Windows Analysis Report https://pjqkh.ytimewornan.xyz

Overview

General Information

Sample URL: https://pjqkh.ytimewornan.xyz
Analysis ID: 502673
Infos:

Most interesting Screenshot:

Detection

Score: 20
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Performs DNS queries to domains with low reputation

Classification

Networking:

barindex
Performs DNS queries to domains with low reputation
Source: C:\Program Files\Google\Chrome\Application\chrome.exe DNS query: pjqkh.ytimewornan.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe DNS query: kuwaiting.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe DNS query: dweatherbe.xyz
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: pjqkh.ytimewornan.xyzConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic HTTP traffic detected: GET /service_worker.js HTTP/1.1Host: pjqkh.ytimewornan.xyzConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic HTTP traffic detected: GET /WFhHWkojejQtFS0qK3hwejAzLjorYmh1OjIpLDJkISwuNy8vNzU0KzZ2PyMwdysiKDwxOyIFPTcqLD84djI0eGZ6Kyo8aGJpa3g5NS5lYGhrdnN4ZnosJj0VMTxlYGhhaXdvfG16a3g5LToYMy5qen14KG06cWkuYGtqPyk7YWpuKz1hajssPGxqPC9ha3Ztcjo7f299eiU HTTP/1.1Host: encythan.onlineConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic HTTP traffic detected: GET /utx?tid=910565&top=pjqkh.ytimewornan.xyz&cb=22eiRgQjEUG4 HTTP/1.1Host: kuwaiting.xyzConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Origin: https://pjqkh.ytimewornan.xyzSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic HTTP traffic detected: GET /service_worker.js?b1BJUEI0cnBhclpmfHJuTXJlciBaMn9jJldjZDUhDGlkZCMKaWQxJAtkZDYnVmN4Z3oNM3FldU18a2chCzMsZiQJfShodgl9fWJ1DX0raSZdfX4zdQtpeGh3XmVwMWBDcjonYENyLScnDiQhNTANNWcoOxVyZXJzX358cm4JMSUjJ0M2KDwxCnwvMS4cNRQ HTTP/1.1Host: pjqkh.ytimewornan.xyzConnection: keep-aliveCache-Control: max-age=0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Service-Worker: scriptSec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: serviceworkerAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic HTTP traffic detected: GET /WG9jaHYDTVpZRm1ZVkpaek1PShRtDVVbEmBcTg0VO1ZOXBc9Vk4JEDxbTg4TYVxSX046DFtdQXpDQV8VPAwGXhA%2BQgJQQj5CV1pBOkIBURJqQlQLQTxWUlBDaVpaCVR0TRAfVHRNBx8TORsLDQQ6Ck0QDyJNT0pHaEFWSlo%2BDg8bE3QJAgQFPUMFCRorCj4 HTTP/1.1Host: dweatherbe.xyzConnection: keep-aliveCache-Control: max-age=0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://pjqkh.ytimewornan.xyz/service_worker.js?b1BJUEI0cnBhclpmfHJuTXJlciBaMn9jJldjZDUhDGlkZCMKaWQxJAtkZDYnVmN4Z3oNM3FldU18a2chCzMsZiQJfShodgl9fWJ1DX0raSZdfX4zdQtpeGh3XmVwMWBDcjonYENyLScnDiQhNTANNWcoOxVyZXJzX358cm4JMSUjJ0M2KDwxCnwvMS4cNRQAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic HTTP traffic detected: GET /crx/blobs/Acy1k0bLIjHsvnKaKN_oRpVaYYvFs25d7GKYF1WXrT6yizCMksBO0c_ggE0B6tx6HPRHe6q1GOEe3_NcIbSiGG8kXeLMUY0sAKVvC6R89zvKM13s5VqoAMZSmuUgjQL5vlygJuArQghXXE_qTL7NlQ/extension_8520_615_0_5.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: unknown DNS traffic detected: queries for: pjqkh.ytimewornan.xyz
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49802
Source: angular.js.0.dr String found in binary or memory: http://angularjs.org
Source: angular.js.0.dr String found in binary or memory: http://errors.angularjs.org/1.6.4-local
Source: mirroring_hangouts.js.0.dr String found in binary or memory: http://tools.ietf.org/html/rfc1950
Source: mirroring_hangouts.js.0.dr String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: mirroring_hangouts.js.0.dr String found in binary or memory: http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions
Source: mirroring_hangouts.js.0.dr String found in binary or memory: http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01
Source: c23e7eb0-bfbf-446d-971d-a1efaaccc4f9.tmp.1.dr, ecf0a112-6235-407a-bbd5-802b7cafed3d.tmp.1.dr, manifest.json0.0.dr String found in binary or memory: https://accounts.google.com
Source: craw_window.js.0.dr String found in binary or memory: https://accounts.google.com/MergeSession
