Edit tour

Windows Analysis Report
http://www.antham.com/

Overview

General Information

Sample URL:	http://www.antham.com/
Analysis ID:	1619362
Infos:

Detection

Score:	56
Range:	0 - 100
Confidence:	100%

Signatures

AI detected phishing page

AI detected suspicious Javascript

HTML page contains obfuscated javascript

Detected suspicious crossdomain redirect

HTML page contains hidden javascript code

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6852 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7052 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1948,i,8623004807321235658,12539442094975710065,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6520 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://www.antham.com/" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

HTTP traffic detected: POST /signal/ HTTP/1.1Host: cint.guard-glider.onlineConnection: keep-aliveContent-Length: 867sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryVIBUVBLn83kcrwRyAccept: */*Origin: https://cint.guard-glider.onlineSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://cint.guard-glider.online/?subid=90968372199&cid=9949&tag=dm&dkw=antham.com&pid=185689&rhi=8bd605d0-4000-48e3-92dc-098779e30ea6Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: tst=%7B%2226%22%3A%22Normal%22%7D; ggr=Normal; gid=26; otid=9949_2025-02-19; mp_9d1f06337c788fcd584725b02fc2e601_mixpanel=%7B%22distinct_id%22%3A%20%2290968372199%22%2C%22%24device_id%22%3A%20%221951fa992b6199d-04f300f43a7c87-26031e51-140000-1951fa992b6199d%22%2C%22%24user_id%22%3A%20%2290968372199%22%2C%22%24initial_referrer%22%3A%20%22%24direct%22%2C%22%24initial_referring_domain%22%3A%20%22%24direct%22%7D

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 19 Feb 2025 19:23:18 GMTTransfer-Encoding: chunkedConnection: closestrict-transport-security: max-age=2592000x-powered-by: ASP.NETCache-Control: max-age=2678400CF-Cache-Status: EXPIREDReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iP36cID8cRHYSGeZBTn4Qq7YrBEEwV6CLR8bc6sEuYkbRqY5O9ufzgWMHQLq7Z7GX7cslXmQGkNrR0KYyRI%2FZCf2NLy7ckS3cjSlSgGwmXdFTUt7L%2B%2Bq1HEX9BMfgmFfw2EG8Z8t45Y%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 9148a16e998242c0-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=57420&min_rtt=5347&rtt_var=33275&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2856&recv_bytes=1504&delivery_rate=546100&cwnd=223&unsent_bytes=0&cid=c28e66dbd715321c&ts=298&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 19 Feb 2025 19:23:23 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closex-powered-by: Expressaccess-control-allow-origin: *content-security-policy: default-src 'none'x-content-type-options: nosniffvia: 1.1 googlecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XCFxzEFof7L4c2UyBl3qSNBY28%2FuydA%2BLQ0dOVRFJt6WwRSB%2F%2B5npL4rw4Jr9lJlGcO331FFTSBlopaFfR5wJYi%2B9jR2faeRtGZiC2mxHillVISfMISz%2Bo0er%2BAQYEduiGz93uZj"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 9148a18d9b4782ba-IADserver-timing: cfL4;desc="?proto=TCP&rtt=7077&min_rtt=7051&rtt_var=2697&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2834&recv_bytes=952&delivery_rate=401982&cwnd=32&unsent_bytes=0&cid=5d4be00f1b57f154&ts=205&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 19 Feb 2025 19:23:33 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closex-powered-by: Expressaccess-control-allow-origin: *content-security-policy: default-src 'none'x-content-type-options: nosniffvia: 1.1 googlecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=drp5wgAbCX0znDIcS44uljoG90Qnc3m6BOxx4O6c%2Fy8oPYH7ZgWe9tzVkUaC5PilFVdtoLa1aQ6y%2Bgwu2ZVUcGrRNDOkpp%2FIk4KyE2ZGrYx%2Fp0J6CdGnpGxijdmobGt3pPzqjEh8"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 9148a1ce0b1e8260-IADserver-timing: cfL4;desc="?proto=TCP&rtt=7044&min_rtt=6974&rtt_var=2755&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2834&recv_bytes=952&delivery_rate=387576&cwnd=32&unsent_bytes=0&cid=728f71448348cc1a&ts=199&x=0"

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50131 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50154 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 50257 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 50360 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 50314 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50222 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50325 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50268 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50292 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 50120 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50359 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 50189 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50291 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50303 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50269 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 50326 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 50119 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50142 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50337 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50348 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50178 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50153 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50221 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50324 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 50347 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 50144 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50335 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 50282 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50155 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50176 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 50313 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 50166 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50281 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 50143 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50358 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50302 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50277 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50337
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50339
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50338
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50219
Source: unknown	Network traffic detected: HTTP traffic on port 50174 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50139 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50331
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50330
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50333
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50332
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50335
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50334
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50305 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50328 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50348
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50347
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50349
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50340
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50221
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50342
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50341
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50223
Source: unknown	Network traffic detected: HTTP traffic on port 50339 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50344
Source: unknown	Network traffic detected: HTTP traffic on port 50352 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50222
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50343
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50346
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50345
Source: unknown	Network traffic detected: HTTP traffic on port 50128 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50162 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50363 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50359
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50358
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50239
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50230
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50351
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50317 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50350
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50353
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50231
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50352
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50355
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50233
Source: unknown	Network traffic detected: HTTP traffic on port 50351 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50354
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50357
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50356
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50360
Source: unknown	Network traffic detected: HTTP traffic on port 50288 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50127 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50198 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50128
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50127
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50129
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50362
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50361
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50122
Source: unknown	Network traffic detected: HTTP traffic on port 50150 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50364
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50363
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50245
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50366
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50244
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50365
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50125
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50367
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50340 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50244 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50315 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50338 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50350 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50129 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50184 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50362 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50303
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50305
Source: unknown	Network traffic detected: HTTP traffic on port 50117 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50173 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50308
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50278 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50201 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50302
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50141 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50233 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50315
Source: unknown	Network traffic detected: HTTP traffic on port 50361 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50314
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50317
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50316
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50319
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50318
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50200 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50311
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50310
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50313
Source: unknown	Network traffic detected: HTTP traffic on port 50223 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50312
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50163 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50349 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50326
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50204
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50325
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50328
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50206
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50327
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50329
Source: unknown	Network traffic detected: HTTP traffic on port 50245 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50316 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50320
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50201
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50322
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50200
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50321
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50324
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50323
Source: unknown	Network traffic detected: HTTP traffic on port 50185 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50327 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50174
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50295
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50176
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50297
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50178
Source: unknown	Network traffic detected: HTTP traffic on port 50319 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50263 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50182
Source: unknown	Network traffic detected: HTTP traffic on port 50286 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50184
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50183
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50343 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50366 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50125 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50320 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50251 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50148 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50185
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50331 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50189
Source: unknown	Network traffic detected: HTTP traffic on port 50183 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50193
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 50159 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50308 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50204 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50275 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50147 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50332 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50198
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50297 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 50354 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 50136 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 50365 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50139
Source: unknown	Network traffic detected: HTTP traffic on port 50170 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50138
Source: unknown	Network traffic detected: HTTP traffic on port 50193 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 50149 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50131
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50251
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50133
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50330 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50135
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50134
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50137
Source: unknown	Network traffic detected: HTTP traffic on port 50353 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50136
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50257
Source: unknown	Network traffic detected: HTTP traffic on port 50161 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50261
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50260
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50230 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50149
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50142
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50263
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50141
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50262
Source: unknown	Network traffic detected: HTTP traffic on port 50318 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50144
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50143
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50264
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50145
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50148
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50269
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50147
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50268
Source: unknown	Network traffic detected: HTTP traffic on port 50264 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50272
Source: unknown	Network traffic detected: HTTP traffic on port 50138 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50150
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50271
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50103 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50342 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50329 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50153
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50273
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50155
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50154
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50275
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50278
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50277
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50159
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 50182 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443

Source: classification engine

Classification label: mal56.phis.win@42/123@121/553

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\Chrome\Application\Dictionaries

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1948,i,8623004807321235658,12539442094975710065,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://www.antham.com/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1948,i,8623004807321235658,12539442094975710065,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Drive-by Compromise	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	3 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	5 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	6 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	4 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Source: https://marketplace-plans.com/trillion/bluecross/?transaction_id=a54663bfeed2436497d6e7441fac4e3b&source=hb501	Joe Sandbox AI: Score: 7 Reasons: The brand 'Medicare' is well-known and is associated with the official domain 'medicare.gov'., The URL 'marketplace-plans.com' does not match the official domain for Medicare., The URL contains generic terms like 'marketplace' and 'plans', which are not specific to Medicare and could be used to mislead users., The presence of multiple input fields requesting personal information such as name, email, and phone number is typical of phishing sites attempting to collect sensitive data., The domain 'marketplace-plans.com' does not have any clear association with Medicare, increasing the likelihood of it being a phishing site. DOM: 6.8.pages.csv
Source: https://marketplace-plans.com/trillion/bluecross/?transaction_id=112ee3dd0ea7488ea06d3a2b024484a6&source=hb501	Joe Sandbox AI: Score: 7 Reasons: The brand 'BlueCross BlueShield' is a well-known health insurance provider., The legitimate domain for BlueCross BlueShield is typically 'bcbs.com' or similar variations depending on the regional branch., The URL 'marketplace-plans.com' does not match the legitimate domain associated with BlueCross BlueShield., The URL contains generic terms 'marketplace' and 'plans', which are not directly associated with the brand., The presence of input fields for personal information (First Name, Last Name, Email, Phone Number) on a non-legitimate domain is suspicious. DOM: 9.24.pages.csv

Source: 0.51.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: http://biruuq.com/f.php?e=foQp1sGF3bOIdS3BkOVDbn49... This script exhibits several high-risk behaviors, including dynamic code execution through URL obfuscation, data exfiltration by sending user information to an untrusted domain, and aggressive redirection. The combination of these factors indicates a high likelihood of malicious intent, potentially for phishing or other nefarious purposes.
Source: 0.49.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: http://biruuq.com/f.php?e=foQp1sGF3bOIdS3BkOVDbn49... This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and the use of obfuscated URLs. The script attempts to redirect the user to a suspicious domain 'biruuq.com' and collects the user's fingerprint data, which could be used for malicious purposes. The use of a fallback redirect mechanism and the overall suspicious nature of the script's behavior indicate a high risk of malicious intent.

