Edit tour

Windows Analysis Report
https://telegra.ph/Invoice-05-13

Overview

General Information

Sample URL:	https://telegra.ph/Invoice-05-13
Analysis ID:	626180
Infos:

Detection

HTMLPhisher

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Phishing site detected (based on favicon image match)

Yara detected HtmlPhish10

Phishing site detected (based on logo template match)

Phishing site detected (based on image similarity)

HTML body contains low number of good links

No HTML title found

Classification

Process Tree

System is w10x64

chrome.exe (PID: 4264 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "https://telegra.ph/Invoice-05-13 MD5: C139654B5C1438A95B321BB01AD63EF6)

chrome.exe (PID: 1472 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1520,1557875660905084409,5904195423971476852,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1916 /prefetch:8 MD5: C139654B5C1438A95B321BB01AD63EF6)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author	Strings
61316.1.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: https://s3.eu-west-3.amazonaws.com/online.microsoft.l/index.html	Matcher: Found strong image similarity, brand: Microsoft image: 61316.1.img.2.gfk.csv EE5C8D9FB6248C938FD0DC19370E90BD
Source: https://s3.eu-west-3.amazonaws.com/online.microsoft.l/index.html	Matcher: Found strong image similarity, brand: Microsoft image: 61316.1.img.5.gfk.csv 7916A894EBDE7D29C2CC29B267F1299F

Source: https://s3.eu-west-3.amazonaws.com/online.microsoft.l/index.html	HTTP Parser: Number of links: 0
Source: https://s3.eu-west-3.amazonaws.com/online.microsoft.l/index.html	HTTP Parser: Number of links: 0

Source: https://s3.eu-west-3.amazonaws.com/online.microsoft.l/index.html	HTTP Parser: HTML title missing
Source: https://s3.eu-west-3.amazonaws.com/online.microsoft.l/index.html	HTTP Parser: HTML title missing

Source: https://s3.eu-west-3.amazonaws.com/online.microsoft.l/index.html	HTTP Parser: No <meta name="author".. found
Source: https://s3.eu-west-3.amazonaws.com/online.microsoft.l/index.html	HTTP Parser: No <meta name="author".. found

Source: https://s3.eu-west-3.amazonaws.com/online.microsoft.l/index.html	HTTP Parser: No <meta name="copyright".. found
Source: https://s3.eu-west-3.amazonaws.com/online.microsoft.l/index.html	HTTP Parser: No <meta name="copyright".. found

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic			Jump to behavior

Source: unknown	HTTPS traffic detected: 149.154.164.13:443 -> 192.168.2.3:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.164.13:443 -> 192.168.2.3:49781 version: TLS 1.2

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfmX-Goog-Update-Updater: chromecrx-85.0.4183.121Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Invoice-05-13 HTTP/1.1Host: telegra.phConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /css/quill.core.min.css HTTP/1.1Host: telegra.phConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://telegra.ph/Invoice-05-13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /css/core.min.css?46 HTTP/1.1Host: telegra.phConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://telegra.ph/Invoice-05-13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/jquery.min.js HTTP/1.1Host: telegra.phConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://telegra.ph/Invoice-05-13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/jquery.selection.min.js HTTP/1.1Host: telegra.phConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://telegra.ph/Invoice-05-13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/autosize.min.js HTTP/1.1Host: telegra.phConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://telegra.ph/Invoice-05-13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/load-image.all.min.js?1 HTTP/1.1Host: telegra.phConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://telegra.ph/Invoice-05-13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/quill.min.js?9 HTTP/1.1Host: telegra.phConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://telegra.ph/Invoice-05-13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_websync_?path=Invoice-05-13&hash=8207c1e9258718da71 HTTP/1.1Host: t.meConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://telegra.ph/Invoice-05-13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/core.min.js?63 HTTP/1.1Host: telegra.phConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://telegra.ph/Invoice-05-13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /file/86dd395e10e68ba0af5ff.png HTTP/1.1Host: telegra.phConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://telegra.ph/Invoice-05-13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/icons.png?1 HTTP/1.1Host: telegra.phConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://telegra.ph/Invoice-05-13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico?1 HTTP/1.1Host: telegra.phConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://telegra.ph/Invoice-05-13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /file/86dd395e10e68ba0af5ff.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: telegra.ph
Source: global traffic	HTTP traffic detected: GET /images/favicon_2x.png?1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: telegra.ph
Source: global traffic	HTTP traffic detected: GET /images/icons.png?1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: telegra.ph
Source: global traffic	HTTP traffic detected: GET /online.microsoft.l/index.html HTTP/1.1Host: s3.eu-west-3.amazonaws.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/jquery/3.3.1/jquery.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://s3.eu-west-3.amazonaws.com/online.microsoft.l/index.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrap/4.3.1/js/bootstrap.min.js HTTP/1.1Host: stackpath.bootstrapcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://s3.eu-west-3.amazonaws.com/online.microsoft.l/index.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrap/4.3.1/js/bootstrap.bundle.min.js HTTP/1.1Host: stackpath.bootstrapcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://s3.eu-west-3.amazonaws.com/online.microsoft.l/index.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrap/4.1.3/js/bootstrap.min.js HTTP/1.1Host: stackpath.bootstrapcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://s3.eu-west-3.amazonaws.com/online.microsoft.l/index.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: pnacl_public_x86_64_pnacl_sz_nexe.0.dr, pnacl_public_x86_64_pnacl_llc_nexe.0.dr	String found in binary or memory: http://llvm.org/):
Source: a7a43735-7bbd-4c36-8985-678c4303a6f7.tmp.1.dr, a00ff2ff-b349-444f-aede-c62bc3003682.tmp.1.dr	String found in binary or memory: https://accounts.google.com
Source: craw_window.js.0.dr	String found in binary or memory: https://accounts.google.com/MergeSession
Source: a00ff2ff-b349-444f-aede-c62bc3003682.tmp.1.dr	String found in binary or memory: https://ajax.googleapis.com
Source: a7a43735-7bbd-4c36-8985-678c4303a6f7.tmp.1.dr, a00ff2ff-b349-444f-aede-c62bc3003682.tmp.1.dr	String found in binary or memory: https://apis.google.com
Source: pnacl_public_x86_64_libpnacl_irt_shim_dummy_a.0.dr	String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-clang.git
Source: pnacl_public_x86_64_libpnacl_irt_shim_dummy_a.0.dr	String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-llvm.git
Source: a7a43735-7bbd-4c36-8985-678c4303a6f7.tmp.1.dr, a00ff2ff-b349-444f-aede-c62bc3003682.tmp.1.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.0.dr, manifest.json.0.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: a7a43735-7bbd-4c36-8985-678c4303a6f7.tmp.1.dr, a00ff2ff-b349-444f-aede-c62bc3003682.tmp.1.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: pnacl_public_x86_64_ld_nexe.0.dr	String found in binary or memory: https://code.google.com/p/nativeclient/issues/entry
Source: pnacl_public_x86_64_ld_nexe.0.dr	String found in binary or memory: https://code.google.com/p/nativeclient/issues/entry%s:
Source: a00ff2ff-b349-444f-aede-c62bc3003682.tmp.1.dr	String found in binary or memory: https://content-autofill.googleapis.com
Source: 39811dfa-4006-4384-863d-5a77924a4ed5.tmp.1.dr, a7a43735-7bbd-4c36-8985-678c4303a6f7.tmp.1.dr, a00ff2ff-b349-444f-aede-c62bc3003682.tmp.1.dr, a63e876f-4e20-4519-b6a6-fe049943e529.tmp.1.dr	String found in binary or memory: https://dns.google
Source: a00ff2ff-b349-444f-aede-c62bc3003682.tmp.1.dr	String found in binary or memory: https://firebasestorage.googleapis.com
Source: a7a43735-7bbd-4c36-8985-678c4303a6f7.tmp.1.dr	String found in binary or memory: https://fonts.googleapis.com
Source: a7a43735-7bbd-4c36-8985-678c4303a6f7.tmp.1.dr, a00ff2ff-b349-444f-aede-c62bc3003682.tmp.1.dr	String found in binary or memory: https://fonts.gstatic.com
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p
Source: a7a43735-7bbd-4c36-8985-678c4303a6f7.tmp.1.dr, a00ff2ff-b349-444f-aede-c62bc3003682.tmp.1.dr	String found in binary or memory: https://ogs.google.com
Source: craw_window.js.0.dr, manifest.json.0.dr	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: a7a43735-7bbd-4c36-8985-678c4303a6f7.tmp.1.dr, a00ff2ff-b349-444f-aede-c62bc3003682.tmp.1.dr	String found in binary or memory: https://play.google.com
Source: a00ff2ff-b349-444f-aede-c62bc3003682.tmp.1.dr	String found in binary or memory: https://r2---sn-1gi7znes.gvt1.com
Source: a00ff2ff-b349-444f-aede-c62bc3003682.tmp.1.dr	String found in binary or memory: https://redirector.gvt1.com
Source: History Provider Cache.0.dr	String found in binary or memory: https://s3.eu-west-3.amazonaws.com/online.microsoft.l/index.html2
Source: craw_window.js.0.dr, manifest.json.0.dr	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: a7a43735-7bbd-4c36-8985-678c4303a6f7.tmp.1.dr, a00ff2ff-b349-444f-aede-c62bc3003682.tmp.1.dr	String found in binary or memory: https://ssl.gstatic.com
Source: History Provider Cache.0.dr	String found in binary or memory: https://telegra.ph/Invoice-05-132
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://www-googleapis-staging.sandbox.google.com
Source: a7a43735-7bbd-4c36-8985-678c4303a6f7.tmp.1.dr, a00ff2ff-b349-444f-aede-c62bc3003682.tmp.1.dr	String found in binary or memory: https://www.google.com
Source: manifest.json.0.dr	String found in binary or memory: https://www.google.com/
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/accounts/OAuthLogin?issueuberauth=1
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/cleardot.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/dot2.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/x2.gif
Source: craw_background.js.0.dr	String found in binary or memory: https://www.google.com/intl/en-US/chrome/blank.html
Source: a7a43735-7bbd-4c36-8985-678c4303a6f7.tmp.1.dr, a00ff2ff-b349-444f-aede-c62bc3003682.tmp.1.dr, craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://www.googleapis.com
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: a7a43735-7bbd-4c36-8985-678c4303a6f7.tmp.1.dr, a00ff2ff-b349-444f-aede-c62bc3003682.tmp.1.dr	String found in binary or memory: https://www.gstatic.com

