.159.61.3	192.168.2.4
Apr 19, 2024 16:21:44.327372074 CEST	443	53144	162.159.61.3	192.168.2.4
Apr 19, 2024 16:21:44.327743053 CEST	443	53144	162.159.61.3	192.168.2.4
Apr 19, 2024 16:21:44.328192949 CEST	53144	443	192.168.2.4	162.159.61.3
Apr 19, 2024 16:21:44.328504086 CEST	443	60256	172.64.41.3	192.168.2.4
Apr 19, 2024 16:21:44.328840971 CEST	443	60256	172.64.41.3	192.168.2.4
Apr 19, 2024 16:21:44.328881025 CEST	443	60256	172.64.41.3	192.168.2.4
Apr 19, 2024 16:21:44.329660892 CEST	60256	443	192.168.2.4	172.64.41.3
Apr 19, 2024 16:21:44.330552101 CEST	60256	443	192.168.2.4	172.64.41.3
Apr 19, 2024 16:21:44.330707073 CEST	60256	443	192.168.2.4	172.64.41.3
Apr 19, 2024 16:21:44.331027031 CEST	60256	443	192.168.2.4	172.64.41.3
Apr 19, 2024 16:21:44.331137896 CEST	60256	443	192.168.2.4	172.64.41.3
Apr 19, 2024 16:21:44.435902119 CEST	443	60256	172.64.41.3	192.168.2.4
Apr 19, 2024 16:21:44.435939074 CEST	443	60256	172.64.41.3	192.168.2.4
Apr 19, 2024 16:21:44.436116934 CEST	443	60256	172.64.41.3	192.168.2.4
Apr 19, 2024 16:21:44.436153889 CEST	443	60256	172.64.41.3	192.168.2.4
Apr 19, 2024 16:21:44.436747074 CEST	443	60256	172.64.41.3	192.168.2.4
Apr 19, 2024 16:21:44.436892986 CEST	60256	443	192.168.2.4	172.64.41.3
Apr 19, 2024 16:21:44.436960936 CEST	443	60256	172.64.41.3	192.168.2.4
Apr 19, 2024 16:21:44.436978102 CEST	60256	443	192.168.2.4	172.64.41.3
Apr 19, 2024 16:21:44.437165022 CEST	60256	443	192.168.2.4	172.64.41.3
Apr 19, 2024 16:21:44.541156054 CEST	443	60256	172.64.41.3	192.168.2.4
Apr 19, 2024 16:21:44.575601101 CEST	60256	443	192.168.2.4	172.64.41.3

Timestamp	Bytes transferred	Direction	Data
2024-04-19 14:21:25 UTC	580	OUT	GET /crx/blobs/AfQPRnlBHVf9QbAmjPnmJQnDwEcerxafOq8p01cAfJ5QoFk2s6gAMnMY_23BNiizXK2e-3smriJGTe2WOZO9s5X2xejbvoKpPILOKN2-0t9ZbrurACaLAMZSmuXX9slHldVQ07B5bvw6KCm_x6CONA/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_76_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-19 14:21:25 UTC	566	IN	HTTP/1.1 200 OK X-GUploader-UploadID: ABPtcPr3Pm0Sa6fgSwm1wxYEZGt9LRoeLSiaf4iaUMIvGsVsgCesFHnDaWwOAcQdZdYhTjPgGPQ Accept-Ranges: bytes Content-Length: 139091 X-Goog-Hash: crc32c=H9/qeQ== Server: UploadServer Date: Thu, 18 Apr 2024 18:32:01 GMT Expires: Fri, 18 Apr 2025 18:32:01 GMT Cache-Control: public, max-age=31536000 Last-Modified: Thu, 18 Apr 2024 18:31:51 GMT ETag: 82b50a01_49fb4719_dae394b7_fbc972d4_42d9e512 Content-Type: application/x-chrome-extension Age: 71364 