Edit tour

Windows Analysis Report
https://c.mail.com/@950756523062077283/jXK93RHJTd6QHf_mxRpglQ

Overview

General Information

Sample URL:	https://c.mail.com/@950756523062077283/jXK93RHJTd6QHf_mxRpglQ
Analysis ID:	562288
Infos:

Detection

HTMLPhisher

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Yara detected HtmlPhish10

Phishing site detected (based on logo template match)

Phishing site detected (based on image similarity)

Invalid 'forgot password' link found

HTML body contains low number of good links

None HTTPS page querying sensitive user data (password, username or email)

No HTML title found

Classification

Process Tree

System is w10x64

chrome.exe (PID: 6408 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "https://c.mail.com/@950756523062077283/jXK93RHJTd6QHf_mxRpglQ MD5: C139654B5C1438A95B321BB01AD63EF6)

chrome.exe (PID: 2628 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1540,12121304557946197679,11161055878062121502,131072 --lang=en-GB --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1948 /prefetch:8 MD5: C139654B5C1438A95B321BB01AD63EF6)

chrome.exe (PID: 7492 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1540,12121304557946197679,11161055878062121502,131072 --lang=en-GB --service-sandbox-type=none --enable-audio-service-sandbox --mojo-platform-channel-handle=3792 /prefetch:8 MD5: C139654B5C1438A95B321BB01AD63EF6)

chrome.exe (PID: 7500 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1540,12121304557946197679,11161055878062121502,131072 --lang=en-GB --service-sandbox-type=none --enable-audio-service-sandbox --mojo-platform-channel-handle=3300 /prefetch:8 MD5: C139654B5C1438A95B321BB01AD63EF6)

cleanup

Yara Overview

Dropped Files

Source	Rule	Description	Author
C:\Users\user\Downloads\ec76792b-097a-48ef-8860-efa82d0c2eb1.tmp	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
C:\Users\user\Downloads\4be5fe68-231a-4714-bd92-311125aedb56.tmp	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache\data_3	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8

Source: Yara match	File source: 79343.1.pages.csv, type: HTML
Source: Yara match	File source: C:\Users\user\Downloads\ec76792b-097a-48ef-8860-efa82d0c2eb1.tmp, type: DROPPED
Source: Yara match	File source: C:\Users\user\Downloads\4be5fe68-231a-4714-bd92-311125aedb56.tmp, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache\data_3, type: DROPPED

Source: file:///C:/Users/user/Downloads/Remittance%20Copy%20(1).html	HTTP Parser: Invalid link: Forgot Password?
Source: file:///C:/Users/user/Downloads/Remittance%20Copy%20(1).html	HTTP Parser: Invalid link: Forgot Password?

Source: file:///C:/Users/user/Downloads/Remittance%20Copy%20(1).html	HTTP Parser: Number of links: 0
Source: file:///C:/Users/user/Downloads/Remittance%20Copy%20(1).html	HTTP Parser: Number of links: 0

Source: file:///C:/Users/user/Downloads/Remittance%20Copy%20(1).html	HTTP Parser: Has password / email / username input fields
Source: file:///C:/Users/user/Downloads/Remittance%20Copy%20(1).html	HTTP Parser: Has password / email / username input fields

Source: file:///C:/Users/user/Downloads/Remittance%20Copy%20(1).html	HTTP Parser: HTML title missing
Source: file:///C:/Users/user/Downloads/Remittance%20Copy%20(1).html	HTTP Parser: HTML title missing

Source: file:///C:/Users/user/Downloads/Remittance%20Copy%20(1).html	HTTP Parser: No <meta name="author".. found
Source: file:///C:/Users/user/Downloads/Remittance%20Copy%20(1).html	HTTP Parser: No <meta name="author".. found

Source: file:///C:/Users/user/Downloads/Remittance%20Copy%20(1).html	HTTP Parser: No <meta name="copyright".. found
Source: file:///C:/Users/user/Downloads/Remittance%20Copy%20(1).html	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 104.19.143.111:443 -> 192.168.2.4:49852 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.19.143.111:443 -> 192.168.2.4:49851 version: TLS 1.2