Source: https://pulse.clickguard.com/s/acczCFYMx6FGc/ast4ZKneZpIWw	HTTP Parser: var a0_0x3157be=a0_0x529c;function a0_0x529c(_0x331471,_0x179a75){var _0x5cb983=a0_0x5cb9();return a
Source: https://pulse.clickguard.com/s/acczCFYMx6FGc/ast4ZKneZpIWw	HTTP Parser: var a0_0x3157be=a0_0x529c;function a0_0x529c(_0x331471,_0x179a75){var _0x5cb983=a0_0x5cb9();return a

Source: https://marketplace-plans.com/trillion/bluecross/?transaction_id=a54663bfeed2436497d6e7441fac4e3b&source=hb501	HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/1001181805?random=1739992997642&cv=11&fst=1739992997642&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be52i0h2v9174096833za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=102067808~102482432~102539968~102558064~102587591~102605417~102640600&u_w=1280&u_h=1024&url=https%3A%2F%2Fmarketplace-plans.com%2Ftrillion%2Fbluecross%2F%3Ftransaction_id%3Da54663bfeed2436497d6e7441fac4e3b%26source%3Dhb501&hn=www.googleadservices.com&frm=0&tiba=Health%20Plan%20Comparison%20-%20Plans%20as%20Low%20as%20%2499%20per%20Month&npa=0&pscdl=noapi&auid=97759315.1739992998&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config
Source: https://marketplace-plans.com/trillion/bluecross/?transaction_id=a54663bfeed2436497d6e7441fac4e3b&source=hb501	HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/1001181805?random=1739992997673&cv=11&fst=1739992997673&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be52i0h2v9174096833za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=102067808~102482432~102539968~102558064~102587591~102605417~102640600&u_w=1280&u_h=1024&url=https%3A%2F%2Fmarketplace-plans.com%2Ftrillion%2Fbluecross%2F%3Ftransaction_id%3Da54663bfeed2436497d6e7441fac4e3b%26source%3Dhb501&hn=www.googleadservices.com&frm=0&tiba=Health%20Plan%20Comparison%20-%20Plans%20as%20Low%20as%20%2499%20per%20Month&npa=0&pscdl=noapi&auid=97759315.1739992998&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config
Source: https://marketplace-plans.com/trillion/bluecross/?transaction_id=a54663bfeed2436497d6e7441fac4e3b&source=hb501	HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/1001181805?random=1739992997642&cv=11&fst=1739992997642&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be52i0h2v9174096833za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=102067808~102482432~102539968~102558064~102587591~102605417~102640600&u_w=1280&u_h=1024&url=https%3A%2F%2Fmarketplace-plans.com%2Ftrillion%2Fbluecross%2F%3Ftransaction_id%3Da54663bfeed2436497d6e7441fac4e3b%26source%3Dhb501&hn=www.googleadservices.com&frm=0&tiba=Health%20Plan%20Comparison%20-%20Plans%20as%20Low%20as%20%2499%20per%20Month&npa=0&pscdl=noapi&auid=97759315.1739992998&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config
Source: https://marketplace-plans.com/trillion/bluecross/?transaction_id=a54663bfeed2436497d6e7441fac4e3b&source=hb501	HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/1001181805?random=1739992997673&cv=11&fst=1739992997673&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be52i0h2v9174096833za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=102067808~102482432~102539968~102558064~102587591~102605417~102640600&u_w=1280&u_h=1024&url=https%3A%2F%2Fmarketplace-plans.com%2Ftrillion%2Fbluecross%2F%3Ftransaction_id%3Da54663bfeed2436497d6e7441fac4e3b%26source%3Dhb501&hn=www.googleadservices.com&frm=0&tiba=Health%20Plan%20Comparison%20-%20Plans%20as%20Low%20as%20%2499%20per%20Month&npa=0&pscdl=noapi&auid=97759315.1739992998&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config
Source: https://marketplace-plans.com/trillion/bluecross/?transaction_id=a54663bfeed2436497d6e7441fac4e3b&source=hb501	HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/1001181805?random=1739992997642&cv=11&fst=1739992997642&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be52i0h2v9174096833za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=102067808~102482432~102539968~102558064~102587591~102605417~102640600&u_w=1280&u_h=1024&url=https%3A%2F%2Fmarketplace-plans.com%2Ftrillion%2Fbluecross%2F%3Ftransaction_id%3Da54663bfeed2436497d6e7441fac4e3b%26source%3Dhb501&hn=www.googleadservices.com&frm=0&tiba=Health%20Plan%20Comparison%20-%20Plans%20as%20Low%20as%20%2499%20per%20Month&npa=0&pscdl=noapi&auid=97759315.1739992998&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config
Source: https://marketplace-plans.com/trillion/bluecross/?transaction_id=a54663bfeed2436497d6e7441fac4e3b&source=hb501	HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/1001181805?random=1739992997673&cv=11&fst=1739992997673&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be52i0h2v9174096833za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=102067808~102482432~102539968~102558064~102587591~102605417~102640600&u_w=1280&u_h=1024&url=https%3A%2F%2Fmarketplace-plans.com%2Ftrillion%2Fbluecross%2F%3Ftransaction_id%3Da54663bfeed2436497d6e7441fac4e3b%26source%3Dhb501&hn=www.googleadservices.com&frm=0&tiba=Health%20Plan%20Comparison%20-%20Plans%20as%20Low%20as%20%2499%20per%20Month&npa=0&pscdl=noapi&auid=97759315.1739992998&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config
Source: https://marketplace-plans.com/trillion/bluecross/?transaction_id=112ee3dd0ea7488ea06d3a2b024484a6&source=hb501	HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/1001181805?random=1739993009865&cv=11&fst=1739993009865&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be52i0h2v9174096833za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=102067808~102482432~102539968~102558064~102587591~102605417~102640600&u_w=1280&u_h=1024&url=https%3A%2F%2Fmarketplace-plans.com%2Ftrillion%2Fbluecross%2F%3Ftransaction_id%3D112ee3dd0ea7488ea06d3a2b024484a6%26source%3Dhb501&hn=www.googleadservices.com&frm=0&tiba=Health%20Plan%20Comparison%20-%20Plans%20as%20Low%20as%20%2499%20per%20Month&npa=0&pscdl=noapi&auid=97759315.1739992998&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config
Source: https://marketplace-plans.com/trillion/bluecross/?transaction_id=112ee3dd0ea7488ea06d3a2b024484a6&source=hb501	HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/1001181805?random=1739993009897&cv=11&fst=1739993009897&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be52i0h2v9174096833za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=102067808~102482432~102539968~102558064~102587591~102605417~102640600&u_w=1280&u_h=1024&url=https%3A%2F%2Fmarketplace-plans.com%2Ftrillion%2Fbluecross%2F%3Ftransaction_id%3D112ee3dd0ea7488ea06d3a2b024484a6%26source%3Dhb501&hn=www.googleadservices.com&frm=0&tiba=Health%20Plan%20Comparison%20-%20Plans%20as%20Low%20as%20%2499%20per%20Month&npa=0&pscdl=noapi&auid=97759315.1739992998&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config
Source: https://marketplace-plans.com/trillion/bluecross/?transaction_id=112ee3dd0ea7488ea06d3a2b024484a6&source=hb501	HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/1001181805?random=1739993009865&cv=11&fst=1739993009865&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be52i0h2v9174096833za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=102067808~102482432~102539968~102558064~102587591~102605417~102640600&u_w=1280&u_h=1024&url=https%3A%2F%2Fmarketplace-plans.com%2Ftrillion%2Fbluecross%2F%3Ftransaction_id%3D112ee3dd0ea7488ea06d3a2b024484a6%26source%3Dhb501&hn=www.googleadservices.com&frm=0&tiba=Health%20Plan%20Comparison%20-%20Plans%20as%20Low%20as%20%2499%20per%20Month&npa=0&pscdl=noapi&auid=97759315.1739992998&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config
Source: https://marketplace-plans.com/trillion/bluecross/?transaction_id=112ee3dd0ea7488ea06d3a2b024484a6&source=hb501	HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/1001181805?random=1739993009897&cv=11&fst=1739993009897&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be52i0h2v9174096833za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=102067808~102482432~102539968~102558064~102587591~102605417~102640600&u_w=1280&u_h=1024&url=https%3A%2F%2Fmarketplace-plans.com%2Ftrillion%2Fbluecross%2F%3Ftransaction_id%3D112ee3dd0ea7488ea06d3a2b024484a6%26source%3Dhb501&hn=www.googleadservices.com&frm=0&tiba=Health%20Plan%20Comparison%20-%20Plans%20as%20Low%20as%20%2499%20per%20Month&npa=0&pscdl=noapi&auid=97759315.1739992998&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config
Source: https://marketplace-plans.com/trillion/bluecross/?transaction_id=112ee3dd0ea7488ea06d3a2b024484a6&source=hb501	HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/1001181805?random=1739993009865&cv=11&fst=1739993009865&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be52i0h2v9174096833za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=102067808~102482432~102539968~102558064~102587591~102605417~102640600&u_w=1280&u_h=1024&url=https%3A%2F%2Fmarketplace-plans.com%2Ftrillion%2Fbluecross%2F%3Ftransaction_id%3D112ee3dd0ea7488ea06d3a2b024484a6%26source%3Dhb501&hn=www.googleadservices.com&frm=0&tiba=Health%20Plan%20Comparison%20-%20Plans%20as%20Low%20as%20%2499%20per%20Month&npa=0&pscdl=noapi&auid=97759315.1739992998&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config
Source: https://marketplace-plans.com/trillion/bluecross/?transaction_id=112ee3dd0ea7488ea06d3a2b024484a6&source=hb501	HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/1001181805?random=1739993009897&cv=11&fst=1739993009897&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be52i0h2v9174096833za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=102067808~102482432~102539968~102558064~102587591~102605417~102640600&u_w=1280&u_h=1024&url=https%3A%2F%2Fmarketplace-plans.com%2Ftrillion%2Fbluecross%2F%3Ftransaction_id%3D112ee3dd0ea7488ea06d3a2b024484a6%26source%3Dhb501&hn=www.googleadservices.com&frm=0&tiba=Health%20Plan%20Comparison%20-%20Plans%20as%20Low%20as%20%2499%20per%20Month&npa=0&pscdl=noapi&auid=97759315.1739992998&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config
Source: https://marketplace-plans.com/trillion/bluecross/?transaction_id=112ee3dd0ea7488ea06d3a2b024484a6&source=hb501	HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/1001181805?random=1739993009865&cv=11&fst=1739993009865&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be52i0h2v9174096833za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=102067808~102482432~102539968~102558064~102587591~102605417~102640600&u_w=1280&u_h=1024&url=https%3A%2F%2Fmarketplace-plans.com%2Ftrillion%2Fbluecross%2F%3Ftransaction_id%3D112ee3dd0ea7488ea06d3a2b024484a6%26source%3Dhb501&hn=www.googleadservices.com&frm=0&tiba=Health%20Plan%20Comparison%20-%20Plans%20as%20Low%20as%20%2499%20per%20Month&npa=0&pscdl=noapi&auid=97759315.1739992998&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config
Source: https://marketplace-plans.com/trillion/bluecross/?transaction_id=112ee3dd0ea7488ea06d3a2b024484a6&source=hb501	HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/1001181805?random=1739993009897&cv=11&fst=1739993009897&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be52i0h2v9174096833za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=102067808~102482432~102539968~102558064~102587591~102605417~102640600&u_w=1280&u_h=1024&url=https%3A%2F%2Fmarketplace-plans.com%2Ftrillion%2Fbluecross%2F%3Ftransaction_id%3D112ee3dd0ea7488ea06d3a2b024484a6%26source%3Dhb501&hn=www.googleadservices.com&frm=0&tiba=Health%20Plan%20Comparison%20-%20Plans%20as%20Low%20as%20%2499%20per%20Month&npa=0&pscdl=noapi&auid=97759315.1739992998&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config
Source: https://marketplace-plans.com/trillion/bluecross/?transaction_id=112ee3dd0ea7488ea06d3a2b024484a6&source=hb501	HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/1001181805?random=1739993009865&cv=11&fst=1739993009865&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be52i0h2v9174096833za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=102067808~102482432~102539968~102558064~102587591~102605417~102640600&u_w=1280&u_h=1024&url=https%3A%2F%2Fmarketplace-plans.com%2Ftrillion%2Fbluecross%2F%3Ftransaction_id%3D112ee3dd0ea7488ea06d3a2b024484a6%26source%3Dhb501&hn=www.googleadservices.com&frm=0&tiba=Health%20Plan%20Comparison%20-%20Plans%20as%20Low%20as%20%2499%20per%20Month&npa=0&pscdl=noapi&auid=97759315.1739992998&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config
Source: https://marketplace-plans.com/trillion/bluecross/?transaction_id=112ee3dd0ea7488ea06d3a2b024484a6&source=hb501	HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/1001181805?random=1739993009897&cv=11&fst=1739993009897&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be52i0h2v9174096833za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=102067808~102482432~102539968~102558064~102587591~102605417~102640600&u_w=1280&u_h=1024&url=https%3A%2F%2Fmarketplace-plans.com%2Ftrillion%2Fbluecross%2F%3Ftransaction_id%3D112ee3dd0ea7488ea06d3a2b024484a6%26source%3Dhb501&hn=www.googleadservices.com&frm=0&tiba=Health%20Plan%20Comparison%20-%20Plans%20as%20Low%20as%20%2499%20per%20Month&npa=0&pscdl=noapi&auid=97759315.1739992998&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config
Source: https://marketplace-plans.com/trillion/bluecross/?transaction_id=112ee3dd0ea7488ea06d3a2b024484a6&source=hb501	HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/1001181805?random=1739993024018&cv=11&fst=1739993024018&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be52i0h2v9174096833za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=102067808~102482432~102539968~102558064~102587591~102605417~102640600&u_w=1280&u_h=1024&url=https%3A%2F%2Fmarketplace-plans.com%2Ftrillion%2Fbluecross%2F%3Ftransaction_id%3D112ee3dd0ea7488ea06d3a2b024484a6%26source%3Dhb501&hn=www.googleadservices.com&frm=0&tiba=Health%20Plan%20Comparison%20-%20Plans%20as%20Low%20as%20%2499%20per%20Month&npa=0&pscdl=noapi&auid=97759315.1739992998&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dform_start