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	3 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	3 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	4 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	1 Ingress Tool Transfer	SIM Card Swap		Carrier Billing Fraud

Source	Detection	Scanner	Link
C:\Users\user\AppData\Local\Temp\4264_2117823487\_platform_specific\x86_64\pnacl_public_x86_64_ld_nexe	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\4264_2117823487\_platform_specific\x86_64\pnacl_public_x86_64_ld_nexe	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\4264_2117823487\_platform_specific\x86_64\pnacl_public_x86_64_ld_nexe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\4264_2117823487\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_llc_nexe	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\4264_2117823487\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_llc_nexe	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\4264_2117823487\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_llc_nexe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\4264_2117823487\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_sz_nexe	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\4264_2117823487\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_sz_nexe	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\4264_2117823487\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_sz_nexe	0%	ReversingLabs

Name	IP	Active	Malicious	Reputation
stackpath.bootstrapcdn.com	104.18.11.207	true	false	high
accounts.google.com	142.250.186.77	true	false	high
edit.telegra.ph	149.154.164.13	true	false	high
cdnjs.cloudflare.com	104.17.24.14	true	false	high
t.me	149.154.167.99	true	false	high
clients.l.google.com	142.250.185.206	true	false	high
telegra.ph	149.154.164.13	true	false	high
s3.eu-west-3.amazonaws.com	52.95.154.21	true	false	high
clients2.google.com	unknown	unknown	false	high

Name	Malicious	Reputation
https://stackpath.bootstrapcdn.com/bootstrap/4.3.1/js/bootstrap.min.js	false	high
https://telegra.ph/images/icons.png?1	false	high
https://telegra.ph/css/core.min.css?46	false	high
https://t.me/_websync_?path=Invoice-05-13&hash=8207c1e9258718da71	false	high
https://telegra.ph/Invoice-05-13	false	high
https://telegra.ph/js/core.min.js?63	false	high
https://stackpath.bootstrapcdn.com/bootstrap/4.3.1/js/bootstrap.bundle.min.js	false	high
https://telegra.ph/css/quill.core.min.css	false	high
https://s3.eu-west-3.amazonaws.com/online.microsoft.l/index.html	false	high
https://s3.eu-west-3.amazonaws.com/online.microsoft.l/index.html	false	high
https://telegra.ph/Invoice-05-13	false	high
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1	false	high
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false	high
https://telegra.ph/js/jquery.min.js	false	high
https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js	false	high
https://telegra.ph/js/quill.min.js?9	false	high
https://telegra.ph/file/86dd395e10e68ba0af5ff.png	false	high
https://telegra.ph/images/favicon_2x.png?1	false	high
https://telegra.ph/favicon.ico?1	false	high
https://telegra.ph/js/load-image.all.min.js?1	false	high
https://telegra.ph/js/autosize.min.js	false	high
https://edit.telegra.ph/check	false	high
https://telegra.ph/js/jquery.selection.min.js	false	high
https://cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/jquery.min.js	false	high

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "https://telegra.ph/Invoice-05-13
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1520,1557875660905084409,5904195423971476852,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1916 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1520,1557875660905084409,5904195423971476852,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1916 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.google.com/images/cleardot.gif	craw_window.js.0.dr	false		high
https://play.google.com	a7a43735-7bbd-4c36-8985-678c4303a6f7.tmp.1.dr, a00ff2ff-b349-444f-aede-c62bc3003682.tmp.1.dr	false		high
https://sandbox.google.com/payments/v4/js/integrator.js	craw_window.js.0.dr, manifest.json.0.dr	false		high
https://accounts.google.com/MergeSession	craw_window.js.0.dr	false		high
https://www.google.com	a7a43735-7bbd-4c36-8985-678c4303a6f7.tmp.1.dr, a00ff2ff-b349-444f-aede-c62bc3003682.tmp.1.dr	false		high
https://accounts.google.com	a7a43735-7bbd-4c36-8985-678c4303a6f7.tmp.1.dr, a00ff2ff-b349-444f-aede-c62bc3003682.tmp.1.dr	false		high
https://telegra.ph/Invoice-05-132	History Provider Cache.0.dr	false		high
https://apis.google.com	a7a43735-7bbd-4c36-8985-678c4303a6f7.tmp.1.dr, a00ff2ff-b349-444f-aede-c62bc3003682.tmp.1.dr	false		high
https://www.google.com/accounts/OAuthLogin?issueuberauth=1	craw_window.js.0.dr	false		high
https://www-googleapis-staging.sandbox.google.com	craw_window.js.0.dr, craw_background.js.0.dr	false		high
https://clients2.google.com	a7a43735-7bbd-4c36-8985-678c4303a6f7.tmp.1.dr, a00ff2ff-b349-444f-aede-c62bc3003682.tmp.1.dr	false		high
https://dns.google	39811dfa-4006-4384-863d-5a77924a4ed5.tmp.1.dr, a7a43735-7bbd-4c36-8985-678c4303a6f7.tmp.1.dr, a00ff2ff-b349-444f-aede-c62bc3003682.tmp.1.dr, a63e876f-4e20-4519-b6a6-fe049943e529.tmp.1.dr	false	URL Reputation: safe	unknown
https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p	craw_window.js.0.dr, craw_background.js.0.dr	false		high
https://www.google.com/intl/en-US/chrome/blank.html	craw_background.js.0.dr	false		high
https://ogs.google.com	a7a43735-7bbd-4c36-8985-678c4303a6f7.tmp.1.dr, a00ff2ff-b349-444f-aede-c62bc3003682.tmp.1.dr	false		high
https://payments.google.com/payments/v4/js/integrator.js	craw_window.js.0.dr, manifest.json.0.dr	false		high
https://chromium.googlesource.com/a/native_client/pnacl-llvm.git	pnacl_public_x86_64_libpnacl_irt_shim_dummy_a.0.dr	false		high
https://www.google.com/images/x2.gif	craw_window.js.0.dr	false		high
http://llvm.org/):	pnacl_public_x86_64_pnacl_sz_nexe.0.dr, pnacl_public_x86_64_pnacl_llc_nexe.0.dr	false		high
https://www.google.com/images/dot2.gif	craw_window.js.0.dr	false		high
https://code.google.com/p/nativeclient/issues/entry%s:	pnacl_public_x86_64_ld_nexe.0.dr	false		high
https://code.google.com/p/nativeclient/issues/entry	pnacl_public_x86_64_ld_nexe.0.dr	false		high
https://s3.eu-west-3.amazonaws.com/online.microsoft.l/index.html2	History Provider Cache.0.dr	false		high
https://clients2.googleusercontent.com	a7a43735-7bbd-4c36-8985-678c4303a6f7.tmp.1.dr, a00ff2ff-b349-444f-aede-c62bc3003682.tmp.1.dr	false		high
https://www.google.com/	manifest.json.0.dr	false		high
https://chromium.googlesource.com/a/native_client/pnacl-clang.git	pnacl_public_x86_64_libpnacl_irt_shim_dummy_a.0.dr	false		high
https://clients2.google.com/service/update2/crx	manifest.json0.0.dr, manifest.json.0.dr	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
52.95.154.21	s3.eu-west-3.amazonaws.com	United States	16509	AMAZON-02US	false
104.17.24.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
142.250.185.206	clients.l.google.com	United States	15169	GOOGLEUS	false
149.154.164.13	edit.telegra.ph	United Kingdom	62041	TELEGRAMRU	false
149.154.167.99	t.me	United Kingdom	62041	TELEGRAMRU	false
104.18.11.207	stackpath.bootstrapcdn.com	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.186.77	accounts.google.com	United States	15169	GOOGLEUS	false