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822

Source: global traffic	HTTP traffic detected: GET /@950756523062077283/jXK93RHJTd6QHf_mxRpglQ HTTP/1.1Host: c.mail.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-GB&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfmX-Goog-Update-Updater: chromecrx-85.0.4183.121Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /js/53681.js HTTP/1.1Host: uim.tifbs.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://c.mail.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /restfs/guest/@950756523062077283/share/jXK93RHJTd6QHf_mxRpglQ/shareinfo?option=thumbnails&option=metadata&option=displayresource&option=props HTTP/1.1Host: c.mail.comConnection: keep-aliveX-UI-STATISTIC: cloud.dir.generalAccept: application/json, text/plain, /X-UI-API-KEY: 0-N7-16211-0-a037a5fc56cd8f2eX-UI-APP: mailcom.web.onlinespeichernebula/3.0.5786User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36x-request-id: e2ab5b36-7035-40ab-819a-bb2bfb93fb99Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://c.mail.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /wa/t.gif?timestamp=1643390031030&software=ngcc&softwareversion=3.0.5786&brand=mailcom&section=general.start&trackingtype=ev&contentposition=en&source=shareexternal&destination=shareread&result=21000127&profileblocked=1&environment=standalone&libname=%40poseidon%2Ftracklib&libversion=3.7.0&attributeset=1&signature=14462 HTTP/1.1Host: wa.mail.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://c.mail.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /wa/t.gif?timestamp=1643390031074&software=ngcc&softwareversion=3.0.5786&brand=mailcom&section=cloud.start&trackingtype=ev&contentposition=en&source=shareexternalsingle&destination=shareread&profileblocked=1&environment=standalone&libname=%40poseidon%2Ftracklib&libversion=3.7.0&attributeset=1&signature=13746 HTTP/1.1Host: wa.mail.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://c.mail.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /wa/t.gif?timestamp=1643390031088&software=ngcc&softwareversion=3.0.5786&brand=mailcom&section=cloud.root.view&trackingtype=pi&contentposition=gallery&source=shareexternalsingle&destination=shareread&count=1&profileblocked=1&environment=standalone&libname=%40poseidon%2Ftracklib&libversion=3.7.0&attributeset=1&signature=9531 HTTP/1.1Host: wa.mail.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://c.mail.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /traffic_p/?md=mailcom&et=CP&agof=1&sc=cloud/share/root&brand=mailcom&region=com&dclass=desktop&dclient=browser&ff=b&tif=53681&tifts=2021-03-15T12:45:09Z&d=39857&anon=1 HTTP/1.1Host: t.uimserv.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://c.mail.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /restfs/guest/@950756523062077283/share/jXK93RHJTd6QHf_mxRpglQ/resourceAlias/ROOT?option=shares&option=thumbnails&option=metadata&option=props&option=displayresource&sort=resourceType-a,ui:media.visual-a,name-a&length=201&offset=0 HTTP/1.1Host: c.mail.comConnection: keep-aliveX-UI-STATISTIC: cloud.dir.generalAccept: application/json, text/plain, /X-UI-API-KEY: 0-N7-16211-0-a037a5fc56cd8f2eX-UI-APP: mailcom.web.onlinespeichernebula/3.0.5786User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36x-request-id: 0c624dd2-ee7a-4364-949b-c26975c090c1Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://c.mail.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /restfs/guest/@950756523062077283/share/jXK93RHJTd6QHf_mxRpglQ/resourceAlias/ROOT?option=shares&option=thumbnails&option=metadata&option=props&option=displayresource&sort=resourceType-a,ui:media.visual-a,name-a&length=1001&offset=0 HTTP/1.1Host: c.mail.comConnection: keep-aliveX-UI-STATISTIC: cloud.dir.generalAccept: application/json, text/plain, /X-UI-API-KEY: 0-N7-16211-0-a037a5fc56cd8f2eX-UI-APP: mailcom.web.onlinespeichernebula/3.0.5786User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36x-request-id: 04cf098b-8fd2-44a7-b21c-a40946ebb96bSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://c.mail.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /restfs/guest/@950756523062077283/share/jXK93RHJTd6QHf_mxRpglQ/resourceAlias/ROOT?option=shares&option=thumbnails&option=metadata&option=props&option=displayresource&sort=resourceType-a,ui:media.visual-a,name-a&length=201&offset=0 HTTP/1.1Host: c.mail.comConnection: keep-aliveX-UI-STATISTIC: cloud.dir.generalAccept: application/json, text/plain, /X-UI-API-KEY: 0-N7-16211-0-a037a5fc56cd8f2eX-UI-APP: mailcom.web.onlinespeichernebula/3.0.5786User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36x-request-id: 77abb7c1-0398-495a-82e1-380c0a58ca0cSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://c.mail.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: wa=opt-outIf-None-Match: "AAABfp11VDkAAAF-nXL0Ug-AABKTA"
Source: global traffic	HTTP traffic detected: GET /crx/blobs/Acy1k0bLIjHsvnKaKN_oRpVaYYvFs25d7GKYF1WXrT6yizCMksBO0c_ggE0B6tx6HPRHe6q1GOEe3_NcIbSiGG8kXeLMUY0sAKVvC6R89zvKM13s5VqoAMZSmuUgjQL5vlygJuArQghXXE_qTL7NlQ/extension_8520_615_0_5.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /wa/t.gif?timestamp=1643390038276&software=ngcc&softwareversion=3.0.5786&brand=mailcom&section=cloud.download.start&trackingtype=cl&eventposition=filelist_directaction&source=shareexternalsingle&destination=shareread&profileblocked=1&environment=standalone&libname=%40poseidon%2Ftracklib&libversion=3.7.0&attributeset=1&signature=10604 HTTP/1.1Host: wa.mail.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://c.mail.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: wa=opt-out
Source: global traffic	HTTP traffic detected: GET /restfs/guest/@950756523062077283/share/jXK93RHJTd6QHf_mxRpglQ/resourceAlias/ROOT?option=download&option=open HTTP/1.1Host: c.mail.comConnection: keep-aliveX-UI-STATISTIC: cloud.dir.generalAccept: application/json, text/plain, /X-UI-API-KEY: 0-N7-16211-0-a037a5fc56cd8f2eX-UI-APP: mailcom.web.onlinespeichernebula/3.0.5786User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36x-request-id: e230fd7e-3941-4238-9f05-5798f7d2e4dcSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://c.mail.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: wa=opt-out
Source: global traffic	HTTP traffic detected: GET /cgate-maus/rest/document/os-live-maus/950760097145956129/1068644333537731777/Remittance%20Copy.html?x_cd=attachment&c=AA0xxAU5ACdjDtSNzu4AIEMAAAF-nXL0Uv__jXK93RHJTd6QHf_mxRpglQ&t=1643397239333&h=-I1uJ7H0CgdTe2kmTHvvB4m8V6g HTTP/1.1Host: cgateu03maus.storage-mailcom.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: iframeReferer: https://c.mail.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /wa/t.gif?timestamp=1643390041407&software=ngcc&softwareversion=3.0.5786&brand=mailcom&section=cloud.download.start&trackingtype=cl&eventposition=filelist_directaction&source=shareexternalsingle&destination=shareread&profileblocked=1&environment=standalone&libname=%40poseidon%2Ftracklib&libversion=3.7.0&attributeset=1&signature=10594 HTTP/1.1Host: wa.mail.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://c.mail.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: wa=opt-out
Source: global traffic	HTTP traffic detected: GET /restfs/guest/@950756523062077283/share/jXK93RHJTd6QHf_mxRpglQ/resourceAlias/ROOT?option=download&option=open HTTP/1.1Host: c.mail.comConnection: keep-aliveX-UI-STATISTIC: cloud.dir.generalAccept: application/json, text/plain, /X-UI-API-KEY: 0-N7-16211-0-a037a5fc56cd8f2eX-UI-APP: mailcom.web.onlinespeichernebula/3.0.5786User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36x-request-id: 4b4f532a-1284-4f92-a628-f53cce9cf72fSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://c.mail.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: wa=opt-outIf-None-Match: "AAABfp11VDkAAAF-nXL0Ug-AAN7mA"
Source: global traffic	HTTP traffic detected: GET /bootstrap/4.0.0/css/bootstrap.min.css HTTP/1.1Host: maxcdn.bootstrapcdn.comConnection: keep-aliveOrigin: nullUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /bootstrap/4.0.0/js/bootstrap.min.js HTTP/1.1Host: maxcdn.bootstrapcdn.comConnection: keep-aliveOrigin: nullUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /cc41020ecb5162014937e0d1c83fa617.png HTTP/1.1Host: i.gyazo.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /ajax/libs/popper.js/1.12.9/umd/popper.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveOrigin: nullUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /bootstrap/4.1.3/js/bootstrap.min.js HTTP/1.1Host: stackpath.bootstrapcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /b308246805567e68aad040e42c453a7f.png HTTP/1.1Host: i.gyazo.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: Gyazo_cfwoker=i
Source: global traffic	HTTP traffic detected: GET /b308246805567e68aad040e42c453a7f.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: i.gyazo.com
Source: global traffic	HTTP traffic detected: GET /cc41020ecb5162014937e0d1c83fa617.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: i.gyazo.com

Source: angular.js.0.dr	String found in binary or memory: http://angularjs.org
Source: angular.js.0.dr	String found in binary or memory: http://errors.angularjs.org/1.6.4-local
Source: pnacl_public_x86_64_pnacl_sz_nexe.0.dr, pnacl_public_x86_64_pnacl_llc_nexe.0.dr	String found in binary or memory: http://llvm.org/):
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: http://tools.ietf.org/html/rfc1950
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01
Source: Reporting and NEL.1.dr	String found in binary or memory: https://a.nel.cloudflare.com/report/v3?s=%2BS6QK81%2Bw3VcTIF3HfV7VTEuoo0Pf2CddKeOx%2FUdo0dCUFISoaALQ
Source: manifest.json0.0.dr, 4437e90f-7a93-4d45-92d8-8a702ae4e4be.tmp.1.dr, 438e58b4-3124-447e-b5c0-ab9cf5c4aa2c.tmp.1.dr	String found in binary or memory: https://accounts.google.com
Source: craw_window.js.0.dr	String found in binary or memory: https://accounts.google.com/MergeSession
Source: 4437e90f-7a93-4d45-92d8-8a702ae4e4be.tmp.1.dr	String found in binary or memory: https://ajax.googleapis.com
Source: ec76792b-097a-48ef-8860-efa82d0c2eb1.tmp.0.dr, 4be5fe68-231a-4714-bd92-311125aedb56.tmp.0.dr, data_1.1.dr, data_3.1.dr	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
Source: manifest.json0.0.dr, 4437e90f-7a93-4d45-92d8-8a702ae4e4be.tmp.1.dr, 438e58b4-3124-447e-b5c0-ab9cf5c4aa2c.tmp.1.dr	String found in binary or memory: https://apis.google.com
Source: mirroring_common.js.0.dr	String found in binary or memory: https://apis.google.com/js/client.js
Source: 000003.log7.0.dr	String found in binary or memory: https://c.mail.com
Source: 000003.log7.0.dr	String found in binary or memory: https://c.mail.com%_https://c.mail.com
Source: History.0.dr	String found in binary or memory: https://c.mail.com/
Source: History.0.dr	String found in binary or memory: https://c.mail.com/https://c.mail.com/
Source: data_1.1.dr	String found in binary or memory: https://c.mail.com/restfs/guest/
Source: Current Session.0.dr	String found in binary or memory: https://c.mail.comh
Source: mirroring_common.js.0.dr	String found in binary or memory: https://castedumessaging-pa.googleapis.com/v1
Source: ec76792b-097a-48ef-8860-efa82d0c2eb1.tmp.0.dr, 4be5fe68-231a-4714-bd92-311125aedb56.tmp.0.dr, data_1.1.dr, data_3.1.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js
Source: data_1.1.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.jskf
Source: data_1.1.dr, 000003.log2.0.dr, Remittance Copy.html_Zone.Identifier.5.dr, Remittance Copy (1).html_Zone.Identifier.6.dr, History.0.dr	String found in binary or memory: https://cgateu03maus.storage-mailcom.com/cgate-maus/rest/document/os-live-maus/950760097145956129/10
Source: pnacl_public_x86_64_libpnacl_irt_shim_dummy_a.0.dr	String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-clang.git
Source: pnacl_public_x86_64_libpnacl_irt_shim_dummy_a.0.dr	String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-llvm.git
Source: 4437e90f-7a93-4d45-92d8-8a702ae4e4be.tmp.1.dr, 438e58b4-3124-447e-b5c0-ab9cf5c4aa2c.tmp.1.dr	String found in binary or memory: https://clients2.google.com
Source: mirroring_hangouts.js.0.dr, mirroring_cast_streaming.js.0.dr	String found in binary or memory: https://clients2.google.com/cr/report
Source: manifest.json1.0.dr, manifest.json0.0.dr, manifest.json.0.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 4437e90f-7a93-4d45-92d8-8a702ae4e4be.tmp.1.dr, 438e58b4-3124-447e-b5c0-ab9cf5c4aa2c.tmp.1.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://clients6.google.com
Source: pnacl_public_x86_64_ld_nexe.0.dr	String found in binary or memory: https://code.google.com/p/nativeclient/issues/entry
Source: pnacl_public_x86_64_ld_nexe.0.dr	String found in binary or memory: https://code.google.com/p/nativeclient/issues/entry%s:
Source: ec76792b-097a-48ef-8860-efa82d0c2eb1.tmp.0.dr, 4be5fe68-231a-4714-bd92-311125aedb56.tmp.0.dr, data_1.1.dr, data_3.1.dr	String found in binary or memory: https://code.jquery.com/jquery-3.2.1.slim.min.js
Source: manifest.json0.0.dr	String found in binary or memory: https://content.googleapis.com
Source: mirroring_cast_streaming.js.0.dr, common.js.0.dr	String found in binary or memory: https://crash.corp.google.com/samples?reportid=&q=
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://creativecommons.org/publicdomain/zero/1.0/.
Source: data_3.1.dr	String found in binary or memory: https://csp.withgoogle.com/csp/hosted-libraries-pushers
Source: data_3.1.dr	String found in binary or memory: https://csp.withgoogle.com/csp/hosted-libraries-pushersCross-Origin-Resource-Policy:
Source: data_3.1.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "https://c.mail.com/@950756523062077283/jXK93RHJTd6QHf_mxRpglQ
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1540,12121304557946197679,11161055878062121502,131072 --lang=en-GB --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1948 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1540,12121304557946197679,11161055878062121502,131072 --lang=en-GB --service-sandbox-type=none --enable-audio-service-sandbox --mojo-platform-channel-handle=3792 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1540,12121304557946197679,11161055878062121502,131072 --lang=en-GB --service-sandbox-type=none --enable-audio-service-sandbox --mojo-platform-channel-handle=3300 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1540,12121304557946197679,11161055878062121502,131072 --lang=en-GB --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1948 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1540,12121304557946197679,11161055878062121502,131072 --lang=en-GB --service-sandbox-type=none --enable-audio-service-sandbox --mojo-platform-channel-handle=3792 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1540,12121304557946197679,11161055878062121502,131072 --lang=en-GB --service-sandbox-type=none --enable-audio-service-sandbox --mojo-platform-channel-handle=3300 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	3 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	4 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	1 Ingress Tool Transfer	SIM Card Swap		Carrier Billing Fraud