Source: c23e7eb0-bfbf-446d-971d-a1efaaccc4f9.tmp.1.dr String found in binary or memory: https://android.clients.google.com
Source: c23e7eb0-bfbf-446d-971d-a1efaaccc4f9.tmp.1.dr, ecf0a112-6235-407a-bbd5-802b7cafed3d.tmp.1.dr, manifest.json0.0.dr String found in binary or memory: https://apis.google.com
Source: mirroring_common.js.0.dr String found in binary or memory: https://apis.google.com/js/client.js
Source: mirroring_common.js.0.dr String found in binary or memory: https://castedumessaging-pa.googleapis.com/v1
Source: c23e7eb0-bfbf-446d-971d-a1efaaccc4f9.tmp.1.dr, ecf0a112-6235-407a-bbd5-802b7cafed3d.tmp.1.dr String found in binary or memory: https://clients2.google.com
Source: mirroring_hangouts.js.0.dr, mirroring_cast_streaming.js.0.dr String found in binary or memory: https://clients2.google.com/cr/report
Source: manifest.json0.0.dr String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: c23e7eb0-bfbf-446d-971d-a1efaaccc4f9.tmp.1.dr, ecf0a112-6235-407a-bbd5-802b7cafed3d.tmp.1.dr String found in binary or memory: https://clients2.googleusercontent.com
Source: mirroring_hangouts.js.0.dr String found in binary or memory: https://clients6.google.com
Source: manifest.json0.0.dr String found in binary or memory: https://content.googleapis.com
Source: mirroring_cast_streaming.js.0.dr, common.js.0.dr String found in binary or memory: https://crash.corp.google.com/samples?reportid=&q=
Source: mirroring_hangouts.js.0.dr String found in binary or memory: https://creativecommons.org/publicdomain/zero/1.0/.
Source: c23e7eb0-bfbf-446d-971d-a1efaaccc4f9.tmp.1.dr, ecf0a112-6235-407a-bbd5-802b7cafed3d.tmp.1.dr, cb906797-f9ed-4538-8efd-42f0e2df3f49.tmp.1.dr, 8da93ffa-3c3f-4107-9b7b-a3d5ba8abef8.tmp.1.dr String found in binary or memory: https://dns.google
Source: mirroring_common.js.0.dr String found in binary or memory: https://docs.google.com
Source: data_1.1.dr, 4cb013792b196a35_1.0.dr String found in binary or memory: https://dweatherbe.xyz/WG9jaHYDTVpZRm1ZVkpaek1PShRtDVVbEmBcTg0VO1ZOXBc9Vk4JEDxbTg4TYVxSX046DFtdQXpDQ
Source: data_1.1.dr String found in binary or memory: https://encythan.online/WFhHWkojejQtFS0qK3hwejAzLjorYmh1OjIpLDJkISwuNy8vNzU0KzZ2PyMwdysiKDwxOyIFPTcq
Source: manifest.json0.0.dr String found in binary or memory: https://feedback.googleusercontent.com
Source: c23e7eb0-bfbf-446d-971d-a1efaaccc4f9.tmp.1.dr, ecf0a112-6235-407a-bbd5-802b7cafed3d.tmp.1.dr String found in binary or memory: https://fonts.googleapis.com
Source: manifest.json0.0.dr String found in binary or memory: https://fonts.googleapis.com;
Source: c23e7eb0-bfbf-446d-971d-a1efaaccc4f9.tmp.1.dr, ecf0a112-6235-407a-bbd5-802b7cafed3d.tmp.1.dr String found in binary or memory: https://fonts.gstatic.com
Source: manifest.json0.0.dr String found in binary or memory: https://fonts.gstatic.com;
Source: material_css_min.css.0.dr String found in binary or memory: https://github.com/angular/material
Source: craw_window.js.0.dr, craw_background.js.0.dr String found in binary or memory: https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p
Source: mirroring_hangouts.js.0.dr String found in binary or memory: https://github.com/madler/zlib/blob/master/zlib.h
Source: mirroring_hangouts.js.0.dr String found in binary or memory: https://hangouts.clients6.google.com
Source: manifest.json0.0.dr String found in binary or memory: https://hangouts.google.com/
Source: mirroring_hangouts.js.0.dr String found in binary or memory: https://hangouts.google.com/hangouts/_/logpref
Source: mirroring_common.js.0.dr String found in binary or memory: https://meet.google.com
Source: mirroring_hangouts.js.0.dr String found in binary or memory: https://meetings.clients6.google.com
Source: mirroring_common.js.0.dr String found in binary or memory: https://networktraversal.googleapis.com/v1alpha
Source: c23e7eb0-bfbf-446d-971d-a1efaaccc4f9.tmp.1.dr, ecf0a112-6235-407a-bbd5-802b7cafed3d.tmp.1.dr String found in binary or memory: https://ogs.google.com
