Windows Analysis Report
http://www.tbmuae.com/

Overview

General Information

Sample URL:	http://www.tbmuae.com/
Analysis ID:	1432043
Infos:

Detection

GRQ Scam

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Yara detected GRQ Scam

Classification

Signatures

AV Detection

Antivirus detection for URL or domain

Source: https://506pp8k.codebenmike.live/media/mainstream/all/ab/box_open.png	Avira URL Cloud: Label: phishing
Source: https://506pp8k.codebenmike.live/media/mainstream/all/ab/1102_3.js	Avira URL Cloud: Label: phishing
Source: https://506pp8k.codebenmike.live/media/mainstream/all/ab/l.png	Avira URL Cloud: Label: phishing
Source: https://506pp8k.codebenmike.live/media/mainstream/flag-icon/css/flag-icon.css	Avira URL Cloud: Label: phishing
Source: https://506pp8k.codebenmike.live/media/mainstream/u.js	Avira URL Cloud: Label: phishing
Source: https://506pp8k.codebenmike.live/media/mainstream/all/ab/fr2.jpg	Avira URL Cloud: Label: phishing
Source: https://506pp8k.codebenmike.live/media/mainstream/all/ab/1102_1.js	Avira URL Cloud: Label: phishing
Source: https://506pp8k.codebenmike.live/media/mainstream/all/ab/iphone15pro.png	Avira URL Cloud: Label: phishing
Source: https://506pp8k.codebenmike.live/media/mainstream/icon.js	Avira URL Cloud: Label: phishing
Source: https://506pp8k.codebenmike.live/media/mainstream/all/ab/fr1.jpg	Avira URL Cloud: Label: phishing
Source: https://506pp8k.codebenmike.live/media/mainstream/all/ab/fr6.jpg	Avira URL Cloud: Label: phishing
Source: https://506pp8k.codebenmike.live/media/mainstream/alert.mp3	Avira URL Cloud: Label: phishing
Source: https://506pp8k.codebenmike.live/media/mainstream/all/ab/fr3.jpg	Avira URL Cloud: Label: phishing
Source: https://codebenmike.live/jqmcsoba/	Avira URL Cloud: Label: malware
Source: https://506pp8k.codebenmike.live/media/mainstream/all/ab/box-iphone15pro.png	Avira URL Cloud: Label: phishing
Source: https://506pp8k.codebenmike.live/media/mainstream/all/ab/top_red.png	Avira URL Cloud: Label: phishing
Source: https://506pp8k.codebenmike.live/media/mainstream/all/ab/x1.png	Avira URL Cloud: Label: phishing
Source: https://506pp8k.codebenmike.live/media/mainstream/all/ab/1102.css	Avira URL Cloud: Label: phishing
Source: https://506pp8k.codebenmike.live/media/mainstream/sound.js	Avira URL Cloud: Label: phishing
Source: https://506pp8k.codebenmike.live/media/mainstream/all/ab/fr4.jpg	Avira URL Cloud: Label: phishing
Source: https://506pp8k.codebenmike.live/media/mainstream/all/ab/box_closed.png	Avira URL Cloud: Label: phishing
Source: https://506pp8k.codebenmike.live/media/mainstream/all/ab/fr5.jpg	Avira URL Cloud: Label: phishing
Source: https://506pp8k.codebenmike.live/media/mainstream/all/ab/2.js	Avira URL Cloud: Label: phishing
Source: https://506pp8k.codebenmike.live/media/mainstream/all/ab/like.png	Avira URL Cloud: Label: phishing
Source: https://506pp8k.codebenmike.live/media/mainstream/flag-icon/flags/1x1/us.svg	Avira URL Cloud: Label: phishing
Source: https://506pp8k.codebenmike.live/media/mainstream/all/ab/1102_2.css	Avira URL Cloud: Label: phishing
Source: https://506pp8k.codebenmike.live/media/mainstream/all/ab/fr11.jpg	Avira URL Cloud: Label: phishing