Source	Detection	Scanner	Label	Link
https://c.mail.com/@950756523062077283/jXK93RHJTd6QHf_mxRpglQ	0%	Virustotal		Browse
https://c.mail.com/@950756523062077283/jXK93RHJTd6QHf_mxRpglQ	0%	Avira URL Cloud	safe
https://c.mail.com/@950756523062077283/jXK93RHJTd6QHf_mxRpglQ	100%	SlashNext	Fake Login Page type: Phishing & Social Engineering

Source	Detection	Scanner	Link
C:\Users\user\AppData\Local\Temp\6408_1594724902\_platform_specific\x86_64\pnacl_public_x86_64_ld_nexe	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\6408_1594724902\_platform_specific\x86_64\pnacl_public_x86_64_ld_nexe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\6408_1594724902\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_llc_nexe	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\6408_1594724902\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_llc_nexe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\6408_1594724902\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_sz_nexe	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\6408_1594724902\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_sz_nexe	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
https://sreckingssonlinefilesdown.com/nextings/rrrrrrrseeeeeeee.php	0%	Virustotal		Browse
https://sreckingssonlinefilesdown.com/nextings/rrrrrrrseeeeeeee.php	0%	Avira URL Cloud	safe
https://dns.google	0%	URL Reputation	safe
https://www.google.com;	0%	Avira URL Cloud	safe
https://csp.withgoogle.com/csp/hosted-libraries-pushers	0%	URL Reputation	safe
https://cgateu03maus.storage-mailcom.com/cgate-maus/rest/document/os-live-maus/950760097145956129/10	0%	Avira URL Cloud	safe
https://uim.tifbs.net/js/53681.js	0%	Avira URL Cloud	safe
https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers	0%	URL Reputation	safe
https://c.mail.com%_https://c.mail.com	0%	Avira URL Cloud	safe
https://c.mail.comh	0%	Avira URL Cloud	safe
https://gyazo.comAge:	0%	Avira URL Cloud	safe
https://csp.withgoogle.com/csp/hosted-libraries-pushersCross-Origin-Resource-Policy:	0%	URL Reputation	safe

Name	IP	Active	Malicious	Reputation
stackpath.bootstrapcdn.com	104.18.11.207	true	false	high
accounts.google.com	142.250.203.109	true	false	high
cloud.mail.com	74.208.232.71	true	false	high
i.gyazo.com	104.19.143.111	true	false	high
cdnjs.cloudflare.com	104.16.18.94	true	false	high
maxcdn.bootstrapcdn.com	104.18.10.207	true	false	high
uim-tifbs.ha-cdn.de	195.20.250.111	true	false	unknown
clients.l.google.com	216.58.215.238	true	false	high
t-uimserv-net.ha-cdn.de	195.20.250.183	true	false	unknown
googlehosted.l.googleusercontent.com	172.217.168.33	true	false	high
wa.mail.com	82.165.229.16	true	false	high
cgateu03lxa.storage-mailcom.com	74.208.232.132	true	false	unknown
t.uimserv.net	unknown	unknown	false	high
uim.tifbs.net	unknown	unknown	false	unknown
clients2.googleusercontent.com	unknown	unknown	false	high
c.mail.com	unknown	unknown	false	high
clients2.google.com	unknown	unknown	false	high
s.uicdn.com	unknown	unknown	false	high
code.jquery.com	unknown	unknown	false	high
cgateu03maus.storage-mailcom.com	unknown	unknown	false	unknown
img.ui-portal.de	unknown	unknown	false	high
dl.mail.com	unknown	unknown	false	high

Name	Malicious	Antivirus Detection	Reputation
https://wa.mail.com/wa/t.gif?timestamp=1643390031074&software=ngcc&softwareversion=3.0.5786&brand=mailcom&section=cloud.start&trackingtype=ev&contentposition=en&source=shareexternalsingle&destination=shareread&profileblocked=1&environment=standalone&libname=%40poseidon%2Ftracklib&libversion=3.7.0&attributeset=1&signature=13746	false		high
https://c.mail.com/@950756523062077283/jXK93RHJTd6QHf_mxRpglQ	false		high
https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js	false		high
https://wa.mail.com/wa/t.gif?timestamp=1643390041407&software=ngcc&softwareversion=3.0.5786&brand=mailcom&section=cloud.download.start&trackingtype=cl&eventposition=filelist_directaction&source=shareexternalsingle&destination=shareread&profileblocked=1&environment=standalone&libname=%40poseidon%2Ftracklib&libversion=3.7.0&attributeset=1&signature=10594	false		high
https://i.gyazo.com/b308246805567e68aad040e42c453a7f.png	false		high
https://c.mail.com/restfs/guest/@950756523062077283/share/jXK93RHJTd6QHf_mxRpglQ/shareinfo?option=thumbnails&option=metadata&option=displayresource&option=props	false		high
https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js	false		high
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-GB&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1	false		high
https://wa.mail.com/wa/t.gif?timestamp=1643390038276&software=ngcc&softwareversion=3.0.5786&brand=mailcom&section=cloud.download.start&trackingtype=cl&eventposition=filelist_directaction&source=shareexternalsingle&destination=shareread&profileblocked=1&environment=standalone&libname=%40poseidon%2Ftracklib&libversion=3.7.0&attributeset=1&signature=10604	false		high
https://c.mail.com/restfs/guest/@950756523062077283/share/jXK93RHJTd6QHf_mxRpglQ/resourceAlias/ROOT?option=download&option=open	false		high
https://i.gyazo.com/cc41020ecb5162014937e0d1c83fa617.png	false		high
https://wa.mail.com/wa/t.gif?timestamp=1643390031030&software=ngcc&softwareversion=3.0.5786&brand=mailcom&section=general.start&trackingtype=ev&contentposition=en&source=shareexternal&destination=shareread&result=21000127&profileblocked=1&environment=standalone&libname=%40poseidon%2Ftracklib&libversion=3.7.0&attributeset=1&signature=14462	false		high
https://c.mail.com/@950756523062077283/jXK93RHJTd6QHf_mxRpglQ	false		high
https://c.mail.com/restfs/guest/@950756523062077283/share/jXK93RHJTd6QHf_mxRpglQ/resourceAlias/ROOT?option=shares&option=thumbnails&option=metadata&option=props&option=displayresource&sort=resourceType-a,ui:media.visual-a,name-a&length=1001&offset=0	false		high
https://clients2.googleusercontent.com/crx/blobs/Acy1k0bLIjHsvnKaKN_oRpVaYYvFs25d7GKYF1WXrT6yizCMksBO0c_ggE0B6tx6HPRHe6q1GOEe3_NcIbSiGG8kXeLMUY0sAKVvC6R89zvKM13s5VqoAMZSmuUgjQL5vlygJuArQghXXE_qTL7NlQ/extension_8520_615_0_5.crx	false		high
https://uim.tifbs.net/js/53681.js	false	Avira URL Cloud: safe	unknown
https://c.mail.com/restfs/guest/@950756523062077283/share/jXK93RHJTd6QHf_mxRpglQ/resourceAlias/ROOT?option=shares&option=thumbnails&option=metadata&option=props&option=displayresource&sort=resourceType-a,ui:media.visual-a,name-a&length=201&offset=0	false		high
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false		high
https://t.uimserv.net/traffic_p/?md=mailcom&et=CP&agof=1&sc=cloud/share/root&brand=mailcom&region=com&dclass=desktop&dclient=browser&ff=b&tif=53681&tifts=2021-03-15T12:45:09Z&d=39857&anon=1	false		high
file:///C:/Users/user/Downloads/Remittance%20Copy%20(1).html	true		low
https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css	false		high
https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js	false		high

