Edit tour

Windows Analysis Report
quorumhealth.com.html

Overview

General Information

Sample Name:	quorumhealth.com.html
Analysis ID:	561860
MD5:	188617d6e78b37ff7c775dd9b0351cf9
SHA1:	c8b18bf4a020c6ec30bab90ba71151ea0292c58f
SHA256:	b93eb4fa7486ec7c67c26df4dda1d66aa81f8a389eabc03505d9ab1ed90e004d
Infos:

Detection

HTMLPhisher

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Phishing site detected (based on favicon image match)

Yara detected HtmlPhish45

Yara detected HtmlPhish10

Antivirus detection for URL or domain

HTML document with suspicious title

JA3 SSL client fingerprint seen in connection with other malware

Yara signature match

Suspicious form URL found

IP address seen in connection with other malware

None HTTPS page querying sensitive user data (password, username or email)

No HTML title found

Classification

Process Tree

System is w10x64

chrome.exe (PID: 6836 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "C:\Users\user\Desktop\quorumhealth.com.html MD5: C139654B5C1438A95B321BB01AD63EF6)

chrome.exe (PID: 5788 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1548,11460706794096793254,11277551737661190615,131072 --lang=en-GB --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1920 /prefetch:8 MD5: C139654B5C1438A95B321BB01AD63EF6)

cleanup

Yara Overview

Initial Sample

Source	Rule	Description	Author	Strings
quorumhealth.com.html	SUSP_obfuscated_JS_obfuscatorio	Detect JS obfuscation done by the js obfuscator (often malicious)	@imp0rtp3	0x3cf:$c8: while(!![]) 0x3ed:$d1: parseInt(_0x4ac5d7(0xde))/0x1(parseInt(_0x4ac5d7(0xd2))/0x2)+parseInt(_0x4ac5d7(0xd5))/0x3(parseInt(_0x4ac5d7(0xd0))/0x4)+-parseInt(_0x4ac5d7(0xd1))/0x5(-parseInt(_0x4ac5d7(0xdd))/0x6)+ 0x40c:$d1: parseInt(_0x4ac5d7(0xd2))/0x2)+parseInt(_0x4ac5d7(0xd5))/0x3(parseInt(_0x4ac5d7(0xd0))/0x4)+-parseInt(_0x4ac5d7(0xd1))/0x5(-parseInt(_0x4ac5d7(0xdd))/0x6)+parseInt(_0x4ac5d7(0xe2))/0x7(- 0x42b:$d1: parseInt(_0x4ac5d7(0xd5))/0x3(parseInt(_0x4ac5d7(0xd0))/0x4)+-parseInt(_0x4ac5d7(0xd1))/0x5(-parseInt(_0x4ac5d7(0xdd))/0x6)+parseInt(_0x4ac5d7(0xe2))/0x7(-parseInt(_0x4ac5d7(0xd4))/0x8)+ 0x44a:$d1: parseInt(_0x4ac5d7(0xd0))/0x4)+-parseInt(_0x4ac5d7(0xd1))/0x5(-parseInt(_0x4ac5d7(0xdd))/0x6)+parseInt(_0x4ac5d7(0xe2))/0x7(-parseInt(_0x4ac5d7(0xd4))/0x8)+parseInt(_0x4ac5d7(0xdf))/0x9(- 0x46a:$d1: parseInt(_0x4ac5d7(0xd1))/0x5(-parseInt(_0x4ac5d7(0xdd))/0x6)+parseInt(_0x4ac5d7(0xe2))/0x7(-parseInt(_0x4ac5d7(0xd4))/0x8)+parseInt(_0x4ac5d7(0xdf))/0x9(-parseInt(_0x4ac5d7(0xcd))/0xa)+- 0x48a:$d1: parseInt(_0x4ac5d7(0xdd))/0x6)+parseInt(_0x4ac5d7(0xe2))/0x7(-parseInt(_0x4ac5d7(0xd4))/0x8)+parseInt(_0x4ac5d7(0xdf))/0x9(-parseInt(_0x4ac5d7(0xcd))/0xa)+-parseInt(_0x4ac5d7(0xd6))/0xb(- 0x4a9:$d1: parseInt(_0x4ac5d7(0xe2))/0x7(-parseInt(_0x4ac5d7(0xd4))/0x8)+parseInt(_0x4ac5d7(0xdf))/0x9(-parseInt(_0x4ac5d7(0xcd))/0xa)+-parseInt(_0x4ac5d7(0xd6))/0xb(-parseInt(_0x4ac5d7(0xce))/0xc)+- 0x4c9:$d1: parseInt(_0x4ac5d7(0xd4))/0x8)+parseInt(_0x4ac5d7(0xdf))/0x9(-parseInt(_0x4ac5d7(0xcd))/0xa)+-parseInt(_0x4ac5d7(0xd6))/0xb(-parseInt(_0x4ac5d7(0xce))/0xc)+-parseInt(_0x4ac5d7(0xd9))/0xd(
quorumhealth.com.html	JoeSecurity_HtmlPhish_45	Yara detected HtmlPhish_45	Joe Security

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8

Source: unknown

HTTPS traffic detected: 192.229.221.185:443 -> 192.168.2.4:49806 version: TLS 1.2

System Summary

HTML document with suspicious title

Source: file:///C:/Users/user/Desktop/quorumhealth.com.html

Tab title: Sign in to your Microsoft account

Source: quorumhealth.com.html, type: SAMPLE

Matched rule: SUSP_obfuscated_JS_obfuscatorio date = 2021-08-25, author = @imp0rtp3, description = Detect JS obfuscation done by the js obfuscator (often malicious), reference = https://obfuscator.io, score =

Source: https://eduline.edu.pe/modules/mod_custom/tmpl/v5.0/___.php?_do=layout&email=adam_loris@quorumhealth.com	Avira URL Cloud: Label: phishing
Source: https://eduline.edu.pe/modules/mod_custom/tmpl/v5.0/	Avira URL Cloud: Label: phishing

Source: file:///C:/Users/user/Desktop/quorumhealth.com.html	HTTP Parser: Form action: https://eduline.edu.pe/modules/mod_custom/tmpl/v5.0/___.php?_do=form1
Source: file:///C:/Users/user/Desktop/quorumhealth.com.html	HTTP Parser: Form action: https://eduline.edu.pe/modules/mod_custom/tmpl/v5.0/___.php?_do=form1

Source: file:///C:/Users/user/Desktop/quorumhealth.com.html	HTTP Parser: Has password / email / username input fields
Source: file:///C:/Users/user/Desktop/quorumhealth.com.html	HTTP Parser: Has password / email / username input fields

Source: file:///C:/Users/user/Desktop/quorumhealth.com.html	HTTP Parser: HTML title missing
Source: file:///C:/Users/user/Desktop/quorumhealth.com.html	HTTP Parser: HTML title missing

Source: file:///C:/Users/user/Desktop/quorumhealth.com.html	HTTP Parser: No <meta name="author".. found
Source: file:///C:/Users/user/Desktop/quorumhealth.com.html	HTTP Parser: No <meta name="author".. found

Source: file:///C:/Users/user/Desktop/quorumhealth.com.html	HTTP Parser: No <meta name="copyright".. found
Source: file:///C:/Users/user/Desktop/quorumhealth.com.html	HTTP Parser: No <meta name="copyright".. found

Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox View	IP Address: 192.229.221.185 192.229.221.185
Source: Joe Sandbox View	IP Address: 104.16.18.94 104.16.18.94
Source: Joe Sandbox View	IP Address: 104.16.18.94 104.16.18.94

Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-GB&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfmX-Goog-Update-Updater: chromecrx-85.0.4183.121Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /ajax/libs/jquery/1.9.1/jquery.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /16.000.29158.8/images/favicon.ico HTTP/1.1Host: logincdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /crx/blobs/Acy1k0bLIjHsvnKaKN_oRpVaYYvFs25d7GKYF1WXrT6yizCMksBO0c_ggE0B6tx6HPRHe6q1GOEe3_NcIbSiGG8kXeLMUY0sAKVvC6R89zvKM13s5VqoAMZSmuUgjQL5vlygJuArQghXXE_qTL7NlQ/extension_8520_615_0_5.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /16.000/Converged_v21033__M8MTZS7Nv0I1zR18wdR-g2.css HTTP/1.1Host: logincdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/documentation_bcb4d1dc4eae64f0b2b2538209d8435a.svg HTTP/1.1Host: logincdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg HTTP/1.1Host: logincdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/signin-options_4e48046ce74f4b89d45037c90576bfac.svg HTTP/1.1Host: logincdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /16.000.29158.8/images/favicon.ico HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: logincdn.msauth.net
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/documentation_bcb4d1dc4eae64f0b2b2538209d8435a.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: logincdn.msauth.net
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: logincdn.msauth.net
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/signin-options_4e48046ce74f4b89d45037c90576bfac.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: logincdn.msauth.net

Source: Ruleset Data.0.dr	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: Filtering Rules.0.dr, Ruleset Data.0.dr	String found in binary or memory: www.facebook.com/ajax/ads/ equals www.facebook.com (Facebook)
Source: Filtering Rules.0.dr	String found in binary or memory: www.facebook.com0 equals www.facebook.com (Facebook)

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "C:\Users\user\Desktop\quorumhealth.com.html
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1548,11460706794096793254,11277551737661190615,131072 --lang=en-GB --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1920 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1548,11460706794096793254,11277551737661190615,131072 --lang=en-GB --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1920 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	3 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	4 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	1 Ingress Tool Transfer	SIM Card Swap		Carrier Billing Fraud

Source	Detection	Scanner	Link
C:\Users\user\AppData\Local\Temp\6836_1384044869\_platform_specific\x86_64\pnacl_public_x86_64_ld_nexe	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\6836_1384044869\_platform_specific\x86_64\pnacl_public_x86_64_ld_nexe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\6836_1384044869\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_llc_nexe	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\6836_1384044869\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_llc_nexe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\6836_1384044869\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_sz_nexe	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\6836_1384044869\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_sz_nexe	0%	ReversingLabs

Source	Detection	Scanner	Link
eduline.edu.pe	3%	Virustotal	Browse
cs1227.wpc.alphacdn.net	0%	Virustotal	Browse
logincdn.msauth.net	0%	Virustotal	Browse
aadcdn.msftauthimages.net	0%	Virustotal	Browse