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-19 14:21:25 UTC	689	IN	Data Raw: 43 72 32 34 03 00 00 00 f3 22 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr24"0"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-04-19 14:21:25 UTC	1255	IN	Data Raw: 3b d2 9f 7a 6c 80 d0 71 98 9f 7a 7b 13 b7 05 9c d7 02 20 17 3b cc 01 6f 51 2a 66 e2 83 e7 11 83 e2 b3 53 9d d5 24 e1 bb 2f bc cc d3 09 89 36 87 72 b7 81 22 82 40 1f 8b 08 00 00 00 00 00 00 ff bd 7c 5b 73 ab 3a ba ed 5f d9 b5 9e 77 57 21 30 5e d3 fb 6d 12 10 98 58 22 08 5d 40 bb 76 75 01 22 c1 20 30 89 49 8c e9 ea ff 7e 94 d5 bd bb eb 74 f5 74 d9 0f e7 bc 64 c6 99 dc 86 be cb 18 43 42 fe ef bf fc a6 9a 73 fd 71 9c e6 e3 69 fc ed bf 7e 9b 3f 9a a6 2d cf ed 7f 4c cd c7 7f bc 1e 75 f3 db 7f fe 76 3e be 8d 8d fa 73 7d 1a e7 66 9c 7f fb af bf fc 36 95 57 7d 2a 95 39 be b9 c6 5d 65 bb 96 14 ae 95 db 6d 5b db ad ae af fb ad 70 ce c7 62 58 be 0a 7b 7e ad 6d bd 95 d9 7e 8b fd 9f 2e 3e 5e 8e 32 d4 a3 cc b1 b5 ef 4e 47 73 7c 8b 3a 66 ef bf ff 3e e8 b3 cc d1 31 d1 f3 Data Ascii: ;zlqz{ ;oQfS$/6r"@\|[s:_wW!0^mX"]@vu" 0I~ttdCBsqi~?-Luv>s}f6W}9]em[pbX{~m~.>^2NGs\|:f>1
2024-04-19 14:21:25 UTC	1255	IN	Data Raw: 95 05 ba ab f8 8e ca 80 f7 32 52 2b 03 d0 13 e3 cf 4d f9 00 3e 34 b8 61 1d 10 8b 73 6c ba 88 f7 42 2d b0 52 b8 2b a5 b5 40 c3 39 ef a9 e5 3e 15 54 43 c1 76 09 f5 25 64 0c 5d 69 80 5f 93 a7 5f e2 eb ef cd cf 2a b0 56 93 eb 52 39 38 af 35 44 86 eb 7b ca dc b2 0e 6b a0 68 61 d7 a2 5f 98 03 73 66 e3 58 69 b2 f0 20 06 a2 77 ed 47 f8 4f 59 f3 35 63 3a e1 63 60 25 7c fa 6c a8 9a 2b 4e 26 9e c7 7b 11 c6 8e 61 f3 98 84 81 9b 09 09 38 9b 7c c4 0c ff d9 e0 49 fe ba bf f4 f7 f2 43 96 f3 43 6a eb 57 d4 a9 4f 02 e1 8b 64 b0 cd 34 06 69 cf 0f 89 88 e3 72 fd 39 13 a3 33 aa 70 3e f0 4e b5 88 f2 57 66 13 fa 48 7f 91 9d 89 d9 1f 39 02 bb 0c ea d0 e8 bc c8 5c 7f 83 6d f8 82 87 d3 86 6b 7e a6 91 d7 97 ce 4f 5b f8 e4 54 db e9 a2 56 cd 6e c4 4f 57 4f f7 e1 2b ec 1f 57 9a cb 82 Data Ascii: 2R+M>4aslB-R+@9>TCv%d]i__*VR985D{kha_sfXi wGOY5c:c`%\|l+N&{a8\|ICCjWOd4ir93p>NWfH9\mk~O[TVnOWO+W
2024-04-19 14:21:25 UTC	1255	IN	Data Raw: dc eb 1f bd 89 14 2b 5f 64 de 8e 48 13 1b 5b 96 c3 38 2c 55 80 c3 ca 87 69 19 61 82 74 e0 a8 a1 7d 22 01 e4 88 c5 a4 36 e3 4f 2c f5 b5 1f ad f3 f7 7c 6e 21 dc af 6a d0 df fd ed f5 8f 71 d4 bb 7f bd c7 45 f8 4a fe d1 23 3b 49 ea d1 3b 55 d6 4e b3 2e 0e a5 e3 71 93 fb 56 aa a5 2d ad f8 a5 c9 c0 0b e6 ed 67 b9 7a 1f c4 9a e3 3f fa 7e 08 ad 3f c6 49 ef ce 95 6d c6 31 34 78 6c 79 bd 13 5f d9 04 3f