Source: https://iecohshasaig.shop/?u=k8pp605&o=c9ewtnr&t=ggdown

HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 23.193.120.112:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.193.120.112:443 -> 192.168.2.4:49743 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 104.46.162.224
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 208.111.136.0
Source: unknown	TCP traffic detected without corresponding DNS query: 208.111.136.0
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 208.111.136.0
Source: unknown	TCP traffic detected without corresponding DNS query: 208.111.136.0
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /?u=k8pp605&o=c9ewtnr&t=ggdown HTTP/1.1Host: iecohshasaig.shopConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: iecohshasaig.shopConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://iecohshasaig.shop/?u=k8pp605&o=c9ewtnr&t=ggdownAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sid=t2~3cv1adg2z3djgwodckpnln2l; p1=https://codebenmike.live/jqmcsoba/; s1=mhurcklgbsmvdgh5
Source: global traffic	HTTP traffic detected: GET /jqmcsoba/?u=k8pp605&o=c9ewtnr&t=ggdown&f=1&sid=t2~3cv1adg2z3djgwodckpnln2l&fp=2WjE4fgbS3Hm3Qkivw8mgw%3D%3D HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://iecohshasaig.shop/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/all/ab/1102_2.css HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://506pp8k.codebenmike.live/jqmcsoba/?u=k8pp605&o=c9ewtnr&t=ggdown&f=1&sid=t2~3cv1adg2z3djgwodckpnln2l&fp=2WjE4fgbS3Hm3Qkivw8mgw%3D%3DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /npm/bootstrap@4.3.1/dist/js/bootstrap.bundle.min.js HTTP/1.1Host: cdn.jsdelivr.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://506pp8k.codebenmike.live/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/all/ab/1102.css HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://506pp8k.codebenmike.live/jqmcsoba/?u=k8pp605&o=c9ewtnr&t=ggdown&f=1&sid=t2~3cv1adg2z3djgwodckpnln2l&fp=2WjE4fgbS3Hm3Qkivw8mgw%3D%3DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/flag-icon/css/flag-icon.css HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://506pp8k.codebenmike.live/jqmcsoba/?u=k8pp605&o=c9ewtnr&t=ggdown&f=1&sid=t2~3cv1adg2z3djgwodckpnln2l&fp=2WjE4fgbS3Hm3Qkivw8mgw%3D%3DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/all/ab/1102_3.js HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://506pp8k.codebenmike.live/jqmcsoba/?u=k8pp605&o=c9ewtnr&t=ggdown&f=1&sid=t2~3cv1adg2z3djgwodckpnln2l&fp=2WjE4fgbS3Hm3Qkivw8mgw%3D%3DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/icon.js HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://506pp8k.codebenmike.live/jqmcsoba/?u=k8pp605&o=c9ewtnr&t=ggdown&f=1&sid=t2~3cv1adg2z3djgwodckpnln2l&fp=2WjE4fgbS3Hm3Qkivw8mgw%3D%3DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/sound.js HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://506pp8k.codebenmike.live/jqmcsoba/?u=k8pp605&o=c9ewtnr&t=ggdown&f=1&sid=t2~3cv1adg2z3djgwodckpnln2l&fp=2WjE4fgbS3Hm3Qkivw8mgw%3D%3DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/u.js HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://506pp8k.codebenmike.live/jqmcsoba/?u=k8pp605&o=c9ewtnr&t=ggdown&f=1&sid=t2~3cv1adg2z3djgwodckpnln2l&fp=2WjE4fgbS3Hm3Qkivw8mgw%3D%3DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/all/ab/2.js HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://506pp8k.codebenmike.live/jqmcsoba/?u=k8pp605&o=c9ewtnr&t=ggdown&f=1&sid=t2~3cv1adg2z3djgwodckpnln2l&fp=2WjE4fgbS3Hm3Qkivw8mgw%3D%3DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/all/ab/1102_1.js HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://506pp8k.codebenmike.live/jqmcsoba/?u=k8pp605&o=c9ewtnr&t=ggdown&f=1&sid=t2~3cv1adg2z3djgwodckpnln2l&fp=2WjE4fgbS3Hm3Qkivw8mgw%3D%3DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/all/ab/l.png HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://506pp8k.codebenmike.live/jqmcsoba/?u=k8pp605&o=c9ewtnr&t=ggdown&f=1&sid=t2~3cv1adg2z3djgwodckpnln2l&fp=2WjE4fgbS3Hm3Qkivw8mgw%3D%3DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/all/ab/iphone15pro.png HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://506pp8k.codebenmike.live/jqmcsoba/?u=k8pp605&o=c9ewtnr&t=ggdown&f=1&sid=t2~3cv1adg2z3djgwodckpnln2l&fp=2WjE4fgbS3Hm3Qkivw8mgw%3D%3DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/all/ab/like.png HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://506pp8k.codebenmike.live/jqmcsoba/?u=k8pp605&o=c9ewtnr&t=ggdown&f=1&sid=t2~3cv1adg2z3djgwodckpnln2l&fp=2WjE4fgbS3Hm3Qkivw8mgw%3D%3DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/all/ab/fr2.jpg HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://506pp8k.codebenmike.live/jqmcsoba/?u=k8pp605&o=c9ewtnr&t=ggdown&f=1&sid=t2~3cv1adg2z3djgwodckpnln2l&fp=2WjE4fgbS3Hm3Qkivw8mgw%3D%3DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/all/ab/fr1.jpg HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://506pp8k.codebenmike.live/jqmcsoba/?u=k8pp605&o=c9ewtnr&t=ggdown&f=1&sid=t2~3cv1adg2z3djgwodckpnln2l&fp=2WjE4fgbS3Hm3Qkivw8mgw%3D%3DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/all/ab/fr3.jpg HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://506pp8k.codebenmike.live/jqmcsoba/?u=k8pp605&o=c9ewtnr&t=ggdown&f=1&sid=t2~3cv1adg2z3djgwodckpnln2l&fp=2WjE4fgbS3Hm3Qkivw8mgw%3D%3DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/all/ab/top_red.png HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://506pp8k.codebenmike.live/jqmcsoba/?u=k8pp605&o=c9ewtnr&t=ggdown&f=1&sid=t2~3cv1adg2z3djgwodckpnln2l&fp=2WjE4fgbS3Hm3Qkivw8mgw%3D%3DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/all/ab/x1.png HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://506pp8k.codebenmike.live/jqmcsoba/?u=k8pp605&o=c9ewtnr&t=ggdown&f=1&sid=t2~3cv1adg2z3djgwodckpnln2l&fp=2WjE4fgbS3Hm3Qkivw8mgw%3D%3DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ExtService.svc/getextparams HTTP/1.1Host: jsontdsexit2.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://506pp8k.codebenmike.liveSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://506pp8k.codebenmike.live/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/all/ab/box-iphone15pro.png HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://506pp8k.codebenmike.live/jqmcsoba/?u=k8pp605&o=c9ewtnr&t=ggdown&f=1&sid=t2~3cv1adg2z3djgwodckpnln2l&fp=2WjE4fgbS3Hm3Qkivw8mgw%3D%3DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/all/ab/box_open.png HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://506pp8k.codebenmike.live/jqmcsoba/?u=k8pp605&o=c9ewtnr&t=ggdown&f=1&sid=t2~3cv1adg2z3djgwodckpnln2l&fp=2WjE4fgbS3Hm3Qkivw8mgw%3D%3DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/all/ab/box_closed.png HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://506pp8k.codebenmike.live/jqmcsoba/?u=k8pp605&o=c9ewtnr&t=ggdown&f=1&sid=t2~3cv1adg2z3djgwodckpnln2l&fp=2WjE4fgbS3Hm3Qkivw8mgw%3D%3DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/all/ab/fr5.jpg HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://506pp8k.codebenmike.live/jqmcsoba/?u=k8pp605&o=c9ewtnr&t=ggdown&f=1&sid=t2~3cv1adg2z3djgwodckpnln2l&fp=2WjE4fgbS3Hm3Qkivw8mgw%3D%3DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/all/ab/fr4.jpg HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://506pp8k.codebenmike.live/jqmcsoba/?u=k8pp605&o=c9ewtnr&t=ggdown&f=1&sid=t2~3cv1adg2z3djgwodckpnln2l&fp=2WjE4fgbS3Hm3Qkivw8mgw%3D%3DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/all/ab/fr6.jpg HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://506pp8k.codebenmike.live/jqmcsoba/?u=k8pp605&o=c9ewtnr&t=ggdown&f=1&sid=t2~3cv1adg2z3djgwodckpnln2l&fp=2WjE4fgbS3Hm3Qkivw8mgw%3D%3DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/all/ab/fr11.jpg HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://506pp8k.codebenmike.live/jqmcsoba/?u=k8pp605&o=c9ewtnr&t=ggdown&f=1&sid=t2~3cv1adg2z3djgwodckpnln2l&fp=2WjE4fgbS3Hm3Qkivw8mgw%3D%3DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/flag-icon/flags/1x1/us.svg HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://506pp8k.codebenmike.live/media/mainstream/flag-icon/css/flag-icon.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ExtService.svc/getextparams HTTP/1.1Host: jsontdsexit2.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/all/ab/iphone15pro.png HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/all/ab/l.png HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/all/ab/fr3.jpg HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/all/ab/like.png HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/all/ab/fr2.jpg HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/all/ab/top_red.png HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/alert.mp3 HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://506pp8k.codebenmike.live/jqmcsoba/?u=k8pp605&o=c9ewtnr&t=ggdown&f=1&sid=t2~3cv1adg2z3djgwodckpnln2l&fp=2WjE4fgbS3Hm3Qkivw8mgw%3D%3DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/all/ab/fr1.jpg HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/all/ab/x1.png HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/all/ab/box_open.png HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/all/ab/box-iphone15pro.png HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/all/ab/fr5.jpg HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/all/ab/fr4.jpg HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/all/ab/box_closed.png HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/all/ab/fr11.jpg HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/all/ab/fr6.jpg HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/flag-icon/flags/1x1/us.svg HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/alert.mp3 HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.tbmuae.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: www.tbmuae.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: iecohshasaig.shop
Source: global traffic	DNS traffic detected: DNS query: 506pp8k.codebenmike.live
Source: global traffic	DNS traffic detected: DNS query: cdn.jsdelivr.net
Source: global traffic	DNS traffic detected: DNS query: jsontdsexit2.com