Source: angular.js.0.dr	String found in binary or memory: http://angularjs.org
Source: angular.js.0.dr	String found in binary or memory: http://errors.angularjs.org/1.6.4-local
Source: pnacl_public_x86_64_pnacl_sz_nexe.0.dr, pnacl_public_x86_64_pnacl_llc_nexe.0.dr	String found in binary or memory: http://llvm.org/):
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: http://tools.ietf.org/html/rfc1950
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01
Source: Reporting and NEL.1.dr	String found in binary or memory: https://a.nel.cloudflare.com/report/v3?s=CTeGcIoJzMkUutnm%2FEVUBmeeJawqjDLqPMaT0JQ1IvZUO6NqC%2B%2B0D
Source: data_1.1.dr	String found in binary or memory: https://aadcdn.msftauthimages.net/dbd5a2dd-l51w515fm0vhm-1ewvpslggo5ghipcicraonllbhlqo/logintenantbr
Source: 2d741294-a9ae-4fe9-ab32-4af12d56837a.tmp.1.dr, 22c87cc8-765a-4ee8-b084-39d2ebdd93a2.tmp.1.dr, fa11d5bf-f2d2-45da-943c-5b782f3d3ee5.tmp.1.dr, manifest.json2.0.dr	String found in binary or memory: https://accounts.google.com
Source: craw_window.js.0.dr	String found in binary or memory: https://accounts.google.com/MergeSession
Source: 2d741294-a9ae-4fe9-ab32-4af12d56837a.tmp.1.dr, 22c87cc8-765a-4ee8-b084-39d2ebdd93a2.tmp.1.dr, fa11d5bf-f2d2-45da-943c-5b782f3d3ee5.tmp.1.dr, manifest.json2.0.dr	String found in binary or memory: https://apis.google.com
Source: mirroring_common.js.0.dr	String found in binary or memory: https://apis.google.com/js/client.js
Source: mirroring_common.js.0.dr	String found in binary or memory: https://castedumessaging-pa.googleapis.com/v1
Source: data_1.1.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.9.1/jquery.min.js
Source: pnacl_public_x86_64_libpnacl_irt_shim_dummy_a.0.dr	String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-clang.git
Source: pnacl_public_x86_64_libpnacl_irt_shim_dummy_a.0.dr	String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-llvm.git
Source: 2d741294-a9ae-4fe9-ab32-4af12d56837a.tmp.1.dr, 22c87cc8-765a-4ee8-b084-39d2ebdd93a2.tmp.1.dr, fa11d5bf-f2d2-45da-943c-5b782f3d3ee5.tmp.1.dr	String found in binary or memory: https://clients2.google.com
Source: mirroring_hangouts.js.0.dr, mirroring_cast_streaming.js.0.dr	String found in binary or memory: https://clients2.google.com/cr/report
Source: manifest.json0.0.dr, manifest.json.0.dr, manifest.json2.0.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 2d741294-a9ae-4fe9-ab32-4af12d56837a.tmp.1.dr, 22c87cc8-765a-4ee8-b084-39d2ebdd93a2.tmp.1.dr, fa11d5bf-f2d2-45da-943c-5b782f3d3ee5.tmp.1.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://clients6.google.com
Source: pnacl_public_x86_64_ld_nexe.0.dr	String found in binary or memory: https://code.google.com/p/nativeclient/issues/entry
Source: pnacl_public_x86_64_ld_nexe.0.dr	String found in binary or memory: https://code.google.com/p/nativeclient/issues/entry%s:
Source: manifest.json2.0.dr	String found in binary or memory: https://content.googleapis.com
Source: mirroring_cast_streaming.js.0.dr, common.js.0.dr	String found in binary or memory: https://crash.corp.google.com/samples?reportid=&q=
Source: LICENSE.txt.0.dr	String found in binary or memory: https://creativecommons.org/.
Source: LICENSE.txt.0.dr	String found in binary or memory: https://creativecommons.org/compatiblelicenses
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://creativecommons.org/publicdomain/zero/1.0/.
Source: Reporting and NEL.1.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/IdentityListAccountsHttp/external
Source: 2d741294-a9ae-4fe9-ab32-4af12d56837a.tmp.1.dr, c2d56e23-e61f-4c2e-b13d-97928d24a0ca.tmp.1.dr, 22c87cc8-765a-4ee8-b084-39d2ebdd93a2.tmp.1.dr, 37aa23bb-4661-4142-ae95-e8898203ad0b.tmp.1.dr, fa11d5bf-f2d2-45da-943c-5b782f3d3ee5.tmp.1.dr	String found in binary or memory: https://dns.google
Source: mirroring_common.js.0.dr	String found in binary or memory: https://docs.google.com
Source: LICENSE.txt.0.dr	String found in binary or memory: https://easylist.to/)
Source: quorumhealth.com.html	String found in binary or memory: https://eduline.edu.pe/modules/mod_custom/tmpl/v5.0/
Source: manifest.json2.0.dr	String found in binary or memory: https://feedback.googleusercontent.com
Source: 2d741294-a9ae-4fe9-ab32-4af12d56837a.tmp.1.dr, 22c87cc8-765a-4ee8-b084-39d2ebdd93a2.tmp.1.dr, fa11d5bf-f2d2-45da-943c-5b782f3d3ee5.tmp.1.dr	String found in binary or memory: https://fonts.googleapis.com
Source: manifest.json2.0.dr	String found in binary or memory: https://fonts.googleapis.com;
Source: 2d741294-a9ae-4fe9-ab32-4af12d56837a.tmp.1.dr, 22c87cc8-765a-4ee8-b084-39d2ebdd93a2.tmp.1.dr, fa11d5bf-f2d2-45da-943c-5b782f3d3ee5.tmp.1.dr	String found in binary or memory: https://fonts.gstatic.com
Source: manifest.json2.0.dr	String found in binary or memory: https://fonts.gstatic.com;
Source: material_css_min.css.0.dr, angular.js.0.dr	String found in binary or memory: https://github.com/angular/material
Source: LICENSE.txt.0.dr	String found in binary or memory: https://github.com/easylist)
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://github.com/madler/zlib/blob/master/zlib.h
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://hangouts.clients6.google.com
Source: manifest.json2.0.dr	String found in binary or memory: https://hangouts.google.com/
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://hangouts.google.com/hangouts/_/logpref
Source: quorumhealth.com.html, data_1.1.dr, Favicons.0.dr	String found in binary or memory: https://logincdn.msauth.net/16.000.29158.8/images/favicon.ico
Source: data_1.1.dr	String found in binary or memory: https://logincdn.msauth.net/16.000/Converged_v21033__M8MTZS7Nv0I1zR18wdR-g2.css
Source: data_1.1.dr	String found in binary or memory: https://logincdn.msauth.net/shared/1.0/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.sv
Source: data_1.1.dr	String found in binary or memory: https://logincdn.msauth.net/shared/1.0/content/images/documentation_bcb4d1dc4eae64f0b2b2538209d8435a
Source: data_1.1.dr	String found in binary or memory: https://logincdn.msauth.net/shared/1.0/content/images/signin-options_4e48046ce74f4b89d45037c90576bfa
Source: mirroring_common.js.0.dr	String found in binary or memory: https://meet.google.com
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://meetings.clients6.google.com
Source: mirroring_common.js.0.dr	String found in binary or memory: https://networktraversal.googleapis.com/v1alpha
Source: 2d741294-a9ae-4fe9-ab32-4af12d56837a.tmp.1.dr, 22c87cc8-765a-4ee8-b084-39d2ebdd93a2.tmp.1.dr, fa11d5bf-f2d2-45da-943c-5b782f3d3ee5.tmp.1.dr	String found in binary or memory: https://ogs.google.com
Source: craw_window.js.0.dr, manifest.json.0.dr	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: 2d741294-a9ae-4fe9-ab32-4af12d56837a.tmp.1.dr, 22c87cc8-765a-4ee8-b084-39d2ebdd93a2.tmp.1.dr, fa11d5bf-f2d2-45da-943c-5b782f3d3ee5.tmp.1.dr	String found in binary or memory: https://play.google.com
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://preprod-hangouts-googleapis.sandbox.google.com
Source: 22c87cc8-765a-4ee8-b084-39d2ebdd93a2.tmp.1.dr	String found in binary or memory: https://r5---sn-h0jeln7l.gvt1.com
Source: 2d741294-a9ae-4fe9-ab32-4af12d56837a.tmp.1.dr, 22c87cc8-765a-4ee8-b084-39d2ebdd93a2.tmp.1.dr, fa11d5bf-f2d2-45da-943c-5b782f3d3ee5.tmp.1.dr	String found in binary or memory: https://redirector.gvt1.com
Source: craw_window.js.0.dr, manifest.json.0.dr	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: 2d741294-a9ae-4fe9-ab32-4af12d56837a.tmp.1.dr, 22c87cc8-765a-4ee8-b084-39d2ebdd93a2.tmp.1.dr, fa11d5bf-f2d2-45da-943c-5b782f3d3ee5.tmp.1.dr	String found in binary or memory: https://ssl.gstatic.com
Source: messages.json66.0.dr, messages.json5.0.dr, messages.json7.0.dr, messages.json37.0.dr, messages.json49.0.dr, feedback.html.0.dr, messages.json69.0.dr, messages.json71.0.dr, messages.json83.0.dr, messages.json82.0.dr, messages.json54.0.dr, messages.json46.0.dr, messages.json70.0.dr, messages.json39.0.dr, messages.json35.0.dr, messages.json0.0.dr, messages.json48.0.dr, messages.json85.0.dr, messages.json88.0.dr, messages.json87.0.dr, messages.json18.0.dr	String found in binary or memory: https://support.google.com/chromecast/answer/2998456
Source: messages.json66.0.dr, messages.json5.0.dr, messages.json7.0.dr, messages.json37.0.dr, messages.json49.0.dr, feedback.html.0.dr, messages.json69.0.dr, messages.json71.0.dr, messages.json83.0.dr, messages.json82.0.dr, messages.json54.0.dr, messages.json46.0.dr, messages.json70.0.dr, messages.json39.0.dr, messages.json35.0.dr, messages.json0.0.dr, messages.json48.0.dr, messages.json85.0.dr, messages.json88.0.dr, messages.json87.0.dr, messages.json18.0.dr	String found in binary or memory: https://support.google.com/chromecast/troubleshooter/2995236
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://www-googleapis-staging.sandbox.google.com
Source: 2d741294-a9ae-4fe9-ab32-4af12d56837a.tmp.1.dr, 22c87cc8-765a-4ee8-b084-39d2ebdd93a2.tmp.1.dr, fa11d5bf-f2d2-45da-943c-5b782f3d3ee5.tmp.1.dr, manifest.json2.0.dr	String found in binary or memory: https://www.google.com
Source: manifest.json.0.dr	String found in binary or memory: https://www.google.com/
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/accounts/OAuthLogin?issueuberauth=1
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/cleardot.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/dot2.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/x2.gif
Source: craw_background.js.0.dr	String found in binary or memory: https://www.google.com/intl/en-US/chrome/blank.html
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://www.google.com/log?format=json&hasfast=true
Source: feedback_script.js.0.dr	String found in binary or memory: https://www.google.com/tools/feedback
Source: manifest.json2.0.dr	String found in binary or memory: https://www.google.com;
Source: 2d741294-a9ae-4fe9-ab32-4af12d56837a.tmp.1.dr, craw_window.js.0.dr, craw_background.js.0.dr, 22c87cc8-765a-4ee8-b084-39d2ebdd93a2.tmp.1.dr, fa11d5bf-f2d2-45da-943c-5b782f3d3ee5.tmp.1.dr	String found in binary or memory: https://www.googleapis.com
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/
Source: manifest.json2.0.dr	String found in binary or memory: https://www.googleapis.com/auth/calendar.readonly
Source: manifest.json2.0.dr	String found in binary or memory: https://www.googleapis.com/auth/cast-edu-messaging
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json2.0.dr	String found in binary or memory: https://www.googleapis.com/auth/clouddevices
Source: manifest.json2.0.dr	String found in binary or memory: https://www.googleapis.com/auth/hangouts
Source: manifest.json2.0.dr	String found in binary or memory: https://www.googleapis.com/auth/hangouts.readonly
Source: manifest.json2.0.dr	String found in binary or memory: https://www.googleapis.com/auth/meetings
Source: manifest.json2.0.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.peopleapi.readwrite
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: manifest.json2.0.dr	String found in binary or memory: https://www.googleapis.com/auth/userinfo.email
Source: mirroring_common.js.0.dr	String found in binary or memory: https://www.googleapis.com/calendar/v3
Source: mirroring_common.js.0.dr	String found in binary or memory: https://www.googleapis.com/hangouts/v1
Source: 2d741294-a9ae-4fe9-ab32-4af12d56837a.tmp.1.dr, 22c87cc8-765a-4ee8-b084-39d2ebdd93a2.tmp.1.dr, fa11d5bf-f2d2-45da-943c-5b782f3d3ee5.tmp.1.dr	String found in binary or memory: https://www.gstatic.com
Source: common.js.0.dr	String found in binary or memory: https://www.gstatic.com/hangouts_echo_detector/release/%
Source: manifest.json2.0.dr	String found in binary or memory: https://www.gstatic.com;