Source: https://cint.guard-glider.online/?subid=90968372199&cid=9949&tag=dm&dkw=antham.com&pid=185689&rhi=8bd605d0-4000-48e3-92dc-098779e30ea6	HTTP Parser: No favicon
Source: https://www.google.com/search?q=antha.mcom&oq=antha.mcom&gs_lcrp=EgZjaHJvbWUyBggAEEUYOdIBCDEzMzlqMGo3qAIAsAIA&sourceid=chrome&ie=UTF-8&sei=ki-2Z_LlPIy0i-gP_o_58Ag	HTTP Parser: No favicon
Source: http://biruuq.com/f.php?e=foQp1sGF3bOIdS3BkOVDbn49fm0zTlgwR3Zya3lxNDJXZldCMnBDN21USjA5N20zb2dFdHZtblVmWWx3b2V0ZUFrN25PSXVpcHFxK3VhT0lBMTB6cWt3SCtGR0p5ZWJjclFid3NOZEowQTY2N1pVK294eFdEYk5XRE5GOElmeExwZVdtUGtrNnJYZnkyL0loUHphdnpPN1FmSWpDWmZPQlYwTGFDU08xMHBmaVNtL3BmaVo0SExISGxhMUJtT3UxRUVzdTNsdmFsQ3lrcjFWWElxbDNsSW9jWS9aYVNGclRRQmhjNHFET3FCamQwSisyeEJWL0h1WGtTYmw0bmMzYTVRY012SG9xM1FrYWdacnhLTHBveFVyeHc3RWxseW9SaWx0STdaYmVVTUZ0aGhVajNZZmpJbVAwRnJRR1ZaWEs4blorVDl6OS91NVo1N3V2MW9iM1I2clZtTXgwYXlicHI0d1pUR2J0cm9YVnl1NWY1NlB6eXZ6QnZRcVN3SEc0NE1EMnBIWUdtLzRXS3FRdmlyaEdOZmxSS3VtRGFIQXAvNEVCYXpEQjRuRHNWWnlNUXkzalhPUnRvaEdEZGRyV2Z6ZFh1Lzk0bWg5bnpGNFV0VG5SZ0xqZFpTNmp3WE1WQ2VXWXpWNDQyQlQwTGkrMjQ2TG83MlFpMG5OM2NsVGo0dVo4a0RwUHZlV0RsNW9DbHZY	HTTP Parser: No favicon
Source: https://marketplace-plans.com/trillion/bluecross/?transaction_id=a54663bfeed2436497d6e7441fac4e3b&source=hb501	HTTP Parser: No favicon
Source: https://marketplace-plans.com/trillion/bluecross/?transaction_id=a54663bfeed2436497d6e7441fac4e3b&source=hb501	HTTP Parser: No favicon
Source: https://marketplace-plans.com/trillion/bluecross/?transaction_id=a54663bfeed2436497d6e7441fac4e3b&source=hb501	HTTP Parser: No favicon
Source: https://marketplace-plans.com/trillion/bluecross/?transaction_id=a54663bfeed2436497d6e7441fac4e3b&source=hb501	HTTP Parser: No favicon
Source: https://marketplace-plans.com/trillion/bluecross/?transaction_id=a54663bfeed2436497d6e7441fac4e3b&source=hb501	HTTP Parser: No favicon
Source: https://marketplace-plans.com/trillion/bluecross/?transaction_id=a54663bfeed2436497d6e7441fac4e3b&source=hb501	HTTP Parser: No favicon
Source: http://biruuq.com/f.php?e=AeiM4aqm0wmStatsChvmqn49fjQrWlVqbWVGanJjcG01MXExWW95TXhXd0RPQ1pETmRRUFg2NUR3TUJrampQUlBFMlpHR0czeEYvTURPbUhKTlFrcm11eVBpN0I0bEVrWW1mTGRlZGY0Y0IzMjZLeWZoUXRMcFM5Sjk0WVJFa3BGanlIVFpUZWhsMDUza0NhSFFGZ2ZDTEkwd1N3VTJheVFwSzRaNDhFNCs5WFJZN2hab1RSa1BROHlhWDM4SUl6ancxZEJwdVJRdFBPdi9NeGQ0T1duVXk4Ty81dDdzMTJzMHdtVkF2blhzZzFGcVBjSzg2NzY0eWw3cytUNXhHaU5TdTdhN3ZIME1uUTVjTGw4SFdTT2V1UUtaVEIzUkxrUzhKdHAvem0yL0VoZGpTWU9pMjN2L29GaDA0N1V1QjJ1RitwSWZuYTVaMUdmd21oMjNtT0Jpcmh0eE1iNHdvdjJZc0VqNS9kdkVNOXppbDhVdlQxWUp0K0ppUFQ3REJWWjhOUzZ2NEplZ00zazNQWGovN3lNOHBuMFRpUVpCY1hHK29UU0ZhcDJZY1NrbVZPVk0yNHdhM2IrQjArcjZtTm85TU1QeWhaSlRQQVA0U3R3WjNHdEZqcGxDUkY5L0NXRGlseDQ2OXB0OVYyVEN0dzA0ZTZrVzZVWW04U0dIYldzekZLY28vU3k1TkxjKzA3bEl5	HTTP Parser: No favicon
Source: https://marketplace-plans.com/trillion/bluecross/?transaction_id=112ee3dd0ea7488ea06d3a2b024484a6&source=hb501	HTTP Parser: No favicon
Source: https://marketplace-plans.com/trillion/bluecross/?transaction_id=112ee3dd0ea7488ea06d3a2b024484a6&source=hb501	HTTP Parser: No favicon
Source: https://marketplace-plans.com/trillion/bluecross/?transaction_id=112ee3dd0ea7488ea06d3a2b024484a6&source=hb501	HTTP Parser: No favicon
Source: https://marketplace-plans.com/trillion/bluecross/?transaction_id=112ee3dd0ea7488ea06d3a2b024484a6&source=hb501	HTTP Parser: No favicon
Source: https://marketplace-plans.com/trillion/bluecross/?transaction_id=112ee3dd0ea7488ea06d3a2b024484a6&source=hb501	HTTP Parser: No favicon