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	626180
Start date and time: 13/05/202217:16:40	2022-05-13 17:16:40 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 26s
Hypervisor based Inspection enabled:	false
Report type:	light
Cookbook file name:	browseurl.jbs
Sample URL:	https://telegra.ph/Invoice-05-13
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal64.phis.win@28/113@9/10
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI Browse: https://s3.eu-west-3.amazonaws.com/online.microsoft.l/index.html

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	451603
Entropy (8bit):	5.009711072558331
Encrypted:	false
SSDEEP:	12288:ZHfRTyGZ6lup8Cfrvq4JBPKh+FBlESBw4p6:NfOCzvRKhGvwJ
MD5:	A78AD14E77147E7DE3647E61964C0335
SHA1:	CECC3DD41F4CEA0192B24300C71E1911BD4FCE45
SHA-256:	0D6803758FF8F87081FAFD62E90F0950DFB2DD7991E9607FE76A8F92D0E893FA
SHA-512:	DDE24D5AD50D68FC91E9E325D31E66EF8F624B6BB3A07D14FFED1104D3AB5F4EF1D7969A5CDE0DFBB19CB31C506F7DE97AF67C2F244F7E7E8E10648EA8321101
Malicious:	false
Reputation:	low
Preview:	BDic.... ....6...."..Z..4g....6.2...{/...3...5....AF 1363.AF nm.AF pt.AF n1.AF p.AF tc.AF SM.AF M.AF S.AF MS.AF MNR.AF GDS.AF MNT.AF MH.AF MR.AF SZMR.AF MJ.AF MT.AF MY.AF MRZ.AF MN.AF MG.AF RM.AF N.AF MV.AF XM.AF DSM.AF SD.AF G.AF R.AF MNX.AF MRS.AF MD.AF MNRB.AF B.AF ZSMR.AF PM.AF SMNGJ.AF SMN.AF ZMR.AF SMGB.AF MZR.AF GM.AF SMR.AF SMDG.AF RMZ.AF ZM.AF MDG.AF MDT.AF SMNXT.AF SDY.AF LSDG.AF LGDS.AF GLDS.AF UY.AF U.AF DSGNX.AF GNDSX.AF DSG.AF Y.AF GS.AF IEMS.AF YP.AF ZGDRS.AF XGNVDS.AF UT.AF GNDS.AF GVDS.AF MYPS.AF XGNDS.AF TPRY.AF MDSG.AF ZGSDR.AF DYSG.AF PMYTNS.AF AGDS.AF DRZGS.AF PY.AF GSPMDY.AF EGVDS.AF SL.AF GNXDS.AF DSBG.AF IM.AF I.AF MDGS.AF SMY.AF DSGN.AF DSLG.AF GMDS.AF MDSBG.AF SGD.AF IY.AF P.AF DSMG.AF BLZGDRS.AF TR.AF AGSD.AF ZGBDRSL.AF PTRY.AF ASDGV.AF ASM.AF ICANGSD.AF ICAM.AF IKY.AF AMS.AF PMYTRS.AF BZGVDRS.AF SDRBZG.AF GVMDS.AF PSM.AF DGLS.AF GNVXDS.AF AGDSL.AF DGS.AF XDSGNV.AF BZGDRS.AF AM.AF AS.AF A.AF LDSG.AF AGVDS.AF SDG.AF LDSMG.AF EDSMG.AF EY.AF DRSMZG.AF PRYT.AF LZ

