Edit tour

Windows Analysis Report
PaymentDetails170.htm

Overview

General Information

Sample Name:	PaymentDetails170.htm
Analysis ID:	626232
MD5:	74814c82959caf161fec96e3603d206b
SHA1:	b7335dd4368545350234cb0861757447c5c1e3c7
SHA256:	1170b449d6be84da2421316280563c7c607582addfd63f66d594f1dd5c7edea8
Infos:

Detection

HTMLPhisher

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected HtmlPhish44

HTML document with suspicious name

Phishing site detected (based on image similarity)

JA3 SSL client fingerprint seen in connection with other malware

Suspicious form URL found

IP address seen in connection with other malware

None HTTPS page querying sensitive user data (password, username or email)

No HTML title found

Classification

Process Tree

System is w10x64

chrome.exe (PID: 3348 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "C:\Users\user\Desktop\PaymentDetails170.htm MD5: C139654B5C1438A95B321BB01AD63EF6)

chrome.exe (PID: 6012 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1584,7513029332295005769,2836462505576527454,131072 --lang=en-GB --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1664 /prefetch:8 MD5: C139654B5C1438A95B321BB01AD63EF6)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
PaymentDetails170.htm	JoeSecurity_HtmlPhish_44	Yara detected HtmlPhish_44	Joe Security

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8

Source: file:///C:/Users/user/Desktop/PaymentDetails170.htm	HTTP Parser: Form action: https://3amgroup.com/seo/oracle.php
Source: file:///C:/Users/user/Desktop/PaymentDetails170.htm	HTTP Parser: Form action: https://3amgroup.com/seo/oracle.php

Source: file:///C:/Users/user/Desktop/PaymentDetails170.htm	HTTP Parser: Has password / email / username input fields
Source: file:///C:/Users/user/Desktop/PaymentDetails170.htm	HTTP Parser: Has password / email / username input fields

Source: file:///C:/Users/user/Desktop/PaymentDetails170.htm	HTTP Parser: HTML title missing
Source: file:///C:/Users/user/Desktop/PaymentDetails170.htm	HTTP Parser: HTML title missing

Source: file:///C:/Users/user/Desktop/PaymentDetails170.htm	HTTP Parser: No <meta name="author".. found
Source: file:///C:/Users/user/Desktop/PaymentDetails170.htm	HTTP Parser: No <meta name="author".. found

Source: file:///C:/Users/user/Desktop/PaymentDetails170.htm	HTTP Parser: No <meta name="copyright".. found
Source: file:///C:/Users/user/Desktop/PaymentDetails170.htm	HTTP Parser: No <meta name="copyright".. found

Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox View	IP Address: 152.199.23.37 152.199.23.37

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-GB&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfmX-Goog-Update-Updater: chromecrx-85.0.4183.121Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /Remote/css/logon-s.css HTTP/1.1Host: remoteaccess.fabtekaero.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /Remote/css/en/logon.css HTTP/1.1Host: remoteaccess.fabtekaero.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /Remote/css/logon.css HTTP/1.1Host: remoteaccess.fabtekaero.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /Remote/Javascript/ramjsfx.menu.css HTTP/1.1Host: remoteaccess.fabtekaero.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /Remote/ScriptResource.axd?d=Q6BmI1jRBDyTlsgFKy8_y1hu8RoSXhGuDSwVgVBnEFY4jnoaRUpwhFPqoT5laGNS4XF0Dirn8ZrXRCGstutuNQJk74OrHUS3goRakhJjBZp3nlDuB1zqLNIrtKI2DEfB_29K5w_7egmFSG_jPi4TjrWm6_D55w0CtLWTxoCoIlnA0j4QX-JLYjitl04BH51k0&t=ffffffffcbc226b4 HTTP/1.1Host: remoteaccess.fabtekaero.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /Remote/Javascript/ramjsfx.watermark.js HTTP/1.1Host: remoteaccess.fabtekaero.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /Remote/Javascript/ramjsfx.core.js HTTP/1.1Host: remoteaccess.fabtekaero.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /Remote/javascript/ramjsfx.fluidlayout.js HTTP/1.1Host: remoteaccess.fabtekaero.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /Remote/Javascript/ramjsfx.js HTTP/1.1Host: remoteaccess.fabtekaero.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /Remote/ScriptResource.axd?d=hDtYIQpgHRviKRoBbknF_hwbz7W9qv1QuruF5fHeGY7aLvg0FZu8uo7oQM49G39kdLoq-10g3beffZ-r6bx56knWeXNtap5L52Zf4S9XgEebHL5Ym4ODB6s4m7yJEHzofWjAbR0llrqlCcaSElGrkYCa6ZfzGKQXhQgOo1HsReye0F_y5SNdgIllVG0APJ1s0&t=ffffffffcbc226b4 HTTP/1.1Host: remoteaccess.fabtekaero.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /Remote/Javascript/ramjsfx.menu.js HTTP/1.1Host: remoteaccess.fabtekaero.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /Remote/Javascript/ramjsfx.popupwindow.js HTTP/1.1Host: remoteaccess.fabtekaero.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /Remote/WebResource.axd?d=AtCAlJUCI67JA5mLHP_GDH_TlFS1EPFlMSz7ePpjtskBytpgY5DU6WpuCDLw8BaEhKFfMorY015VRWJfsGo8EkiPIzDFmL7aAZrNZV3XhdA1&t=637719884927241407 HTTP/1.1Host: remoteaccess.fabtekaero.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /Remote/javascript/ramjsfx.windowspool.js HTTP/1.1Host: remoteaccess.fabtekaero.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /Remote/Javascript/ramjsfx.utils.js HTTP/1.1Host: remoteaccess.fabtekaero.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: aadcdn.msftauth.net