ae 15 8d 5d 29 14 4a 33 e0 d7 3e 3c 48 1d e7 e9 70 71 48 f0 e6 64 39 0c 59 a0 58 9a c7 8e c9 87 27 33 1e 1c 51 cf 79 00 5f 60 7c c9 95 33 f5 22 81 d7 a9 3e 0e 8a 4e 85 5c b7 af 55 e4 1d 13 fa d3 35 bc bf 6d b8 7e 42 81 e9 a3 0c cd ca 99 82 1a 78 e3 2d 7c b9 85 bd 3b 31 5e 71 a8 bb 2c e4 96 1a e6 8f 92 ab bd a9 11 64 3c dc 13 1e d4 58 e8 36 2c b5 ce eb 30 ee 89 6e 33 Data Ascii: +_dH[8,Uiat}"6O,\|n!jqEJ#;I;UN.qV-gz?~?Im14xly_?])J3><HpqHd9YX'3Qy_`\|3">N\U5m~Bx-\|;1^q,d<X6,0n3
2024-04-19 14:21:25 UTC	1255	IN	Data Raw: 0a 24 0f c4 6f bf c9 84 12 25 e3 a7 2c 57 5b c4 c0 20 2d 45 58 0f a3 ca e8 6d 31 92 8c 53 e2 24 21 08 70 de 5e 1a bd df 30 3b e6 bc 87 eb af f1 cd f7 e2 c3 99 00 48 75 30 4a 28 94 68 9c ce b9 e1 5b 12 29 29 99 75 a1 02 be 18 8d d6 19 3d 3b 19 7f 56 c8 11 b9 68 44 a0 1a b5 7c 20 7e 16 77 8c f7 08 71 8e c3 e9 9d 0c 1c 16 b6 de 53 d0 9e d4 88 9c 32 df cf 3c e4 a0 ee 02 53 ff 72 e6 86 0b f1 8a 1c 25 da af 1b f8 3e ee c4 27 32 8a a3 86 d7 56 13 ee f2 66 98 84 a9 7b 61 ea 64 6c 46 1c 63 e7 34 e3 41 bf d2 bc a5 8c 81 23 b3 c1 49 68 a5 a9 23 1f e1 87 4d a3 09 16 14 53 b2 b6 2b 8a da 77 2c 60 57 db 1b 97 32 ee a1 60 72 08 d3 59 1d 71 8b 83 bd 23 fd c0 f8 cf 5d 81 47 7e c3 23 cd f3 9d f8 2e 65 a0 d2 d4 ae 57 d3 c3 75 da b5 9e d4 6c 83 72 69 31 5f 71 16 2e 8c 74 9a Data Ascii: $o%,W[ -EXm1S$!p^0;Hu0J(h[))u=;VhD\| ~wqS2<Sr%>'2Vf{adlFc4A#Ih#MS+w,`W2`rYq#]G~#.eWulri1_q.t
2024-04-19 14:21:25 UTC	1255	IN	Data Raw: 96 55 a7 4f 68 b0 1e e0 bf 78 9b 0d a0 6b 60 60 d5 3c 6e 79 88 fb 82 42 88 46 78 ce 18 36 de d3 b8 7a a7 be d4 c3 8f b9 19 63 a0 42 b8 25 3e 27 d8 de dd 98 df 75 ef ec 9f 7b 5b e4 6d 97 db da 38 32 cb dc 9f bc 57 fd c9 28 24 93 35 c1 65 31 7d e6 50 41 cf 78 b6 b8 c8 2d fe 52 0a fd 8a 38 3e 28 30 3d d0 5f f6 cb 81 15 97 34 df bb df ef b8 96 3e d6 d2 6f b3 8a b9 2d ea 27 50 c1 f8 50 31 b8 a7 91 1c b8 43 a0 f1 fa 22 e3 de 36 1d e0 2d 7c f7 ea 97 f5 90 4f 93 e4 13 c1 d6 8c 4b ad 85 cc 75 64 72 71 5b 05 3f dc 03 8d 2f ca 78 11 02 15 47 0c ef 8d 37 34 7d 88 0c 12 c6 8f e0 9b 0b 47 2d 19 35 fc 6a 69 ca 73 7c 96 83 bb 64 fd e4 d4 9d e1 27 aa 58 22 f0 47 ed 90 01 33 bd 94 39 b4 aa b0 b6 89 86 bf 9e df 75 bc 7b fd 1f 48 d8 c6 65 22 1e a4 d8 03 0a f8 3b ee a7 c0 68 Data Ascii: UOhxk``<nyBFx6zcB%>'u{[m82W($5e1}PAx-R8>(0=_4>o-'PP1C"6-\|OKudrq[?/xG74}G-5jis\|d'X"G39u{He";h