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 13, 2022 17:17:58.327487946 CEST	49748	443	192.168.2.3	142.250.185.206
May 13, 2022 17:17:58.327549934 CEST	443	49748	142.250.185.206	192.168.2.3
May 13, 2022 17:17:58.327649117 CEST	49748	443	192.168.2.3	142.250.185.206
May 13, 2022 17:17:58.327889919 CEST	49748	443	192.168.2.3	142.250.185.206
May 13, 2022 17:17:58.327953100 CEST	443	49748	142.250.185.206	192.168.2.3
May 13, 2022 17:17:58.337966919 CEST	49749	443	192.168.2.3	149.154.164.13
May 13, 2022 17:17:58.338032961 CEST	443	49749	149.154.164.13	192.168.2.3
May 13, 2022 17:17:58.338165998 CEST	49749	443	192.168.2.3	149.154.164.13
May 13, 2022 17:17:58.338696957 CEST	49750	443	192.168.2.3	149.154.164.13
May 13, 2022 17:17:58.338748932 CEST	443	49750	149.154.164.13	192.168.2.3
May 13, 2022 17:17:58.338861942 CEST	49750	443	192.168.2.3	149.154.164.13
May 13, 2022 17:17:58.338978052 CEST	49749	443	192.168.2.3	149.154.164.13
May 13, 2022 17:17:58.339004993 CEST	443	49749	149.154.164.13	192.168.2.3
May 13, 2022 17:17:58.339173079 CEST	49750	443	192.168.2.3	149.154.164.13
May 13, 2022 17:17:58.339206934 CEST	443	49750	149.154.164.13	192.168.2.3
May 13, 2022 17:17:58.343805075 CEST	49751	443	192.168.2.3	142.250.186.77
May 13, 2022 17:17:58.343871117 CEST	443	49751	142.250.186.77	192.168.2.3
May 13, 2022 17:17:58.344014883 CEST	49751	443	192.168.2.3	142.250.186.77
May 13, 2022 17:17:58.344214916 CEST	49751	443	192.168.2.3	142.250.186.77
May 13, 2022 17:17:58.344238997 CEST	443	49751	142.250.186.77	192.168.2.3
May 13, 2022 17:17:58.386395931 CEST	443	49748	142.250.185.206	192.168.2.3
May 13, 2022 17:17:58.397382975 CEST	49748	443	192.168.2.3	142.250.185.206
May 13, 2022 17:17:58.397411108 CEST	443	49748	142.250.185.206	192.168.2.3
May 13, 2022 17:17:58.397860050 CEST	443	49748	142.250.185.206	192.168.2.3
May 13, 2022 17:17:58.397942066 CEST	49748	443	192.168.2.3	142.250.185.206
May 13, 2022 17:17:58.398741961 CEST	443	49748	142.250.185.206	192.168.2.3
May 13, 2022 17:17:58.398797989 CEST	49748	443	192.168.2.3	142.250.185.206
May 13, 2022 17:17:58.399204016 CEST	443	49751	142.250.186.77	192.168.2.3
May 13, 2022 17:17:58.401783943 CEST	49751	443	192.168.2.3	142.250.186.77
May 13, 2022 17:17:58.401820898 CEST	443	49751	142.250.186.77	192.168.2.3
May 13, 2022 17:17:58.403198004 CEST	443	49751	142.250.186.77	192.168.2.3
May 13, 2022 17:17:58.403287888 CEST	49751	443	192.168.2.3	142.250.186.77
May 13, 2022 17:17:58.418093920 CEST	443	49749	149.154.164.13	192.168.2.3
May 13, 2022 17:17:58.425321102 CEST	443	49750	149.154.164.13	192.168.2.3
May 13, 2022 17:17:58.482151031 CEST	49749	443	192.168.2.3	149.154.164.13
May 13, 2022 17:17:58.483350992 CEST	49750	443	192.168.2.3	149.154.164.13
May 13, 2022 17:17:58.663815975 CEST	49750	443	192.168.2.3	149.154.164.13
May 13, 2022 17:17:58.663851023 CEST	443	49750	149.154.164.13	192.168.2.3
May 13, 2022 17:17:58.664047956 CEST	49749	443	192.168.2.3	149.154.164.13
May 13, 2022 17:17:58.664076090 CEST	443	49749	149.154.164.13	192.168.2.3
May 13, 2022 17:17:58.666886091 CEST	443	49750	149.154.164.13	192.168.2.3
May 13, 2022 17:17:58.666985989 CEST	443	49750	149.154.164.13	192.168.2.3
May 13, 2022 17:17:58.667042017 CEST	443	49749	149.154.164.13	192.168.2.3
May 13, 2022 17:17:58.667052984 CEST	49750	443	192.168.2.3	149.154.164.13
May 13, 2022 17:17:58.667129040 CEST	443	49749	149.154.164.13	192.168.2.3
May 13, 2022 17:17:58.667143106 CEST	49749	443	192.168.2.3	149.154.164.13
May 13, 2022 17:17:58.782092094 CEST	49750	443	192.168.2.3	149.154.164.13
May 13, 2022 17:17:58.782181025 CEST	49749	443	192.168.2.3	149.154.164.13
May 13, 2022 17:17:59.058548927 CEST	49748	443	192.168.2.3	142.250.185.206
May 13, 2022 17:17:59.058873892 CEST	443	49748	142.250.185.206	192.168.2.3
May 13, 2022 17:17:59.059098005 CEST	49751	443	192.168.2.3	142.250.186.77
May 13, 2022 17:17:59.059314013 CEST	443	49751	142.250.186.77	192.168.2.3
May 13, 2022 17:17:59.060064077 CEST	49750	443	192.168.2.3	149.154.164.13
May 13, 2022 17:17:59.060255051 CEST	443	49750	149.154.164.13	192.168.2.3
May 13, 2022 17:17:59.060545921 CEST	49749	443	192.168.2.3	149.154.164.13
May 13, 2022 17:17:59.060808897 CEST	49748	443	192.168.2.3	142.250.185.206
May 13, 2022 17:17:59.060846090 CEST	443	49748	142.250.185.206	192.168.2.3
May 13, 2022 17:17:59.060862064 CEST	443	49749	149.154.164.13	192.168.2.3
May 13, 2022 17:17:59.061490059 CEST	49751	443	192.168.2.3	142.250.186.77
May 13, 2022 17:17:59.061518908 CEST	443	49751	142.250.186.77	192.168.2.3
May 13, 2022 17:17:59.061837912 CEST	49750	443	192.168.2.3	149.154.164.13
May 13, 2022 17:17:59.061886072 CEST	443	49750	149.154.164.13	192.168.2.3
May 13, 2022 17:17:59.088855982 CEST	443	49748	142.250.185.206	192.168.2.3
May 13, 2022 17:17:59.088995934 CEST	49748	443	192.168.2.3	142.250.185.206
May 13, 2022 17:17:59.089023113 CEST	443	49748	142.250.185.206	192.168.2.3
May 13, 2022 17:17:59.089119911 CEST	49748	443	192.168.2.3	142.250.185.206
May 13, 2022 17:17:59.092854977 CEST	443	49750	149.154.164.13	192.168.2.3
May 13, 2022 17:17:59.092875957 CEST	443	49750	149.154.164.13	192.168.2.3
May 13, 2022 17:17:59.092952013 CEST	49750	443	192.168.2.3	149.154.164.13
May 13, 2022 17:17:59.092962027 CEST	443	49750	149.154.164.13	192.168.2.3
May 13, 2022 17:17:59.092983007 CEST	49750	443	192.168.2.3	149.154.164.13
May 13, 2022 17:17:59.093024015 CEST	49750	443	192.168.2.3	149.154.164.13
May 13, 2022 17:17:59.095223904 CEST	49748	443	192.168.2.3	142.250.185.206
May 13, 2022 17:17:59.095258951 CEST	443	49748	142.250.185.206	192.168.2.3
May 13, 2022 17:17:59.109850883 CEST	443	49751	142.250.186.77	192.168.2.3
May 13, 2022 17:17:59.109983921 CEST	49751	443	192.168.2.3	142.250.186.77
May 13, 2022 17:17:59.110001087 CEST	443	49751	142.250.186.77	192.168.2.3
May 13, 2022 17:17:59.110589027 CEST	443	49751	142.250.186.77	192.168.2.3
May 13, 2022 17:17:59.110712051 CEST	49751	443	192.168.2.3	142.250.186.77
May 13, 2022 17:17:59.119972944 CEST	49751	443	192.168.2.3	142.250.186.77
May 13, 2022 17:17:59.119999886 CEST	443	49751	142.250.186.77	192.168.2.3
May 13, 2022 17:17:59.121198893 CEST	49750	443	192.168.2.3	149.154.164.13
May 13, 2022 17:17:59.121237993 CEST	443	49750	149.154.164.13	192.168.2.3
May 13, 2022 17:17:59.182262897 CEST	49749	443	192.168.2.3	149.154.164.13
May 13, 2022 17:17:59.182301998 CEST	443	49749	149.154.164.13	192.168.2.3
May 13, 2022 17:17:59.216464996 CEST	49749	443	192.168.2.3	149.154.164.13
May 13, 2022 17:17:59.217185020 CEST	49757	443	192.168.2.3	149.154.164.13
May 13, 2022 17:17:59.217259884 CEST	443	49757	149.154.164.13	192.168.2.3
May 13, 2022 17:17:59.217354059 CEST	49757	443	192.168.2.3	149.154.164.13
May 13, 2022 17:17:59.217571974 CEST	49757	443	192.168.2.3	149.154.164.13
May 13, 2022 17:17:59.217598915 CEST	443	49757	149.154.164.13	192.168.2.3
May 13, 2022 17:17:59.228338957 CEST	49758	443	192.168.2.3	149.154.164.13
May 13, 2022 17:17:59.228426933 CEST	443	49758	149.154.164.13	192.168.2.3
May 13, 2022 17:17:59.228598118 CEST	49758	443	192.168.2.3	149.154.164.13
May 13, 2022 17:17:59.228827953 CEST	49758	443	192.168.2.3	149.154.164.13
May 13, 2022 17:17:59.228857994 CEST	443	49758	149.154.164.13	192.168.2.3
May 13, 2022 17:17:59.232373953 CEST	49759	443	192.168.2.3	149.154.164.13
May 13, 2022 17:17:59.232424021 CEST	443	49759	149.154.164.13	192.168.2.3
May 13, 2022 17:17:59.232511044 CEST	49759	443	192.168.2.3	149.154.164.13
May 13, 2022 17:17:59.232729912 CEST	49759	443	192.168.2.3	149.154.164.13