Source	Detection	Scanner	Label
https://logincdn.msauth.net/shared/1.0/content/images/signin-options_4e48046ce74f4b89d45037c90576bfa	0%	Avira URL Cloud	safe
https://logincdn.msauth.net/16.000/Converged_v21033__M8MTZS7Nv0I1zR18wdR-g2.css	0%	Avira URL Cloud	safe
https://logincdn.msauth.net/shared/1.0/content/images/signin-options_4e48046ce74f4b89d45037c90576bfac.svg	0%	Avira URL Cloud	safe
https://eduline.edu.pe/modules/mod_custom/tmpl/v5.0/___.php?_do=layout&email=adam_loris@quorumhealth.com	100%	Avira URL Cloud	phishing
https://logincdn.msauth.net/shared/1.0/content/images/documentation_bcb4d1dc4eae64f0b2b2538209d8435a	0%	Avira URL Cloud	safe
https://logincdn.msauth.net/shared/1.0/content/images/documentation_bcb4d1dc4eae64f0b2b2538209d8435a.svg	0%	Avira URL Cloud	safe
https://dns.google	0%	URL Reputation	safe
https://logincdn.msauth.net/shared/1.0/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.sv	0%	Avira URL Cloud	safe
https://logincdn.msauth.net/16.000.29158.8/images/favicon.ico	0%	Avira URL Cloud	safe
https://www.google.com;	0%	Avira URL Cloud	safe
https://aadcdn.msftauthimages.net/dbd5a2dd-l51w515fm0vhm-1ewvpslggo5ghipcicraonllbhlqo/logintenantbr	0%	Avira URL Cloud	safe
https://logincdn.msauth.net/shared/1.0/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg	0%	Avira URL Cloud	safe
https://eduline.edu.pe/modules/mod_custom/tmpl/v5.0/	100%	Avira URL Cloud	phishing
https://csp.withgoogle.com/csp/report-to/IdentityListAccountsHttp/external	0%	URL Reputation	safe

Name	IP	Active	Malicious	Antivirus Detection	Reputation
accounts.google.com	172.217.16.141	true	false		high
cdnjs.cloudflare.com	104.16.18.94	true	false		high
eduline.edu.pe	192.185.149.73	true	false	3%, Virustotal, Browse	unknown
cs1227.wpc.alphacdn.net	192.229.221.185	true	false	0%, Virustotal, Browse	unknown
clients.l.google.com	142.250.185.78	true	false		high
googlehosted.l.googleusercontent.com	142.250.185.65	true	false		high
logincdn.msauth.net	unknown	unknown	false	0%, Virustotal, Browse	unknown
clients2.googleusercontent.com	unknown	unknown	false		high
clients2.google.com	unknown	unknown	false		high
aadcdn.msftauthimages.net	unknown	unknown	false	0%, Virustotal, Browse	unknown

Name	Malicious	Antivirus Detection	Reputation
https://logincdn.msauth.net/16.000/Converged_v21033__M8MTZS7Nv0I1zR18wdR-g2.css	false	Avira URL Cloud: safe	unknown
file:///C:/Users/user/Desktop/quorumhealth.com.html	true		low
https://logincdn.msauth.net/shared/1.0/content/images/signin-options_4e48046ce74f4b89d45037c90576bfac.svg	false	Avira URL Cloud: safe	unknown
https://clients2.googleusercontent.com/crx/blobs/Acy1k0bLIjHsvnKaKN_oRpVaYYvFs25d7GKYF1WXrT6yizCMksBO0c_ggE0B6tx6HPRHe6q1GOEe3_NcIbSiGG8kXeLMUY0sAKVvC6R89zvKM13s5VqoAMZSmuUgjQL5vlygJuArQghXXE_qTL7NlQ/extension_8520_615_0_5.crx	false		high
https://eduline.edu.pe/modules/mod_custom/tmpl/v5.0/___.php?_do=layout&email=adam_loris@quorumhealth.com	true	Avira URL Cloud: phishing	unknown
https://cdnjs.cloudflare.com/ajax/libs/jquery/1.9.1/jquery.min.js	false		high
https://logincdn.msauth.net/shared/1.0/content/images/documentation_bcb4d1dc4eae64f0b2b2538209d8435a.svg	false	Avira URL Cloud: safe	unknown
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false		high
https://logincdn.msauth.net/16.000.29158.8/images/favicon.ico	false	Avira URL Cloud: safe	unknown
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-GB&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1	false		high
https://logincdn.msauth.net/shared/1.0/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg	false	Avira URL Cloud: safe	unknown