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report
http://www.antham.com/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Screenshots

Thumbnails

Source: https://www.google.com/search?q=antha.mcom&oq=antha.mcom&gs_lcrp=EgZjaHJvbWUyBggAEEUYOdIBCDEzMzlqMGo3qAIAsAIA&sourceid=chrome&ie=UTF-8&sei=ki-2Z_LlPIy0i-gP_o_58Ag	HTTP Parser: No <meta name="author".. found
Source: https://marketplace-plans.com/trillion/bluecross/?transaction_id=a54663bfeed2436497d6e7441fac4e3b&source=hb501	HTTP Parser: No <meta name="author".. found
Source: https://marketplace-plans.com/trillion/bluecross/?transaction_id=a54663bfeed2436497d6e7441fac4e3b&source=hb501	HTTP Parser: No <meta name="author".. found
Source: https://marketplace-plans.com/trillion/bluecross/?transaction_id=a54663bfeed2436497d6e7441fac4e3b&source=hb501	HTTP Parser: No <meta name="author".. found
Source: https://marketplace-plans.com/trillion/bluecross/?transaction_id=a54663bfeed2436497d6e7441fac4e3b&source=hb501	HTTP Parser: No <meta name="author".. found
Source: https://marketplace-plans.com/trillion/bluecross/?transaction_id=112ee3dd0ea7488ea06d3a2b024484a6&source=hb501	HTTP Parser: No <meta name="author".. found
Source: https://marketplace-plans.com/trillion/bluecross/?transaction_id=112ee3dd0ea7488ea06d3a2b024484a6&source=hb501	HTTP Parser: No <meta name="author".. found
Source: https://marketplace-plans.com/trillion/bluecross/?transaction_id=112ee3dd0ea7488ea06d3a2b024484a6&source=hb501	HTTP Parser: No <meta name="author".. found
Source: https://marketplace-plans.com/trillion/bluecross/?transaction_id=112ee3dd0ea7488ea06d3a2b024484a6&source=hb501	HTTP Parser: No <meta name="author".. found
Source: https://marketplace-plans.com/trillion/bluecross/?transaction_id=112ee3dd0ea7488ea06d3a2b024484a6&source=hb501	HTTP Parser: No <meta name="author".. found

Source: https://www.google.com/search?q=antha.mcom&oq=antha.mcom&gs_lcrp=EgZjaHJvbWUyBggAEEUYOdIBCDEzMzlqMGo3qAIAsAIA&sourceid=chrome&ie=UTF-8&sei=ki-2Z_LlPIy0i-gP_o_58Ag	HTTP Parser: No <meta name="copyright".. found
Source: https://marketplace-plans.com/trillion/bluecross/?transaction_id=a54663bfeed2436497d6e7441fac4e3b&source=hb501	HTTP Parser: No <meta name="copyright".. found
Source: https://marketplace-plans.com/trillion/bluecross/?transaction_id=a54663bfeed2436497d6e7441fac4e3b&source=hb501	HTTP Parser: No <meta name="copyright".. found
Source: https://marketplace-plans.com/trillion/bluecross/?transaction_id=a54663bfeed2436497d6e7441fac4e3b&source=hb501	HTTP Parser: No <meta name="copyright".. found
Source: https://marketplace-plans.com/trillion/bluecross/?transaction_id=a54663bfeed2436497d6e7441fac4e3b&source=hb501	HTTP Parser: No <meta name="copyright".. found
Source: https://marketplace-plans.com/trillion/bluecross/?transaction_id=112ee3dd0ea7488ea06d3a2b024484a6&source=hb501	HTTP Parser: No <meta name="copyright".. found
Source: https://marketplace-plans.com/trillion/bluecross/?transaction_id=112ee3dd0ea7488ea06d3a2b024484a6&source=hb501	HTTP Parser: No <meta name="copyright".. found
Source: https://marketplace-plans.com/trillion/bluecross/?transaction_id=112ee3dd0ea7488ea06d3a2b024484a6&source=hb501	HTTP Parser: No <meta name="copyright".. found
Source: https://marketplace-plans.com/trillion/bluecross/?transaction_id=112ee3dd0ea7488ea06d3a2b024484a6&source=hb501	HTTP Parser: No <meta name="copyright".. found
Source: https://marketplace-plans.com/trillion/bluecross/?transaction_id=112ee3dd0ea7488ea06d3a2b024484a6&source=hb501	HTTP Parser: No <meta name="copyright".. found

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: www.ne1trk.com to https://marketplace-plans.com/trillion/bluecross/?transaction_id=a54663bfeed2436497d6e7441fac4e3b&source=hb501
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: www.ne1trk.com to https://marketplace-plans.com/trillion/bluecross/?transaction_id=112ee3dd0ea7488ea06d3a2b024484a6&source=hb501