Source: craw_window.js.0.dr, manifest.json.0.dr String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: 000003.log9.0.dr String found in binary or memory: https://pjqkh.ytimewornan.xyz
Source: QuotaManager.0.dr String found in binary or memory: https://pjqkh.ytimewornan.xyz/
Source: 000003.log6.0.dr String found in binary or memory: https://pjqkh.ytimewornan.xyz/#CC89067E-3743-4FDD-9EF0-17F518D25-V2
Source: 000003.log2.0.dr String found in binary or memory: https://pjqkh.ytimewornan.xyz/0
Source: History Provider Cache.0.dr String found in binary or memory: https://pjqkh.ytimewornan.xyz/2
Source: History.0.dr String found in binary or memory: https://pjqkh.ytimewornan.xyz/Title
Source: History.0.dr String found in binary or memory: https://pjqkh.ytimewornan.xyz/Title/
Source: data_1.1.dr String found in binary or memory: https://pjqkh.ytimewornan.xyz/service_worker.js
Source: 000003.log2.0.dr String found in binary or memory: https://pjqkh.ytimewornan.xyz/service_worker.js?b1BJUEI0cnBhclpmfHJuTXJlciBaMn9jJldjZDUhDGlkZCMKaWQx
Source: c23e7eb0-bfbf-446d-971d-a1efaaccc4f9.tmp.1.dr, ecf0a112-6235-407a-bbd5-802b7cafed3d.tmp.1.dr String found in binary or memory: https://play.google.com
Source: mirroring_hangouts.js.0.dr String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: mirroring_hangouts.js.0.dr String found in binary or memory: https://preprod-hangouts-googleapis.sandbox.google.com
Source: ecf0a112-6235-407a-bbd5-802b7cafed3d.tmp.1.dr String found in binary or memory: https://r5---sn-h0jeln7l.gvt1.com
Source: c23e7eb0-bfbf-446d-971d-a1efaaccc4f9.tmp.1.dr, ecf0a112-6235-407a-bbd5-802b7cafed3d.tmp.1.dr String found in binary or memory: https://redirector.gvt1.com
Source: craw_window.js.0.dr, manifest.json.0.dr String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: c23e7eb0-bfbf-446d-971d-a1efaaccc4f9.tmp.1.dr, ecf0a112-6235-407a-bbd5-802b7cafed3d.tmp.1.dr String found in binary or memory: https://ssl.gstatic.com
Source: messages.json41.0.dr, feedback.html.0.dr String found in binary or memory: https://support.google.com/chromecast/answer/2998456
Source: messages.json41.0.dr, feedback.html.0.dr String found in binary or memory: https://support.google.com/chromecast/troubleshooter/2995236
Source: craw_window.js.0.dr, craw_background.js.0.dr String found in binary or memory: https://www-googleapis-staging.sandbox.google.com
Source: c23e7eb0-bfbf-446d-971d-a1efaaccc4f9.tmp.1.dr, ecf0a112-6235-407a-bbd5-802b7cafed3d.tmp.1.dr, manifest.json0.0.dr String found in binary or memory: https://www.google.com
Source: manifest.json.0.dr String found in binary or memory: https://www.google.com/
Source: craw_window.js.0.dr String found in binary or memory: https://www.google.com/accounts/OAuthLogin?issueuberauth=1
Source: craw_window.js.0.dr String found in binary or memory: https://www.google.com/images/cleardot.gif
Source: craw_window.js.0.dr String found in binary or memory: https://www.google.com/images/dot2.gif
Source: craw_window.js.0.dr String found in binary or memory: https://www.google.com/images/x2.gif
Source: craw_background.js.0.dr String found in binary or memory: https://www.google.com/intl/en-US/chrome/blank.html
Source: mirroring_hangouts.js.0.dr String found in binary or memory: https://www.google.com/log?format=json&hasfast=true
Source: feedback_script.js.0.dr String found in binary or memory: https://www.google.com/tools/feedback
Source: manifest.json0.0.dr String found in binary or memory: https://www.google.com;
Source: c23e7eb0-bfbf-446d-971d-a1efaaccc4f9.tmp.1.dr, ecf0a112-6235-407a-bbd5-802b7cafed3d.tmp.1.dr, craw_window.js.0.dr, craw_background.js.0.dr String found in binary or memory: https://www.googleapis.com
Source: manifest.json.0.dr String found in binary or memory: https://www.googleapis.com/
Source: manifest.json0.0.dr String found in binary or memory: https://www.googleapis.com/auth/calendar.readonly