Source: 5c008219-c240-4c35-bbf0-11dc479b3950.tmp.1.dr, 4c337d50-3b31-4751-80fc-6c511f5e8080.tmp.1.dr	String found in binary or memory: https://accounts.google.com
Source: craw_window.js.0.dr	String found in binary or memory: https://accounts.google.com/MergeSession
Source: 5c008219-c240-4c35-bbf0-11dc479b3950.tmp.1.dr, 4c337d50-3b31-4751-80fc-6c511f5e8080.tmp.1.dr	String found in binary or memory: https://apis.google.com
Source: 5c008219-c240-4c35-bbf0-11dc479b3950.tmp.1.dr, 4c337d50-3b31-4751-80fc-6c511f5e8080.tmp.1.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json.0.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 5c008219-c240-4c35-bbf0-11dc479b3950.tmp.1.dr, 4c337d50-3b31-4751-80fc-6c511f5e8080.tmp.1.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: 5c008219-c240-4c35-bbf0-11dc479b3950.tmp.1.dr, 2f05617d-bf2d-4f9f-a5d1-878e474b8020.tmp.1.dr, 4c337d50-3b31-4751-80fc-6c511f5e8080.tmp.1.dr, f6100422-ed05-40bb-9230-d7af9ca091ca.tmp.1.dr	String found in binary or memory: https://dns.google
Source: 5c008219-c240-4c35-bbf0-11dc479b3950.tmp.1.dr, 4c337d50-3b31-4751-80fc-6c511f5e8080.tmp.1.dr	String found in binary or memory: https://fonts.googleapis.com
Source: 5c008219-c240-4c35-bbf0-11dc479b3950.tmp.1.dr, 4c337d50-3b31-4751-80fc-6c511f5e8080.tmp.1.dr	String found in binary or memory: https://fonts.gstatic.com
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p
Source: 5c008219-c240-4c35-bbf0-11dc479b3950.tmp.1.dr, 4c337d50-3b31-4751-80fc-6c511f5e8080.tmp.1.dr	String found in binary or memory: https://ogs.google.com
Source: craw_window.js.0.dr, manifest.json.0.dr	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: 5c008219-c240-4c35-bbf0-11dc479b3950.tmp.1.dr, 4c337d50-3b31-4751-80fc-6c511f5e8080.tmp.1.dr	String found in binary or memory: https://play.google.com
Source: 4c337d50-3b31-4751-80fc-6c511f5e8080.tmp.1.dr	String found in binary or memory: https://r5---sn-h0jeln7l.gvt1.com
Source: 5c008219-c240-4c35-bbf0-11dc479b3950.tmp.1.dr, 4c337d50-3b31-4751-80fc-6c511f5e8080.tmp.1.dr	String found in binary or memory: https://redirector.gvt1.com
Source: craw_window.js.0.dr, manifest.json.0.dr	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: 5c008219-c240-4c35-bbf0-11dc479b3950.tmp.1.dr, 4c337d50-3b31-4751-80fc-6c511f5e8080.tmp.1.dr	String found in binary or memory: https://ssl.gstatic.com
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://www-googleapis-staging.sandbox.google.com
Source: 5c008219-c240-4c35-bbf0-11dc479b3950.tmp.1.dr, 4c337d50-3b31-4751-80fc-6c511f5e8080.tmp.1.dr	String found in binary or memory: https://www.google.com
Source: manifest.json.0.dr	String found in binary or memory: https://www.google.com/
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/accounts/OAuthLogin?issueuberauth=1
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/cleardot.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/dot2.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/x2.gif
Source: craw_background.js.0.dr	String found in binary or memory: https://www.google.com/intl/en-US/chrome/blank.html
Source: 5c008219-c240-4c35-bbf0-11dc479b3950.tmp.1.dr, craw_window.js.0.dr, craw_background.js.0.dr, 4c337d50-3b31-4751-80fc-6c511f5e8080.tmp.1.dr	String found in binary or memory: https://www.googleapis.com
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: 5c008219-c240-4c35-bbf0-11dc479b3950.tmp.1.dr, 4c337d50-3b31-4751-80fc-6c511f5e8080.tmp.1.dr	String found in binary or memory: https://www.gstatic.com