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.77.188
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKdate: Wed, 19 Feb 2025 19:23:07 GMTserver: Apachevary: Accept-Encodingcontent-encoding: gzipcontent-length: 1202content-type: text/html; charset=UTF-8connection: closeData Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 57 5b 73 9b 38 18 7d 4e 66 f2 1f 34 ee cc da 99 6e 6d 2e 71 b6 4e ec ec d4 31 e0 b8 31 09 37 61 78 d9 11 20 0c b6 10 14 64 1b a7 93 ff 5e 61 27 ed 76 f7 61 f7 b9 13 5e 00 e9 1c e9 3b d2 9c 23 18 26 2c 23 37 67 a7 c3 04 a3 a8 b9 b3 94 11 7c 83 28 4b 50 d6 0d f3 6c d8 3b b6 f0 ae 2a 2c d3 82 01 b6 2f f0 a8 c5 70 cd 7a 2b b4 45 c7 d6 16 a8 ca 70 d4 ea ad aa 5e 9c d2 25 2e 8b 32 a5 ac 97 a6 31 ee 66 29 ed ae aa d6 cd b0 77 c4 fe e7 58 1c b0 45 25 28 71 94 96 38 64 7f 91 94 ae c1 08 b4 13 c6 8a ab 5e 2f 48 cb cd e6 4b 53 5c 2f ee 16 49 f1 27 1e c5 b9 51 88 95 a6 ca c1 c3 5d 64 c9 e3 f5 03 9c 04 f4 62 10 67 c2 93 4d 96 3b 53 f6 f7 48 26 b5 3e 99 2d 7c 12 dd ce e9 78 a2 4b a2 63 ad 3e f5 75 49 78 0a a4 48 8d a6 3e 0b 08 cc 5c b7 96 03 09 0a be a3 96 ba d4 7f b4 16 b0 08 a7 6a fd 59 86 89 2d 90 f1 dc 1e 5f 86 2e 93 ad 5b a6 99 42 d1 f7 dd d9 2a 24 6a 1a c9 fa 83 af e4 3b c3 f6 24 5d 2c e0 67 69 70 81 d5 48 f1 d6 fd 85 a9 f4 b5 07 85 64 58 a9 77 3e 8c 98 a3 b1 52 a7 33 cf a7 eb fd bd 40 72 67 5a 24 11 2d 1e 75 51 cd 2c b7 98 b8 99 ff 68 10 6f 67 6b ea c4 11 3e d6 f3 e9 38 43 50 67 f7 72 73 cf 05 4b a9 ef 2c ad 4e e6 ce 8c d9 b2 53 9b 0e 7c 8a 6c bd 8a 32 b5 32 64 52 86 2b d5 75 15 52 07 13 bd b2 dc c1 ca b5 06 c8 83 ba 16 12 d3 34 b2 64 a5 4f 55 c5 96 d5 5b 94 19 3b 2b ad f6 58 99 b9 f7 42 22 ba 1a b3 bd 6c 27 04 d9 fc c9 b3 a1 e9 09 a2 64 69 83 7a 2e aa a5 e7 46 28 a4 c9 bd 3d 1d 6f b1 0a f7 78 1a ca a6 5b 57 d8 1d 58 c8 ad 05 cb 8e 90 97 41 68 3b be 80 b4 04 a2 95 ee fb 59 31 0b e0 a7 9d 49 67 a6 29 fa c8 55 aa 8b 80 e4 25 9c 90 cb 07 6b 20 ea 30 17 75 19 4a 73 77 90 ce c5 3b 29 24 3e b3 17 cb 9d b7 20 69 38 bd 13 22 b1 70 4c 69 26 84 d9 c0 83 94 88 ba eb 89 3a 19 5f e2 85 7f 69 50 df 0c a1 2e 5b 4a 28 e8 8a a8 f0 3d bd 73 9d 88 dd 3f 99 0b 4b 56 cd 28 23 7b a4 44 0f 7e 56 5b 96 0c 99 a9 a9 77 c6 e2 d3 56 57 e0 ad b7 28 14 63 65 6e cc a9 ee ba 94 e8 ce 62 fd 84 48 f2 e8 50 73 cb 39 8a af 99 7b 28 f9 97 be 9a 88 f7 4f 6b 21 70 97 fd 80 16 9a ae 42 01 6a 7d cb 17 ea 2f be 5a d8 7a 56 c8 ae 22 ba 86 04 17 ee a2 70 f5 89 b1 37 88 c1 f7 6d 5d ce 57 86 64 6b 1f e5 39 51 8b b9 d6 7f 98 4b 7a 05 b5 5c 88 60 7e 81 04 73 e7 4c 7d 02 05 b3 d2 dd c1 24 98 fa de 6f ed eb b3 d3 b3 d3 5e 0f 58 98 01 04 58 9a e1 7c c3 40 1e 03 59 10 40 96 12 92 56 38 cc 69 54 01 96 03 5c e3 70 c3 30 07 be fa 04 a4 31 60 09 06 7f 33 20 28 ca 3c e3 2c 10 a3 94 54 20 ce 4b 50 e5 19 e6 14 54 e5 f4 ec 34 de d0 90 a5 39 e5 fd 84 04 28 5c 9b 2f 63 75 ce c1 d7 b3 d3 93 5d 4a a3 7c d7 25 79 88 1a 58 b7 c4 05 41 21 ee fc 64 cd f7 ed b8 18 7d f8 a3 7d ce eb 7f 6e 24 b0 72 7f 60 f3 5a 2b 06 ca a8 b4 5f a4 8c 40 85 d9 cb 4b e7 9f 53 fe de c8 6c c6 38 69 cc 1f 17 8f 2f a5 8f 80 fa 43 d0 cc e2 c5 a0 a8 f3 35 cb 69 ca 72 de b4 bc 6a 8a af f0 f3 81 fa 9d c6 9f 4f ba
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKdate: Wed, 19 Feb 2025 19:23:07 GMTserver: Apachelast-modified: Tue, 22 Oct 2024 03:26:38 GMTetag: "85c0-62508564b3780-gzip"accept-ranges: bytesvary: Accept-Encodingcontent-encoding: gzipcontent-length: 14345content-type: application/javascriptconnection: closeData Raw: 1f 8b 08 00 00 00 00 00 00 03 cd 7d 5b 57 e3 c8 96 e6 7b af d5 ff c1 28 ab b3 a4 44 36 92 2f 24 98 54 b1 80 e4 96 05 24 09 24 90 76 f9 70 64 29 b0 95 e8 e2 d2 c5 60 12 cf 5f 98 df d0 f3 3a 0f 33 8f fd 34 0f a7 57 ff af f9 76 84 6e 36 86 aa 3a 6b 1e e6 9c 2c 2c 45 ec 88 d8 11 b1 63 df 22 62 6b e5 dd bb 7f fd 97 ca bb ca 9e e3 0f 58 38 0a 1d 3f fe 74 5e 19 37 6a cd 9a 56 a9 56 76 82 d1 24 74 06 c3 b8 22 5b ca 2c 90 5a 39 f4 2d b5 52 d7 ea 8d 8a 3c 8c e3 51 d4 5e 59 b9 2d 20 6a 56 e0 29 bc ee 23 c7 62 7e c4 ec 4a e2 db 2c ac c4 43 56 39 3e bc 10 85 50 e6 fe fe be 16 8c 00 11 24 a1 c5 6a 41 38 58 71 45 89 68 c5 73 e2 6a fa 52 1b 0d 47 4a 25 7b a1 8a 79 e5 17 43 27 aa 44 c1 6d 7c 6f 86 ac 62 05 7e 6c 3a 7e 84 07 9b 55 6e c3 c0 ab 50 d5 55 51 77 65 14 06 df 99 15 47 6d 5e f4 38 09 bd 24 3c 30 a3 61 a3 d2 9f 54 7e 35 43 d3 af 1c 4d 02 14 cf 3b 34 70 e2 61 d2 a7 be ac dc 51 be 4b d9 2b 5e 51 b2 f6 3d e2 bd 5c f9 d7 7f 19 9b e1 ec 10 19 b7 89 6f c5 4e e0 cb 4c f9 21 25 11 ab 44 71 e8 58 b1 b4 41 a0 7e 91 ad fc 08 59 9c 84 3e d2 3e f7 09 c3 9a 19 45 ce c0 7f 7a 2a d7 70 1b 84 32 2f a8 c6 86 ae 86 86 19 0e 12 8f f9 71 54 73 99 3f 88 87 1b f1 87 70 23 5e 5e 56 32 c0 a0 e2 50 95 39 5c 37 ee 29 69 fd 18 89 38 88 27 23 56 1b 9a d1 e7 7b ff 34 c4 38 85 f1 a4 66 99 ae 2b fb 6a a0 bc 7d 2b b3 6e d0 33 7c fc 51 36 52 fc d8 54 f5 6b e6 68 e4 4e e4 18 03 af e6 55 2b d3 8d 0c d5 4a 2c 33 15 38 aa 61 d1 2d 76 2f c7 4f 4f 72 6c a0 1d cf 89 98 a2 c8 72 de b5 40 35 d1 b9 ac b4 43 5d 8d c3 c9 8f 44 0e 6b 3e 7b 40 6d 8a 32 b5 cc d8 1a ca be f2 c3 c4 9f e9 34 87 b6 ca d0 f1 30 0c ee 5f 05 4f 08 9c 8f e1 06 ab d9 81 cf 36 03 99 d5 c6 a6 9b 30 a5 2d fb 46 fa ac 02 0d 3f 8a 4d df 62 c1 6d 25 de f4 db e8 01 fa 25 97 a7 83 51 d5 8a a2 a0 59 e6 cb 8e 6a 29 d3 44 96 43 23 4c 07 08 b5 3c 3d 75 7b 00 e0 bd 50 08 b8 c0 24 a4 7c 81 0b 46 4a c5 18 a8 8e f1 c3 35 fb cc 6d 6b 6a 84 31 6d 97 c8 c3 b9 95 f5 b7 41 57 eb 29 bc 8f 95 a0 ab f7 b2 39 a1 e7 a9 8a 31 88 da dd 9e 1a 8c e8 67 9a 65 9a c6 0f 6a bd 6d c9 9a a2 f2 b2 78 d4 15 55 64 e3 b9 ae 4c 55 29 6b 49 32 0c a2 09 f4 f9 7c e2 f5 03 17 34 60 76 c5 63 cd 89 59 68 c6 41 d8 5b 40 b6 44 0b 53 45 35 37 4a f3 62 e5 b9 39 7c f2 3c c9 e2 7d 8b d3 6e d1 28 5f 00 81 dd 30 04 09 4b fb cc 17 6d 56 b0 c6 4d 37 64 a6 3d a9 b0 07 66 25 31 96 59 4d 52 36 88 d2 37 4c 42 d3 d0 54 0b e3 83 47 c7 d0 14 45 75 36 14 22 0b aa 9c 16 0b d2 03 a3 fe 96 40 36 c3 5a d6 7b f1 c6 db 06 75 02 22 cb 02 f5 07 62 29 84 8a aa 29 6d 41 89 48 5d 02 50 96 83 06 75 9a 5e a2 23 25 9b 8c 8d e8 de 21 da 0b 81 50 80 56 2d a3 2b 9a 55 03 41 5b 3d 85 23 aa fc b0 4c 30 04 ad cd 7f f4 76 60 58 1b 7d f4 f0 6e 83 27 34 db 69 85 4e 8d d3 c4 f2 b2 fa 83 17 6f 53 a3 2a 35 d9 5e d2 a