Name	Source	Malicious	Antivirus Detection	Reputation
https://logincdn.msauth.net/shared/1.0/content/images/signin-options_4e48046ce74f4b89d45037c90576bfa	data_1.1.dr	false	Avira URL Cloud: safe	unknown
https://apis.google.com/js/client.js	mirroring_common.js.0.dr	false		high
https://www.google.com/images/cleardot.gif	craw_window.js.0.dr	false		high
https://play.google.com	2d741294-a9ae-4fe9-ab32-4af12d56837a.tmp.1.dr, 22c87cc8-765a-4ee8-b084-39d2ebdd93a2.tmp.1.dr, fa11d5bf-f2d2-45da-943c-5b782f3d3ee5.tmp.1.dr	false		high
https://crash.corp.google.com/samples?reportid=&q=	mirroring_cast_streaming.js.0.dr, common.js.0.dr	false		high
https://www.google.com/log?format=json&hasfast=true	mirroring_hangouts.js.0.dr	false		high
https://easylist.to/)	LICENSE.txt.0.dr	false		high
https://sandbox.google.com/payments/v4/js/integrator.js	craw_window.js.0.dr, manifest.json.0.dr	false		high
http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01	mirroring_hangouts.js.0.dr	false		high
https://accounts.google.com/MergeSession	craw_window.js.0.dr	false		high
https://creativecommons.org/compatiblelicenses	LICENSE.txt.0.dr	false		high
https://preprod-hangouts-googleapis.sandbox.google.com	mirroring_hangouts.js.0.dr	false		high
https://www.google.com	2d741294-a9ae-4fe9-ab32-4af12d56837a.tmp.1.dr, 22c87cc8-765a-4ee8-b084-39d2ebdd93a2.tmp.1.dr, fa11d5bf-f2d2-45da-943c-5b782f3d3ee5.tmp.1.dr, manifest.json2.0.dr	false		high
https://github.com/easylist)	LICENSE.txt.0.dr	false		high
https://creativecommons.org/.	LICENSE.txt.0.dr	false		high
https://hangouts.clients6.google.com	mirroring_hangouts.js.0.dr	false		high
https://meet.google.com	mirroring_common.js.0.dr	false		high
https://logincdn.msauth.net/shared/1.0/content/images/documentation_bcb4d1dc4eae64f0b2b2538209d8435a	data_1.1.dr	false	Avira URL Cloud: safe	unknown
https://hangouts.google.com/hangouts/_/logpref	mirroring_hangouts.js.0.dr	false		high
https://accounts.google.com	2d741294-a9ae-4fe9-ab32-4af12d56837a.tmp.1.dr, 22c87cc8-765a-4ee8-b084-39d2ebdd93a2.tmp.1.dr, fa11d5bf-f2d2-45da-943c-5b782f3d3ee5.tmp.1.dr, manifest.json2.0.dr	false		high
https://clients2.google.com/cr/report	mirroring_hangouts.js.0.dr, mirroring_cast_streaming.js.0.dr	false		high
http://angularjs.org	angular.js.0.dr	false		high
https://a.nel.cloudflare.com/report/v3?s=CTeGcIoJzMkUutnm%2FEVUBmeeJawqjDLqPMaT0JQ1IvZUO6NqC%2B%2B0D	Reporting and NEL.1.dr	false		high
https://creativecommons.org/publicdomain/zero/1.0/.	mirroring_hangouts.js.0.dr	false		high
https://github.com/angular/material	material_css_min.css.0.dr, angular.js.0.dr	false		high
https://apis.google.com	2d741294-a9ae-4fe9-ab32-4af12d56837a.tmp.1.dr, 22c87cc8-765a-4ee8-b084-39d2ebdd93a2.tmp.1.dr, fa11d5bf-f2d2-45da-943c-5b782f3d3ee5.tmp.1.dr, manifest.json2.0.dr	false		high
https://www.google.com/accounts/OAuthLogin?issueuberauth=1	craw_window.js.0.dr	false		high
https://github.com/madler/zlib/blob/master/zlib.h	mirroring_hangouts.js.0.dr	false		high
https://www-googleapis-staging.sandbox.google.com	craw_window.js.0.dr, craw_background.js.0.dr	false		high
https://clients2.google.com	2d741294-a9ae-4fe9-ab32-4af12d56837a.tmp.1.dr, 22c87cc8-765a-4ee8-b084-39d2ebdd93a2.tmp.1.dr, fa11d5bf-f2d2-45da-943c-5b782f3d3ee5.tmp.1.dr	false		high
https://www.google.com/tools/feedback	feedback_script.js.0.dr	false		high
http://www.apache.org/licenses/LICENSE-2.0	mirroring_hangouts.js.0.dr	false		high
https://dns.google	2d741294-a9ae-4fe9-ab32-4af12d56837a.tmp.1.dr, c2d56e23-e61f-4c2e-b13d-97928d24a0ca.tmp.1.dr, 22c87cc8-765a-4ee8-b084-39d2ebdd93a2.tmp.1.dr, 37aa23bb-4661-4142-ae95-e8898203ad0b.tmp.1.dr, fa11d5bf-f2d2-45da-943c-5b782f3d3ee5.tmp.1.dr	false	URL Reputation: safe	unknown
https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p	craw_window.js.0.dr, craw_background.js.0.dr	false		high
https://www.google.com/intl/en-US/chrome/blank.html	craw_background.js.0.dr	false		high
https://ogs.google.com	2d741294-a9ae-4fe9-ab32-4af12d56837a.tmp.1.dr, 22c87cc8-765a-4ee8-b084-39d2ebdd93a2.tmp.1.dr, fa11d5bf-f2d2-45da-943c-5b782f3d3ee5.tmp.1.dr	false		high
https://support.google.com/chromecast/troubleshooter/2995236	messages.json66.0.dr, messages.json5.0.dr, messages.json7.0.dr, messages.json37.0.dr, messages.json49.0.dr, feedback.html.0.dr, messages.json69.0.dr, messages.json71.0.dr, messages.json83.0.dr, messages.json82.0.dr, messages.json54.0.dr, messages.json46.0.dr, messages.json70.0.dr, messages.json39.0.dr, messages.json35.0.dr, messages.json0.0.dr, messages.json48.0.dr, messages.json85.0.dr, messages.json88.0.dr, messages.json87.0.dr, messages.json18.0.dr	false		high
http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions	mirroring_hangouts.js.0.dr	false		high
https://logincdn.msauth.net/shared/1.0/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.sv	data_1.1.dr	false	Avira URL Cloud: safe	unknown
https://payments.google.com/payments/v4/js/integrator.js	craw_window.js.0.dr, manifest.json.0.dr	false		high
https://www.google.com;	manifest.json2.0.dr	false	Avira URL Cloud: safe	low
https://chromium.googlesource.com/a/native_client/pnacl-llvm.git	pnacl_public_x86_64_libpnacl_irt_shim_dummy_a.0.dr	false		high
https://hangouts.google.com/	manifest.json2.0.dr	false		high
https://www.google.com/images/x2.gif	craw_window.js.0.dr	false		high
https://aadcdn.msftauthimages.net/dbd5a2dd-l51w515fm0vhm-1ewvpslggo5ghipcicraonllbhlqo/logintenantbr	data_1.1.dr	false	Avira URL Cloud: safe	unknown
http://llvm.org/):	pnacl_public_x86_64_pnacl_sz_nexe.0.dr, pnacl_public_x86_64_pnacl_llc_nexe.0.dr	false		high
https://www.google.com/images/dot2.gif	craw_window.js.0.dr	false		high
https://meetings.clients6.google.com	mirroring_hangouts.js.0.dr	false		high
https://play.google.com/log?format=json&hasfast=true	mirroring_hangouts.js.0.dr	false		high
https://code.google.com/p/nativeclient/issues/entry%s:	pnacl_public_x86_64_ld_nexe.0.dr	false		high
http://tools.ietf.org/html/rfc1950	mirroring_hangouts.js.0.dr	false		high
https://eduline.edu.pe/modules/mod_custom/tmpl/v5.0/	quorumhealth.com.html	true	Avira URL Cloud: phishing	unknown
https://code.google.com/p/nativeclient/issues/entry	pnacl_public_x86_64_ld_nexe.0.dr	false		high
https://support.google.com/chromecast/answer/2998456	messages.json66.0.dr, messages.json5.0.dr, messages.json7.0.dr, messages.json37.0.dr, messages.json49.0.dr, feedback.html.0.dr, messages.json69.0.dr, messages.json71.0.dr, messages.json83.0.dr, messages.json82.0.dr, messages.json54.0.dr, messages.json46.0.dr, messages.json70.0.dr, messages.json39.0.dr, messages.json35.0.dr, messages.json0.0.dr, messages.json48.0.dr, messages.json85.0.dr, messages.json88.0.dr, messages.json87.0.dr, messages.json18.0.dr	false		high
https://clients2.googleusercontent.com	2d741294-a9ae-4fe9-ab32-4af12d56837a.tmp.1.dr, 22c87cc8-765a-4ee8-b084-39d2ebdd93a2.tmp.1.dr, fa11d5bf-f2d2-45da-943c-5b782f3d3ee5.tmp.1.dr	false		high
https://csp.withgoogle.com/csp/report-to/IdentityListAccountsHttp/external	Reporting and NEL.1.dr	false	URL Reputation: safe	unknown
https://docs.google.com	mirroring_common.js.0.dr	false		high
https://www.google.com/	manifest.json.0.dr	false		high
https://feedback.googleusercontent.com	manifest.json2.0.dr	false		high
https://chromium.googlesource.com/a/native_client/pnacl-clang.git	pnacl_public_x86_64_libpnacl_irt_shim_dummy_a.0.dr	false		high
https://clients2.google.com/service/update2/crx	manifest.json0.0.dr, manifest.json.0.dr, manifest.json2.0.dr	false		high
https://clients6.google.com	mirroring_hangouts.js.0.dr	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.185.78	clients.l.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
192.229.221.185	cs1227.wpc.alphacdn.net	United States	15133	EDGECASTUS	false
192.185.149.73	eduline.edu.pe	United States	46606	UNIFIEDLAYER-AS-1US	false
104.16.18.94	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
172.217.16.141	accounts.google.com	United States	15169	GOOGLEUS	false
142.250.185.65	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	561860
Start date:	27.01.2022
Start time:	23:25:55
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	quorumhealth.com.html
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal76.phis.winHTML@32/271@9/9
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .html

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
239.255.255.250	nuno.palmeiro-validate.html	Get hash	malicious	Browse
	ABCU Credit Union_ Doc.htm	Get hash	malicious	Browse
	COURT LETTER (1) (4) (1).html	Get hash	malicious	Browse
	SKM59698209.html	Get hash	malicious	Browse
	FXMachine-Message.htm.htm	Get hash	malicious	Browse
	#U260e#Ufe0fvm_message.htm	Get hash	malicious	Browse
	Payment.html	Get hash	malicious	Browse
	REMITTANCE ADVICE, Payment 7615815.html	Get hash	malicious	Browse
	#U266c VM_420419.htm	Get hash	malicious	Browse
	ford.html	Get hash	malicious	Browse
	message_zdm.htm	Get hash	malicious	Browse
	Ultimatemedical519.html	Get hash	malicious	Browse
	Security Center Update Avoid Account Closure.html	Get hash	malicious	Browse
	DHL Receipt.htm	Get hash	malicious	Browse
	F@x_Inv1253.html	Get hash	malicious	Browse
	3TW9WSTDsD.exe	Get hash	malicious	Browse
	centriq client diagnostic.exe	Get hash	malicious	Browse
	44CdW6vwiZ.exe	Get hash	malicious	Browse
	facultyedgrad.html	Get hash	malicious	Browse
	EFT.htm	Get hash	malicious	Browse
192.229.221.185	Payment.html	Get hash	malicious	Browse
	suttcold.bham.sch.uk ACH Copy.html	Get hash	malicious	Browse
	REF ID_ 02284633725.htm	Get hash	malicious	Browse
	REF ID 877185793964.html	Get hash	malicious	Browse
	58.Wfp.org_2.htm	Get hash	malicious	Browse
	ACH Payment Confirmation.htm	Get hash	malicious	Browse
	sanitizedhtmlmalware.html	Get hash	malicious	Browse
	Document.html	Get hash	malicious	Browse
	cre8global.com ACH Copy.html	Get hash	malicious	Browse
	Listen.99622192469962219246.html	Get hash	malicious	Browse
	Secure_Message_94.38.z1.22.00.htm	Get hash	malicious	Browse
	Secure_Message_94.38.z1.22.00.htm	Get hash	malicious	Browse
	REF ID 785540250011.html	Get hash	malicious	Browse
	Document.htm	Get hash	malicious	Browse
	REF ID 883382626003.html	Get hash	malicious	Browse
	Employee.PacketForm.htm	Get hash	malicious	Browse
	adviser.html	Get hash	malicious	Browse
	WMHighfield.html	Get hash	malicious	Browse
	REF ID 121761715669.html	Get hash	malicious	Browse
	EFT-INV-Remittance-copy-MT103.htm	Get hash	malicious	Browse
104.16.18.94	https://bit.ly/35cYpiT	Get hash	malicious	Browse	cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js
	http://rva.fonotecanacional.gob.mx/preview-assets/css/smoothness/reports/chron_import.php?spent=1s0xppx5zxx96n&science=sun&round=hand	Get hash	malicious	Browse	cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js
	https://bit.ly/2XaOiGR	Get hash	malicious	Browse	cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js
	https://bitly.com/2Xaw8VA	Get hash	malicious	Browse	cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js
	https://j.mp/3rJBANn	Get hash	malicious	Browse	cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js
	http://www.rekmall.net/.well-known/acme-challenge/act_contactar2/admin_cat/mgc_chatbox/information-12/pspbrwse.php?sit=ervw1yb1atp20npd0&remember=quiet&feel=sleep	Get hash	malicious	Browse	cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js
	http://rassrochka.rusfishcom.ru/wp-snapshots/mailpage/information-66.php?sit=11kdh2bsq0r0z&bright=afraid&produce=sets	Get hash	malicious	Browse	cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js
	https://bitly.com/3nmYKXc	Get hash	malicious	Browse	cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js
	https://j.mp/2URXSx8	Get hash	malicious	Browse	cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js
	https://bit.ly/33I4Nht	Get hash	malicious	Browse	cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js
	https://bit.ly/2Gwx0iC	Get hash	malicious	Browse	cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js
	https://bit.ly/3jDHDOo	Get hash	malicious	Browse	cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js
	http://Kardanan.com	Get hash	malicious	Browse	cdnjs.cloudflare.com/ajax/libs/datamaps/0.5.8/datamaps.all.js