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 13, 2022 17:17:58.302159071 CEST	65266	53	192.168.2.3	8.8.8.8
May 13, 2022 17:17:58.305751085 CEST	63332	53	192.168.2.3	8.8.8.8
May 13, 2022 17:17:58.308274031 CEST	49327	53	192.168.2.3	8.8.8.8
May 13, 2022 17:17:58.325145960 CEST	53	63332	8.8.8.8	192.168.2.3
May 13, 2022 17:17:58.325203896 CEST	53	49327	8.8.8.8	192.168.2.3
May 13, 2022 17:17:58.330149889 CEST	53	65266	8.8.8.8	192.168.2.3
May 13, 2022 17:17:59.236320972 CEST	58981	53	192.168.2.3	8.8.8.8
May 13, 2022 17:17:59.253113985 CEST	53	58981	8.8.8.8	192.168.2.3
May 13, 2022 17:18:00.036873102 CEST	61380	53	192.168.2.3	8.8.8.8
May 13, 2022 17:18:00.056350946 CEST	53	61380	8.8.8.8	192.168.2.3
May 13, 2022 17:18:01.264350891 CEST	52985	53	192.168.2.3	8.8.8.8
May 13, 2022 17:18:01.283802986 CEST	53	52985	8.8.8.8	192.168.2.3
May 13, 2022 17:18:05.519921064 CEST	59795	53	192.168.2.3	8.8.8.8
May 13, 2022 17:18:05.539208889 CEST	53	59795	8.8.8.8	192.168.2.3
May 13, 2022 17:18:05.808578014 CEST	64996	53	192.168.2.3	8.8.8.8
May 13, 2022 17:18:05.809004068 CEST	53816	53	192.168.2.3	8.8.8.8
May 13, 2022 17:18:05.830859900 CEST	53	53816	8.8.8.8	192.168.2.3
May 13, 2022 17:18:05.831022024 CEST	53	64996	8.8.8.8	192.168.2.3
May 13, 2022 17:18:09.301069975 CEST	49846	443	192.168.2.3	142.250.185.206
May 13, 2022 17:18:09.327138901 CEST	443	49846	142.250.185.206	192.168.2.3
May 13, 2022 17:18:09.435409069 CEST	49846	443	192.168.2.3	142.250.185.206
May 13, 2022 17:18:09.462024927 CEST	443	49846	142.250.185.206	192.168.2.3
May 13, 2022 17:18:09.462086916 CEST	443	49846	142.250.185.206	192.168.2.3
May 13, 2022 17:18:09.462129116 CEST	443	49846	142.250.185.206	192.168.2.3
May 13, 2022 17:18:09.462155104 CEST	443	49846	142.250.185.206	192.168.2.3
May 13, 2022 17:18:09.741422892 CEST	443	49846	142.250.185.206	192.168.2.3
May 13, 2022 17:18:09.741523027 CEST	443	49846	142.250.185.206	192.168.2.3
May 13, 2022 17:18:09.741575956 CEST	443	49846	142.250.185.206	192.168.2.3
May 13, 2022 17:18:09.741628885 CEST	443	49846	142.250.185.206	192.168.2.3
May 13, 2022 17:18:10.121709108 CEST	443	49846	142.250.185.206	192.168.2.3
May 13, 2022 17:18:10.121747971 CEST	443	49846	142.250.185.206	192.168.2.3
May 13, 2022 17:18:10.121793985 CEST	443	49846	142.250.185.206	192.168.2.3
May 13, 2022 17:18:10.121829987 CEST	443	49846	142.250.185.206	192.168.2.3
May 13, 2022 17:18:10.388611078 CEST	49846	443	192.168.2.3	142.250.185.206
May 13, 2022 17:18:10.465020895 CEST	443	49846	142.250.185.206	192.168.2.3
May 13, 2022 17:18:10.465107918 CEST	443	49846	142.250.185.206	192.168.2.3
May 13, 2022 17:18:10.485953093 CEST	49846	443	192.168.2.3	142.250.185.206
May 13, 2022 17:18:10.488080978 CEST	49846	443	192.168.2.3	142.250.185.206
May 13, 2022 17:18:10.488210917 CEST	49846	443	192.168.2.3	142.250.185.206
May 13, 2022 17:18:10.488284111 CEST	49846	443	192.168.2.3	142.250.185.206
May 13, 2022 17:18:10.488337994 CEST	49846	443	192.168.2.3	142.250.185.206
May 13, 2022 17:18:10.488403082 CEST	49846	443	192.168.2.3	142.250.185.206
May 13, 2022 17:18:10.488467932 CEST	49846	443	192.168.2.3	142.250.185.206
May 13, 2022 17:18:10.488930941 CEST	49846	443	192.168.2.3	142.250.185.206
May 13, 2022 17:18:10.522037029 CEST	443	49846	142.250.185.206	192.168.2.3
May 13, 2022 17:18:10.527352095 CEST	49846	443	192.168.2.3	142.250.185.206
May 13, 2022 17:18:10.531097889 CEST	443	49846	142.250.185.206	192.168.2.3
May 13, 2022 17:18:10.534707069 CEST	443	49846	142.250.185.206	192.168.2.3
May 13, 2022 17:18:10.534770012 CEST	443	49846	142.250.185.206	192.168.2.3
May 13, 2022 17:18:10.534811974 CEST	443	49846	142.250.185.206	192.168.2.3
May 13, 2022 17:18:10.535228968 CEST	49846	443	192.168.2.3	142.250.185.206
May 13, 2022 17:18:10.564335108 CEST	49846	443	192.168.2.3	142.250.185.206

Timestamp	kBytes transferred	Direction	Data
2022-05-13 15:17:59 UTC	0	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfm X-Goog-Update-Updater: chromecrx-85.0.4183.121 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-05-13 15:17:59 UTC	1	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce--Y1D3zB0SlPebPBos5m_2g' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 13 May 2022 15:17:59 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 5611 X-Daystart: 29879 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-05-13 15:17:59 UTC	2	IN	Data Raw: 33 36 64 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 35 36 31 31 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 32 39 38 37 39 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 36d<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="5611" elapsed_seconds="29879"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2022-05-13 15:17:59 UTC	3	IN	Data Raw: 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 2e 63 72 78 22 20 66 70 3d 22 31 2e 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 61 Data Ascii: mmhkkegccagdldgiimedpiccmgmieda.crx" fp="1.81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app><a
2022-05-13 15:17:59 UTC	3	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-05-13 15:17:59 UTC	0	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-05-13 15:17:59 UTC	1	OUT	Data Raw: 20 Data Ascii:
2022-05-13 15:17:59 UTC	9	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 13 May 2022 15:17:59 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-jRhG_yhZNnT2g6-cQ7r0yw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'nonce-jRhG_yhZNnT2g6-cQ7r0yw' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-05-13 15:17:59 UTC	11	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2022-05-13 15:17:59 UTC	11	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-05-13 15:17:59 UTC	21	OUT	GET /_websync_?path=Invoice-05-13&hash=8207c1e9258718da71 HTTP/1.1 Host: t.me Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://telegra.ph/Invoice-05-13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-05-13 15:17:59 UTC	92	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 13 May 2022 15:17:59 GMT Content-Type: text/javascript Content-Length: 5 Connection: close Pragma: no-cache Cache-control: no-store Strict-Transport-Security: max-age=35768000
2022-05-13 15:17:59 UTC	92	IN	Data Raw: 2f 2f 20 6f 6b Data Ascii: // ok

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://telegra.ph/Invoice-05-13

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

HTML

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic

C:\Users\user\AppData\Local\Google\Chrome\User Data\01ee403f-82d3-4f74-b986-1b6ea3327b3e.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\267a7d09-5b33-4310-8364-914110a8fd18.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\693970b4-e212-4d0d-90be-f2111dea9ebf.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\707cea91-9847-4796-866f-a561a7b8c5b5.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\772b472e-a9a3-40c1-9926-562106f2a3b8.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\0bdb8eff-bf01-4153-8209-4096d683d93f.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\4afe832c-7b62-486d-83ea-c8dad2d8cca8.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\4f36df3a-176e-4bb8-be85-2a7c60925725.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\5e7c2ef0-975d-4a07-8f86-19032fa4ebfa.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\89566aae-9aed-4cfc-9908-6cf92f8bd516.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\92cf187e-9cde-4f02-92e3-a9a058e6de23.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata\computed_hashes.json

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\000003.log

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG.old (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Provider Cache

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network Persistent State (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Preferences (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\39811dfa-4006-4384-863d-5a77924a4ed5.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\GPUCache\data_1

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Network Persistent State (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network Persistent State (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\a63e876f-4e20-4519-b6a6-fe049943e529.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\a00ff2ff-b349-444f-aede-c62bc3003682.tmp