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKdate: Wed, 19 Feb 2025 19:23:08 GMTserver: Apachelast-modified: Tue, 22 Oct 2024 03:26:38 GMTetag: "85c0-62508564b3780-gzip"accept-ranges: bytesvary: Accept-Encodingcontent-encoding: gzipcontent-length: 14345content-type: application/javascriptconnection: closeData Raw: 1f 8b 08 00 00 00 00 00 00 03 cd 7d 5b 57 e3 c8 96 e6 7b af d5 ff c1 28 ab b3 a4 44 36 92 2f 24 98 54 b1 80 e4 96 05 24 09 24 90 76 f9 70 64 29 b0 95 e8 e2 d2 c5 60 12 cf 5f 98 df d0 f3 3a 0f 33 8f fd 34 0f a7 57 ff af f9 76 84 6e 36 86 aa 3a 6b 1e e6 9c 2c 2c 45 ec 88 d8 11 b1 63 df 22 62 6b e5 dd bb 7f fd 97 ca bb ca 9e e3 0f 58 38 0a 1d 3f fe 74 5e 19 37 6a cd 9a 56 a9 56 76 82 d1 24 74 06 c3 b8 22 5b ca 2c 90 5a 39 f4 2d b5 52 d7 ea 8d 8a 3c 8c e3 51 d4 5e 59 b9 2d 20 6a 56 e0 29 bc ee 23 c7 62 7e c4 ec 4a e2 db 2c ac c4 43 56 39 3e bc 10 85 50 e6 fe fe be 16 8c 00 11 24 a1 c5 6a 41 38 58 71 45 89 68 c5 73 e2 6a fa 52 1b 0d 47 4a 25 7b a1 8a 79 e5 17 43 27 aa 44 c1 6d 7c 6f 86 ac 62 05 7e 6c 3a 7e 84 07 9b 55 6e c3 c0 ab 50 d5 55 51 77 65 14 06 df 99 15 47 6d 5e f4 38 09 bd 24 3c 30 a3 61 a3 d2 9f 54 7e 35 43 d3 af 1c 4d 02 14 cf 3b 34 70 e2 61 d2 a7 be ac dc 51 be 4b d9 2b 5e 51 b2 f6 3d e2 bd 5c f9 d7 7f 19 9b e1 ec 10 19 b7 89 6f c5 4e e0 cb 4c f9 21 25 11 ab 44 71 e8 58 b1 b4 41 a0 7e 91 ad fc 08 59 9c 84 3e d2 3e f7 09 c3 9a 19 45 ce c0 7f 7a 2a d7 70 1b 84 32 2f a8 c6 86 ae 86 86 19 0e 12 8f f9 71 54 73 99 3f 88 87 1b f1 87 70 23 5e 5e 56 32 c0 a0 e2 50 95 39 5c 37 ee 29 69 fd 18 89 38 88 27 23 56 1b 9a d1 e7 7b ff 34 c4 38 85 f1 a4 66 99 ae 2b fb 6a a0 bc 7d 2b b3 6e d0 33 7c fc 51 36 52 fc d8 54 f5 6b e6 68 e4 4e e4 18 03 af e6 55 2b d3 8d 0c d5 4a 2c 33 15 38 aa 61 d1 2d 76 2f c7 4f 4f 72 6c a0 1d cf 89 98 a2 c8 72 de b5 40 35 d1 b9 ac b4 43 5d 8d c3 c9 8f 44 0e 6b 3e 7b 40 6d 8a 32 b5 cc d8 1a ca be f2 c3 c4 9f e9 34 87 b6 ca d0 f1 30 0c ee 5f 05 4f 08 9c 8f e1 06 ab d9 81 cf 36 03 99 d5 c6 a6 9b 30 a5 2d fb 46 fa ac 02 0d 3f 8a 4d df 62 c1 6d 25 de f4 db e8 01 fa 25 97 a7 83 51 d5 8a a2 a0 59 e6 cb 8e 6a 29 d3 44 96 43 23 4c 07 08 b5 3c 3d 75 7b 00 e0 bd 50 08 b8 c0 24 a4 7c 81 0b 46 4a c5 18 a8 8e f1 c3 35 fb cc 6d 6b 6a 84 31 6d 97 c8 c3 b9 95 f5 b7 41 57 eb 29 bc 8f 95 a0 ab f7 b2 39 a1 e7 a9 8a 31 88 da dd 9e 1a 8c e8 67 9a 65 9a c6 0f 6a bd 6d c9 9a a2 f2 b2 78 d4 15 55 64 e3 b9 ae 4c 55 29 6b 49 32 0c a2 09 f4 f9 7c e2 f5 03 17 34 60 76 c5 63 cd 89 59 68 c6 41 d8 5b 40 b6 44 0b 53 45 35 37 4a f3 62 e5 b9 39 7c f2 3c c9 e2 7d 8b d3 6e d1 28 5f 00 81 dd 30 04 09 4b fb cc 17 6d 56 b0 c6 4d 37 64 a6 3d a9 b0 07 66 25 31 96 59 4d 52 36 88 d2 37 4c 42 d3 d0 54 0b e3 83 47 c7 d0 14 45 75 36 14 22 0b aa 9c 16 0b d2 03 a3 fe 96 40 36 c3 5a d6 7b f1 c6 db 06 75 02 22 cb 02 f5 07 62 29 84 8a aa 29 6d 41 89 48 5d 02 50 96 83 06 75 9a 5e a2 23 25 9b 8c 8d e8 de 21 da 0b 81 50 80 56 2d a3 2b 9a 55 03 41 5b 3d 85 23 aa fc b0 4c 30 04 ad cd 7f f4 76 60 58 1b 7d f4 f0 6e 83 27 34 db 69 85 4e 8d d3 c4 f2 b2 fa 83 17 6f 53 a3 2a 35 d9 5e d2 a
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKdate: Wed, 19 Feb 2025 19:23:09 GMTserver: Apachevary: Accept-Encodingcontent-encoding: gzipcontent-length: 990content-type: text/html; charset=UTF-8connection: closeData Raw: 1f 8b 08 00 00 00 00 00 00 03 95 95 5d 73 a3 36 14 86 ef 77 26 ff 81 49 27 4d 52 4f 63 c0 76 a7 de 8d d3 59 62 f3 b5 06 1b 19 09 d0 4d 07 10 09 60 f1 11 50 6c cc 6e ff 7b ed 90 9d 49 62 5f b4 ba 01 bd d2 73 f4 0a 71 74 6e 63 96 d1 bb b3 4f b7 71 e4 93 c3 93 25 8c 46 77 7e ce 62 3f bb 09 8b ec b6 df 29 fb a1 3a ac 92 92 71 6c 57 46 93 73 16 35 ac 9f fa 1b bf 53 cf f7 13 36 7e c5 55 11 49 aa 28 64 7f d3 24 5f 73 13 ee 32 66 ac fc dc ef 07 49 f5 fc fc 74 08 d8 7f 10 6f ca b8 fc 2b 9a 80 0b 51 aa 43 36 92 a6 91 fb ed 42 94 15 0f 37 4e b1 5e 38 83 e1 f8 21 43 cf 2b 84 a7 96 38 9e 41 47 58 a2 29 9a 42 01 a3 b9 10 ef ac 14 d7 48 01 cc 4a 91 84 04 e0 91 84 2d 3d 41 ce 09 05 99 23 c7 92 a9 62 2d 98 12 b4 50 64 14 f0 a5 bd ef c3 55 6b 2a 90 1f 6f ec 8c ac c8 6c ec da 03 f2 e4 0b 48 5d d9 52 0e 52 a0 d8 b2 c4 08 a5 d2 02 c5 d3 d5 0c 3f f9 f7 ac 09 e4 c7 6d a8 8c 97 8e a3 af 1c c7 2c 4d 1e 64 06 0f 9e 82 fb 5a 58 b8 b0 f2 1c a4 98 19 96 ac 4c 13 a1 1a 6f 22 a7 16 21 2f 63 60 7f 1d 7e 13 59 4e 84 fd 5a ab f1 08 b4 c0 34 93 71 1a 66 b2 01 66 26 86 3c bf f1 a9 bc 5e 40 2a f8 b6 a9 d9 2d 6a c8 94 2c c2 5c 9a 13 a5 68 9c 8c d4 91 aa 37 01 d4 a1 01 b7 43 2b 1b 2d d0 fa b1 0a 5c bc 5c f1 b1 65 88 31 0c 55 b4 21 33 ad b2 d6 f2 73 20 7c 15 43 ba 6e b0 88 76 4e d6 6c 89 5c c6 64 80 3c c8 b3 1a c3 51 0e d4 d8 c5 70 28 22 c7 aa 4c 65 3c 47 ed e3 06 39 c0 0f 55 33 8d b2 3f 37 44 5d 8f 7c 4a 1a e2 c6 30 48 63 85 88 e3 34 10 99 1f 0c 4c 1f 3a 8d 64 f3 ba 42 a8 2c 44 54 92 57 aa 37 84 ae 9c 21 37 9e db b9 27 3a 90 30 00 4d 9f 64 d6 10 88 6c 64 a5 fa 10 38 24 b1 73 54 f8 a2 31 32 b2 11 6f 67 58 33 b3 91 13 88 cd d2 e6 35 1e c1 46 27 39 06 64 50 66 c4 89 f3 08 12 cf 74 8a dd 4a 2c eb 40 09 5b 38 28 ed 30 05 b5 a1 c8 06 54 d8 ce 72 69 ed cf 9a 27 43 d5 0b 9c b1 a5 3d 40 b1 81 e2 6d b8 26 1a 70 0f 7e b1 b7 f7 e8 44 6b 59 b4 05 c9 b6 15 53 b0 67 40 f3 5d b9 80 39 01 f3 d6 18 41 81 18 46 8e 37 e1 20 fe c3 54 b4 0a 52 2c 07 b2 e4 1a d0 a4 5e 36 6c 1d 1b 03 4f a4 da 42 2e 5b 2b 8f 35 94 e2 59 d8 ea 08 b6 32 b2 1d d4 00 ba 16 91 d8 cc f0 3d cb 30 6f ea 81 8a 06 38 43 26 81 5a 1b ae 11 0c 07 fa c8 9f 7a 8d 97 22 95 88 f2 16 0a e6 fe 4d 9f 13 84 e6 be 4c d5 c5 4c 28 61 2e b5 76 8a 17 5e ae 43 20 53 0b d9 fc c5 60 7a f9 a5 cb 9c 4d 7d 48 97 5f 37 f5 e4 b2 b7 4d 72 52 6c 6f 92 3c 8f 2a 27 21 2c e6 7a dc e5 e7 f7 ba 1a 25 8f 31 7b 85 49 07 93 37 f0 3e 2f a3 28 bf d9 1e e3 af 23 f1 db 00 35 7d 09 50 d3 8f 01 dc 53 ac f7 4a 15 dd b2 45 3d 79 38 6c e3 ec 53 f2 70 f5 81 be 9b 70 27 0c 5d 73 df df c0 ec f2 0b f7 cf 31 ec 1d c3 9d e7 93 f4 c1 4f fe aa e6 3f 1d fd 57 3f bf 5f 9d 10 7f e3 6f 84 6b ee c7 0f ee e8 83 1c 9f cf ed 91 d4 d1 df df 79 fa bf 1b fd 68 ab 53 4f fb f2 3e f8 ea fe 8f f7 c6 d4 37 fc 49 67 67 9f 5e a7 d3 22 f4 59 52 e4 37 55 54 52 3f 8c ae de 5d ec bd 4d dd 23 75 af a6 bd