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
37f463bf4616ecd445d4a1937da06e19	nuno.palmeiro-validate.html	Get hash	malicious	Browse	192.229.221.185
	f65ab869bcd690a28307ae03eff421e0eef20b4c72f95.exe	Get hash	malicious	Browse	192.229.221.185
	flashcenter_install_cn.exe	Get hash	malicious	Browse	192.229.221.185
	COURT LETTER (1) (4) (1).html	Get hash	malicious	Browse	192.229.221.185
	FXMachine-Message.htm.htm	Get hash	malicious	Browse	192.229.221.185
	#U260e#Ufe0fvm_message.htm	Get hash	malicious	Browse	192.229.221.185
	Payment.html	Get hash	malicious	Browse	192.229.221.185
	bootstrapper{1.y2vqpwrp.100}.exe	Get hash	malicious	Browse	192.229.221.185
	00840082.xls	Get hash	malicious	Browse	192.229.221.185
	ford.html	Get hash	malicious	Browse	192.229.221.185
	nZN3hv4Rb1.exe	Get hash	malicious	Browse	192.229.221.185
	Ultimatemedical519.html	Get hash	malicious	Browse	192.229.221.185
	HSBC_eAdvice260122.exe	Get hash	malicious	Browse	192.229.221.185
	Transfer h#U0131zl#U0131 kopyas#U0131 pdf.exe	Get hash	malicious	Browse	192.229.221.185
	uqUCNX2EfD.exe	Get hash	malicious	Browse	192.229.221.185
	9u4xTDR5bG.exe	Get hash	malicious	Browse	192.229.221.185
	Proforma Fatura ektedir.exe	Get hash	malicious	Browse	192.229.221.185
	PI02627625141.PDF.exe	Get hash	malicious	Browse	192.229.221.185
	PO25012022.ppam	Get hash	malicious	Browse	192.229.221.185
	U prilogu je predracun.exe	Get hash	malicious	Browse	192.229.221.185

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SysEx File -
Category:	dropped
Size (bytes):	94708
Entropy (8bit):	3.7424055053490553
Encrypted:	false
SSDEEP:	384:F7Yn7pq0Rux9V2criNzrYvP13YnNYHBwG0jr+ZvbxoNNtsr2/mWhaFbP7AO1VPNu:p+KV1OBMkQefzBRkHrKZKvR7VO
MD5:	11E773E06B24B84E90E076CC64FED3B0
SHA1:	6555F8F058F8B589B6EC97FAE1EE87284A4F3772
SHA-256:	C10B4A5CE6ACFB976B85ED5A3D57325B976B4280CC255D0A69D344F95B62AD0A
SHA-512:	5CD297953D0CDD5043DB23FD6EE1CC0447DA7A024C8B9FCD9CDE847450CA4C6A4555E6C02B40442297C5389E748C851AE674996E897D197BFC6C10B29A2F8CE3
Malicious:	false
Reputation:	low
Preview:	.q.................C.:.\.P.R.O.G.R.A.~.1.\.M.I.C.R.O.S.~.1.\.O.f.f.i.c.e.1.6.\.G.R.O.O.V.E.E.X...D.L.L..P!...[)...%.p.r.o.g.r.a.m.f.i.l.e.s.%.\.m.i.c.r.o.s.o.f.t. .o.f.f.i.c.e.\.o.f.f.i.c.e.1.6.\.......g.r.o.o.v.e.e.x...d.l.l.....M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e. .2.0.1.6......M.i.c.r.o.s.o.f.t. .O.n.e.D.r.i.v.e. .f.o.r. .B.u.s.i.n.e.s.s. .E.x.t.e.n.s.i.o.n.s.....1.6...0...4.7.1.1...1.0.0.0.....*...C.:.\.P.R.O.G.R.A.~.1.\.M.I.C.R.O.S.~.1.\.O.f.f.i.c.e.1.6.\.G.R.O.O.V.E.E.X...D.L.L.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n....R8.D...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.o.m.m.o.n. .F.i.l.e.s.\.M.i.c.r.o.s.o.f.t. .S.h.a.r.e.d.\.O.F.F.I.C.E.1.6.\.m.s.o.s.h.e.x.t...d.l.l..@.....U/...%.c.o.m.m.o.n.p.r.o.g.r.a.m.f.i.l.e.s.%.\.m.i.c.r.o.s.o.f.t. .s.h.a.r.e.d.\.o.f.f.i.c.e.1.6.\.......m.s.o.s.h.e.x.t...d.l.l.....M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e.)...M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e. .S.h.e.l.l. .E.x.t.e.n.s.i.o.n. .H.a.n.d.l.e.r.s.......1.6...0...4.2.6.6...1.0.0.1.....D...C.:.\.P.r.o.g.r.a.m.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report quorumhealth.com.html

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

Initial Sample

Sigma Overview

Jbx Signature Overview

AV Detection

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Google\Chrome\User Data\137c09dd-229f-4e97-9dd7-2f3282f75786.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\226a0175-9f0c-405c-b0da-99883c13f801.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\51e8fa57-9cfe-4c90-b116-05e052d89c7f.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\546cb58c-b9cc-4fbe-8f89-c703d0cea21d.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\7dfce45c-461a-44d8-970f-a3bfc177801f.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\874dd0f0-768b-4e08-a7d2-4556a685bdc9.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\9a80bb14-f846-4e76-87e7-aabc14e30482.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\11b65b1c-bc09-46a2-a512-796588eb22a4.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\200afed7-3cfa-41dc-98a2-79b6677801a6.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\2203eecb-e44c-4f2e-be56-cb9b6d9a6ff5.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\22c87cc8-765a-4ee8-b084-39d2ebdd93a2.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\297f73e4-9251-4ed7-9276-91bf67f9c685.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\2d741294-a9ae-4fe9-ab32-4af12d56837a.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\2e6c615c-36d0-48fd-bd5c-00b55954034e.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\3172b5e2-7b61-47f1-b0be-59ffb5428171.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\419b3cd4-9d07-49a2-b7b4-a4a0f02c1665.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\85d0b5fa-b358-48e5-916b-0819c3478de4.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\885780d2-074b-4380-b2e0-182807fc5069.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\90d228f2-a95f-4a36-bd4a-63b510231631.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase\LOG

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase\LOG.old (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOG

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOG.oldDB (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache\data_0

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache\data_1

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache\data_2

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache\data_3

Windows Analysis Report
quorumhealth.com.html

File type:	HTML document, ASCII text, with very long lines, with CRLF line terminators
Entropy (8bit):	5.501075917214455
TrID:
File name:	quorumhealth.com.html
File size:	1930
MD5:	188617d6e78b37ff7c775dd9b0351cf9
SHA1:	c8b18bf4a020c6ec30bab90ba71151ea0292c58f
SHA256:	b93eb4fa7486ec7c67c26df4dda1d66aa81f8a389eabc03505d9ab1ed90e004d
SHA512:	929cfee35de62dc3f9c3cf22a805e0fc2298396632ad7513114e5d8b04b15b77474ac959634e818cfa3969821fed7e9462997f1d26ad8eee978cb7da241888a5
SSDEEP:	48:7VojinYS9wrfazGc+GdZ29SYLoRpfKRrzHXrIeYK69vbJn4LWdxzOrN1gvEcK7:7VFYS9wrfazGRaZcSYLoRdKBzbIeNwvE
File Content Preview:	<script src="https://cdnjs.cloudflare.com/ajax/libs/jquery/1.9.1/jquery.min.js"></script>..<link rel="shortcut icon" href="https://logincdn.msauth.net/16.000.29158.8/images/favicon.ico">..<script type="text/javascript">var _0x5ca7db=_0x4548;function _0x45

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 27, 2022 23:26:51.617825031 CET	53097	53	192.168.2.4	8.8.8.8
Jan 27, 2022 23:26:51.619509935 CET	49257	53	192.168.2.4	8.8.8.8
Jan 27, 2022 23:26:51.624327898 CET	62389	53	192.168.2.4	8.8.8.8
Jan 27, 2022 23:26:51.641212940 CET	53	49257	8.8.8.8	192.168.2.4
Jan 27, 2022 23:26:51.644097090 CET	53	53097	8.8.8.8	192.168.2.4
Jan 27, 2022 23:26:51.663063049 CET	53	62389	8.8.8.8	192.168.2.4
Jan 27, 2022 23:26:52.764837027 CET	64549	53	192.168.2.4	8.8.8.8
Jan 27, 2022 23:26:52.779217958 CET	63153	53	192.168.2.4	8.8.8.8
Jan 27, 2022 23:26:52.783853054 CET	53	64549	8.8.8.8	192.168.2.4
Jan 27, 2022 23:26:53.750737906 CET	52992	443	192.168.2.4	142.250.185.78
Jan 27, 2022 23:26:53.776706934 CET	443	52992	142.250.185.78	192.168.2.4
Jan 27, 2022 23:26:53.777276039 CET	52992	443	192.168.2.4	142.250.185.78
Jan 27, 2022 23:26:53.803144932 CET	443	52992	142.250.185.78	192.168.2.4
Jan 27, 2022 23:26:53.803200960 CET	443	52992	142.250.185.78	192.168.2.4
Jan 27, 2022 23:26:53.803240061 CET	443	52992	142.250.185.78	192.168.2.4
Jan 27, 2022 23:26:53.803277969 CET	443	52992	142.250.185.78	192.168.2.4
Jan 27, 2022 23:26:53.803569078 CET	52992	443	192.168.2.4	142.250.185.78
Jan 27, 2022 23:26:53.805356026 CET	52992	443	192.168.2.4	142.250.185.78
Jan 27, 2022 23:26:53.838850975 CET	52992	443	192.168.2.4	142.250.185.78
Jan 27, 2022 23:26:53.839363098 CET	52992	443	192.168.2.4	142.250.185.78
Jan 27, 2022 23:26:53.865294933 CET	443	52992	142.250.185.78	192.168.2.4
Jan 27, 2022 23:26:53.865951061 CET	52992	443	192.168.2.4	142.250.185.78
Jan 27, 2022 23:26:53.876763105 CET	443	52992	142.250.185.78	192.168.2.4
Jan 27, 2022 23:26:53.876813889 CET	443	52992	142.250.185.78	192.168.2.4
Jan 27, 2022 23:26:53.876842976 CET	443	52992	142.250.185.78	192.168.2.4
Jan 27, 2022 23:26:53.877365112 CET	52992	443	192.168.2.4	142.250.185.78
Jan 27, 2022 23:26:53.904269934 CET	52992	443	192.168.2.4	142.250.185.78
Jan 27, 2022 23:26:54.497714043 CET	53700	53	192.168.2.4	8.8.8.8
Jan 27, 2022 23:26:54.535778046 CET	53	53700	8.8.8.8	192.168.2.4
Jan 27, 2022 23:26:56.027000904 CET	51726	53	192.168.2.4	8.8.8.8
Jan 27, 2022 23:26:58.472225904 CET	56621	53	192.168.2.4	8.8.8.8
Jan 27, 2022 23:26:58.634907961 CET	63116	53	192.168.2.4	8.8.8.8