Source: chromecache_73.2.dr, chromecache_66.2.dr	String found in binary or memory: http://www.gimp.org/xmp/
Source: chromecache_97.2.dr	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js
Source: chromecache_97.2.dr	String found in binary or memory: https://cdn.jsdelivr.net/npm/bootstrap
Source: chromecache_101.2.dr	String found in binary or memory: https://codebenmike.live/jqmcsoba/
Source: chromecache_90.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v17/mem8YaGs126MiZpBA-UFUZ0bf8pkAp6a.woff2)
Source: chromecache_90.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v17/mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2)
Source: chromecache_90.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v17/mem8YaGs126MiZpBA-UFVp0bf8pkAp6a.woff2)
Source: chromecache_90.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v17/mem8YaGs126MiZpBA-UFW50bf8pkAp6a.woff2)
Source: chromecache_90.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v17/mem8YaGs126MiZpBA-UFWJ0bf8pkAp6a.woff2)
Source: chromecache_90.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v17/mem8YaGs126MiZpBA-UFWZ0bf8pkAp6a.woff2)
Source: chromecache_90.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v17/mem8YaGs126MiZpBA-UFWp0bf8pkAp6a.woff2)
Source: chromecache_60.2.dr	String found in binary or memory: https://getbootstrap.com/)
Source: chromecache_60.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: chromecache_60.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/graphs/contributors)

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49672
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 23.193.120.112:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.193.120.112:443 -> 192.168.2.4:49743 version: TLS 1.2

Spam, unwanted Advertisements and Ransom Demands

Yara detected GRQ Scam

Source: Yara match	File source: 1.1.pages.csv, type: HTML
Source: Yara match	File source: 1.2.pages.csv, type: HTML
Source: Yara match	File source: dropped/chromecache_97, type: DROPPED

Source: classification engine

Classification label: mal56.phis.win@20/82@16/9

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2024 --field-trial-handle=1956,i,8973572468749049646,7398222630303733936,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://www.tbmuae.com/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6104 --field-trial-handle=1956,i,8973572468749049646,7398222630303733936,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2024 --field-trial-handle=1956,i,8973572468749049646,7398222630303733936,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6104 --field-trial-handle=1956,i,8973572468749049646,7398222630303733936,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.155.186.25	506pp8k.codebenmike.live	Switzerland	6898	INTERNETONE_CH	false
151.101.1.229	jsdelivr.map.fastly.net	United States	54113	FASTLYUS	false
185.155.184.55	unknown	Switzerland	44160	INTERNETONEInternetServicesProviderIT	false
136.243.216.235	jsontdsexit2.com	Germany	24940	HETZNER-ASDE	false
198.57.149.230	tbmuae.com	United States	46606	UNIFIEDLAYER-AS-1US	false
142.250.217.196	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.155.184.36	iecohshasaig.shop	Switzerland	44160	INTERNETONEInternetServicesProviderIT	false

Private

IP
192.168.2.4

Contacted Domains

Name	IP	Active
jsdelivr.map.fastly.net	151.101.1.229	true
tbmuae.com	198.57.149.230	true
jsontdsexit2.com	136.243.216.235	true
www.google.com	142.250.217.196	true
iecohshasaig.shop	185.155.184.36	true
506pp8k.codebenmike.live	185.155.186.25	true
fp2e7a.wpc.phicdn.net	192.229.211.108	true
cdn.jsdelivr.net	unknown	unknown
www.tbmuae.com	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://506pp8k.codebenmike.live/media/mainstream/all/ab/1102_3.js	false	Avira URL Cloud: phishing	unknown
https://506pp8k.codebenmike.live/media/mainstream/all/ab/l.png	false	Avira URL Cloud: phishing	unknown
https://cdn.jsdelivr.net/npm/bootstrap@4.3.1/dist/js/bootstrap.bundle.min.js	false		high
https://506pp8k.codebenmike.live/media/mainstream/flag-icon/css/flag-icon.css	false	Avira URL Cloud: phishing	unknown
https://506pp8k.codebenmike.live/media/mainstream/all/ab/box_open.png	false	Avira URL Cloud: phishing	unknown
https://506pp8k.codebenmike.live/media/mainstream/u.js	false	Avira URL Cloud: phishing	unknown
https://506pp8k.codebenmike.live/media/mainstream/all/ab/1102_1.js	false	Avira URL Cloud: phishing	unknown
https://506pp8k.codebenmike.live/media/mainstream/all/ab/fr2.jpg	false	Avira URL Cloud: phishing	unknown
https://506pp8k.codebenmike.live/media/mainstream/all/ab/iphone15pro.png	false	Avira URL Cloud: phishing	unknown
https://506pp8k.codebenmike.live/media/mainstream/icon.js	false	Avira URL Cloud: phishing	unknown
https://506pp8k.codebenmike.live/media/mainstream/all/ab/fr1.jpg	false	Avira URL Cloud: phishing	unknown
https://506pp8k.codebenmike.live/media/mainstream/all/ab/fr6.jpg	false	Avira URL Cloud: phishing	unknown
https://506pp8k.codebenmike.live/media/mainstream/alert.mp3	false	Avira URL Cloud: phishing	unknown
http://www.tbmuae.com/	false		unknown
https://506pp8k.codebenmike.live/media/mainstream/all/ab/fr3.jpg	false	Avira URL Cloud: phishing	unknown
https://506pp8k.codebenmike.live/media/mainstream/all/ab/box-iphone15pro.png	false	Avira URL Cloud: phishing	unknown
https://506pp8k.codebenmike.live/jqmcsoba/?u=k8pp605&o=c9ewtnr&t=ggdown&f=1&sid=t2~3cv1adg2z3djgwodckpnln2l&fp=2WjE4fgbS3Hm3Qkivw8mgw%3D%3D	false		unknown
https://506pp8k.codebenmike.live/media/mainstream/all/ab/top_red.png	false	Avira URL Cloud: phishing	unknown
https://506pp8k.codebenmike.live/media/mainstream/all/ab/x1.png	false	Avira URL Cloud: phishing	unknown
https://506pp8k.codebenmike.live/media/mainstream/all/ab/1102.css	false	Avira URL Cloud: phishing	unknown
https://506pp8k.codebenmike.live/media/mainstream/sound.js	false	Avira URL Cloud: phishing	unknown
https://iecohshasaig.shop/?u=k8pp605&o=c9ewtnr&t=ggdown	false		unknown
https://jsontdsexit2.com/ExtService.svc/getextparams	false	3%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://506pp8k.codebenmike.live/media/mainstream/all/ab/fr4.jpg	false	Avira URL Cloud: phishing	unknown
https://506pp8k.codebenmike.live/media/mainstream/all/ab/box_closed.png	false	Avira URL Cloud: phishing	unknown
https://iecohshasaig.shop/favicon.ico	false	Avira URL Cloud: safe	unknown
https://506pp8k.codebenmike.live/media/mainstream/all/ab/fr5.jpg	false	Avira URL Cloud: phishing	unknown
https://506pp8k.codebenmike.live/media/mainstream/all/ab/2.js	false	Avira URL Cloud: phishing	unknown
https://506pp8k.codebenmike.live/media/mainstream/all/ab/like.png	false	Avira URL Cloud: phishing	unknown
https://506pp8k.codebenmike.live/media/mainstream/flag-icon/flags/1x1/us.svg	false	Avira URL Cloud: phishing	unknown
https://506pp8k.codebenmike.live/media/mainstream/all/ab/1102_2.css	false	Avira URL Cloud: phishing	unknown
https://506pp8k.codebenmike.live/media/mainstream/all/ab/fr11.jpg	false	Avira URL Cloud: phishing	unknown