2024-04-19 14:21:25 UTC	1255	IN	Data Raw: 9a 01 47 06 6e 54 b1 78 cb 05 79 49 c2 02 c8 f0 87 25 60 7c 92 06 5b da ab 77 e4 fc 7c c4 47 8c 46 bf ba 05 6d c3 26 dc 09 14 f1 d7 74 84 a6 6f bb 76 c1 77 9f 32 a8 2f 28 24 56 06 a6 89 da b8 54 bc 7d 26 ab c4 e6 99 7e 3d 8f ed 90 7b 75 68 6a 9e 7f 29 ba fd a2 20 e7 b5 19 d3 0c f2 e7 7a 65 6e 39 a8 b4 f1 c9 d1 f4 1d 5c 07 cb 4c 06 d7 4d 7b 6e 1c f9 0e 48 2e 1f e2 07 62 3c ca 81 ed 4a 1e c1 59 86 6a ce a0 7c 3a f0 dd ca 23 d2 f1 91 6c 69 38 9f 8a 15 1f 8a b5 cd 89 75 71 0a dd 2e e5 9a de e8 2f e4 5e 1f f8 61 6a ea 50 8a f9 42 c7 e2 62 3c 4c 90 6a 7c 12 42 5e 6b 0e 23 bc f2 0b e9 7f ac c2 f7 5c e4 78 4c d9 46 0f 84 f0 ab 84 d3 03 f3 d8 f1 98 50 e4 10 c7 cb 14 53 ba 61 f3 73 39 40 50 45 53 51 e6 38 26 be 1e 90 c6 25 86 8a e0 3c b8 a0 d5 db 70 7b 9a ab 48 ff Data Ascii: GnTxyI%`\|[w\|GFm&tovw2/($VT}&~={uhj) zen9\LM{nH.b<JYj\|:#li8uq./^ajPBb<Lj\|B^k#\xLFPSas9@PESQ8&%<p{H
2024-04-19 14:21:25 UTC	1255	IN	Data Raw: 99 31 96 3d 7f 02 23 a6 86 1b fb 5d f7 af 71 34 7a 60 a8 6d 7c 35 5e fd 53 86 bb 4e 09 a0 ab 91 bc 56 86 48 ab a3 c1 7e fd 77 fb 17 e2 05 85 aa e0 d0 68 44 c8 e7 cc 68 8c 03 d3 8c 85 64 4b 06 f9 29 f3 e9 bd b2 e4 33 13 e4 15 1b 5d c2 8d ce 32 79 f7 55 8b bf ef 3f f9 e7 38 5f be f7 63 e5 b6 c9 9b 81 f7 b9 f3 3d 06 fa f2 c7 98 ff bb fb 0e 68 a6 96 7e a7 86 87 71 c0 9f 0b e0 d1 03 73 f7 55 ee b9 c6 3b 69 d6 63 8f 44 6c ad 46 6c 08 b4 58 88 ff d3 c9 78 dc e5 ff bb 6f e9 9f f7 5d 65 1e db a5 c0 3a 77 d4 57 3d cc ba d6 bb 63 29 4c 3e 45 f1 97 fc e5 fd 77 83 39 27 ca 81 f1 92 5d 6b fc 56 0c a9 38 bb a5 15 6f 32 d6 26 28 2f ec 84 b5 a7 2c 04 25 07 4a 23 a3 fd ca b5 b6 ab ee ed f8 ca ad f3 7e 90 e6 5e 46 0b fe 6d ff c9 f7 98 ff 2d 97 4c 6e fd 71 0f b8 3b 7e ef e9 Data Ascii: 1=#]q4z`m\|5^SNVH~whDhdK)3]2yU?8_c=h~qsU;icDlFlXxo]e:wW=c)L>Ew9']kV8o2&(/,%J#~^Fm-Lnq;~
2024-04-19 14:21:25 UTC	1255	IN	Data Raw: 6d 76 d5 ab f1 d4 d9 78 ea 7c 3c f5 72 3c f5 f5 78 ea 9b f1 d4 ab 31 d4 10 a1 9c ea 08 6a ca a2 d5 ae 7d 86 ba 42 6e 80 68 75 4a da bb e1 e8 a5 d1 a1 f1 22 aa af 20 14 89 3d 01 df a3 ce 40 48 ef 8c b6 b8 56 cb ec a3 68 81 ad 8e 8d 95 40 f6 c8 dc f1 e0 8d 96 bb e2 2d b8 c7 12 f5 e0 01 f9 a9 d8 54 46 1d 72 95 a2 9c 5c 24 30 eb 8b b7 13 df dc 82 3c 86 8a 61 15 ac 45 6f 32 37 5e 0a 03 b4 15 1c ff b6 64 a5 34 a8 a0 30 e1 9c 7f 5e 7e e2 d8 eb 23 e2 9c 13 83 1a 47 27 8c d9 71 9c cf a1 bc 68 8a c8 7f bf ff 8b 7e 27 3f 75 3e 65 7e ee fa bf 35 00 25 48 cb 41 65 cf 66 f3 05 f9 10 7f ea e0 da e2 5e 2b 9c 5e 03 76 dc 40 4c 83 4f 2f 09 d6 4e db de 72 d9 45 6f e1 a8 c8 16 0b 6a e9 84 85 13 4b 7f 41 60 b0 f4 f9 e8 c2 88 68 13 55 d2 43 1c 9f 8b 28 62 7e bd c6 b8 00 b8 32 Data Ascii: mvx\|<r<x1j}BnhuJ" =@HVh@-TFr\$0<aEo27^d40^~#G'qh~'?u>e~5%HAef^+^v@LO/NrEojKA`hUC(b~2