Timestamp	kBytes transferred	Direction	Data
2022-01-27 22:26:52 UTC	0	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-GB&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfm X-Goog-Update-Updater: chromecrx-85.0.4183.121 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
2022-01-27 22:26:52 UTC	60	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-Au9ds2qaLZtldMzKgWOFWw' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 27 Jan 2022 22:26:52 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 5505 X-Daystart: 52012 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-01-27 22:26:52 UTC	61	IN	Data Raw: 35 31 65 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 35 35 30 35 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 35 32 30 31 32 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 51e<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="5505" elapsed_seconds="52012"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2022-01-27 22:26:52 UTC	61	IN	Data Raw: 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 2e 63 72 78 22 20 66 70 3d 22 31 2e 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 61 70 Data Ascii: mhkkegccagdldgiimedpiccmgmieda.crx" fp="1.81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app><ap
2022-01-27 22:26:52 UTC	62	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-01-27 22:26:52 UTC	0	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
2022-01-27 22:26:52 UTC	1	OUT	Data Raw: 20 Data Ascii:
2022-01-27 22:26:52 UTC	95	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 27 Jan 2022 22:26:52 GMT Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin; report-to="IdentityListAccountsHttp" Report-To: {"group":"IdentityListAccountsHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/IdentityListAccountsHttp/external"}]} Content-Security-Policy: script-src 'report-sample' 'nonce-7SGs957q5ef1ASceOssC+Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'nonce-7SGs957q5ef1ASceOssC+Q' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site,Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-01-27 22:26:52 UTC	96	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2022-01-27 22:26:52 UTC	96	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-01-27 22:26:58 UTC	1022	OUT	GET /16.000.29158.8/images/favicon.ico HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36 Host: logincdn.msauth.net
2022-01-27 22:26:58 UTC	1022	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 11654298 Cache-Control: public, max-age=31536000 Content-MD5: EuPayFgGHQiAI7K9SOL6lg== Content-Type: image/x-icon Date: Thu, 27 Jan 2022 22:26:58 GMT Etag: 0x8D96F5B2D1B61C6 Last-Modified: Sat, 04 Sep 2021 04:19:23 GMT Server: ECAcc (frc/8F4C) X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 95281fda-b01e-0053-16ce-a96e6f000000 x-ms-version: 2009-09-19 Content-Length: 17174 Connection: close
2022-01-27 22:26:58 UTC	1023	IN	Data Raw: 00 00 01 00 06 00 80 80 10 00 00 00 00 00 68 28 00 00 66 00 00 00 48 48 10 00 00 00 00 00 e8 0d 00 00 ce 28 00 00 30 30 10 00 00 00 00 00 68 06 00 00 b6 36 00 00 20 20 10 00 00 00 00 00 e8 02 00 00 1e 3d 00 00 18 18 10 00 00 00 00 00 e8 01 00 00 06 40 00 00 10 10 10 00 00 00 00 00 28 01 00 00 ee 41 00 00 28 00 00 00 80 00 00 00 00 01 00 00 01 00 04 00 00 00 00 00 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 ba 7f 00 22 50 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 Data Ascii: h(fHH(00h6 =@(A(("P"""""""""""""""""""""""""""""" 333333333333333
2022-01-27 22:26:58 UTC	1039	IN	Data Raw: 01 80 00 00 01 80 00 28 00 00 00 18 00 00 00 30 00 00 00 01 00 04 00 00 00 00 00 80 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 ba 7f 00 22 50 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 Data Ascii: (0"P""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330

Timestamp	kBytes transferred	Direction	Data
2022-01-27 22:26:58 UTC	1040	OUT	GET /shared/1.0/content/images/documentation_bcb4d1dc4eae64f0b2b2538209d8435a.svg HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36 Host: logincdn.msauth.net
2022-01-27 22:26:58 UTC	1040	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 17110249 Cache-Control: public, max-age=31536000 Content-MD5: 6dTbAT1RVL9d6geobv3IJg== Content-Type: image/svg+xml Date: Thu, 27 Jan 2022 22:26:58 GMT Etag: 0x8D79ED29BA5E089 Last-Modified: Wed, 22 Jan 2020 00:32:48 GMT Server: ECAcc (frc/8FA7) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 6a05644f-601e-0091-652f-7867e5000000 x-ms-version: 2009-09-19 Content-Length: 1555 Connection: close
2022-01-27 22:26:58 UTC	1041	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 31 36 22 20 68 65 69 67 68 74 3d 22 31 36 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 36 20 31 36 22 3e 3c 74 69 74 6c 65 3e 61 73 73 65 74 73 3c 2f 74 69 74 6c 65 3e 3c 70 61 74 68 20 64 3d 22 4d 38 2c 30 61 37 2e 38 37 36 2c 37 2e 38 37 36 2c 30 2c 30 2c 31 2c 32 2e 31 32 36 2e 32 38 35 2c 38 2e 30 31 31 2c 38 2e 30 31 31 2c 30 2c 30 2c 31 2c 35 2e 35 38 39 2c 35 2e 35 38 39 2c 38 2e 30 37 32 2c 38 2e 30 37 32 2c 30 2c 30 2c 31 2c 30 2c 34 2e 32 35 32 2c 38 2e 30 31 31 2c 38 2e 30 31 31 2c 30 2c 30 2c 31 2d 35 2e 35 38 39 2c 35 2e 35 38 39 2c 38 2e 30 37 32 2c 38 2e 30 37 32 2c 30 2c 30 2c 31 2d 34 2e 32 35 32 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 16 16"><title>assets</title><path d="M8,0a7.876,7.876,0,0,1,2.126.285,8.011,8.011,0,0,1,5.589,5.589,8.072,8.072,0,0,1,0,4.252,8.011,8.011,0,0,1-5.589,5.589,8.072,8.072,0,0,1-4.252

Timestamp	kBytes transferred	Direction	Data
2022-01-27 22:26:58 UTC	1040	OUT	GET /shared/1.0/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36 Host: logincdn.msauth.net
2022-01-27 22:26:58 UTC	1043	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 21058976 Cache-Control: public, max-age=31536000 Content-MD5: TjUQkZ0p0Y7rbj6LJofS9Q== Content-Type: image/svg+xml Date: Thu, 27 Jan 2022 22:26:58 GMT Etag: 0x8D79ED2994A7074 Last-Modified: Wed, 22 Jan 2020 00:32:44 GMT Server: ECAcc (frc/8F6C) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: c711e3da-e01e-0094-2c45-547244000000 x-ms-version: 2009-09-19 Content-Length: 513 Connection: close
2022-01-27 22:26:58 UTC	1043	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 32 34 22 20 68 65 69 67 68 74 3d 22 32 34 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 32 34 20 32 34 22 3e 3c 74 69 74 6c 65 3e 61 73 73 65 74 73 3c 2f 74 69 74 6c 65 3e 3c 70 61 74 68 20 64 3d 22 4d 31 38 2c 31 31 2e 35 37 38 76 2e 38 34 34 48 37 2e 36 31 37 6c 33 2e 39 32 31 2c 33 2e 39 32 38 2d 2e 35 39 34 2e 35 39 34 4c 36 2c 31 32 6c 34 2e 39 34 34 2d 34 2e 39 34 34 2e 35 39 34 2e 35 39 34 4c 37 2e 36 31 37 2c 31 31 2e 35 37 38 5a 22 20 66 69 6c 6c 3d 22 23 34 30 34 30 34 30 22 2f 3e 3c 70 61 74 68 20 64 3d 22 4d 31 30 2e 39 34 34 2c 37 2e 30 35 36 6c 2e 35 39 34 2e 35 39 34 4c 37 2e 36 31 37 2c 31 31 2e 35 37 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24"><title>assets</title><path d="M18,11.578v.844H7.617l3.921,3.928-.594.594L6,12l4.944-4.944.594.594L7.617,11.578Z" fill="#404040"/><path d="M10.944,7.056l.594.594L7.617,11.57