Name	Type	MD5	SHA1	SHA256
Chrome Cache Entry: 100	ASCII text, with very long lines (17374), with no line terminators	A050517D2E76DC353AB4591805BC7E43	A5B1A19C84C5F91DC0BB9BEBA2B6339269CB3980	05BB3B4C00A768232100B296F15B2087314183A9C4BF1819322B999550348B55
Chrome Cache Entry: 101	HTML document, ASCII text, with very long lines (47858), with CRLF line terminators	40DC9D993A4A8D344A521E97072E90C9	034128F6DBBFC6FD2C50884138D3D872A59B6975	25DBEB8626791B07693F32A4530DFE17C09FD4244D8AC00565879CAA06BAECCD
Chrome Cache Entry: 102	PNG image data, 15 x 14, 8-bit colormap, non-interlaced	17586A0AEB3F7B2AA7FB15A9251FBCD4	6ADFFAD1183C93BC0DC114C89C77365734EC0DD6	8BF8DC3A4B6F7E4FA2A6FA74495C212F37A301311980CBC758050993ED9C07E1
Chrome Cache Entry: 103	PNG image data, 417 x 515, 8-bit colormap, non-interlaced	86C9F807FC66133969F63198AC0FE75D	037A01FF739DDADB3A24E964002330176C75C5D2	5CC828750E8D07A70BB34DE95A298592868D1BB1EB9D8E61B025779F9F3DDF58
Chrome Cache Entry: 104	assembler source, ASCII text	9A13F3506156BF7084AA380C75FDA671	117AB6DE499A40ABBFE8B7C56A6F40D812F0E309	FE71A9AA3271DD1850F74BBD853F9A9FAEDA64350652141C2FF6EB4DD8187AD5
Chrome Cache Entry: 105	ASCII text, with very long lines (2564), with no line terminators	2832F0FF7EE2B8D871310202FFE7F5F4	9FF1C89B338FAEBFC1EBD10A72899C98AF7165D0	CDD76972E0254FC58C898953EE47888137CF8A596C40D2FD9356A04CFE0ED76A
Chrome Cache Entry: 106	JSON data	C9910B9B96656FD7A05C30A070A95470	F9C074580FE7560528DEA9F7841FDE09121FEF8B	E5A0111985FB4CCCC4B0E4A29E43F6289C5D9B46BC054C94254CBDACE0222A63
Chrome Cache Entry: 107	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 60x60, components 3	F17D127DFCAA6F94929EEDD080276DF0	EC801473523B8EB44E123B5634081D2B57715BA6	0108E4D428F408F819F174AE8A5923B4010E80A14FC9872B018C12781E114403
Chrome Cache Entry: 58	Web Open Font Format (Version 2), TrueType, length 9132, version 1.0	358D3070946A90B4960CD111154FDC12	A0BA0BF47A7F905F9AA1A3CE15A39CDAC62466EE	54C64F3C66372027154F01FC9F24B4E25FDFE405B70D1994C79ABBC2576FF775
Chrome Cache Entry: 59	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 60x60, components 3	4C88EBF87B0CC26121497DE03DB7F64A	A1256A5CFCD62223172EB3633659CADDFF6CF005	28DB5EDB0FE5E61F42EB8A0D10250A317F3AC840E074FFA761CB953C330F2CF6
Chrome Cache Entry: 60	ASCII text, with very long lines (65297)	A454220FC07088BF1FDD19313B6BFD50	265A733CB7FBC481FD2510A659A85AD55C93C895	7F3145C87D3570154F633975E8A4F8D30AA38603EDABA145501E9C90DDBE186C
Chrome Cache Entry: 61	PNG image data, 258 x 184, 8-bit colormap, non-interlaced	EE850988ED56CD6F2498CAE7993A8753	965F9091CA3E7F21F5B8115347227AEDC93C586E	0303153A716BC5000D737521C0F6EB517700A1856B8E22BA8C088EC8F06ED8BA
Chrome Cache Entry: 62	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 60x60, components 3	752F51C4C387C0CA7F4337ACDEEC15D6	7F9777F95AECECFCE6FA930181269CCE30A4A059	227CEC10C842BA3865D12ED22363F87CA5135B3AC2C72E5AB1A3169C4A2D569C
Chrome Cache Entry: 63	ASCII text, with CRLF line terminators	B7A46A018DCD21A4828BAE0B04DDCC6C	1D8418D6CC45E5C29E1AAB008C18EA633E7730C4	299595FD56AA6A2FCFAC34FCF780D33B61785AD96F19485E65A33EAD8FD69CBC
Chrome Cache Entry: 64	PNG image data, 258 x 184, 8-bit colormap, non-interlaced	A660370FEB6A1543C3C872A52F7BCFA7	B9478ED6228E8FB34A393013D474CDE8DC400848	9D1EED749548DAD4B80B2D7CE32052143BD38773685029D7B60CEE82A31840B7
Chrome Cache Entry: 65	ASCII text, with very long lines (65451)	DC5E7F18C8D36AC1D3D4753A87C98D0A	C8E1C8B386DC5B7A9184C763C88D19A346EB3342	F7F6A5894F1D19DDAD6FA392B2ECE2C5E578CBF7DA4EA805B6885EB6985B6E3D
Chrome Cache Entry: 66	PNG image data, 768 x 293, 8-bit colormap, non-interlaced	3ABE055E63C17D1FD7A5598C1924503D	7CC8997B72CDA7EB64DB973FEA07F7C5C3E362E5	65C6B55F035B9973169B8F66625697E50EC57D6ED7F228E345FD77BB7C5C159D
Chrome Cache Entry: 67	JSON data	C9910B9B96656FD7A05C30A070A95470	F9C074580FE7560528DEA9F7841FDE09121FEF8B	E5A0111985FB4CCCC4B0E4A29E43F6289C5D9B46BC054C94254CBDACE0222A63
Chrome Cache Entry: 68	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 60x60, components 3	C74A5BEFD416E24626972E88ED65526D	4E8C25553248600CF23C3D6BCEC488D986A129F8	53BB570F4465306A78670ECBEA911BA0362251D2DC825D9EA0CB5D1C70F413AC
Chrome Cache Entry: 69	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 60x60, components 3	C74A5BEFD416E24626972E88ED65526D	4E8C25553248600CF23C3D6BCEC488D986A129F8	53BB570F4465306A78670ECBEA911BA0362251D2DC825D9EA0CB5D1C70F413AC
Chrome Cache Entry: 70	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 60x60, components 3	9B63CCBD631923743813E838190CECBF	5C6DD930C81346616E9C641FF41B6F18344C7E76	4CA9130A03F6874BAB37D2D52FD4546E3DE34CCCCBD83AA5B9CB6ED0F923D8B3
Chrome Cache Entry: 71	Audio file with ID3 version 2.3.0, contains: MPEG ADTS, layer III, v1, 128 kbps, 44.1 kHz, Monaural	6D2D3DA2EA28ACE816FA4A138829DC18	606E0EC3D7FB05C69F16233CFE1FF0A0EE760505	D79BC81189750262716692ADE6CC4D6FB6C4FBC4AA01C2B9D0AA67E5788821FC
Chrome Cache Entry: 72	ASCII text, with very long lines (24389), with no line terminators	89ED4B592AB506A6FCA18E95657DFC4F	179998AD5741D669E75521FB943850A808917924	4EF3A6A1FD10BCF96549FD9A09BDE836DAEA3343523644D1830367EDC1F9031B
Chrome Cache Entry: 73	PNG image data, 768 x 293, 8-bit colormap, non-interlaced	3ABE055E63C17D1FD7A5598C1924503D	7CC8997B72CDA7EB64DB973FEA07F7C5C3E362E5	65C6B55F035B9973169B8F66625697E50EC57D6ED7F228E345FD77BB7C5C159D
Chrome Cache Entry: 74	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 60x60, components 3	F96150CBBB80AC607B3F264141A7FAEF	9ED21CB4E5C552F29BC23DB55684C945E7582071	F013C5F2D9AEDD8072D4BF01749C7DFCBACB80A43D06AA579403ADFD8FD21FD3