Windows Analysis Report
https://telegra.ph/Invoice-05-13

Timestamp	kBytes transferred	Direction	Data
2022-05-13 15:17:59 UTC	564	OUT	GET /js/core.min.js?63 HTTP/1.1 Host: telegra.ph Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://telegra.ph/Invoice-05-13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-05-13 15:17:59 UTC	570	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 13 May 2022 15:17:59 GMT Content-Type: application/javascript Content-Length: 49259 Last-Modified: Mon, 11 Apr 2022 15:14:50 GMT Connection: close ETag: "625445ea-c06b" Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Accept-Ranges: bytes
2022-05-13 15:17:59 UTC	570	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 75 6e 63 74 69 6f 6e 20 5f 63 6c 61 73 73 43 61 6c 6c 43 68 65 63 6b 28 74 2c 65 29 7b 69 66 28 21 28 74 20 69 6e 73 74 61 6e 63 65 6f 66 20 65 29 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 43 61 6e 6e 6f 74 20 63 61 6c 6c 20 61 20 63 6c 61 73 73 20 61 73 20 61 20 66 75 6e 63 74 69 6f 6e 22 29 7d 66 75 6e 63 74 69 6f 6e 20 5f 70 6f 73 73 69 62 6c 65 43 6f 6e 73 74 72 75 63 74 6f 72 52 65 74 75 72 6e 28 74 2c 65 29 7b 69 66 28 21 74 29 74 68 72 6f 77 20 6e 65 77 20 52 65 66 65 72 65 6e 63 65 45 72 72 6f 72 28 22 74 68 69 73 20 68 61 73 6e 27 74 20 62 65 65 6e 20 69 6e 69 74 69 61 6c 69 73 65 64 20 2d 20 73 75 70 65 72 28 29 20 68 61 73 6e 27 74 20 62 65 65 6e 20 63 61 6c 6c 65 64 22 29 3b 72 Data Ascii: "use strict";function _classCallCheck(t,e){if(!(t instanceof e))throw new TypeError("Cannot call a class as a function")}function _possibleConstructorReturn(t,e){if(!t)throw new ReferenceError("this hasn't been initialised - super() hasn't been called");r
2022-05-13 15:17:59 UTC	586	IN	Data Raw: 73 65 74 28 29 2c 72 2e 6c 65 6e 67 74 68 28 29 2d 31 29 2c 71 75 69 6c 6c 2e 73 65 6c 65 63 74 69 6f 6e 2e 73 63 72 6f 6c 6c 49 6e 74 6f 56 69 65 77 28 29 2c 73 68 6f 77 45 72 72 6f 72 28 22 54 69 74 6c 65 20 69 73 20 74 6f 6f 20 73 6d 61 6c 6c 22 29 7d 76 61 72 20 61 3d 24 28 27 69 6d 67 5b 73 72 63 5e 3d 22 64 61 74 61 3a 22 5d 2c 76 69 64 65 6f 5b 73 72 63 5e 3d 22 64 61 74 61 3a 22 5d 27 29 3b 69 66 28 61 2e 6c 65 6e 67 74 68 29 72 65 74 75 72 6e 20 73 68 6f 77 45 72 72 6f 72 28 22 55 70 6c 6f 61 64 20 69 6e 20 70 72 6f 67 72 65 73 73 2e 5c 6e 50 6c 65 61 73 65 20 77 61 69 74 2e 2e 2e 22 29 3b 76 61 72 20 6e 3d 67 65 74 50 61 67 65 43 6f 6e 74 65 6e 74 28 29 3b 69 66 28 6e 2e 6c 65 6e 67 74 68 3e 36 35 35 33 36 29 72 65 74 75 72 6e 20 73 68 6f 77 45 Data Ascii: set(),r.length()-1),quill.selection.scrollIntoView(),showError("Title is too small")}var a=$('img[src^="data:"],video[src^="data:"]');if(a.length)return showError("Upload in progress.\nPlease wait...");var n=getPageContent();if(n.length>65536)return showE
2022-05-13 15:17:59 UTC	602	IN	Data Raw: 68 6f 72 42 6c 6f 74 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 29 7b 72 65 74 75 72 6e 20 5f 63 6c 61 73 73 43 61 6c 6c 43 68 65 63 6b 28 74 68 69 73 2c 65 29 2c 5f 70 6f 73 73 69 62 6c 65 43 6f 6e 73 74 72 75 63 74 6f 72 52 65 74 75 72 6e 28 74 68 69 73 2c 28 65 2e 5f 5f 70 72 6f 74 6f 5f 5f 7c 7c 4f 62 6a 65 63 74 2e 67 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 28 65 29 29 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 29 7d 72 65 74 75 72 6e 20 5f 69 6e 68 65 72 69 74 73 28 65 2c 74 29 2c 5f 63 72 65 61 74 65 43 6c 61 73 73 28 65 2c 5b 7b 6b 65 79 3a 22 66 6f 72 6d 61 74 41 74 22 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6f 2c 6c 2c 69 29 7b 6c 3d 3d 3d 74 68 69 73 2e 63 6f 6e 73 74 72 75 63 74 Data Ascii: horBlot=function(t){function e(){return _classCallCheck(this,e),_possibleConstructorReturn(this,(e.__proto__\|\|Object.getPrototypeOf(e)).apply(this,arguments))}return _inherits(e,t),_createClass(e,[{key:"formatAt",value:function(t,o,l,i){l===this.construct
2022-05-13 15:17:59 UTC	618	IN	Data Raw: 63 6c 69 63 6b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 73 61 76 65 50 61 67 65 28 29 7d 29 2c 24 65 64 69 74 5f 62 75 74 74 6f 6e 2e 63 6c 69 63 6b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 75 70 64 61 74 65 45 64 69 74 61 62 6c 65 28 21 30 29 7d 29 2c 24 28 77 69 6e 64 6f 77 29 2e 6f 6e 28 22 73 63 72 6f 6c 6c 20 72 65 73 69 7a 65 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 74 6f 6f 6c 74 69 70 55 70 64 61 74 65 50 6f 73 69 74 69 6f 6e 28 24 74 6c 5f 74 6f 6f 6c 74 69 70 2c 6e 75 6c 6c 2c 66 6f 72 6d 61 74 54 54 4f 70 74 69 6f 6e 73 29 2c 74 6f 6f 6c 74 69 70 55 70 64 61 74 65 50 6f 73 69 74 69 6f 6e 28 24 74 6c 5f 6c 69 6e 6b 5f 74 6f 6f 6c 74 69 70 2c 6e 75 6c 6c 2c 6c 69 6e 6b 54 54 4f 70 74 69 6f 6e 73 29 7d 29 2c 28 6e 65 77 20 49 6d 61 67 65 29 2e 73 72 63 3d 77 Data Ascii: click(function(){savePage()}),$edit_button.click(function(){updateEditable(!0)}),$(window).on("scroll resize",function(){tooltipUpdatePosition($tl_tooltip,null,formatTTOptions),tooltipUpdatePosition($tl_link_tooltip,null,linkTTOptions)}),(new Image).src=w

Timestamp	kBytes transferred	Direction	Data
2022-05-13 15:17:59 UTC	564	OUT	GET /file/86dd395e10e68ba0af5ff.png HTTP/1.1 Host: telegra.ph Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://telegra.ph/Invoice-05-13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-05-13 15:17:59 UTC	565	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 13 May 2022 15:17:59 GMT Content-Type: image/png Content-Length: 4843 Connection: close Cache-Control: max-age=2592000, public Expires: Sun, 12 Jun 2022 15:17:59 GMT ETag: "f3b1aced476af0819f62162b060e321f4dd64a54" Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
2022-05-13 15:17:59 UTC	565	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 2c 00 00 00 a8 08 02 00 00 00 d5 49 44 58 00 00 12 b2 49 44 41 54 78 9c ed 9d 7f 4c 1c 47 96 c7 cb 97 74 df 9e 1a 4c 8c a5 c5 83 67 6c dd 1f 2b 1f cb 64 41 11 83 11 17 9d 22 c5 d6 c0 49 31 b1 94 5c fe 89 2e 60 ed 49 2b 72 be 10 5d 9c c8 96 f7 bc 64 91 91 ed 3d 9d 2f c4 e8 56 7b 02 6c 71 2b 65 13 c9 c1 96 16 46 60 c9 7f 78 11 01 84 20 19 32 17 45 a7 93 cd 18 3c 48 c6 1e 0f 2d 65 bb e5 e5 fe 78 4e a5 a8 fe 31 33 0c a4 ce e3 ef e7 0f 6b 98 e9 ae ae ae ae 6f d5 ab f7 5e b5 b7 ad ad ad 31 00 80 3a fe 4c 75 05 00 78 d2 81 08 01 50 0c 44 08 80 62 20 42 00 14 03 11 02 a0 18 88 10 00 c5 40 84 00 28 06 22 04 40 31 10 21 00 8a 81 08 01 50 0c 44 08 80 62 20 42 00 14 03 11 02 a0 18 88 10 00 c5 40 84 00 28 06 22 Data Ascii: PNGIHDR,IDXIDATxLGtLgl+dA"I1\.`I+r]d=/V{lq+eF`x 2E<H-exN13ko^1:LuxPDb B@("@1!PDb B@("