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKdate: Wed, 19 Feb 2025 19:23:25 GMTserver: Apachevary: Accept-Encodingcontent-encoding: gzipcontent-length: 1202content-type: text/html; charset=UTF-8connection: closeData Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 57 5b 73 da 38 18 7d 4e 66 f2 1f 34 74 66 49 a6 5b 90 21 74 9b 04 b2 13 02 e6 92 d8 09 c6 b2 c1 2f 3b c2 12 91 6d f9 12 59 dc dc c9 7f af 0c 49 bb dd 7d d8 7d ee c4 2f d8 d2 39 fa be 23 cf 39 32 6d 26 63 7e 7d 72 dc 66 14 93 f2 57 06 92 d3 6b 9c 48 86 e3 9a 9f c6 ed fa 61 44 4d e5 be 08 32 09 e4 2e a3 9d 8a a4 5b 59 0f f1 1a 1f 46 2b 20 17 7e a7 52 0f f3 fa 32 48 9e a8 c8 44 90 c8 7a 10 2c 69 2d 0e 92 5a 98 57 ae db f5 03 f6 3f d7 52 80 35 16 40 50 12 08 ea cb bf 78 90 44 a0 03 aa 4c ca ec b2 5e 5f 04 62 b5 7a 2e 9b ab 2f 6b 19 cb fe a4 9d 1b 1a 18 e7 f8 39 86 9b 78 2a b1 cc 6f d9 3a 7e 4e ce 2f 96 e1 44 b8 dc 79 5e b8 ce 00 27 e3 d0 1f 40 cd 98 f5 b7 ae 7b d1 b2 67 6c 46 a0 f5 38 d1 b2 be 1d 5b 16 d2 9f 1a 26 b2 9a 36 1a 0b 1c 67 13 c4 bb ba c1 b3 a1 05 fd 82 f6 e7 6b 1b 59 8f 0b c4 ee 6c ae 0b 3f d6 34 ea 74 33 13 8e e0 a2 ef 08 d7 d5 62 7b 60 71 6f 30 87 73 38 2a 8c d0 bb a7 ae 97 a2 99 65 f8 ba d1 9a 86 11 74 9d b1 8e 9b 5d d5 07 1f 39 7a 86 3c 97 e5 46 0f 15 18 9a 6c aa eb 03 af e1 f5 ec 7e b4 21 9a d9 74 ec 31 a3 8e be 99 16 16 36 7b 4c 37 6f f3 96 ab 8f 3d b3 c1 f0 42 b3 a6 58 eb 5a 0f 43 ce dc 9e 71 3e 45 fc 33 4e fc ad d7 1f 6f 88 33 b6 88 de 7d 24 c1 85 49 07 13 68 6b 64 e5 cc a2 73 7b f7 45 23 3d 52 18 f6 b8 30 86 44 3a 91 de 58 70 56 78 85 3e f0 9d 6e 38 2d 94 f6 62 0e a9 bb 69 fa 3b 89 cc 19 1b 62 d4 b2 89 4d 98 d9 f4 46 46 5f 5b 21 db 09 ed c1 e6 7c aa 13 db 6e 38 1a 42 12 3b fd 51 81 a2 ad 40 05 bb 23 c3 9b 35 8d e1 ee 1e 3a a9 37 c8 6c 17 5d 64 46 68 36 ee 1b 17 03 dc bb 81 a6 e6 68 93 70 ac 59 81 dc 4c 5d 6f 35 b7 1d 6c 20 12 93 86 96 2a 9c b4 e1 38 f3 63 06 69 5f 0b cc 21 59 93 70 ec f9 d0 79 36 a7 17 11 89 1c f3 61 96 65 8b 1e 73 08 9f 6c 5d 94 c1 3b 98 65 48 9f 34 ad fe d8 75 43 f6 80 0a af 61 f6 33 ee 41 58 e0 c2 9c b8 83 74 6d 36 b9 f9 30 ec ae 0c dd ca 90 93 dd ce 35 36 bc 6b 5c 20 04 3d e6 f7 c6 de 5c 33 c5 c2 f1 1e 9d 08 ee 54 4d 66 34 46 62 12 de 08 3f f4 a4 1d 7f 69 d9 48 9b 50 97 e1 29 b7 26 13 e7 06 a2 a6 d5 74 43 85 ec 7b cf fe 60 db 43 d1 bc 75 0f cd 99 35 e0 39 ed 4d 1a 0f b3 2e 7c 70 e6 3b a7 6f 42 52 dc 40 cf f6 84 53 78 8e eb c2 73 04 c9 68 ce 49 41 23 ef 7e de f8 b2 46 cd 48 b3 a3 6d 78 57 dc 34 17 7d de fa ad 7a 75 72 7c 72 5c af 83 29 95 00 03 19 c4 34 5d 49 90 2e 41 13 42 10 07 9c 07 39 f5 d3 84 e4 40 a6 80 6e a9 bf 92 54 01 df 7c 02 82 25 90 8c 82 bf 19 10 64 22 8d 15 0b 2c 71 c0 73 b0 4c 05 c8 d3 98 2a 0a ce d3 e4 e4 78 b9 4a 7c 19 a4 89 9a e7 7c 81 fd c8 7a 5d eb f4 0c 7c 3d 39 3e da 04 09 49 37 35 9e fa b8 84 d5 04 cd 38 f6 e9 e9 4f d6 fc 58 5d 66 9d 4f 7f 54 cf 54 ff 2f a5 04 29 76 7b b6 ea 35 97 40 10 61 bf 4a e9 80 9c ca d7 87 d3 7f 96 fc bd 94 59 ae 71 54 9a 7f 99 3d be b6 de 01 fa 0f 41 e3 a9 6a 06 93 d3 af 71 9a 04 32 55 43 4f 97 65 f3 39 7d d9 53 bf d3 d4 fd 51
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKdate: Wed, 19 Feb 2025 19:23:26 GMTserver: Apachevary: Accept-Encodingcontent-encoding: gzipcontent-length: 990content-type: text/html; charset=UTF-8connection: closeData Raw: 1f 8b 08 00 00 00 00 00 00 03 95 95 5d 73 9b 38 14 86 ef 3b d3 ff e0 c9 ce 6e da f5 6c cc 87 b3 53 da b8 3b b1 0d 38 34 16 45 e8 c3 e2 66 07 2c 25 60 64 a0 46 c1 86 76 ff fb da 71 3a 93 af 8b 5d dd 30 bc d2 73 f4 8a c3 d1 b9 48 d5 5a 7e 7e fb e6 22 15 31 3f 3c 55 a6 a4 f8 1c 17 2a 8d d7 67 cb 72 7d 31 38 2a fb a9 7a b9 c9 2a d5 53 6d 25 46 27 4a ec d4 60 15 37 f1 51 3d d9 2f 68 e2 4d 6f 23 78 b6 11 4b f5 b7 cc 8a bc 37 ea 9d a6 4a 55 1f 07 83 24 db dc dd 7d 3b 04 1c dc 18 67 55 5a fd 25 46 97 b0 bd 6c f5 c5 d8 58 09 68 dd 04 be 71 a9 7d 1d 9a 43 eb 66 7d 6e 24 46 d5 12 9b 19 01 81 4e 88 6b 9d 6b 55 47 0b 07 c4 58 4f c9 6a fc 15 d8 29 c1 b9 35 9c 9b f9 56 10 90 85 1d 09 a1 56 6e 63 cd ba 13 d3 a8 8d 0b 07 83 8e 4f 18 e5 a9 70 23 cc 24 28 02 6a 69 73 7a fe 0d 9a d1 35 a0 29 5a 76 5c 13 76 b4 f3 5d eb 8a e7 3b 9b 9b 90 11 ec 31 e1 44 5f 7d 0a cc 64 4a 32 8c 80 1b ac af 74 e2 2a cc 5d 62 0a 07 cc 43 5b 9f f2 ce 31 01 f1 ee b0 49 22 e2 ea 25 59 39 5f 80 ed f8 51 e7 14 44 f7 66 70 25 0d e2 e6 43 8a 3d 17 69 51 c6 75 dc 42 6a 75 10 ef 00 36 22 15 76 50 81 56 31 9f cc bb 79 97 ef 04 05 06 33 53 83 2d 08 85 1d 38 4f 26 16 0c b1 d5 00 c7 c9 10 fe a0 41 ec 29 40 2a 5d 90 c8 87 85 fc 12 20 19 86 a6 ac 82 fc 43 13 68 f3 06 19 bb 0d 98 c9 26 b6 f3 0e cd f2 21 d6 3c 9c d0 a8 e6 38 6a ae 75 3e 0d 8a 68 17 ba 91 46 e5 78 c6 16 40 43 0b 0f 2f 27 aa 8a 73 48 31 92 f3 65 5e 4d 91 73 a9 25 6b bd f5 6d 67 c7 69 c5 10 05 63 ec de ea 02 2b ba b4 2d 7f e9 3a 6c 4e d3 6b ea c0 ab e5 14 e6 4c e6 2d 94 1e 45 8b ca 23 79 5a 26 13 35 4b 28 d7 e3 7c 57 82 35 2f 93 fd 3e f1 14 b6 60 7d 8e 50 9e 36 48 b2 61 62 7a 8b a8 88 7c e1 e0 8d 6f df 1a 61 8e b7 f1 cc db 45 85 33 4b f2 e1 d0 77 e1 35 32 cb 73 b0 18 23 32 b1 58 62 eb d5 17 9d 6f 21 55 33 80 80 03 35 8e 02 23 9d 8a 89 35 a7 94 2b 90 7d d0 13 4d 67 28 1f 76 41 be 0b c4 d4 23 73 23 f5 80 1c b3 78 e5 4c 68 51 35 b1 8c 42 b6 e6 2e d7 c7 d7 8c 5c e9 28 b3 0a 58 70 c6 d7 9a 1e 21 c7 20 18 5c 13 6a 85 68 c5 7d d4 49 0a 9c 94 24 fb fc f9 6e 5a f3 bc 32 59 01 67 4c 96 0d 33 6f 3b a6 c1 3f 23 c7 d6 a1 5e ee 02 2c d3 08 ab 69 28 89 1b d9 d2 88 f5 aa 9d 6b 81 81 dc 6a 82 74 b2 85 98 5c f1 85 b3 65 84 7f 23 ad 55 93 42 32 df 75 1a 6c 7b 76 d4 69 bf 9a d3 d3 4f c7 aa 69 ea 43 a9 fc d6 d4 a3 d3 fe 36 2b 78 b9 3d cb 8a 42 6c 68 c6 55 da eb f7 4e 3f 3e d5 67 22 bb 4d d5 03 cc 8f 30 7f 04 ef 6b 52 88 e2 6c fb 12 7f 98 49 1f 07 a8 e5 7d 80 5a 3e 0f b0 78 8d 65 0f 54 79 dc b6 ac 47 37 87 63 bc 7d 93 dd bc 7b 46 7f 1e f5 5e 31 f4 be f7 fd 11 ac 4e 3f f5 fe 79 09 b3 97 f0 d1 f3 ab f4 c1 4f f1 a0 16 3f 1d fd 57 3f 7f bc 7b 45 fc 5d 3b d3 df f7 7e fc e8 bd f8 20 2f f3 73 f1 42 3a d2 df 9f 78 fa bf 07 7d 6e eb a8 be ee 8b 3d f3 75 fc 3f 9e 1a 9b 3d e2 5f 75 f6 f6 cd c3 72 59 2e 63 95 95 c5 d9 46 54 32 5e 8a 77 4f 2e f5 7e 53 f7 79 dd af 65 bf ac