2024-04-19 14:21:25 UTC	1255	IN	Data Raw: 6a b3 a5 0a 7f b3 78 7a 9c 1c a7 27 27 91 4d cc d4 d6 05 cc 34 af 37 f4 5b b3 00 80 c8 84 b3 d6 ab 9b 61 ef 2a 01 e6 40 a6 e4 36 05 c4 0e 96 9a 94 59 bb 96 4b 52 f6 6b c4 2f e6 5d a0 72 ec b8 02 f6 93 b8 9e 33 2c 0d 69 34 94 31 67 16 47 61 80 1b 3f 62 66 50 b8 cf 04 8d 10 1f 12 d3 80 2e 71 66 38 8b 77 36 12 b4 3d 33 70 12 43 db dc ac 0c 71 73 73 75 d4 11 11 22 85 86 ad 94 95 25 b4 8d 6f bd d1 d9 30 e1 53 43 4e 15 29 91 a5 25 28 70 26 cb c8 a6 8b 62 63 c0 eb a6 a7 f7 f3 a8 41 3d c2 4a 34 c6 d3 06 61 c9 e1 e0 1b 47 42 a9 27 35 60 12 cb 37 7c 66 53 0c 2a 1d 20 f4 71 da 06 b9 01 b5 8e 4f a2 0d 3f 01 d2 89 63 f1 83 a0 85 9c 32 0a 60 a3 9e cd fa 7e 22 78 53 00 7b 25 35 ab 8a 75 4f af 62 a1 29 50 d1 39 ef 39 bf ba 6b 68 1c 88 09 89 c1 c0 98 d9 94 2a 59 86 df 58 Data Ascii: jxz''M47[a@6YKRk/]r3,i41gGa?bfP.qf8w6=3pCqssu"%o0SCN)%(p&bcA=J4aGB'5`7\|fS qO?c2`~"xS{%5uOb)P99kh*YX

Timestamp	Bytes transferred	Direction	Data
2024-04-19 14:21:28 UTC	617	OUT	GET /assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=R83mlHRCqeHRG9T0loza5cz3U8zjuZzQy2wVvoSHGHw%3D&st=2021-01-01T00%3A00%3A00Z&se=2024-06-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: ArbitrationService Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-19 14:21:28 UTC	638	IN	HTTP/1.1 200 OK Date: Fri, 19 Apr 2024 14:21:28 GMT Content-Type: application/octet-stream Content-Length: 11989 Connection: close Content-MD5: 2Sac1JgWnA2goeZEYMrzXg== Last-Modified: Wed, 17 Apr 2024 21:53:43 GMT ETag: "0x8DC5F28D9976E3C" x-ms-request-id: 104ab873-201e-0059-6664-926d81000000 x-ms-version: 2017-07-29 x-ms-lease-status: unlocked x-ms-lease-state: available x-ms-blob-type: BlockBlob x-ms-server-encrypted: true x-azure-ref: 20240419T142128Z-15497cdd9fd4wmvqhywnewwfen00000001p000000000mq9r Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 59346683 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-04-19 14:21:28 UTC	11989	IN	Data Raw: 7b 0d 0a 20 20 22 63 6f 6e 66 69 67 56 65 72 73 69 6f 6e 22 3a 20 33 32 2c 0d 0a 20 20 22 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 73 22 3a 20 5b 0d 0a 20 20 20 20 22 53 68 6f 72 65 6c 69 6e 65 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 49 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 43 4f 55 50 4f 4e 53 5f 43 48 45 43 4b 4f 55 54 