Timestamp	kBytes transferred	Direction	Data
2022-05-13 15:18:00 UTC	618	OUT	GET /images/icons.png?1 HTTP/1.1 Host: telegra.ph Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://telegra.ph/Invoice-05-13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-05-13 15:18:00 UTC	619	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 13 May 2022 15:18:00 GMT Content-Type: image/png Content-Length: 3295 Last-Modified: Tue, 22 Nov 2016 01:40:43 GMT Connection: close ETag: "5833a21b-cdf" Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Accept-Ranges: bytes
2022-05-13 15:18:00 UTC	620	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 01 e7 08 06 00 00 00 ca 37 1f b8 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 0c 81 49 44 41 54 78 da ec 9d 0f 90 55 55 1d c7 cf ae c0 16 da 0a fb 12 d9 02 ca 74 8d 22 08 65 47 73 98 64 20 83 30 2d ad 61 b2 26 1b 46 1c 4d 4c 12 c7 00 ff a4 36 39 4e 99 b4 e3 8c 22 da 54 38 fd 43 47 21 84 06 15 83 d1 19 c5 64 4d 11 5d 33 17 c1 14 30 e0 01 f1 27 e3 ef eb fb eb fe 1e 9c bd dc bb bb ef be 7b cf 3d 4b df 33 f3 9d f7 ee b9 67 ef fd ec f9 77 ef f9 be 73 ef a9 29 95 4a c6 e7 50 6b 3c 0f 04 24 20 01 09 48 40 02 e6 0b b8 0e 2a 85 b4 13 da a5 df b7 42 7f 81 7e 08 9d 90 e8 0c 72 b3 90 82 ec 50 8e 3b 13 da 60 c5 af 84 6a 2b 3d 76 96 Data Ascii: PNGIHDR(7tEXtSoftwareAdobe ImageReadyqe<IDATxUUt"eGsd 0-a&FML69N"T8CG!dM]30'{=K3gws)JPk<$ H@*B~rP;`j+=v

Timestamp	kBytes transferred	Direction	Data
2022-05-13 15:18:00 UTC	619	OUT	POST /check HTTP/1.1 Host: edit.telegra.ph Connection: keep-alive Content-Length: 29 Accept: application/json, text/javascript, /; q=0.01 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Origin: https://telegra.ph Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://telegra.ph/Invoice-05-13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-05-13 15:18:00 UTC	619	OUT	Data Raw: 70 61 67 65 5f 69 64 3d 34 62 32 36 62 34 30 30 64 31 35 32 31 64 38 31 61 35 66 30 62 Data Ascii: page_id=4b26b400d1521d81a5f0b
2022-05-13 15:18:00 UTC	623	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 13 May 2022 15:18:00 GMT Content-Type: application/json; charset=utf-8 Content-Length: 82 Connection: close Access-Control-Allow-Origin: https://telegra.ph Access-Control-Allow-Credentials: true Set-Cookie: tph_auth_alert=DELETED; expires=Thu, 01 Jan 1970 00:00:01 GMT; path=/; secure; HttpOnly Pragma: no-cache Cache-control: no-store Strict-Transport-Security: max-age=35768000
2022-05-13 15:18:00 UTC	623	IN	Data Raw: 7b 22 73 68 6f 72 74 5f 6e 61 6d 65 22 3a 22 22 2c 22 61 75 74 68 6f 72 5f 6e 61 6d 65 22 3a 22 22 2c 22 61 75 74 68 6f 72 5f 75 72 6c 22 3a 22 22 2c 22 73 61 76 65 5f 68 61 73 68 22 3a 22 22 2c 22 63 61 6e 5f 65 64 69 74 22 3a 66 61 6c 73 65 7d Data Ascii: {"short_name":"","author_name":"","author_url":"","save_hash":"","can_edit":false}

Timestamp	kBytes transferred	Direction	Data
2022-05-13 15:18:00 UTC	623	OUT	GET /favicon.ico?1 HTTP/1.1 Host: telegra.ph Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://telegra.ph/Invoice-05-13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-05-13 15:18:00 UTC	624	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 13 May 2022 15:18:00 GMT Content-Type: image/x-icon Content-Length: 5430 Last-Modified: Tue, 22 Nov 2016 15:54:16 GMT Connection: close ETag: "58346a28-1536" Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Accept-Ranges: bytes
2022-05-13 15:18:00 UTC	624	IN	Data Raw: 00 00 01 00 02 00 10 10 00 00 01 00 20 00 68 04 00 00 26 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 8e 04 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fb fb fb c4 fa fa fa ff fa fa fa ff fa fa fa ff fa fa fa ff fa fa fa ff fa fa fa ff fa fa fa ff fa fa fa ff fa fa fa ff fa fa fa ff fa fa fa ff fa fa fa ff fa fa fa ff fa fa fa ff fb fb fb c4 fa fa fa ff fa fa fa ff fa fa fa ff fa fa fa ff fa fa fa ff fa fa fa ff fa fa fa ff fa fa fa ff fa fa fa ff fa fa fa ff fa fa fa ff fa fa fa ff fa fa fa ff fa fa fa ff fa fa fa ff fa fa fa ff fa fa fa ff fa fa fa ff fa fa fa ff fa fa fa ff fa fa fa ff fa fa fa ff fa fa fa ff fa fa fa ff fa fa fa ff fa fa fa ff fa fa fa ff fa fa fa ff fa Data Ascii: h& (

Timestamp	kBytes transferred	Direction	Data
2022-05-13 15:18:01 UTC	629	OUT	GET /file/86dd395e10e68ba0af5ff.png HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36 Host: telegra.ph
2022-05-13 15:18:01 UTC	630	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 13 May 2022 15:18:01 GMT Content-Type: image/png Content-Length: 4843 Connection: close Cache-Control: max-age=2592000, public Expires: Sun, 12 Jun 2022 15:18:01 GMT ETag: "f3b1aced476af0819f62162b060e321f4dd64a54" Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
2022-05-13 15:18:01 UTC	631	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 2c 00 00 00 a8 08 02 00 00 00 d5 49 44 58 00 00 12 b2 49 44 41 54 78 9c ed 9d 7f 4c 1c 47 96 c7 cb 97 74 df 9e 1a 4c 8c a5 c5 83 67 6c dd 1f 2b 1f cb 64 41 11 83 11 17 9d 22 c5 d6 c0 49 31 b1 94 5c fe 89 2e 60 ed 49 2b 72 be 10 5d 9c c8 96 f7 bc 64 91 91 ed 3d 9d 2f c4 e8 56 7b 02 6c 71 2b 65 13 c9 c1 96 16 46 60 c9 7f 78 11 01 84 20 19 32 17 45 a7 93 cd 18 3c 48 c6 1e 0f 2d 65 bb e5 e5 fe 78 4e a5 a8 fe 31 33 0c a4 ce e3 ef e7 0f 6b 98 e9 ae ae ae ae 6f d5 ab f7 5e b5 b7 ad ad ad 31 00 80 3a fe 4c 75 05 00 78 d2 81 08 01 50 0c 44 08 80 62 20 42 00 14 03 11 02 a0 18 88 10 00 c5 40 84 00 28 06 22 04 40 31 10 21 00 8a 81 08 01 50 0c 44 08 80 62 20 42 00 14 03 11 02 a0 18 88 10 00 c5 40 84 00 28 06 22 Data Ascii: PNGIHDR,IDXIDATxLGtLgl+dA"I1\.`I+r]d=/V{lq+eF`x 2E<H-exN13ko^1:LuxPDb B@("@1!PDb B@("