Chrome Cache Entry: 75	Audio file with ID3 version 2.3.0, contains: MPEG ADTS, layer III, v1, 128 kbps, 44.1 kHz, Monaural	6D2D3DA2EA28ACE816FA4A138829DC18	606E0EC3D7FB05C69F16233CFE1FF0A0EE760505	D79BC81189750262716692ADE6CC4D6FB6C4FBC4AA01C2B9D0AA67E5788821FC
Chrome Cache Entry: 76	PNG image data, 258 x 185, 8-bit colormap, non-interlaced	99264BEE31A1ABDE5D0035468E53BBFB	D1F25383B68C3769EB3BDB36783E85C112078054	8DA9180789C861B8D0D67D2BCA168DFCC6DE98F6999AB47400C38397D122157F
Chrome Cache Entry: 77	PNG image data, 258 x 185, 8-bit colormap, non-interlaced	99264BEE31A1ABDE5D0035468E53BBFB	D1F25383B68C3769EB3BDB36783E85C112078054	8DA9180789C861B8D0D67D2BCA168DFCC6DE98F6999AB47400C38397D122157F
Chrome Cache Entry: 78	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 60x60, components 3	752F51C4C387C0CA7F4337ACDEEC15D6	7F9777F95AECECFCE6FA930181269CCE30A4A059	227CEC10C842BA3865D12ED22363F87CA5135B3AC2C72E5AB1A3169C4A2D569C
Chrome Cache Entry: 79	ASCII text, with very long lines (3422), with no line terminators	BB6B0303BDF4D00F569EA2779560743A	F7AD4DBDE8C72B2513D1876621113AB9E1B1905E	76258946EE92A601ABA0B605B921AB01168534B0987CAF446DBBE4C3D3D25FBA
Chrome Cache Entry: 80	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 60x60, components 3	9B63CCBD631923743813E838190CECBF	5C6DD930C81346616E9C641FF41B6F18344C7E76	4CA9130A03F6874BAB37D2D52FD4546E3DE34CCCCBD83AA5B9CB6ED0F923D8B3
Chrome Cache Entry: 81	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 60x60, components 3	F96150CBBB80AC607B3F264141A7FAEF	9ED21CB4E5C552F29BC23DB55684C945E7582071	F013C5F2D9AEDD8072D4BF01749C7DFCBACB80A43D06AA579403ADFD8FD21FD3
Chrome Cache Entry: 82	ASCII text, with very long lines (32813), with no line terminators	DE4AF01A50DB5454DBC0376DBD439AF3	BB026B70A9701A80A580668D7D241C545A06D60D	8CFA2E960C0BF98660286437E4DCEAAE75C8A094760F6BDB9F088888F1567DBC
Chrome Cache Entry: 83	ASCII text, with very long lines (4473), with no line terminators	309154A7108A1A6A726ADE3C39649A2C	B14969C2A6A1A655C07DCE08ECF647C0747554BF	1CAC0D3B7E921266710DF94CA32C7FE0D43359D71FACB97C114E21A7A1B7D907
Chrome Cache Entry: 84	PNG image data, 417 x 515, 8-bit colormap, non-interlaced	86C9F807FC66133969F63198AC0FE75D	037A01FF739DDADB3A24E964002330176C75C5D2	5CC828750E8D07A70BB34DE95A298592868D1BB1EB9D8E61B025779F9F3DDF58
Chrome Cache Entry: 85	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 60x60, components 3	7F103BC91A8084CD154189B5EBB2CF86	375E58C42A8C409BBF111847A1F6798BA6C0D5F5	346139AAEC984853288672896D297DED47AC7EE1CB77CA43B63E130952CDD946
Chrome Cache Entry: 86	PNG image data, 15 x 14, 8-bit colormap, non-interlaced	17586A0AEB3F7B2AA7FB15A9251FBCD4	6ADFFAD1183C93BC0DC114C89C77365734EC0DD6	8BF8DC3A4B6F7E4FA2A6FA74495C212F37A301311980CBC758050993ED9C07E1
Chrome Cache Entry: 87	PNG image data, 258 x 184, 8-bit colormap, non-interlaced	890D869DB1B3D28AF588BE81685214F2	5375BD0C2C75A6E40168F5561EB4ECA993D14505	EA2521ADD13DEB769FB7ABEE364670A567E7A3DC7B3B4474B5F80510DC593212
Chrome Cache Entry: 88	PNG image data, 258 x 184, 8-bit colormap, non-interlaced	EE850988ED56CD6F2498CAE7993A8753	965F9091CA3E7F21F5B8115347227AEDC93C586E	0303153A716BC5000D737521C0F6EB517700A1856B8E22BA8C088EC8F06ED8BA
Chrome Cache Entry: 89	SVG Scalable Vector Graphics image	1067E4F544573A808DB9CF39397E3B8E	7D2A7929ED766649E6D09157371AFFAD5B9AE005	442F2945EBCD2872EB28599AAD185E96A054C9FE611087EBC02398FADE385C48
Chrome Cache Entry: 90	ASCII text, with CRLF line terminators	A42AF1908408284441961EE5FAC7891E	9C4E5D6EEA95A03464380779A7AB9764E163F3A9	36A93A8003AB142DC7446633CF75524283582968CE207F8B773BE234C4ED5CF6
Chrome Cache Entry: 91	PNG image data, 258 x 185, 8-bit colormap, non-interlaced	F32165874F658A8497F38D204EBB92DE	7511015AD482EDAA0F024B5C78A7307A5E2E7077	8A623F9360C9544015B526A887EF1D3AEB7DABA217FC1567FD0610FDEA744792
Chrome Cache Entry: 92	PNG image data, 258 x 184, 8-bit colormap, non-interlaced	890D869DB1B3D28AF588BE81685214F2	5375BD0C2C75A6E40168F5561EB4ECA993D14505	EA2521ADD13DEB769FB7ABEE364670A567E7A3DC7B3B4474B5F80510DC593212
Chrome Cache Entry: 93	PNG image data, 258 x 184, 8-bit colormap, non-interlaced	A660370FEB6A1543C3C872A52F7BCFA7	B9478ED6228E8FB34A393013D474CDE8DC400848	9D1EED749548DAD4B80B2D7CE32052143BD38773685029D7B60CEE82A31840B7
Chrome Cache Entry: 94	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 60x60, components 3	7F103BC91A8084CD154189B5EBB2CF86	375E58C42A8C409BBF111847A1F6798BA6C0D5F5	346139AAEC984853288672896D297DED47AC7EE1CB77CA43B63E130952CDD946
Chrome Cache Entry: 95	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 60x60, components 3	4C88EBF87B0CC26121497DE03DB7F64A	A1256A5CFCD62223172EB3633659CADDFF6CF005	28DB5EDB0FE5E61F42EB8A0D10250A317F3AC840E074FFA761CB953C330F2CF6
Chrome Cache Entry: 96	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 60x60, components 3	F17D127DFCAA6F94929EEDD080276DF0	EC801473523B8EB44E123B5634081D2B57715BA6	0108E4D428F408F819F174AE8A5923B4010E80A14FC9872B018C12781E114403
Chrome Cache Entry: 97	HTML document, Unicode text, UTF-8 text, with very long lines (615), with CRLF line terminators	B90F2E5B97A97DF386752F2DF115D9DB	6C7698FC1394F6803E09EBBBEB8B3B2CB89F5116	6650872E81F10F60284A0E815E2F901DAABD3A917403BD9D8BF6E3C442850202
Chrome Cache Entry: 98	PNG image data, 258 x 185, 8-bit colormap, non-interlaced	F32165874F658A8497F38D204EBB92DE	7511015AD482EDAA0F024B5C78A7307A5E2E7077	8A623F9360C9544015B526A887EF1D3AEB7DABA217FC1567FD0610FDEA744792
Chrome Cache Entry: 99	SVG Scalable Vector Graphics image	1067E4F544573A808DB9CF39397E3B8E	7D2A7929ED766649E6D09157371AFFAD5B9AE005	442F2945EBCD2872EB28599AAD185E96A054C9FE611087EBC02398FADE385C48