Name	Source	Malicious	Antivirus Detection	Reputation
https://s.uicdn.com/cloudclient/mailcom/assets/style/bt_mailcom-4eb40dd431.css:root	data_1.1.dr	false		high
https://apis.google.com/js/client.js	mirroring_common.js.0.dr	false		high
https://code.jquery.com/jquery-3.2.1.slim.min.js	ec76792b-097a-48ef-8860-efa82d0c2eb1.tmp.0.dr, 4be5fe68-231a-4714-bd92-311125aedb56.tmp.0.dr, data_1.1.dr, data_3.1.dr	false		high
https://crash.corp.google.com/samples?reportid=&q=	mirroring_cast_streaming.js.0.dr, common.js.0.dr	false		high
https://a.nel.cloudflare.com/report/v3?s=%2BS6QK81%2Bw3VcTIF3HfV7VTEuoo0Pf2CddKeOx%2FUdo0dCUFISoaALQ	Reporting and NEL.1.dr	false		high
http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01	mirroring_hangouts.js.0.dr	false		high
https://sreckingssonlinefilesdown.com/nextings/rrrrrrrseeeeeeee.php	ec76792b-097a-48ef-8860-efa82d0c2eb1.tmp.0.dr, 4be5fe68-231a-4714-bd92-311125aedb56.tmp.0.dr, data_3.1.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://preprod-hangouts-googleapis.sandbox.google.com	mirroring_hangouts.js.0.dr	false		high
https://www.google.com	manifest.json0.0.dr, 4437e90f-7a93-4d45-92d8-8a702ae4e4be.tmp.1.dr, 438e58b4-3124-447e-b5c0-ab9cf5c4aa2c.tmp.1.dr	false		high
https://dl.mail.com/tcf/live/v1/js/tcf-api.js	data_1.1.dr	false		high
https://hangouts.google.com/hangouts/_/logpref	mirroring_hangouts.js.0.dr	false		high
https://creativecommons.org/publicdomain/zero/1.0/.	mirroring_hangouts.js.0.dr	false		high
https://www.google.com/accounts/OAuthLogin?issueuberauth=1	craw_window.js.0.dr	false		high
https://github.com/madler/zlib/blob/master/zlib.h	mirroring_hangouts.js.0.dr	false		high
https://s.uicdn.com/cloudclient/mailcom/assets/style/cloud_intensebluectagreen-7ebdceb8e1.css	data_1.1.dr	false		high
https://www.google.com/tools/feedback	feedback_script.js.0.dr	false		high
https://dns.google	4437e90f-7a93-4d45-92d8-8a702ae4e4be.tmp.1.dr, fb7399f9-7cdc-4464-8326-0ffb045bd317.tmp.1.dr, 438e58b4-3124-447e-b5c0-ab9cf5c4aa2c.tmp.1.dr, f0503a97-51d0-4f2b-a344-16d18056bd4e.tmp.1.dr	false	URL Reputation: safe	unknown
https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p	craw_window.js.0.dr, craw_background.js.0.dr	false		high
https://support.google.com/chromecast/troubleshooter/2995236	messages.json41.0.dr, messages.json5.0.dr, messages.json7.0.dr, messages.json37.0.dr, feedback.html.0.dr, messages.json23.0.dr, messages.json69.0.dr, messages.json75.0.dr, messages.json71.0.dr, messages.json73.0.dr, messages.json83.0.dr, messages.json79.0.dr, messages.json25.0.dr, messages.json82.0.dr, messages.json54.0.dr, messages.json70.0.dr, messages.json74.0.dr, messages.json39.0.dr, messages.json33.0.dr, messages.json57.0.dr, messages.json18.0.dr	false		high
https://c.mail.com	000003.log7.0.dr	false		high
http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions	mirroring_hangouts.js.0.dr	false		high
https://payments.google.com/payments/v4/js/integrator.js	craw_window.js.0.dr, manifest.json.0.dr	false		high
https://www.google.com;	manifest.json0.0.dr	false	Avira URL Cloud: safe	low
https://csp.withgoogle.com/csp/hosted-libraries-pushers	data_3.1.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/x2.gif	craw_window.js.0.dr	false		high
https://s.uicdn.com/cloudclient/mailcom/main-es2015.f148c117aa1ea1fa4616.js	data_1.1.dr	false		high
https://www.google.com/images/dot2.gif	craw_window.js.0.dr	false		high
https://cgateu03maus.storage-mailcom.com/cgate-maus/rest/document/os-live-maus/950760097145956129/10	data_1.1.dr, 000003.log2.0.dr, Remittance Copy.html_Zone.Identifier.5.dr, Remittance Copy (1).html_Zone.Identifier.6.dr, History.0.dr	false	Avira URL Cloud: safe	unknown
https://play.google.com/log?format=json&hasfast=true	mirroring_hangouts.js.0.dr	false		high
http://tools.ietf.org/html/rfc1950	mirroring_hangouts.js.0.dr	false		high
https://i.gyazo.com/b308246805567e68aad040e42c453a7f.pngD	data_1.1.dr	false		high
https://gyazo.com	data_2.1.dr	false		high
https://c.mail.com/restfs/guest/	data_1.1.dr	false		high
https://docs.google.com	mirroring_common.js.0.dr	false		high
https://www.google.com/	manifest.json.0.dr	false		high
https://feedback.googleusercontent.com	manifest.json0.0.dr	false		high
https://clients6.google.com	mirroring_hangouts.js.0.dr	false		high
https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.jskf	data_1.1.dr	false		high
https://s.uicdn.com/cloudclient/mailcom/main-es2015.f148c117aa1ea1fa4616.js9/9	data_1.1.dr	false		high
https://s.uicdn.com/cloudclient/mailcom/runtime-es2015.3d8a04dcae2d724c8acc.js	data_1.1.dr	false		high
https://www.google.com/images/cleardot.gif	craw_window.js.0.dr	false		high
https://c.mail.com/	History.0.dr	false		high
https://play.google.com	4437e90f-7a93-4d45-92d8-8a702ae4e4be.tmp.1.dr, 438e58b4-3124-447e-b5c0-ab9cf5c4aa2c.tmp.1.dr	false		high
https://www.google.com/log?format=json&hasfast=true	mirroring_hangouts.js.0.dr	false		high
https://sandbox.google.com/payments/v4/js/integrator.js	craw_window.js.0.dr, manifest.json.0.dr	false		high
https://accounts.google.com/MergeSession	craw_window.js.0.dr	false		high
https://hangouts.clients6.google.com	mirroring_hangouts.js.0.dr	false		high
https://meet.google.com	mirroring_common.js.0.dr	false		high
https://accounts.google.com	manifest.json0.0.dr, 4437e90f-7a93-4d45-92d8-8a702ae4e4be.tmp.1.dr, 438e58b4-3124-447e-b5c0-ab9cf5c4aa2c.tmp.1.dr	false		high
https://clients2.google.com/cr/report	mirroring_hangouts.js.0.dr, mirroring_cast_streaming.js.0.dr	false		high
https://s.uicdn.com/mailint/7.218.0/assets/favicon.ico	data_1.1.dr, Favicons.0.dr	false		high
http://angularjs.org	angular.js.0.dr	false		high
https://s.uicdn.com/cloudclient/mailcom/polyfills-es2015.723cd1080b9f48044248.js	data_1.1.dr	false		high
https://github.com/angular/material	material_css_min.css.0.dr, angular.js.0.dr	false		high
https://apis.google.com	manifest.json0.0.dr, 4437e90f-7a93-4d45-92d8-8a702ae4e4be.tmp.1.dr, 438e58b4-3124-447e-b5c0-ab9cf5c4aa2c.tmp.1.dr	false		high
https://c.mail.com/https://c.mail.com/	History.0.dr	false		high
https://www-googleapis-staging.sandbox.google.com	craw_window.js.0.dr, craw_background.js.0.dr	false		high
https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers	data_3.1.dr	false	URL Reputation: safe	unknown
https://clients2.google.com	4437e90f-7a93-4d45-92d8-8a702ae4e4be.tmp.1.dr, 438e58b4-3124-447e-b5c0-ab9cf5c4aa2c.tmp.1.dr	false		high
https://c.mail.com%_https://c.mail.com	000003.log7.0.dr	false	Avira URL Cloud: safe	low
http://www.apache.org/licenses/LICENSE-2.0	mirroring_hangouts.js.0.dr	false		high
https://www.google.com/intl/en-US/chrome/blank.html	craw_background.js.0.dr	false		high
https://ogs.google.com	4437e90f-7a93-4d45-92d8-8a702ae4e4be.tmp.1.dr, 438e58b4-3124-447e-b5c0-ab9cf5c4aa2c.tmp.1.dr	false		high
https://c.mail.comh	Current Session.0.dr	false	Avira URL Cloud: safe	unknown
https://img.ui-portal.de/ci/mailcom/global/fonts/DroidSans/DroidSans-webfont.woff	data_1.1.dr	false		high
https://chromium.googlesource.com/a/native_client/pnacl-llvm.git	pnacl_public_x86_64_libpnacl_irt_shim_dummy_a.0.dr	false		high
https://hangouts.google.com/	manifest.json0.0.dr	false		high
https://s.uicdn.com/cloudclient/mailcom/assets/style/bt_mailcom-4eb40dd431.css	data_1.1.dr	false		high
http://llvm.org/):	pnacl_public_x86_64_pnacl_sz_nexe.0.dr, pnacl_public_x86_64_pnacl_llc_nexe.0.dr	false		high
https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.jsM	data_1.1.dr	false		high
https://meetings.clients6.google.com	mirroring_hangouts.js.0.dr	false		high
https://code.google.com/p/nativeclient/issues/entry%s:	pnacl_public_x86_64_ld_nexe.0.dr	false		high
https://gyazo.comAge:	data_2.1.dr	false	Avira URL Cloud: safe	unknown
https://s.uicdn.com/cloudclient/mailcom/vendor-es2015.ac806ff28cf734722e9b.js	data_1.1.dr	false		high
https://code.google.com/p/nativeclient/issues/entry	pnacl_public_x86_64_ld_nexe.0.dr	false		high
https://csp.withgoogle.com/csp/hosted-libraries-pushersCross-Origin-Resource-Policy:	data_3.1.dr	false	URL Reputation: safe	unknown
https://support.google.com/chromecast/answer/2998456	messages.json41.0.dr, messages.json5.0.dr, messages.json7.0.dr, messages.json37.0.dr, feedback.html.0.dr, messages.json23.0.dr, messages.json69.0.dr, messages.json75.0.dr, messages.json71.0.dr, messages.json73.0.dr, messages.json83.0.dr, messages.json79.0.dr, messages.json25.0.dr, messages.json82.0.dr, messages.json54.0.dr, messages.json70.0.dr, messages.json74.0.dr, messages.json39.0.dr, messages.json33.0.dr, messages.json57.0.dr, messages.json18.0.dr	false		high
https://clients2.googleusercontent.com	4437e90f-7a93-4d45-92d8-8a702ae4e4be.tmp.1.dr, 438e58b4-3124-447e-b5c0-ab9cf5c4aa2c.tmp.1.dr	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
104.18.10.207	maxcdn.bootstrapcdn.com	United States	13335	CLOUDFLARENETUS	false
104.19.143.111	i.gyazo.com	United States	13335	CLOUDFLARENETUS	false
74.208.232.71	cloud.mail.com	United States	8560	ONEANDONE-ASBrauerstrasse48DE	false
216.58.215.238	clients.l.google.com	United States	15169	GOOGLEUS	false
195.20.250.111	uim-tifbs.ha-cdn.de	Germany	8560	ONEANDONE-ASBrauerstrasse48DE	false
74.208.232.132	cgateu03lxa.storage-mailcom.com	United States	8560	ONEANDONE-ASBrauerstrasse48DE	false
82.165.229.16	wa.mail.com	Germany	8560	ONEANDONE-ASBrauerstrasse48DE	false
104.18.11.207	stackpath.bootstrapcdn.com	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.217.168.33	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
195.20.250.183	t-uimserv-net.ha-cdn.de	Germany	8560	ONEANDONE-ASBrauerstrasse48DE	false
104.16.18.94	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
142.250.203.109	accounts.google.com	United States	15169	GOOGLEUS	false