Source: manifest.json0.0.dr String found in binary or memory: https://www.googleapis.com/auth/cast-edu-messaging
Source: manifest.json.0.dr String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json.0.dr String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json0.0.dr String found in binary or memory: https://www.googleapis.com/auth/clouddevices
Source: manifest.json0.0.dr String found in binary or memory: https://www.googleapis.com/auth/hangouts
Source: manifest.json0.0.dr String found in binary or memory: https://www.googleapis.com/auth/hangouts.readonly
Source: manifest.json0.0.dr String found in binary or memory: https://www.googleapis.com/auth/meetings
Source: manifest.json0.0.dr String found in binary or memory: https://www.googleapis.com/auth/plus.peopleapi.readwrite
Source: manifest.json.0.dr String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json.0.dr String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: manifest.json0.0.dr String found in binary or memory: https://www.googleapis.com/auth/userinfo.email
Source: mirroring_common.js.0.dr String found in binary or memory: https://www.googleapis.com/calendar/v3
Source: mirroring_common.js.0.dr String found in binary or memory: https://www.googleapis.com/hangouts/v1
Source: c23e7eb0-bfbf-446d-971d-a1efaaccc4f9.tmp.1.dr, ecf0a112-6235-407a-bbd5-802b7cafed3d.tmp.1.dr String found in binary or memory: https://www.gstatic.com
Source: common.js.0.dr String found in binary or memory: https://www.gstatic.com/hangouts_echo_detector/release/%
Source: manifest.json0.0.dr String found in binary or memory: https://www.gstatic.com;
Source: unknown HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Local\Temp\9b9943b4-d88a-4a1a-a2f3-9babff23329a.tmp Jump to behavior
Source: QuotaManager.0.dr Binary or memory string: CREATE TABLE HostQuotaTable(host TEXT NOT NULL, type INTEGER NOT NULL, quota INTEGER DEFAULT 0, UNIQUE(host, type));
Source: classification engine Classification label: sus20.troj.win@29/245@7/11
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --start-maximized --enable-automation 'https://pjqkh.ytimewornan.xyz'
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1592,15534381744756406703,17476867209242298863,131072 --lang=en-GB --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1924 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1592,15534381744756406703,17476867209242298863,131072 --lang=en-GB --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1924 /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-6167D350-190C.pma Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 502673 URL: https://pjqkh.ytimewornan.xyz Startdate: 14/10/2021 Architecture: WINDOWS Score: 20 25 Performs DNS queries to domains with low reputation 2->25 6 chrome.exe 15 367 2->6         started        process3 dnsIp4 12 192.168.2.1 unknown unknown 6->12 14 239.255.255.250 unknown Reserved 6->14 9 chrome.exe 19 6->9         started        process5 dnsIp6 16 clients2.google.com 9->16 19 dweatherbe.xyz 44.195.137.121, 443, 49797, 49799 AMAZON-AESUS United States 9->19 21 11 other IPs or domains 9->21 signatures7 23 Performs DNS queries to domains with low reputation 16->23
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
44.195.137.121
 dweatherbe.xyz United States
14618 AMAZON-AESUS true
44.198.9.0
 encythan.online United States
14618 AMAZON-AESUS false
216.58.215.225
 googlehosted.l.googleusercontent.com United States
15169 GOOGLEUS false
142.250.203.110
 android.l.google.com United States
15169 GOOGLEUS false
172.217.168.45
 accounts.google.com United States
15169 GOOGLEUS false
173.194.69.188
 mobile-gtalk.l.google.com United States
15169 GOOGLEUS false
239.255.255.250
 unknown Reserved
unknown unknown false
44.196.246.79
 hotlightexpens.fun United States
14618 AMAZON-AESUS false
13.224.193.92
 kuwaiting.xyz United States
16509 AMAZON-02US true