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 4c 4f 57 45 52 5f 50 52 49 43 45 5f 46 4f 55 4e 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 42 49 4e 47 5f 53 45 41 52 43 48 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 52 45 42 41 54 45 Data Ascii: { "configVersion": 32, "PrivilegedExperiences": [ "ShorelinePrivilegedExperienceID", "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT", "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND", "SHOPPING_AUTO_SHOW_BING_SEARCH", "SHOPPING_AUTO_SHOW_REBATE

Timestamp	Bytes transferred	Direction	Data
2024-04-19 14:21:29 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-04-19 14:21:29 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-04-19 14:21:29 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 19 Apr 2024 14:21:29 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 876d8a948d6b7bb8-ATL alt-svc: h3=":443"; ma=86400
2024-04-19 14:21:29 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 b4 00 04 4a 7d 88 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomJ}^)

Timestamp	Bytes transferred	Direction	Data
2024-04-19 14:21:31 UTC	448	OUT	POST /chromewebstore/v1.1/items/verify HTTP/1.1 Host: www.googleapis.com Connection: keep-alive Content-Length: 119 Content-Type: application/json Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-19 14:21:31 UTC	119	OUT	Data Raw: 7b 22 68 61 73 68 22 3a 22 72 4b 78 33 44 73 4e 71 39 61 74 65 6e 62 69 6e 35 6e 69 54 74 67 38 38 78 78 6a 53 79 4b 6d 77 75 54 4c 35 2f 50 6f 4b 43 30 73 3d 22 2c 22 69 64 73 22 3a 5b 22 67 68 62 6d 6e 6e 6a 6f 6f 65 6b 70 6d 6f 65 63 6e 6e 6e 69 6c 6e 6e 62 64 6c 6f 6c 68 6b 68 69 22 5d 2c 22 70 72 6f 74 6f 63 6f 6c 5f 76 65 72 73 69 6f 6e 22 3a 31 7d Data Ascii: {"hash":"rKx3DsNq9atenbin5niTtg88xxjSyKmwuTL5/PoKC0s=","ids":["ghbmnnjooekpmoecnnnilnnbdlolhkhi"],"protocol_version":1}
2024-04-19 14:21:31 UTC	341	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Vary: Origin Vary: X-Origin Vary: Referer Date: Fri, 19 Apr 2024 14:21:31 GMT Server: ESF Content-Length: 483 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-19 14:21:31 UTC	483	IN	Data Raw: 7b 0a 20 20 22 70 72 6f 74 6f 63 6f 6c 5f 76 65 72 73 69 6f 6e 22 3a 20 31 2c 0a 20 20 22 73 69 67 6e 61 74 75 72 65 22 3a 20 22 50 54 6d 56 48 6b 65 64 78 46 46 73 6c 66 39 6a 4c 4e 55 4c 6b 49 63 6e 36 56 55 52 67 6c 66 50 4a 69 2f 58 49 42 6d 31 6d 59 57 69 56 64 68 79 44 67 66 59 57 54 2b 6d 34 72 4b 65 6f 6b 49 34 2b 63 65 64 31 36 53 