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	562288
Start date:	28.01.2022
Start time:	18:12:48
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://c.mail.com/@950756523062077283/jXK93RHJTd6QHf_mxRpglQ
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal64.phis.win@40/263@18/15
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	190308
Entropy (8bit):	6.045651289654084
Encrypted:	false
SSDEEP:	3072:mdk+l20ee3L2oVJhynrpnbtpQVzg4d8qkwMc0YKFcbXafIB0u1GOJmA3iuRF:g9407dorBtGzg4Kqkjc0zaqfIlUOoSiw
MD5:	3F7FBABA63DB386FDC6254F524EB958A
SHA1:	18DA45E9270F5C0CFE2824E76072A5F6522C4570
SHA-256:	A90382AB5D885E6351AE3096B39099FA155608F830C45948595A873AAA207D78
SHA-512:	6E6BA0A54B83580B738CA95637CC62B206AC4421EE9C3E11FA1DB2EE29736D02A59420022D9840731BD6CD41C8B401EE336DC32C2849C39E3883E8B02465480D
Malicious:	false
Reputation:	low
Preview:	{"browser":{"last_redirect_origin":"","shortcut_migration_version":"85.0.4183.121"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en-GB"},"legacy":{"profile":{"name":{"migrated":true}}},"network_time":{"network_time_mapping":{"local":1.643390028885758e+12,"network":1.64339003e+12,"ticks":314345512.0,"uncertainty":4133163.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABaHlwIoHYlQKZwuwW8V0yxAAAAAAIAAAAAABBmAAAAAQAAIAAAAOT4j8Zm9U1zXX6oEUpPqIYBIjSlOiLGeiMKiIFJZDroAAAAAA6AAAAAAgAAIAAAAFW1OavBhyV7qwszPZbindD+KU2Osh5O7HSmDPpFnuCDMAAAAGEkmqbufgFUSmOzx4cW7Aup7spqps4DvqbPrwRgUGqSpRZvQkbO+yVH56WF9zMTt0AAAAAyRwtYxjf7/AqYrFr0JZ6kbTiUt0/2PKkCw7ntLtbN2qrad7I3MeL4iNGDFgqRlhWgsb/6w0gJzQxAfL6rdzxi"},"password_manager":{"os_password_blank":true,"os_password_last_changed":"13245922715671931"},"plugins":{"metadata":{"adobe-flash-player":{"di