AV Detection

Antivirus detection for URL or domain

Source: https://506pp8k.codebenmike.live/media/mainstream/all/ab/box_open.png	Avira URL Cloud: Label: phishing
Source: https://506pp8k.codebenmike.live/media/mainstream/all/ab/1102_3.js	Avira URL Cloud: Label: phishing
Source: https://506pp8k.codebenmike.live/media/mainstream/all/ab/l.png	Avira URL Cloud: Label: phishing
Source: https://506pp8k.codebenmike.live/media/mainstream/flag-icon/css/flag-icon.css	Avira URL Cloud: Label: phishing
Source: https://506pp8k.codebenmike.live/media/mainstream/u.js	Avira URL Cloud: Label: phishing
Source: https://506pp8k.codebenmike.live/media/mainstream/all/ab/fr2.jpg	Avira URL Cloud: Label: phishing
Source: https://506pp8k.codebenmike.live/media/mainstream/all/ab/1102_1.js	Avira URL Cloud: Label: phishing
Source: https://506pp8k.codebenmike.live/media/mainstream/all/ab/iphone15pro.png	Avira URL Cloud: Label: phishing
Source: https://506pp8k.codebenmike.live/media/mainstream/icon.js	Avira URL Cloud: Label: phishing
Source: https://506pp8k.codebenmike.live/media/mainstream/all/ab/fr1.jpg	Avira URL Cloud: Label: phishing
Source: https://506pp8k.codebenmike.live/media/mainstream/all/ab/fr6.jpg	Avira URL Cloud: Label: phishing
Source: https://506pp8k.codebenmike.live/media/mainstream/alert.mp3	Avira URL Cloud: Label: phishing
Source: https://506pp8k.codebenmike.live/media/mainstream/all/ab/fr3.jpg	Avira URL Cloud: Label: phishing
Source: https://codebenmike.live/jqmcsoba/	Avira URL Cloud: Label: malware
Source: https://506pp8k.codebenmike.live/media/mainstream/all/ab/box-iphone15pro.png	Avira URL Cloud: Label: phishing
Source: https://506pp8k.codebenmike.live/media/mainstream/all/ab/top_red.png	Avira URL Cloud: Label: phishing
Source: https://506pp8k.codebenmike.live/media/mainstream/all/ab/x1.png	Avira URL Cloud: Label: phishing
Source: https://506pp8k.codebenmike.live/media/mainstream/all/ab/1102.css	Avira URL Cloud: Label: phishing
Source: https://506pp8k.codebenmike.live/media/mainstream/sound.js	Avira URL Cloud: Label: phishing
Source: https://506pp8k.codebenmike.live/media/mainstream/all/ab/fr4.jpg	Avira URL Cloud: Label: phishing
Source: https://506pp8k.codebenmike.live/media/mainstream/all/ab/box_closed.png	Avira URL Cloud: Label: phishing
Source: https://506pp8k.codebenmike.live/media/mainstream/all/ab/fr5.jpg	Avira URL Cloud: Label: phishing
Source: https://506pp8k.codebenmike.live/media/mainstream/all/ab/2.js	Avira URL Cloud: Label: phishing
Source: https://506pp8k.codebenmike.live/media/mainstream/all/ab/like.png	Avira URL Cloud: Label: phishing
Source: https://506pp8k.codebenmike.live/media/mainstream/flag-icon/flags/1x1/us.svg	Avira URL Cloud: Label: phishing
Source: https://506pp8k.codebenmike.live/media/mainstream/all/ab/1102_2.css	Avira URL Cloud: Label: phishing
Source: https://506pp8k.codebenmike.live/media/mainstream/all/ab/fr11.jpg	Avira URL Cloud: Label: phishing