Source: global traffic	DNS traffic detected: DNS query: www.antham.com
Source: global traffic	DNS traffic detected: DNS query: andoree.com
Source: global traffic	DNS traffic detected: DNS query: cint.guard-glider.online
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: impr.guard-glider.online
Source: global traffic	DNS traffic detected: DNS query: mc.yandex.ru
Source: global traffic	DNS traffic detected: DNS query: cdn.mxpnl.com
Source: global traffic	DNS traffic detected: DNS query: 7proof.com
Source: global traffic	DNS traffic detected: DNS query: mc.yandex.com
Source: global traffic	DNS traffic detected: DNS query: api-js.mixpanel.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: dns-tunnel-check.googlezip.net
Source: global traffic	DNS traffic detected: DNS query: tunnel.googlezip.net
Source: global traffic	DNS traffic detected: DNS query: id.google.com
Source: global traffic	DNS traffic detected: DNS query: biruuq.com
Source: global traffic	DNS traffic detected: DNS query: orinks-prence.com
Source: global traffic	DNS traffic detected: DNS query: www.ne1trk.com
Source: global traffic	DNS traffic detected: DNS query: marketplace-plans.com
Source: global traffic	DNS traffic detected: DNS query: pulse.clickguard.com
Source: global traffic	DNS traffic detected: DNS query: cdn.clkmc.com
Source: global traffic	DNS traffic detected: DNS query: connect.facebook.net
Source: global traffic	DNS traffic detected: DNS query: www.clickcease.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: td.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: googleads.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: api.trustedform.com
Source: global traffic	DNS traffic detected: DNS query: cdn.trustedform.com
Source: global traffic	DNS traffic detected: DNS query: www.facebook.com
Source: global traffic	DNS traffic detected: DNS query: google.com
Source: global traffic	DNS traffic detected: DNS query: www.clkmc.com

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://www.antham.com/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Screenshots

Thumbnails

Windows Analysis Report
http://www.antham.com/