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "C:\Users\user\Desktop\PaymentDetails170.htm
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1584,7513029332295005769,2836462505576527454,131072 --lang=en-GB --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1664 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1584,7513029332295005769,2836462505576527454,131072 --lang=en-GB --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1664 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	3 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	4 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	1 Ingress Tool Transfer	SIM Card Swap		Carrier Billing Fraud

Source	Detection	Scanner	Link
cs1100.wpc.omegacdn.net	0%	Virustotal	Browse
remoteaccess.fabtekaero.com	0%	Virustotal	Browse
aadcdn.msftauth.net	0%	Virustotal	Browse

Source	Detection	Scanner	Label	Link
https://remoteaccess.fabtekaero.com/Remote/Javascript/ramjsfx.popupwindow.js	0%	Virustotal		Browse
https://remoteaccess.fabtekaero.com/Remote/Javascript/ramjsfx.popupwindow.js	0%	Avira URL Cloud	safe
https://dns.google	0%	URL Reputation	safe
https://remoteaccess.fabtekaero.com/Remote/Javascript/ramjsfx.js	0%	Virustotal		Browse
https://remoteaccess.fabtekaero.com/Remote/Javascript/ramjsfx.js	0%	Avira URL Cloud	safe
https://remoteaccess.fabtekaero.com/Remote/javascript/ramjsfx.fluidlayout.js	0%	Virustotal		Browse
https://remoteaccess.fabtekaero.com/Remote/javascript/ramjsfx.fluidlayout.js	0%	Avira URL Cloud	safe
https://remoteaccess.fabtekaero.com/Remote/Javascript/ramjsfx.watermark.js	0%	Avira URL Cloud	safe
https://remoteaccess.fabtekaero.com/Remote/javascript/ramjsfx.windowspool.js	0%	Avira URL Cloud	safe
https://remoteaccess.fabtekaero.com/Remote/Javascript/ramjsfx.core.js	0%	Avira URL Cloud	safe
https://remoteaccess.fabtekaero.com/Remote/css/logon-s.css	0%	Avira URL Cloud	safe
https://remoteaccess.fabtekaero.com/Remote/Javascript/ramjsfx.menu.js	0%	Avira URL Cloud	safe
https://remoteaccess.fabtekaero.com/Remote/WebResource.axd?d=AtCAlJUCI67JA5mLHP_GDH_TlFS1EPFlMSz7ePpjtskBytpgY5DU6WpuCDLw8BaEhKFfMorY015VRWJfsGo8EkiPIzDFmL7aAZrNZV3XhdA1&t=637719884927241407	0%	Avira URL Cloud	safe
https://remoteaccess.fabtekaero.com/Remote/ScriptResource.axd?d=Q6BmI1jRBDyTlsgFKy8_y1hu8RoSXhGuDSwVgVBnEFY4jnoaRUpwhFPqoT5laGNS4XF0Dirn8ZrXRCGstutuNQJk74OrHUS3goRakhJjBZp3nlDuB1zqLNIrtKI2DEfB_29K5w_7egmFSG_jPi4TjrWm6_D55w0CtLWTxoCoIlnA0j4QX-JLYjitl04BH51k0&t=ffffffffcbc226b4	0%	Avira URL Cloud	safe
https://aadcdn.msftauth.net/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg	0%	URL Reputation	safe
https://remoteaccess.fabtekaero.com/Remote/Javascript/ramjsfx.menu.css	0%	Avira URL Cloud	safe
https://remoteaccess.fabtekaero.com/Remote/ScriptResource.axd?d=hDtYIQpgHRviKRoBbknF_hwbz7W9qv1QuruF5fHeGY7aLvg0FZu8uo7oQM49G39kdLoq-10g3beffZ-r6bx56knWeXNtap5L52Zf4S9XgEebHL5Ym4ODB6s4m7yJEHzofWjAbR0llrqlCcaSElGrkYCa6ZfzGKQXhQgOo1HsReye0F_y5SNdgIllVG0APJ1s0&t=ffffffffcbc226b4	0%	Avira URL Cloud	safe
https://remoteaccess.fabtekaero.com/Remote/css/en/logon.css	0%	Avira URL Cloud	safe
https://remoteaccess.fabtekaero.com/Remote/css/logon.css	0%	Avira URL Cloud	safe
https://remoteaccess.fabtekaero.com/Remote/Javascript/ramjsfx.utils.js	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Antivirus Detection	Reputation
cs1100.wpc.omegacdn.net	152.199.23.37	true	false	0%, Virustotal, Browse	unknown
accounts.google.com	142.250.186.77	true	false		high
remoteaccess.fabtekaero.com	96.87.113.77	true	false	0%, Virustotal, Browse	unknown
clients.l.google.com	142.250.185.206	true	false		high
clients2.google.com	unknown	unknown	false		high
aadcdn.msftauth.net	unknown	unknown	false	0%, Virustotal, Browse	unknown