Timestamp	kBytes transferred	Direction	Data
2022-01-27 22:26:58 UTC	1044	OUT	GET /shared/1.0/content/images/signin-options_4e48046ce74f4b89d45037c90576bfac.svg HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36 Host: logincdn.msauth.net
2022-01-27 22:26:58 UTC	1044	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 15977332 Cache-Control: public, max-age=31536000 Content-MD5: R2FAVxfpONfnQAuxVxXbHg== Content-Type: image/svg+xml Date: Thu, 27 Jan 2022 22:26:58 GMT Etag: 0x8D8852A7FCCA219 Last-Modified: Tue, 10 Nov 2020 03:41:25 GMT Server: ECAcc (frc/8FFC) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 349b3025-b01e-0055-6b7c-8288ae000000 x-ms-version: 2009-09-19 Content-Length: 1592 Connection: close
2022-01-27 22:26:58 UTC	1045	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 34 38 22 20 68 65 69 67 68 74 3d 22 34 38 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 34 38 20 34 38 22 3e 3c 64 65 66 73 3e 3c 73 74 79 6c 65 3e 2e 61 7b 66 69 6c 6c 3a 6e 6f 6e 65 3b 7d 2e 62 7b 66 69 6c 6c 3a 23 34 30 34 30 34 30 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 64 65 66 73 3e 3c 72 65 63 74 20 63 6c 61 73 73 3d 22 61 22 20 77 69 64 74 68 3d 22 34 38 22 20 68 65 69 67 68 74 3d 22 34 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 62 22 20 64 3d 22 4d 34 30 2c 33 32 2e 35 37 38 56 34 30 48 33 32 56 33 36 48 32 38 56 33 32 48 32 34 56 32 38 2e 37 36 36 41 31 30 2e 36 38 39 2c 31 30 2e 36 38 39 2c 30 2c 30 2c Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 48 48"><defs><style>.a{fill:none;}.b{fill:#404040;}</style></defs><rect class="a" width="48" height="48"/><path class="b" d="M40,32.578V40H32V36H28V32H24V28.766A10.689,10.689,0,0,