73 71 45 66 63 4d 62 30 64 63 77 72 6d 6c 75 74 50 33 65 41 52 70 57 31 4e 75 63 54 41 6f 75 31 68 76 6c 55 4f 37 45 44 58 76 66 57 42 35 66 75 46 65 6b 32 41 52 33 7a 57 74 76 4c 50 57 6d 79 4d 36 63 30 6f 37 55 6e 31 66 76 38 58 6d 6d 79 43 50 44 6b 61 70 75 72 34 6b 37 31 4f 79 66 77 59 58 4d 44 35 6e 52 31 48 67 45 32 47 63 74 55 4c 65 32 53 57 4c 67 6c 4b 30 65 75 31 4a 6b 46 7a 65 38 44 59 6c 38 46 69 52 68 4e 4f Data Ascii: { "protocol_version": 1, "signature": "PTmVHkedxFFslf9jLNULkIcn6VURglfPJi/XIBm1mYWiVdhyDgfYWT+m4rKeokI4+ced16SsqEfcMb0dcwrmlutP3eARpW1NucTAou1hvlUO7EDXvfWB5fuFek2AR3zWtvLPWmyM6c0o7Un1fv8XmmyCPDkapur4k71OyfwYXMD5nR1HgE2GctULe2SWLglK0eu1JkFze8DYl8FiRhNO

Timestamp	Bytes transferred	Direction	Data
2024-04-19 14:21:43 UTC	626	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1714141286&P2=404&P3=2&P4=NO%2b6Bn%2bUYXbBnY6dYtTlRt3KqVFy1SE%2f%2bDQLdSHmdlSyTHjFSwheDWL%2fqw%2fiu7ngPF4Cj0wvB1OGdhA%2fBw2v0Q%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: qwTGFoeAiJncXOGOzNl7VS Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-19 14:21:43 UTC	632	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Age: 2184419 Cache-Control: public, max-age=17280000 Content-Type: application/x-chrome-extension Date: Fri, 19 Apr 2024 14:21:43 GMT Etag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT MS-CorrelationId: b7f8b24e-0698-4a3f-a1bd-7c623ff16639 MS-CV: vACUU9H8MqK/p0vJ5M+vR2.0 MS-RequestId: 0d3d019c-fed5-4324-bece-20384dacd5df Server: ECAcc (agc/7F92) X-AspNet-Version: 4.0.30319 X-AspNetMvc-Version: 5.3 X-Cache: HIT X-CCC: US X-CID: 11 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Connection: close
2024-04-19 14:21:43 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Timestamp	Bytes transferred	Direction	Data
2024-04-19 14:21:44 UTC	459	OUT	POST /extensioninstallverifier/v1.1/installverify HTTP/1.1 Host: edge.microsoft.com Connection: keep-alive Content-Length: 119 Content-Type: application/json Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-19 14:21:44 UTC	119	OUT	Data Raw: 7b 22 68 61 73 68 22 3a 22 59 70 2b 4a 35 39 69 30 68 4b 6a 4e 67 69 63 75 2f 6d 44 62 52 2f 68 56 74 63 6b 6b 36 54 64 57 62 7a 6c 4a 4b 37 63 53 53 74 55 3d 22 2c 22 69 64 73 22 3a 5b 22 6a 6d 6a 66 6c 67 6a 70 63 70 65 70 65 61 66 6d 6d 67 64 70 66 6b 6f 67 6b 67 68 63 70 69 68 61 22 5d 2c 22 70 72 6f 74 6f 63 6f 6c 5f 76 65 72 73 69 6f 6e 22 3a 31 7d Data Ascii: {"hash":"Yp+J59i0hKjNgicu/mDbR/hVtckk6TdWbzlJK7cSStU=","ids":["jmjflgjpcpepeafmmgdpfkogkghcpiha"],"protocol_version":1}