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 28, 2022 18:13:48.633773088 CET	53097	53	192.168.2.4	8.8.8.8
Jan 28, 2022 18:13:48.642795086 CET	49257	53	192.168.2.4	8.8.8.8
Jan 28, 2022 18:13:48.658359051 CET	53	53097	8.8.8.8	192.168.2.4
Jan 28, 2022 18:13:48.664448023 CET	53	49257	8.8.8.8	192.168.2.4
Jan 28, 2022 18:13:48.708374023 CET	62389	53	192.168.2.4	8.8.8.8
Jan 28, 2022 18:13:48.727097034 CET	53	62389	8.8.8.8	192.168.2.4
Jan 28, 2022 18:13:49.706554890 CET	64549	53	192.168.2.4	8.8.8.8
Jan 28, 2022 18:13:50.332545996 CET	63153	53	192.168.2.4	8.8.8.8
Jan 28, 2022 18:13:50.332673073 CET	52991	53	192.168.2.4	8.8.8.8
Jan 28, 2022 18:13:50.350519896 CET	53	63153	8.8.8.8	192.168.2.4
Jan 28, 2022 18:13:51.286063910 CET	51726	53	192.168.2.4	8.8.8.8
Jan 28, 2022 18:13:51.290278912 CET	56794	53	192.168.2.4	8.8.8.8
Jan 28, 2022 18:13:51.307871103 CET	53	56794	8.8.8.8	192.168.2.4
Jan 28, 2022 18:13:51.387206078 CET	56534	53	192.168.2.4	8.8.8.8
Jan 28, 2022 18:13:51.405524969 CET	53	56534	8.8.8.8	192.168.2.4
Jan 28, 2022 18:13:53.022458076 CET	56627	53	192.168.2.4	8.8.8.8
Jan 28, 2022 18:13:53.589111090 CET	56629	443	192.168.2.4	216.58.215.238
Jan 28, 2022 18:13:53.620558023 CET	443	56629	216.58.215.238	192.168.2.4
Jan 28, 2022 18:13:53.621063948 CET	56629	443	192.168.2.4	216.58.215.238
Jan 28, 2022 18:13:53.651268005 CET	443	56629	216.58.215.238	192.168.2.4
Jan 28, 2022 18:13:53.651302099 CET	443	56629	216.58.215.238	192.168.2.4
Jan 28, 2022 18:13:53.651319027 CET	443	56629	216.58.215.238	192.168.2.4
Jan 28, 2022 18:13:53.651334047 CET	443	56629	216.58.215.238	192.168.2.4
Jan 28, 2022 18:13:53.655535936 CET	56629	443	192.168.2.4	216.58.215.238
Jan 28, 2022 18:13:53.658817053 CET	56629	443	192.168.2.4	216.58.215.238
Jan 28, 2022 18:13:53.692085028 CET	56629	443	192.168.2.4	216.58.215.238
Jan 28, 2022 18:13:53.692624092 CET	56629	443	192.168.2.4	216.58.215.238
Jan 28, 2022 18:13:53.734967947 CET	443	56629	216.58.215.238	192.168.2.4
Jan 28, 2022 18:13:53.737539053 CET	443	56629	216.58.215.238	192.168.2.4
Jan 28, 2022 18:13:53.739932060 CET	56629	443	192.168.2.4	216.58.215.238
Jan 28, 2022 18:13:53.756464005 CET	443	56629	216.58.215.238	192.168.2.4
Jan 28, 2022 18:13:53.756485939 CET	443	56629	216.58.215.238	192.168.2.4
Jan 28, 2022 18:13:53.756519079 CET	443	56629	216.58.215.238	192.168.2.4
Jan 28, 2022 18:13:53.757298946 CET	56629	443	192.168.2.4	216.58.215.238
Jan 28, 2022 18:13:53.839783907 CET	56629	443	192.168.2.4	216.58.215.238
Jan 28, 2022 18:13:55.347145081 CET	64801	53	192.168.2.4	8.8.8.8
Jan 28, 2022 18:13:55.373805046 CET	53	64801	8.8.8.8	192.168.2.4
Jan 28, 2022 18:13:59.493041039 CET	52337	53	192.168.2.4	8.8.8.8
Jan 28, 2022 18:13:59.518377066 CET	53	52337	8.8.8.8	192.168.2.4
Jan 28, 2022 18:14:09.782546997 CET	55046	53	192.168.2.4	8.8.8.8
Jan 28, 2022 18:14:09.783226013 CET	49612	53	192.168.2.4	8.8.8.8
Jan 28, 2022 18:14:09.804903030 CET	53	55046	8.8.8.8	192.168.2.4
Jan 28, 2022 18:14:09.805078030 CET	53	49612	8.8.8.8	192.168.2.4
Jan 28, 2022 18:14:09.834228992 CET	49285	53	192.168.2.4	8.8.8.8
Jan 28, 2022 18:14:09.834475994 CET	50601	53	192.168.2.4	8.8.8.8
Jan 28, 2022 18:14:09.844372034 CET	60875	53	192.168.2.4	8.8.8.8
Jan 28, 2022 18:14:09.860888958 CET	53	50601	8.8.8.8	192.168.2.4
Jan 28, 2022 18:14:09.864335060 CET	53	60875	8.8.8.8	192.168.2.4
Jan 28, 2022 18:14:12.787152052 CET	59172	53	192.168.2.4	8.8.8.8
Jan 28, 2022 18:14:12.812093019 CET	53	59172	8.8.8.8	192.168.2.4

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://c.mail.com/@950756523062077283/jXK93RHJTd6QHf_mxRpglQ

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

Dropped Files

Sigma Overview

Jbx Signature Overview

AV Detection

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Google\Chrome\User Data\1bafc157-4259-4ab7-824e-7025fce16972.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\30f0db9c-a9e1-465f-b4ae-ab0b154ca6a5.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\462f3dbb-5cab-490b-b992-5bb1dae5f166.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\4f89f81c-b72f-497f-8928-dea7dac8f379.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\54b786fc-a8a2-45bb-b576-31e2f9703b46.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\731b340f-e648-49f6-8676-92ed2934b04f.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\8d38b2b6-6947-44bd-b673-9e0f8d2ae5a6.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\000001.dbtmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\000002.dbtmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\000003.log

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\00e6ef73-dd4c-4f74-afac-26ad731ff022.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\438e58b4-3124-447e-b5c0-ab9cf5c4aa2c.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\4437e90f-7a93-4d45-92d8-8a702ae4e4be.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\89b2b1ae-95ec-4e42-9c32-59b8ac3e7faf.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\8d11f3c0-dab8-482e-babf-937f9c4a0d0e.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\935945d6-cf57-496b-b087-fb9a2724b9be.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\978b4a45-af72-4418-8125-04bbbb0d2194.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase\LOG

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase\LOG.oldld (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOG

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOG.oldDB (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\CURRENT (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\CURRENTto (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache\data_0

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache\data_1

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache\data_2

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache\data_3

Windows Analysis Report
https://c.mail.com/@950756523062077283/jXK93RHJTd6QHf_mxRpglQ

Timestamp	kBytes transferred	Direction	Data
2022-01-28 17:13:49 UTC	0	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-GB&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfm X-Goog-Update-Updater: chromecrx-85.0.4183.121 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
2022-01-28 17:13:49 UTC	1	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-90+YL6qP8ajMjZ1kydxOeQ' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 28 Jan 2022 17:13:49 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 5506 X-Daystart: 33229 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-01-28 17:13:49 UTC	2	IN	Data Raw: 35 31 65 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 35 35 30 36 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 33 33 32 32 39 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 51e<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="5506" elapsed_seconds="33229"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2022-01-28 17:13:49 UTC	3	IN	Data Raw: 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 2e 63 72 78 22 20 66 70 3d 22 31 2e 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 61 70 Data Ascii: mhkkegccagdldgiimedpiccmgmieda.crx" fp="1.81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app><ap
2022-01-28 17:13:49 UTC	4	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-01-28 17:13:51 UTC	174	OUT	GET /restfs/guest/@950756523062077283/share/jXK93RHJTd6QHf_mxRpglQ/resourceAlias/ROOT?option=shares&option=thumbnails&option=metadata&option=props&option=displayresource&sort=resourceType-a,ui:media.visual-a,name-a&length=1001&offset=0 HTTP/1.1 Host: c.mail.com Connection: keep-alive X-UI-STATISTIC: cloud.dir.general Accept: application/json, text/plain, / X-UI-API-KEY: 0-N7-16211-0-a037a5fc56cd8f2e X-UI-APP: mailcom.web.onlinespeichernebula/3.0.5786 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 x-request-id: 04cf098b-8fd2-44a7-b21c-a40946ebb96b Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://c.mail.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
2022-01-28 17:13:52 UTC	176	IN	HTTP/1.1 200 OK Date: Fri, 28 Jan 2022 17:13:51 GMT Server: Apache Cache-Control: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT X-UI-VERSION: 1.6.4100/1.6.4100 Content-Security-Policy: default-src 'none' ETag: "AAABfp11VDkAAAF-nXL0Ug-AABKTA" Referrer-Policy: origin X-Content-Type-Options: nosniff X-Frame-Options: DENY X-REQUEST-ID: 04cf098b-8fd2-44a7-b21c-a40946ebb96b X-XSS-Protection: 1; mode=block Content-MD5: HK1c5BU8WxCndhQsOOnrtA== Content-Length: 903 Content-Type: application/json;charset=utf-8 Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000; includeSubDomains Connection: close
2022-01-28 17:13:52 UTC	177	IN	Data Raw: 7b 22 75 69 3a 6d 65 74 61 3a 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 65 78 74 72 61 63 74 6f 72 22 3a 22 30 22 7d 2c 22 75 69 3a 6d 65 74 61 3a 75 73 65 72 22 3a 7b 22 63 72 65 61 74 65 74 69 6d 65 22 3a 22 31 36 3a 33 31 3a 30 30 2e 39 33 31 22 2c 22 63 72 65 61 74 65 64 22 3a 22 32 30 32 32 2d 30 31 2d 32 37 54 31 36 3a 33 31 3a 30 30 2e 39 33 31 22 2c 22 63 72 65 61 74 65 64 61 74 65 22 3a 22 32 30 32 32 2d 30 31 2d 32 37 22 2c 22 63 72 65 61 74 65 64 59 65 61 72 4d 6f 6e 74 68 22 3a 22 32 30 32 32 2d 30 31 22 7d 2c 22 75 69 3a 6d 65 74 61 3a 72 65 73 6f 75 72 63 65 22 3a 7b 22 65 78 74 65 6e 73 69 6f 6e 22 3a 22 68 74 6d 6c 22 2c 22 6e 61 6d 65 22 3a 22 52 65 6d 69 74 74 61 6e 63 65 20 43 6f 70 79 22 2c 22 6d 69 6d 65 74 79 70 65 22 3a 22 74 65 78 74 2f Data Ascii: {"ui:meta:document":{"extractor":"0"},"ui:meta:user":{"createtime":"16:31:00.931","created":"2022-01-27T16:31:00.931","createdate":"2022-01-27","createdYearMonth":"2022-01"},"ui:meta:resource":{"extension":"html","name":"Remittance Copy","mimetype":"text/