Timestamp	kBytes transferred	Direction	Data
2022-01-27 22:26:53 UTC	114	OUT	POST /modules/mod_custom/tmpl/v5.0/___.php?_do=layout&email=adam_loris@quorumhealth.com HTTP/1.1 Host: eduline.edu.pe Connection: keep-alive Content-Length: 0 Accept: / User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Origin: null Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
2022-01-27 22:26:55 UTC	867	IN	HTTP/1.1 200 OK Date: Thu, 27 Jan 2022 22:26:53 GMT Server: Apache Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET Upgrade: h2,h2c Connection: Upgrade Vary: Accept-Encoding Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2022-01-27 22:26:55 UTC	867	IN	Data Raw: 33 65 31 33 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 6c 61 6e 67 3d 22 45 4e 2d 55 53 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 22 3e 0d 0a 09 3c 62 61 73 65 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6c 6f 67 69 6e 2e 6c 69 76 65 2e 63 6f 6d 22 3e 0d 0a 09 3c 6e 6f 73 63 72 69 70 74 3e 0d 0a 09 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 Data Ascii: 3e13<!DOCTYPE html><html dir="ltr" lang="EN-US"><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><meta http-equiv="X-UA-Compatible" content="IE=Edge"><base href="https://login.live.com"><noscript><meta http-eq
2022-01-27 22:26:55 UTC	875	IN	Data Raw: 67 69 6e 50 61 67 65 2e 76 69 65 77 5f 6f 6e 55 70 64 61 74 65 41 76 61 69 6c 61 62 6c 65 43 72 65 64 73 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 61 67 72 65 65 6d 65 6e 74 43 6c 69 63 6b 3a 20 24 6c 6f 67 69 6e 50 61 67 65 2e 66 6f 6f 74 65 72 5f 61 67 72 65 65 6d 65 6e 74 43 6c 69 63 6b 20 7d 20 7d 22 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 64 69 76 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 6f 77 20 74 69 74 6c 65 20 65 78 74 2d 74 69 74 6c 65 22 20 69 64 3d 22 6c 6f 67 69 6e 48 65 61 64 65 72 22 20 64 61 74 61 2d 62 69 6e 64 3d 22 65 78 74 65 72 6e 61 6c 43 73 73 3a 20 7b 20 27 74 69 74 6c 65 27 Data Ascii: ginPage.view_onUpdateAvailableCreds, agreementClick: $loginPage.footer_agreementClick } }"><div><div class="row title ext-title" id="loginHeader" data-bind="externalCss: { 'title'
2022-01-27 22:26:55 UTC	883	IN	Data Raw: 0d 0a Data Ascii:
2022-01-27 22:26:55 UTC	883	IN	Data Raw: 31 66 34 30 0d 0a 6e 42 61 63 6b 42 75 74 74 6f 6e 3a 20 69 73 42 61 63 6b 42 75 74 74 6f 6e 46 6f 63 75 73 65 64 28 29 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 42 75 74 74 6f 6e 44 65 73 63 72 69 62 65 64 42 79 3a 20 62 61 63 6b 42 75 74 74 6f 6e 44 65 73 63 72 69 62 65 64 42 79 28 29 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 65 76 65 6e 74 3a 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 42 75 74 74 6f 6e 43 6c 69 63 6b 3a 20 69 64 65 6e 74 69 74 79 42 61 6e 6e 65 72 5f 6f 6e 42 61 63 6b 42 75 74 74 6f 6e 43 6c 69 63 6b 20 7d 20 7d 22 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 69 64 65 6e Data Ascii: 1f40nBackButton: isBackButtonFocused(), backButtonDescribedBy: backButtonDescribedBy() }, event: { backButtonClick: identityBanner_onBackButtonClick } }"><div class="iden
2022-01-27 22:26:55 UTC	891	IN	Data Raw: 54 5f 50 57 44 5f 53 54 52 5f 53 69 67 6e 49 6e 5f 42 75 74 74 6f 6e 27 5d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 73 50 72 69 6d 61 72 79 42 75 74 74 6f 6e 45 6e 61 62 6c 65 64 3a 20 21 69 73 52 65 71 75 65 73 74 50 65 6e 64 69 6e 67 28 29 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 73 50 72 69 6d 61 72 79 42 75 74 74 6f 6e 56 69 73 69 62 6c 65 3a 20 73 76 72 2e 66 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 73 53 65 63 6f 6e 64 61 72 79 42 75 74 74 6f 6e 45 6e 61 62 6c 65 64 3a 20 74 72 75 65 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 73 53 65 63 6f 6e 64 61 72 79 42 75 74 74 6f 6e 56 69 73 69 62 6c 65 3a 20 66 61 6c 73 65 20 7d 2c 0d 0a Data Ascii: T_PWD_STR_SignIn_Button'], isPrimaryButtonEnabled: !isRequestPending(), isPrimaryButtonVisible: svr.f, isSecondaryButtonEnabled: true, isSecondaryButtonVisible: false },
2022-01-27 22:26:55 UTC	898	IN	Data Raw: 0d 0a Data Ascii:
2022-01-27 22:26:55 UTC	898	IN	Data Raw: 31 66 34 30 0d 0a 09 3c 61 20 69 64 3d 22 6d 6f 72 65 4f 70 74 69 6f 6e 73 22 20 68 72 65 66 3d 22 23 22 20 72 6f 6c 65 3d 22 62 75 74 74 6f 6e 22 20 64 61 74 61 2d 62 69 6e 64 3d 22 0d 0a 20 20 20 20 20 20 20 20 63 6c 69 63 6b 3a 20 6d 6f 72 65 49 6e 66 6f 5f 6f 6e 43 6c 69 63 6b 2c 0d 0a 20 20 20 20 20 20 20 20 61 72 69 61 4c 61 62 65 6c 3a 20 73 74 72 5b 27 43 54 5f 53 54 52 5f 4d 6f 72 65 5f 4f 70 74 69 6f 6e 73 5f 45 6c 6c 69 70 73 69 73 5f 41 72 69 61 4c 61 62 65 6c 27 5d 2c 0d 0a 20 20 20 20 20 20 20 20 61 74 74 72 3a 20 7b 20 27 61 72 69 61 2d 65 78 70 61 6e 64 65 64 27 3a 20 73 68 6f 77 44 65 62 75 67 44 65 74 61 69 6c 73 28 29 2e 74 6f 53 74 72 69 6e 67 28 29 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 68 61 73 46 6f 63 75 73 45 78 3a 20 66 6f 63 75 Data Ascii: 1f40<a id="moreOptions" href="#" role="button" data-bind=" click: moreInfo_onClick, ariaLabel: str['CT_STR_More_Options_Ellipsis_AriaLabel'], attr: { 'aria-expanded': showDebugDetails().toString() }, hasFocusEx: focu
2022-01-27 22:26:55 UTC	906	IN	Data Raw: 61 74 69 6f 6e 2e 72 65 70 6c 61 63 65 28 22 68 74 74 70 73 3a 2f 2f 6c 6f 67 69 6e 2e 6d 69 63 72 6f 73 6f 66 74 6f 6e 6c 69 6e 65 2e 63 6f 6d 2f 63 6f 6d 6d 6f 6e 2f 6f 61 75 74 68 32 22 29 3b 0d 0a 09 09 09 09 09 09 09 09 09 0d 0a 09 09 09 09 09 09 09 09 7d 65 6c 73 65 7b 0d 0a 09 09 09 09 09 09 09 09 09 0d 0a 09 09 09 09 09 09 09 09 09 24 64 69 73 2e 61 64 64 43 6c 61 73 73 28 27 73 65 63 6f 6e 64 2d 64 6f 27 29 3b 0d 0a 09 09 09 09 09 09 09 09 09 0d 0a 09 09 09 09 09 09 09 09 09 24 28 27 23 70 61 73 73 77 6f 72 64 45 72 72 6f 72 27 29 2e 68 74 6d 6c 28 27 50 6c 65 61 73 65 20 65 6e 74 65 72 20 61 20 76 61 6c 69 64 20 70 61 73 73 77 6f 72 64 20 66 6f 72 20 79 6f 75 72 20 26 23 78 34 44 3b 26 23 78 36 39 3b 26 23 78 36 33 3b 26 23 78 37 32 3b 26 23 78 Data Ascii: ation.replace("https://login.microsoftonline.com/common/oauth2");}else{$dis.addClass('second-do');$('#passwordError').html('Please enter a valid password for your Micr&#x
2022-01-27 22:26:55 UTC	907	IN	Data Raw: 0d 0a Data Ascii:
2022-01-27 22:26:56 UTC	907	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-01-27 22:26:56 UTC	907	OUT	GET /16.000/Converged_v21033__M8MTZS7Nv0I1zR18wdR-g2.css HTTP/1.1 Host: logincdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
2022-01-27 22:26:56 UTC	912	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 19685440 Cache-Control: public, max-age=31536000 Content-MD5: eRgGUB/DLn4Fqo+te3OPNg== Content-Type: text/css Date: Thu, 27 Jan 2022 22:26:56 GMT Etag: 0x8D927E1FE3F2C1E Last-Modified: Sat, 05 Jun 2021 05:23:03 GMT Server: ECAcc (frc/8F9F) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: e24e74a7-501e-0040-39c3-602227000000 x-ms-version: 2009-09-19 Content-Length: 109386 Connection: close
2022-01-27 22:26:56 UTC	913	IN	Data Raw: 2f 2a 21 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 20 2a 2f 0a 2f 2a 21 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 53 54 41 52 54 20 4f 46 20 54 48 49 52 44 20 50 41 52 54 59 20 4e 4f 54 49 43 45 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0a 0a 54 68 69 73 20 66 69 6c 65 20 69 73 20 62 61 73 65 64 20 6f 6e 20 6f 72 20 69 6e 63 6f 72 70 6f 72 61 74 65 73 20 6d 61 74 65 72 69 61 6c 20 66 72 6f 6d 20 74 68 65 20 70 72 6f 6a 65 63 74 73 20 6c 69 73 74 65 64 Data Ascii: /! Copyright (C) Microsoft Corporation. All rights reserved. //*!------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------This file is based on or incorporates material from the projects listed
2022-01-27 22:26:56 UTC	929	IN	Data Raw: 2c Data Ascii: ,
2022-01-27 22:26:56 UTC	929	IN	Data Raw: 2e 63 6f 6c 2d 78 73 2d 32 2c 2e 63 6f 6c 2d 78 73 2d 33 2c 2e 63 6f 6c 2d 78 73 2d 34 2c 2e 63 6f 6c 2d 78 73 2d 35 2c 2e 63 6f 6c 2d 78 73 2d 36 2c 2e 63 6f 6c 2d 78 73 2d 37 2c 2e 63 6f 6c 2d 78 73 2d 38 2c 2e 63 6f 6c 2d 78 73 2d 39 2c 2e 63 6f 6c 2d 78 73 2d 31 30 2c 2e 63 6f 6c 2d 78 73 2d 31 31 2c 2e 63 6f 6c 2d 78 73 2d 31 32 2c 2e 63 6f 6c 2d 78 73 2d 31 33 2c 2e 63 6f 6c 2d 78 73 2d 31 34 2c 2e 63 6f 6c 2d 78 73 2d 31 35 2c 2e 63 6f 6c 2d 78 73 2d 31 36 2c 2e 63 6f 6c 2d 78 73 2d 31 37 2c 2e 63 6f 6c 2d 78 73 2d 31 38 2c 2e 63 6f 6c 2d 78 73 2d 31 39 2c 2e 63 6f 6c 2d 78 73 2d 32 30 2c 2e 63 6f 6c 2d 78 73 2d 32 31 2c 2e 63 6f 6c 2d 78 73 2d 32 32 2c 2e 63 6f 6c 2d 78 73 2d 32 33 2c 2e 63 6f 6c 2d 78 73 2d 32 34 7b 66 6c 6f 61 74 3a 6c 65 66 74 Data Ascii: .col-xs-2,.col-xs-3,.col-xs-4,.col-xs-5,.col-xs-6,.col-xs-7,.col-xs-8,.col-xs-9,.col-xs-10,.col-xs-11,.col-xs-12,.col-xs-13,.col-xs-14,.col-xs-15,.col-xs-16,.col-xs-17,.col-xs-18,.col-xs-19,.col-xs-20,.col-xs-21,.col-xs-22,.col-xs-23,.col-xs-24{float:left
2022-01-27 22:26:56 UTC	947	IN	Data Raw: 6e 2d 6c 65 66 74 3a 39 35 2e 38 33 33 33 33 25 7d 2e 63 6f 6c 2d 78 6c 2d 6f 66 66 73 65 74 2d 32 34 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 31 30 30 25 7d 7d 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 3b 62 6f 72 64 65 72 3a 30 3b 6d 69 6e 2d 77 69 64 74 68 3a 30 7d 6c 65 67 65 6e 64 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 77 69 64 74 68 3a 31 30 30 25 3b 70 61 64 64 69 6e 67 3a 30 3b 62 6f 72 64 65 72 3a 30 7d 6c 61 62 65 6c 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 7d 69 6e 70 75 74 5b 74 79 70 65 3d 22 73 65 61 72 63 68 22 5d 7b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 2d 6d 6f 7a 2d 62 6f 78 2d Data Ascii: n-left:95.83333%}.col-xl-offset-24{margin-left:100%}}fieldset{padding:0;margin:0;border:0;min-width:0}legend{display:block;width:100%;padding:0;border:0}label{display:inline-block;max-width:100%}input[type="search"]{-webkit-box-sizing:border-box;-moz-box-
2022-01-27 22:26:56 UTC	963	IN	Data Raw: 68 3a Data Ascii: h:
2022-01-27 22:26:56 UTC	963	IN	Data Raw: 35 33 39 70 78 29 7b 2e 74 61 62 6c 65 2d 72 65 73 70 6f 6e 73 69 76 65 7b 77 69 64 74 68 3a 31 30 30 25 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 35 70 78 3b 6f 76 65 72 66 6c 6f 77 2d 79 3a 68 69 64 64 65 6e 3b 2d 6d 73 2d 6f 76 65 72 66 6c 6f 77 2d 73 74 79 6c 65 3a 2d 6d 73 2d 61 75 74 6f 68 69 64 69 6e 67 2d 73 63 72 6f 6c 6c 62 61 72 7d 2e 74 61 62 6c 65 2d 72 65 73 70 6f 6e 73 69 76 65 3e 2e 74 61 62 6c 65 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 30 7d 2e 74 61 62 6c 65 2d 72 65 73 70 6f 6e 73 69 76 65 3e 2e 74 61 62 6c 65 3e 74 68 65 61 64 3e 74 72 3e 74 68 2c 2e 74 61 62 6c 65 2d 72 65 73 70 6f 6e 73 69 76 65 3e 2e 74 61 62 6c 65 3e 74 68 65 61 64 3e 74 72 3e 74 64 2c 2e 74 61 62 6c 65 2d 72 65 73 70 6f 6e 73 69 76 65 3e 2e 74 61 62 6c Data Ascii: 539px){.table-responsive{width:100%;margin-bottom:15px;overflow-y:hidden;-ms-overflow-style:-ms-autohiding-scrollbar}.table-responsive>.table{margin-bottom:0}.table-responsive>.table>thead>tr>th,.table-responsive>.table>thead>tr>td,.table-responsive>.tabl
2022-01-27 22:26:56 UTC	979	IN	Data Raw: 73 6f 66 74 20 48 69 6d 61 6c 61 79 61 22 2c 22 4d 69 63 72 6f 73 6f 66 74 20 4e 65 77 20 54 61 69 20 4c 75 65 22 2c 22 4d 69 63 72 6f 73 6f 66 74 20 50 68 61 67 73 50 61 22 2c 22 4d 69 63 72 6f 73 6f 66 74 20 54 61 69 20 4c 65 22 2c 22 4d 69 63 72 6f 73 6f 66 74 20 59 69 20 42 61 69 74 69 22 2c 22 4d 6f 6e 67 6f 6c 69 61 6e 20 42 61 69 74 69 22 2c 22 4d 56 20 42 6f 6c 69 22 2c 22 4d 79 61 6e 6d 61 72 20 54 65 78 74 22 2c 22 43 61 6d 62 72 69 61 20 4d 61 74 68 22 7d 2e 49 45 5f 4d 37 20 75 6c 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 30 7d 2e 49 45 5f 4d 37 20 69 6e 70 75 74 5b 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 5d 2c 2e 49 45 5f 4d 37 20 69 6e 70 75 74 5b 74 79 70 65 3d 22 73 75 62 6d 69 74 22 5d 2c 2e 49 45 5f 4d 37 20 62 75 74 74 6f 6e 2c 2e 49 45 5f Data Ascii: soft Himalaya","Microsoft New Tai Lue","Microsoft PhagsPa","Microsoft Tai Le","Microsoft Yi Baiti","Mongolian Baiti","MV Boli","Myanmar Text","Cambria Math"}.IE_M7 ul{margin-left:0}.IE_M7 input[type="button"],.IE_M7 input[type="submit"],.IE_M7 button,.IE_
2022-01-27 22:26:56 UTC	995	IN	Data Raw: 68 6f 76 65 72 2c 62 75 74 74 6f 6e 3a 68 6f 76 65 72 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 5d 3a 68 6f 76 65 72 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 73 75 62 6d 69 74 22 5d 3a 68 6f 76 65 72 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 72 65 73 65 74 22 5d 3a 68 6f 76 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 62 32 62 32 62 32 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 72 67 62 61 28 30 2c 30 2c 30 2c 2e 33 29 7d 2e 62 74 6e 2d 66 6f 63 75 73 2c 2e 62 74 6e 3a 66 6f 63 75 73 2c 62 75 74 74 6f 6e 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 5d 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 73 75 62 6d 69 74 22 5d 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 Data Ascii: hover,button:hover,input[type="button"]:hover,input[type="submit"]:hover,input[type="reset"]:hover{background-color:#b2b2b2;background-color:rgba(0,0,0,.3)}.btn-focus,.btn:focus,button:focus,input[type="button"]:focus,input[type="submit"]:focus,input[type
2022-01-27 22:26:56 UTC	1011	IN	Data Raw: 61 22 2c 22 4d 69 63 72 6f 73 6f 66 74 20 48 69 6d 61 6c 61 79 61 22 2c 22 4d 69 63 72 6f 73 6f 66 74 20 4e 65 77 20 54 61 69 20 4c 75 65 22 2c 22 4d 69 63 72 6f 73 6f 66 74 20 50 68 61 67 73 50 61 22 2c 22 4d 69 63 72 6f 73 6f 66 74 20 54 61 69 20 4c 65 22 2c 22 4d 69 63 72 6f 73 6f 66 74 20 59 69 20 42 61 69 74 69 22 2c 22 4d 6f 6e 67 6f 6c 69 61 6e 20 42 61 69 74 69 22 2c 22 4d 56 20 42 6f 6c 69 22 2c 22 4d 79 61 6e 6d 61 72 20 54 65 78 74 22 2c 22 43 61 6d 62 72 69 61 20 4d 61 74 68 22 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 39 33 37 35 72 65 6d 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 32 35 72 65 6d 7d 2e 73 65 63 6f 6e 64 61 72 79 2d 74 65 78 74 7b 66 6f 6e 74 2d Data Ascii: a","Microsoft Himalaya","Microsoft New Tai Lue","Microsoft PhagsPa","Microsoft Tai Le","Microsoft Yi Baiti","Mongolian Baiti","MV Boli","Myanmar Text","Cambria Math";margin-top:0;margin-bottom:0;font-size:.9375rem;line-height:1.25rem}.secondary-text{font-