Private
IP
192.168.2.1
127.0.0.1

Contacted Domains

Name IP Active
android.l.google.com 142.250.203.110 true
hotlightexpens.fun 44.196.246.79 true
accounts.google.com 172.217.168.45 true
dweatherbe.xyz 44.195.137.121 true
kuwaiting.xyz 13.224.193.92 true
clients.l.google.com 172.217.168.78 true
mobile-gtalk.l.google.com 173.194.69.188 true
googlehosted.l.googleusercontent.com 216.58.215.225 true
encythan.online 44.198.9.0 true
clients2.googleusercontent.com unknown unknown
clients2.google.com unknown unknown
pjqkh.ytimewornan.xyz unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://pjqkh.ytimewornan.xyz/service_worker.js?b1BJUEI0cnBhclpmfHJuTXJlciBaMn9jJldjZDUhDGlkZCMKaWQxJAtkZDYnVmN4Z3oNM3FldU18a2chCzMsZiQJfShodgl9fWJ1DX0raSZdfX4zdQtpeGh3XmVwMWBDcjonYENyLScnDiQhNTANNWcoOxVyZXJzX358cm4JMSUjJ0M2KDwxCnwvMS4cNRQ false
  • Avira URL Cloud: safe
 unknown
https://clients2.googleusercontent.com/crx/blobs/Acy1k0bLIjHsvnKaKN_oRpVaYYvFs25d7GKYF1WXrT6yizCMksBO0c_ggE0B6tx6HPRHe6q1GOEe3_NcIbSiGG8kXeLMUY0sAKVvC6R89zvKM13s5VqoAMZSmuUgjQL5vlygJuArQghXXE_qTL7NlQ/extension_8520_615_0_5.crx false
    		high
    https://pjqkh.ytimewornan.xyz/ false
      		unknown
      https://pjqkh.ytimewornan.xyz/service_worker.js false
      • Avira URL Cloud: safe
      		 unknown
      https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard false
        		high
        https://encythan.online/WFhHWkojejQtFS0qK3hwejAzLjorYmh1OjIpLDJkISwuNy8vNzU0KzZ2PyMwdysiKDwxOyIFPTcqLD84djI0eGZ6Kyo8aGJpa3g5NS5lYGhrdnN4ZnosJj0VMTxlYGhhaXdvfG16a3g5LToYMy5qen14KG06cWkuYGtqPyk7YWpuKz1hajssPGxqPC9ha3Ztcjo7f299eiU false
        • Avira URL Cloud: safe
        		 unknown
        https://kuwaiting.xyz/utx?tid=910565&top=pjqkh.ytimewornan.xyz&cb=22eiRgQjEUG4 false
        • Avira URL Cloud: safe
        		 unknown
        https://dweatherbe.xyz/ false
        • Avira URL Cloud: safe
        		 unknown
        https://pjqkh.ytimewornan.xyz/ true
          		unknown