Source: https://iecohshasaig.shop/?u=k8pp605&o=c9ewtnr&t=ggdown

HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 23.193.120.112:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.193.120.112:443 -> 192.168.2.4:49743 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 104.46.162.224
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 208.111.136.0
Source: unknown	TCP traffic detected without corresponding DNS query: 208.111.136.0
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 208.111.136.0
Source: unknown	TCP traffic detected without corresponding DNS query: 208.111.136.0
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /?u=k8pp605&o=c9ewtnr&t=ggdown HTTP/1.1Host: iecohshasaig.shopConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: iecohshasaig.shopConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://iecohshasaig.shop/?u=k8pp605&o=c9ewtnr&t=ggdownAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sid=t2~3cv1adg2z3djgwodckpnln2l; p1=https://codebenmike.live/jqmcsoba/; s1=mhurcklgbsmvdgh5
Source: global traffic	HTTP traffic detected: GET /jqmcsoba/?u=k8pp605&o=c9ewtnr&t=ggdown&f=1&sid=t2~3cv1adg2z3djgwodckpnln2l&fp=2WjE4fgbS3Hm3Qkivw8mgw%3D%3D HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://iecohshasaig.shop/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/all/ab/1102_2.css HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://506pp8k.codebenmike.live/jqmcsoba/?u=k8pp605&o=c9ewtnr&t=ggdown&f=1&sid=t2~3cv1adg2z3djgwodckpnln2l&fp=2WjE4fgbS3Hm3Qkivw8mgw%3D%3DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /npm/bootstrap@4.3.1/dist/js/bootstrap.bundle.min.js HTTP/1.1Host: cdn.jsdelivr.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://506pp8k.codebenmike.live/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/all/ab/1102.css HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://506pp8k.codebenmike.live/jqmcsoba/?u=k8pp605&o=c9ewtnr&t=ggdown&f=1&sid=t2~3cv1adg2z3djgwodckpnln2l&fp=2WjE4fgbS3Hm3Qkivw8mgw%3D%3DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/flag-icon/css/flag-icon.css HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://506pp8k.codebenmike.live/jqmcsoba/?u=k8pp605&o=c9ewtnr&t=ggdown&f=1&sid=t2~3cv1adg2z3djgwodckpnln2l&fp=2WjE4fgbS3Hm3Qkivw8mgw%3D%3DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/all/ab/1102_3.js HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://506pp8k.codebenmike.live/jqmcsoba/?u=k8pp605&o=c9ewtnr&t=ggdown&f=1&sid=t2~3cv1adg2z3djgwodckpnln2l&fp=2WjE4fgbS3Hm3Qkivw8mgw%3D%3DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/icon.js HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://506pp8k.codebenmike.live/jqmcsoba/?u=k8pp605&o=c9ewtnr&t=ggdown&f=1&sid=t2~3cv1adg2z3djgwodckpnln2l&fp=2WjE4fgbS3Hm3Qkivw8mgw%3D%3DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/sound.js HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://506pp8k.codebenmike.live/jqmcsoba/?u=k8pp605&o=c9ewtnr&t=ggdown&f=1&sid=t2~3cv1adg2z3djgwodckpnln2l&fp=2WjE4fgbS3Hm3Qkivw8mgw%3D%3DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/u.js HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://506pp8k.codebenmike.live/jqmcsoba/?u=k8pp605&o=c9ewtnr&t=ggdown&f=1&sid=t2~3cv1adg2z3djgwodckpnln2l&fp=2WjE4fgbS3Hm3Qkivw8mgw%3D%3DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/all/ab/2.js HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://506pp8k.codebenmike.live/jqmcsoba/?u=k8pp605&o=c9ewtnr&t=ggdown&f=1&sid=t2~3cv1adg2z3djgwodckpnln2l&fp=2WjE4fgbS3Hm3Qkivw8mgw%3D%3DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/all/ab/1102_1.js HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://506pp8k.codebenmike.live/jqmcsoba/?u=k8pp605&o=c9ewtnr&t=ggdown&f=1&sid=t2~3cv1adg2z3djgwodckpnln2l&fp=2WjE4fgbS3Hm3Qkivw8mgw%3D%3DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/all/ab/l.png HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://506pp8k.codebenmike.live/jqmcsoba/?u=k8pp605&o=c9ewtnr&t=ggdown&f=1&sid=t2~3cv1adg2z3djgwodckpnln2l&fp=2WjE4fgbS3Hm3Qkivw8mgw%3D%3DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/all/ab/iphone15pro.png HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://506pp8k.codebenmike.live/jqmcsoba/?u=k8pp605&o=c9ewtnr&t=ggdown&f=1&sid=t2~3cv1adg2z3djgwodckpnln2l&fp=2WjE4fgbS3Hm3Qkivw8mgw%3D%3DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/all/ab/like.png HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://506pp8k.codebenmike.live/jqmcsoba/?u=k8pp605&o=c9ewtnr&t=ggdown&f=1&sid=t2~3cv1adg2z3djgwodckpnln2l&fp=2WjE4fgbS3Hm3Qkivw8mgw%3D%3DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/all/ab/fr2.jpg HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://506pp8k.codebenmike.live/jqmcsoba/?u=k8pp605&o=c9ewtnr&t=ggdown&f=1&sid=t2~3cv1adg2z3djgwodckpnln2l&fp=2WjE4fgbS3Hm3Qkivw8mgw%3D%3DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/all/ab/fr1.jpg HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://506pp8k.codebenmike.live/jqmcsoba/?u=k8pp605&o=c9ewtnr&t=ggdown&f=1&sid=t2~3cv1adg2z3djgwodckpnln2l&fp=2WjE4fgbS3Hm3Qkivw8mgw%3D%3DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/all/ab/fr3.jpg HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://506pp8k.codebenmike.live/jqmcsoba/?u=k8pp605&o=c9ewtnr&t=ggdown&f=1&sid=t2~3cv1adg2z3djgwodckpnln2l&fp=2WjE4fgbS3Hm3Qkivw8mgw%3D%3DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/all/ab/top_red.png HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://506pp8k.codebenmike.live/jqmcsoba/?u=k8pp605&o=c9ewtnr&t=ggdown&f=1&sid=t2~3cv1adg2z3djgwodckpnln2l&fp=2WjE4fgbS3Hm3Qkivw8mgw%3D%3DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/all/ab/x1.png HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://506pp8k.codebenmike.live/jqmcsoba/?u=k8pp605&o=c9ewtnr&t=ggdown&f=1&sid=t2~3cv1adg2z3djgwodckpnln2l&fp=2WjE4fgbS3Hm3Qkivw8mgw%3D%3DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ExtService.svc/getextparams HTTP/1.1Host: jsontdsexit2.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://506pp8k.codebenmike.liveSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://506pp8k.codebenmike.live/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/all/ab/box-iphone15pro.png HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://506pp8k.codebenmike.live/jqmcsoba/?u=k8pp605&o=c9ewtnr&t=ggdown&f=1&sid=t2~3cv1adg2z3djgwodckpnln2l&fp=2WjE4fgbS3Hm3Qkivw8mgw%3D%3DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/all/ab/box_open.png HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://506pp8k.codebenmike.live/jqmcsoba/?u=k8pp605&o=c9ewtnr&t=ggdown&f=1&sid=t2~3cv1adg2z3djgwodckpnln2l&fp=2WjE4fgbS3Hm3Qkivw8mgw%3D%3DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/all/ab/box_closed.png HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://506pp8k.codebenmike.live/jqmcsoba/?u=k8pp605&o=c9ewtnr&t=ggdown&f=1&sid=t2~3cv1adg2z3djgwodckpnln2l&fp=2WjE4fgbS3Hm3Qkivw8mgw%3D%3DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/all/ab/fr5.jpg HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://506pp8k.codebenmike.live/jqmcsoba/?u=k8pp605&o=c9ewtnr&t=ggdown&f=1&sid=t2~3cv1adg2z3djgwodckpnln2l&fp=2WjE4fgbS3Hm3Qkivw8mgw%3D%3DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/all/ab/fr4.jpg HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://506pp8k.codebenmike.live/jqmcsoba/?u=k8pp605&o=c9ewtnr&t=ggdown&f=1&sid=t2~3cv1adg2z3djgwodckpnln2l&fp=2WjE4fgbS3Hm3Qkivw8mgw%3D%3DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/all/ab/fr6.jpg HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://506pp8k.codebenmike.live/jqmcsoba/?u=k8pp605&o=c9ewtnr&t=ggdown&f=1&sid=t2~3cv1adg2z3djgwodckpnln2l&fp=2WjE4fgbS3Hm3Qkivw8mgw%3D%3DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/all/ab/fr11.jpg HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://506pp8k.codebenmike.live/jqmcsoba/?u=k8pp605&o=c9ewtnr&t=ggdown&f=1&sid=t2~3cv1adg2z3djgwodckpnln2l&fp=2WjE4fgbS3Hm3Qkivw8mgw%3D%3DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/flag-icon/flags/1x1/us.svg HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://506pp8k.codebenmike.live/media/mainstream/flag-icon/css/flag-icon.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ExtService.svc/getextparams HTTP/1.1Host: jsontdsexit2.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/all/ab/iphone15pro.png HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/all/ab/l.png HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/all/ab/fr3.jpg HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/all/ab/like.png HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/all/ab/fr2.jpg HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/all/ab/top_red.png HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/alert.mp3 HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://506pp8k.codebenmike.live/jqmcsoba/?u=k8pp605&o=c9ewtnr&t=ggdown&f=1&sid=t2~3cv1adg2z3djgwodckpnln2l&fp=2WjE4fgbS3Hm3Qkivw8mgw%3D%3DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/all/ab/fr1.jpg HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/all/ab/x1.png HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/all/ab/box_open.png HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/all/ab/box-iphone15pro.png HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/all/ab/fr5.jpg HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/all/ab/fr4.jpg HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/all/ab/box_closed.png HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/all/ab/fr11.jpg HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/all/ab/fr6.jpg HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/flag-icon/flags/1x1/us.svg HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/mainstream/alert.mp3 HTTP/1.1Host: 506pp8k.codebenmike.liveConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.tbmuae.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: www.tbmuae.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: iecohshasaig.shop
Source: global traffic	DNS traffic detected: DNS query: 506pp8k.codebenmike.live
Source: global traffic	DNS traffic detected: DNS query: cdn.jsdelivr.net
Source: global traffic	DNS traffic detected: DNS query: jsontdsexit2.com