Timestamp	kBytes transferred	Direction	Data
2022-01-28 17:13:52 UTC	178	OUT	GET /restfs/guest/@950756523062077283/share/jXK93RHJTd6QHf_mxRpglQ/resourceAlias/ROOT?option=shares&option=thumbnails&option=metadata&option=props&option=displayresource&sort=resourceType-a,ui:media.visual-a,name-a&length=201&offset=0 HTTP/1.1 Host: c.mail.com Connection: keep-alive X-UI-STATISTIC: cloud.dir.general Accept: application/json, text/plain, / X-UI-API-KEY: 0-N7-16211-0-a037a5fc56cd8f2e X-UI-APP: mailcom.web.onlinespeichernebula/3.0.5786 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 x-request-id: 77abb7c1-0398-495a-82e1-380c0a58ca0c Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://c.mail.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8 Cookie: wa=opt-out If-None-Match: "AAABfp11VDkAAAF-nXL0Ug-AABKTA"
2022-01-28 17:13:53 UTC	179	IN	HTTP/1.1 304 Not Modified Date: Fri, 28 Jan 2022 17:13:52 GMT Server: Apache ETag: "AAABfp11VDkAAAF-nXL0Ug-AABKTA" Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-cache X-XSS-Protection: 1; mode=block Referrer-Policy: origin X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000; includeSubDomains X-Frame-Options: DENY Connection: close

Timestamp	kBytes transferred	Direction	Data
2022-01-28 17:13:58 UTC	931	OUT	GET /wa/t.gif?timestamp=1643390038276&software=ngcc&softwareversion=3.0.5786&brand=mailcom&section=cloud.download.start&trackingtype=cl&eventposition=filelist_directaction&source=shareexternalsingle&destination=shareread&profileblocked=1&environment=standalone&libname=%40poseidon%2Ftracklib&libversion=3.7.0&attributeset=1&signature=10604 HTTP/1.1 Host: wa.mail.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://c.mail.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8 Cookie: wa=opt-out
2022-01-28 17:13:58 UTC	932	IN	HTTP/1.1 200 OK Date: Fri, 28 Jan 2022 17:13:58 GMT Server: Apache Set-Cookie: wa=opt-out; path=/; domain=.mail.com; expires=Sat, 28-Jan-2023 17:13:58 GMT; secure; HttpOnly Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: Wed, 11 Jan 1984 05:00:00 GMT P3P: CP="this is not a p3p policy" Access-Control-Allow-Origin: * Vary: X-Forwarded-For Accept-Ranges: bytes Content-Length: 43 Content-Type: image/gif Connection: close
2022-01-28 17:13:58 UTC	932	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff ff ff ff 21 f9 04 01 0a 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: GIF89a!,L;

Timestamp	kBytes transferred	Direction	Data
2022-01-28 17:13:58 UTC	932	OUT	GET /restfs/guest/@950756523062077283/share/jXK93RHJTd6QHf_mxRpglQ/resourceAlias/ROOT?option=download&option=open HTTP/1.1 Host: c.mail.com Connection: keep-alive X-UI-STATISTIC: cloud.dir.general Accept: application/json, text/plain, / X-UI-API-KEY: 0-N7-16211-0-a037a5fc56cd8f2e X-UI-APP: mailcom.web.onlinespeichernebula/3.0.5786 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 x-request-id: e230fd7e-3941-4238-9f05-5798f7d2e4dc Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://c.mail.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8 Cookie: wa=opt-out
2022-01-28 17:13:59 UTC	933	IN	HTTP/1.1 200 OK Date: Fri, 28 Jan 2022 17:13:59 GMT Server: Apache Cache-Control: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT X-UI-VERSION: 1.6.4100/1.6.4100 Content-Security-Policy: default-src 'none' ETag: "AAABfp11VDkAAAF-nXL0Ug-AAN7mA" Referrer-Policy: origin X-Content-Type-Options: nosniff X-Frame-Options: DENY X-REQUEST-ID: e230fd7e-3941-4238-9f05-5798f7d2e4dc X-XSS-Protection: 1; mode=block Content-MD5: oGxDKhLud7wAQmt5Oygz9A== Content-Length: 968 Content-Type: application/json;charset=utf-8 Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000; includeSubDomains Connection: close
2022-01-28 17:13:59 UTC	934	IN	Data Raw: 7b 22 75 69 3a 6c 69 6e 6b 22 3a 7b 22 64 6f 77 6e 6c 6f 61 64 55 52 49 22 3a 22 68 74 74 70 73 3a 2f 2f 63 67 61 74 65 75 30 33 6d 61 75 73 2e 73 74 6f 72 61 67 65 2d 6d 61 69 6c 63 6f 6d 2e 63 6f 6d 2f 63 67 61 74 65 2d 6d 61 75 73 2f 72 65 73 74 2f 64 6f 63 75 6d 65 6e 74 2f 6f 73 2d 6c 69 76 65 2d 6d 61 75 73 2f 39 35 30 37 36 30 30 39 37 31 34 35 39 35 36 31 32 39 2f 31 30 36 38 36 34 34 33 33 33 35 33 37 37 33 31 37 37 37 2f 52 65 6d 69 74 74 61 6e 63 65 25 32 30 43 6f 70 79 2e 68 74 6d 6c 3f 78 5f 63 64 3d 61 74 74 61 63 68 6d 65 6e 74 26 63 3d 41 41 30 78 78 41 55 35 41 43 64 6a 44 74 53 4e 7a 75 34 41 49 45 4d 41 41 41 46 2d 6e 58 4c 30 55 76 5f 5f 6a 58 4b 39 33 52 48 4a 54 64 36 51 48 66 5f 6d 78 52 70 67 6c 51 26 74 3d 31 36 34 33 33 39 37 32 Data Ascii: {"ui:link":{"downloadURI":"https://cgateu03maus.storage-mailcom.com/cgate-maus/rest/document/os-live-maus/950760097145956129/1068644333537731777/Remittance%20Copy.html?x_cd=attachment&c=AA0xxAU5ACdjDtSNzu4AIEMAAAF-nXL0Uv__jXK93RHJTd6QHf_mxRpglQ&t=16433972