2024-04-19 14:21:44 UTC	337	IN	HTTP/1.1 200 OK Cache-Control: max-age=0, no-cache, no-store, must-revalidate Content-Length: 420 Content-Type: application/json; charset=utf-8 X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: F31B0B7CCB9E4EACBA89B8A915E50FD0 Ref B: BL2AA2010204031 Ref C: 2024-04-19T14:21:44Z Date: Fri, 19 Apr 2024 14:21:44 GMT Connection: close
2024-04-19 14:21:44 UTC	420	IN	Data Raw: 7b 22 73 69 67 6e 61 74 75 72 65 22 3a 22 63 67 5a 69 2b 53 53 78 75 6b 6f 63 2f 42 6f 72 71 57 69 57 47 35 73 7a 7a 4d 53 2f 4d 4e 4b 62 53 36 64 41 73 7a 78 32 57 34 6a 4d 32 63 36 6c 4d 4e 39 76 4d 4e 51 4c 45 42 4c 76 6f 6a 6d 64 58 64 34 6b 56 4a 47 6e 31 42 2f 58 4f 4b 2f 79 78 76 48 62 72 65 6f 47 2f 78 4c 4b 72 61 50 6b 52 6e 51 78 55 6c 53 6d 37 31 34 71 5a 4d 54 53 46 5a 48 37 49 4d 6b 6e 2b 67 77 4c 65 4c 5a 53 78 42 31 2b 34 79 44 50 4f 35 39 38 4f 59 44 63 4e 32 41 39 73 58 66 66 43 4e 54 37 71 75 77 45 33 59 69 53 39 57 68 4c 38 2b 73 77 4c 37 5a 7a 34 4b 34 58 52 4d 4e 6b 57 67 4d 73 75 55 4e 6d 72 35 74 69 57 79 64 59 77 4e 64 68 2b 68 47 71 44 68 2f 69 2f 6e 7a 33 76 35 72 76 65 67 4a 54 63 58 6b 7a 38 78 70 53 53 56 42 58 49 51 4f 61 2b Data Ascii: {"signature":"cgZi+SSxukoc/BorqWiWG5szzMS/MNKbS6dAszx2W4jM2c6lMN9vMNQLEBLvojmdXd4kVJGn1B/XOK/yxvHbreoG/xLKraPkRnQxUlSm714qZMTSFZH7IMkn+gwLeLZSxB1+4yDPO598OYDcN2A9sXffCNT7quwE3YiS9WhL8+swL7Zz4K4XRMNkWgMsuUNmr5tiWydYwNdh+hGqDh/i/nz3v5rvegJTcXkz8xpSSVBXIQOa+

Target ID:	0
Start time:	16:21:17
Start date:	19/04/2024
Path:	C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\user\Desktop\dzfp_24912000000008328502_20240419143854.xml"
Imagebase:	0x690000
File size:	225'176 bytes
MD5 hash:	A2E6E2A1C125973A4967540FD08C9AF0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	1
Start time:	16:21:18
Start date:	19/04/2024
Path:	C:\Program Files\Internet Explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\user\Desktop\dzfp_24912000000008328502_20240419143854.xml
Imagebase:	0x7ff68e7f0000
File size:	834'512 bytes
MD5 hash:	CFE2E6942AC1B72981B3105E22D3224E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Target ID:	2
Start time:	16:21:19
Start date:	19/04/2024
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6432 CREDAT:17410 /prefetch:2
Imagebase:	0x860000
File size:	828'368 bytes
MD5 hash:	6F0F06D6AB125A99E43335427066A4A1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false