Source: chromecache_73.2.dr, chromecache_66.2.dr	String found in binary or memory: http://www.gimp.org/xmp/
Source: chromecache_97.2.dr	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js
Source: chromecache_97.2.dr	String found in binary or memory: https://cdn.jsdelivr.net/npm/bootstrap
Source: chromecache_101.2.dr	String found in binary or memory: https://codebenmike.live/jqmcsoba/
Source: chromecache_90.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v17/mem8YaGs126MiZpBA-UFUZ0bf8pkAp6a.woff2)
Source: chromecache_90.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v17/mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2)
Source: chromecache_90.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v17/mem8YaGs126MiZpBA-UFVp0bf8pkAp6a.woff2)
Source: chromecache_90.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v17/mem8YaGs126MiZpBA-UFW50bf8pkAp6a.woff2)
Source: chromecache_90.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v17/mem8YaGs126MiZpBA-UFWJ0bf8pkAp6a.woff2)
Source: chromecache_90.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v17/mem8YaGs126MiZpBA-UFWZ0bf8pkAp6a.woff2)
Source: chromecache_90.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v17/mem8YaGs126MiZpBA-UFWp0bf8pkAp6a.woff2)
Source: chromecache_60.2.dr	String found in binary or memory: https://getbootstrap.com/)
Source: chromecache_60.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: chromecache_60.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/graphs/contributors)

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49672
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 23.193.120.112:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.193.120.112:443 -> 192.168.2.4:49743 version: TLS 1.2

Spam, unwanted Advertisements and Ransom Demands

Yara detected GRQ Scam

Source: Yara match	File source: 1.1.pages.csv, type: HTML
Source: Yara match	File source: 1.2.pages.csv, type: HTML
Source: Yara match	File source: dropped/chromecache_97, type: DROPPED

Source: classification engine

Classification label: mal56.phis.win@20/82@16/9

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2024 --field-trial-handle=1956,i,8973572468749049646,7398222630303733936,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://www.tbmuae.com/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6104 --field-trial-handle=1956,i,8973572468749049646,7398222630303733936,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2024 --field-trial-handle=1956,i,8973572468749049646,7398222630303733936,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6104 --field-trial-handle=1956,i,8973572468749049646,7398222630303733936,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

ID:	1432043
Product:	CloudBasic
Start time:	10:47:10
Start date:	26.04.2024
Cookbook:	browseurl.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Windows Analysis Report
http://www.tbmuae.com/

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Phishing

Compliance

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report http://www.tbmuae.com/

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Phishing

Compliance

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
http://www.tbmuae.com/