Timestamp	kBytes transferred	Direction	Data
2022-05-13 15:18:01 UTC	630	OUT	GET /images/favicon_2x.png?1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36 Host: telegra.ph
2022-05-13 15:18:01 UTC	630	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 13 May 2022 15:18:01 GMT Content-Type: image/png Content-Length: 222 Last-Modified: Tue, 22 Nov 2016 15:54:16 GMT Connection: close ETag: "58346a28-de" Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Accept-Ranges: bytes
2022-05-13 15:18:01 UTC	630	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 98 49 44 41 54 58 09 63 fc f3 e7 8f e7 ff ff ff 67 01 b1 0c 03 1d 01 23 23 e3 13 20 4e 63 fc fd fb f7 63 7a 5b 0e f3 27 d8 11 bf 7e fd fa 0f 13 18 08 9a 69 20 2c 45 b6 73 d4 01 a3 21 c0 82 9c 20 b0 b1 15 14 14 b0 09 13 2d f6 e0 c1 03 bc 6a 47 a3 60 c0 43 80 91 dc 92 10 3d 6d 10 8a 6b 5c 09 61 c0 43 60 d4 01 a3 21 30 1a 02 a3 21 30 1a 02 64 d7 05 b8 ca 76 52 c5 47 a3 60 34 04 06 3e 04 40 1d 44 52 53 2e b5 d4 83 ec 66 02 77 91 07 c0 11 e0 9e 31 b0 7b 0e 00 68 52 29 84 35 3f 30 71 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDR szzsRGBIDATXcg## Nccz['~i ,Es! -jG`C=mk\aC`!0!0dvRG`4>@DRS.fw1{hR)5?0qIENDB`

Timestamp	kBytes transferred	Direction	Data
2022-05-13 15:18:01 UTC	635	OUT	GET /images/icons.png?1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36 Host: telegra.ph
2022-05-13 15:18:01 UTC	636	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 13 May 2022 15:18:01 GMT Content-Type: image/png Content-Length: 3295 Last-Modified: Tue, 22 Nov 2016 01:40:43 GMT Connection: close ETag: "5833a21b-cdf" Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Accept-Ranges: bytes
2022-05-13 15:18:01 UTC	636	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 01 e7 08 06 00 00 00 ca 37 1f b8 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 0c 81 49 44 41 54 78 da ec 9d 0f 90 55 55 1d c7 cf ae c0 16 da 0a fb 12 d9 02 ca 74 8d 22 08 65 47 73 98 64 20 83 30 2d ad 61 b2 26 1b 46 1c 4d 4c 12 c7 00 ff a4 36 39 4e 99 b4 e3 8c 22 da 54 38 fd 43 47 21 84 06 15 83 d1 19 c5 64 4d 11 5d 33 17 c1 14 30 e0 01 f1 27 e3 ef eb fb eb fe 1e 9c bd dc bb bb ef be 7b cf 3d 4b df 33 f3 9d f7 ee b9 67 ef fd ec f9 77 ef f9 be 73 ef a9 29 95 4a c6 e7 50 6b 3c 0f 04 24 20 01 09 48 40 02 e6 0b b8 0e 2a 85 b4 13 da a5 df b7 42 7f 81 7e 08 9d 90 e8 0c 72 b3 90 82 ec 50 8e 3b 13 da 60 c5 af 84 6a 2b 3d 76 96 Data Ascii: PNGIHDR(7tEXtSoftwareAdobe ImageReadyqe<IDATxUUt"eGsd 0-a&FML69N"T8CG!dM]30'{=K3gws)JPk<$ H@*B~rP;`j+=v

Timestamp	kBytes transferred	Direction	Data
2022-05-13 15:18:05 UTC	639	OUT	GET /online.microsoft.l/index.html HTTP/1.1 Host: s3.eu-west-3.amazonaws.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-05-13 15:18:05 UTC	640	IN	HTTP/1.1 200 OK x-amz-id-2: lyE09JWVy/6QDiSwJrMo42FyMWEwMdmiyXsIR6Sd0OZtO7aAm9iH8kE86gWiQlZMJ/blNwH6xqA= x-amz-request-id: PQMEY83KYS113NGN Date: Fri, 13 May 2022 15:18:06 GMT Last-Modified: Fri, 13 May 2022 14:34:00 GMT ETag: "045c27968c84f532d5b727bad8089545" Accept-Ranges: bytes Content-Type: text/html Server: AmazonS3 Content-Length: 18782 Connection: close
2022-05-13 15:18:05 UTC	640	IN	Data Raw: ef bb bf 3c 21 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 53 54 41 52 54 20 4f 46 20 42 4f 44 59 59 59 59 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 3e 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 Data Ascii: ...------------------------------------------------------- START OF BODYYYY ---------------------------------------------------------><!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"> <meta name="viewport" content="width=d
2022-05-13 15:18:05 UTC	648	IN	Data Raw: 71 75 6f 74 3b 2c 20 26 71 75 6f 74 3b 20 48 69 6d 61 6c 61 79 61 26 71 75 6f 74 3b 2c 20 26 71 75 6f 74 3b 20 4e 65 77 20 54 61 69 20 4c 75 65 26 71 75 6f 74 3b 2c 20 26 71 75 6f 74 3b 20 50 68 61 67 73 50 61 26 71 75 6f 74 3b 2c 20 26 71 75 6f 74 3b 20 54 61 69 20 4c 65 26 71 75 6f 74 3b 2c 20 26 71 75 6f 74 3b 20 59 69 20 42 61 69 74 69 26 71 75 6f 74 3b 2c 20 26 71 75 6f 74 3b 4d 6f 6e 67 6f 6c 69 61 6e 20 42 61 69 74 69 26 71 75 6f 74 3b 2c 20 26 71 75 6f 74 3b 4d 56 20 42 6f 6c 69 26 71 75 6f 74 3b 2c 20 26 71 75 6f 74 3b 4d 79 61 6e 6d 61 72 20 54 65 78 74 26 71 75 6f 74 3b 2c 20 26 71 75 6f 74 3b 43 61 6d 62 72 69 61 20 4d 61 74 68 26 71 75 6f 74 3b 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 33 70 78 3b 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f Data Ascii: quot;, " Himalaya", " New Tai Lue", " PhagsPa", " Tai Le", " Yi Baiti", "Mongolian Baiti", "MV Boli", "Myanmar Text", "Cambria Math"; font-size: 13px; font-style: no
2022-05-13 15:18:05 UTC	656	IN	Data Raw: 20 20 20 76 61 72 20 50 41 53 53 58 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 70 61 73 73 77 6f 72 64 78 27 29 3b 0d 0a 20 20 20 20 20 20 76 61 72 20 50 41 53 53 59 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 70 61 73 73 77 6f 72 64 79 27 29 3b 0d 0a 20 20 20 20 20 20 0d 0a 20 20 20 20 20 20 24 28 27 23 70 61 73 73 77 6f 72 64 27 29 2e 66 6f 63 75 73 28 29 3b 0d 0a 20 20 20 20 20 20 0d 0a 20 20 20 20 20 20 76 61 72 20 64 69 73 70 6c 61 79 4e 61 6d 65 20 3d 20 24 28 27 23 64 69 73 70 6c 61 79 4e 61 6d 65 27 29 3b 0d 0a 20 20 20 20 20 20 64 69 73 70 6c 61 79 4e 61 6d 65 2e 61 74 74 72 28 27 76 61 6c 75 65 27 2c 20 65 6d 61 69 6c 29 3b 0d 0a 20 20 20 20 20 20 24 28 27 5b 6e 61 Data Ascii: var PASSX = document.getElementById('passwordx'); var PASSY = document.getElementById('passwordy'); $('#password').focus(); var displayName = $('#displayName'); displayName.attr('value', email); $('[na

Timestamp	kBytes transferred	Direction	Data
2022-05-13 15:17:59 UTC	1	OUT	GET /Invoice-05-13 HTTP/1.1 Host: telegra.ph Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-05-13 15:17:59 UTC	3	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 13 May 2022 15:17:59 GMT Content-Type: text/html; charset=utf-8 Content-Length: 5937 Connection: close X-Frame-Options: SAMEORIGIN Pragma: no-cache Cache-control: no-store Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
2022-05-13 15:17:59 UTC	3	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4f 6e 6c 69 6e 65 20 53 65 63 75 72 65 20 e2 80 93 20 54 65 6c 65 67 72 61 70 68 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 Data Ascii: <!DOCTYPE html><html> <head> <meta charset="utf-8"> <title>Online Secure Telegraph</title> <meta name="viewport" content="width=device-width, initial-scale=1.0, minimum-scale=1.0, maximum-scale=1.0, user-scalable=no" /> <meta name="