Timestamp	kBytes transferred	Direction	Data
2022-01-28 17:14:00 UTC	935	OUT	GET /cgate-maus/rest/document/os-live-maus/950760097145956129/1068644333537731777/Remittance%20Copy.html?x_cd=attachment&c=AA0xxAU5ACdjDtSNzu4AIEMAAAF-nXL0Uv__jXK93RHJTd6QHf_mxRpglQ&t=1643397239333&h=-I1uJ7H0CgdTe2kmTHvvB4m8V6g HTTP/1.1 Host: cgateu03maus.storage-mailcom.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: iframe Referer: https://c.mail.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
2022-01-28 17:14:00 UTC	935	IN	HTTP/1.1 200 OK Connection: close Date: Fri, 28 Jan 2022 17:14:00 GMT Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers Last-Modified: Thu, 27 Jan 2022 21:31:03 GMT ETag: "kac0Ks9nds5rBBRbQys8Wks1ErQRs3YcEf21syWfv84" Cache-Control: max-age=7198, no-transform Accept-Ranges: bytes Content-Type: application/octet-stream Content-Disposition: attachment; filename="Remittance Copy.html"; filename*=UTF-8''Remittance%20Copy.html X-UI-CDOS-StoreId: 950760097145956129 X-UI-CDOS-RefId: 1068644333537731777 X-UI-CDOS-CDASH64: kac0Ks9nds5rBBRbQys8Wks1ErQRs3YcEf21syWfv84 X-UI-CDOS-DocumentLength: 7607 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Strict-Transport-Security: max-age=15552001 X-Frame-Options: DENY Content-Length: 7607
2022-01-28 17:14:00 UTC	936	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 45 6d 75 6c 61 74 65 49 45 39 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6d 61 78 63 Data Ascii: <html lang="en"><head> <meta http-equiv="x-ua-compatible" content="EmulateIE9"> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <link rel="stylesheet" href="https://maxc

Timestamp	kBytes transferred	Direction	Data
2022-01-28 17:14:01 UTC	944	OUT	GET /wa/t.gif?timestamp=1643390041407&software=ngcc&softwareversion=3.0.5786&brand=mailcom&section=cloud.download.start&trackingtype=cl&eventposition=filelist_directaction&source=shareexternalsingle&destination=shareread&profileblocked=1&environment=standalone&libname=%40poseidon%2Ftracklib&libversion=3.7.0&attributeset=1&signature=10594 HTTP/1.1 Host: wa.mail.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://c.mail.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8 Cookie: wa=opt-out
2022-01-28 17:14:01 UTC	944	IN	HTTP/1.1 200 OK Date: Fri, 28 Jan 2022 17:14:01 GMT Server: Apache Set-Cookie: wa=opt-out; path=/; domain=.mail.com; expires=Sat, 28-Jan-2023 17:14:01 GMT; secure; HttpOnly Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: Wed, 11 Jan 1984 05:00:00 GMT P3P: CP="this is not a p3p policy" Access-Control-Allow-Origin: * Vary: X-Forwarded-For Accept-Ranges: bytes Content-Length: 43 Content-Type: image/gif Connection: close
2022-01-28 17:14:01 UTC	945	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff ff ff ff 21 f9 04 01 0a 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: GIF89a!,L;

Timestamp	kBytes transferred	Direction	Data
2022-01-28 17:14:02 UTC	945	OUT	GET /restfs/guest/@950756523062077283/share/jXK93RHJTd6QHf_mxRpglQ/resourceAlias/ROOT?option=download&option=open HTTP/1.1 Host: c.mail.com Connection: keep-alive X-UI-STATISTIC: cloud.dir.general Accept: application/json, text/plain, / X-UI-API-KEY: 0-N7-16211-0-a037a5fc56cd8f2e X-UI-APP: mailcom.web.onlinespeichernebula/3.0.5786 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 x-request-id: 4b4f532a-1284-4f92-a628-f53cce9cf72f Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://c.mail.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8 Cookie: wa=opt-out If-None-Match: "AAABfp11VDkAAAF-nXL0Ug-AAN7mA"
2022-01-28 17:14:02 UTC	946	IN	HTTP/1.1 304 Not Modified Date: Fri, 28 Jan 2022 17:14:02 GMT Server: Apache ETag: "AAABfp11VDkAAAF-nXL0Ug-AAN7mA" Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-cache X-XSS-Protection: 1; mode=block Referrer-Policy: origin X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000; includeSubDomains X-Frame-Options: DENY Connection: close

Timestamp	kBytes transferred	Direction	Data
2022-01-28 17:13:49 UTC	1	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
2022-01-28 17:13:49 UTC	1	OUT	Data Raw: 20 Data Ascii:
2022-01-28 17:13:49 UTC	4	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 28 Jan 2022 17:13:49 GMT Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-tSzO7ylVIHeu6qG1AcSlcw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'nonce-tSzO7ylVIHeu6qG1AcSlcw' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport Cross-Origin-Opener-Policy: same-origin Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site,Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-01-28 17:13:49 UTC	5	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2022-01-28 17:13:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-01-28 17:14:09 UTC	947	OUT	GET /cc41020ecb5162014937e0d1c83fa617.png HTTP/1.1 Host: i.gyazo.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
2022-01-28 17:14:09 UTC	1056	IN	HTTP/1.1 200 OK Date: Fri, 28 Jan 2022 17:14:09 GMT Content-Type: image/png Content-Length: 1637 Connection: close CF-Ray: 6d4bdb03da14927a-FRA Accept-Ranges: bytes Access-Control-Allow-Origin: https://gyazo.com Age: 285770 Cache-Control: public, max-age=31536000 ETag: "cc41" Expires: Sat, 28 Jan 2023 17:14:09 GMT Set-Cookie: Gyazo_cfwoker=i; Secure; HttpOnly; SameSite=None; Expires=Tue, 01 Jan 2030 00:00:00 GMT Vary: Accept-Encoding Via: 1.1 google CF-Cache-Status: HIT Access-Control-Allow-Credentials: true Content-Dpr: 1.000000 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" X-Cache-Level: ZS Server: cloudflare
2022-01-28 17:14:09 UTC	1056	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 6c 00 00 00 18 08 03 00 00 00 28 0b e8 28 00 00 02 6d 50 4c 54 45 00 00 00 00 00 00 80 80 80 55 55 55 80 80 80 66 66 66 80 80 80 6d 6d 6d 80 80 80 71 71 71 80 80 80 6a 6a 6a 6d 6d 6d 78 78 78 71 71 71 79 79 79 73 73 73 6d 6d 6d 6f 6f 6f 75 75 75 70 70 70 76 76 76 71 71 71 76 76 76 72 72 72 77 77 77 70 70 70 71 71 71 71 71 71 75 75 75 72 72 72 76 76 76 70 70 70 73 73 73 71 71 71 74 74 74 71 71 71 72 72 72 75 75 75 73 73 73 71 71 71 74 74 74 72 72 72 74 74 74 75 75 75 73 73 73 75 75 75 73 73 73 71 71 71 74 74 74 74 74 74 72 72 72 74 74 74 73 73 73 75 75 75 73 73 73 73 73 73 72 72 72 74 74 74 72 72 72 74 74 74 73 73 73 73 73 73 73 73 73 72 72 72 74 74 74 72 72 72 74 74 74 73 73 73 72 72 72 72 72 72 72 Data Ascii: PNGIHDRl((mPLTEUUUfffmmmqqqjjjmmmxxxqqqyyysssmmmooouuupppvvvqqqvvvrrrwwwpppqqqqqquuurrrvvvpppsssqqqtttqqqrrruuusssqqqtttrrrtttuuusssuuusssqqqttttttrrrtttsssuuussssssrrrtttrrrtttsssssssssrrrtttrrrtttsssrrrrrrr
2022-01-28 17:14:09 UTC	1057	IN	Data Raw: 00 01 02 03 04 05 06 07 08 09 0a 0c 0e 11 12 13 14 15 17 18 19 1a 1b 1c 1d 1e 20 22 24 25 26 27 29 2a 2b 2c 2d 31 32 33 36 37 38 39 3b 3c 3d 3e 3f 40 42 43 44 45 46 47 49 4a 4d 4e 4f 50 52 54 55 56 57 58 5b 5c 5e 60 61 62 63 64 66 67 68 69 6b 6c 6d 6e 6f 73 75 76 77 78 79 7a 7b 7d 80 81 82 83 84 85 86 88 89 8c 8d 8e 8f 90 92 95 96 98 99 9a 9d 9e 9f a1 a2 a3 a4 a5 a6 a8 a9 aa ac ad ae af b0 b1 b2 b3 b4 b5 b6 b7 b9 ba bb bc bd c0 c3 c5 c6 c8 cb ce cf d0 d1 d3 d4 d5 d6 d7 d8 d9 da db dc dd dd dd dd dd de df e0 e1 e2 e4 e6 e7 e8 e9 ea eb ec ee ee ee ee ee ef f0 f1 f2 f3 f4 f5 f6 f8 f9 fa fb fc fd fe 4e 3e 1a e6 00 00 00 01 62 4b 47 44 ce f4 d9 f2 ff 00 00 02 d1 49 44 41 54 48 c7 ed d1 e9 57 94 65 18 80 f1 6b 80 32 81 0a 17 90 28 0b 2b 63 d2 2c cb 05 b2 05 68 Data Ascii: "$%&')*+,-1236789;<=>?@BCDEFGIJMNOPRTUVWX[\^`abcdfghiklmnosuvwxyz{}N>bKGDIDATHWek2(+c,h