Name	Malicious	Antivirus Detection	Reputation
https://remoteaccess.fabtekaero.com/Remote/Javascript/ramjsfx.popupwindow.js	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://remoteaccess.fabtekaero.com/Remote/Javascript/ramjsfx.js	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false		high
file:///C:/Users/user/Desktop/PaymentDetails170.htm	true		low
https://remoteaccess.fabtekaero.com/Remote/javascript/ramjsfx.fluidlayout.js	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://remoteaccess.fabtekaero.com/Remote/Javascript/ramjsfx.watermark.js	false	Avira URL Cloud: safe	unknown
https://remoteaccess.fabtekaero.com/Remote/javascript/ramjsfx.windowspool.js	false	Avira URL Cloud: safe	unknown
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-GB&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1	false		high
https://remoteaccess.fabtekaero.com/Remote/Javascript/ramjsfx.core.js	false	Avira URL Cloud: safe	unknown
https://remoteaccess.fabtekaero.com/Remote/css/logon-s.css	false	Avira URL Cloud: safe	unknown
https://remoteaccess.fabtekaero.com/Remote/Javascript/ramjsfx.menu.js	false	Avira URL Cloud: safe	unknown
https://remoteaccess.fabtekaero.com/Remote/WebResource.axd?d=AtCAlJUCI67JA5mLHP_GDH_TlFS1EPFlMSz7ePpjtskBytpgY5DU6WpuCDLw8BaEhKFfMorY015VRWJfsGo8EkiPIzDFmL7aAZrNZV3XhdA1&t=637719884927241407	false	Avira URL Cloud: safe	unknown
https://remoteaccess.fabtekaero.com/Remote/ScriptResource.axd?d=Q6BmI1jRBDyTlsgFKy8_y1hu8RoSXhGuDSwVgVBnEFY4jnoaRUpwhFPqoT5laGNS4XF0Dirn8ZrXRCGstutuNQJk74OrHUS3goRakhJjBZp3nlDuB1zqLNIrtKI2DEfB_29K5w_7egmFSG_jPi4TjrWm6_D55w0CtLWTxoCoIlnA0j4QX-JLYjitl04BH51k0&t=ffffffffcbc226b4	false	Avira URL Cloud: safe	unknown
https://aadcdn.msftauth.net/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg	false	URL Reputation: safe	unknown
https://remoteaccess.fabtekaero.com/Remote/Javascript/ramjsfx.menu.css	false	Avira URL Cloud: safe	unknown
https://remoteaccess.fabtekaero.com/Remote/ScriptResource.axd?d=hDtYIQpgHRviKRoBbknF_hwbz7W9qv1QuruF5fHeGY7aLvg0FZu8uo7oQM49G39kdLoq-10g3beffZ-r6bx56knWeXNtap5L52Zf4S9XgEebHL5Ym4ODB6s4m7yJEHzofWjAbR0llrqlCcaSElGrkYCa6ZfzGKQXhQgOo1HsReye0F_y5SNdgIllVG0APJ1s0&t=ffffffffcbc226b4	false	Avira URL Cloud: safe	unknown
https://remoteaccess.fabtekaero.com/Remote/css/en/logon.css	false	Avira URL Cloud: safe	unknown
https://remoteaccess.fabtekaero.com/Remote/css/logon.css	false	Avira URL Cloud: safe	unknown
https://remoteaccess.fabtekaero.com/Remote/Javascript/ramjsfx.utils.js	false	Avira URL Cloud: safe	unknown

Name	Source	Malicious	Antivirus Detection	Reputation
https://dns.google	5c008219-c240-4c35-bbf0-11dc479b3950.tmp.1.dr, 2f05617d-bf2d-4f9f-a5d1-878e474b8020.tmp.1.dr, 4c337d50-3b31-4751-80fc-6c511f5e8080.tmp.1.dr, f6100422-ed05-40bb-9230-d7af9ca091ca.tmp.1.dr	false	URL Reputation: safe	unknown
https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p	craw_window.js.0.dr, craw_background.js.0.dr	false		high
https://www.google.com/intl/en-US/chrome/blank.html	craw_background.js.0.dr	false		high
https://ogs.google.com	5c008219-c240-4c35-bbf0-11dc479b3950.tmp.1.dr, 4c337d50-3b31-4751-80fc-6c511f5e8080.tmp.1.dr	false		high
https://www.google.com/images/cleardot.gif	craw_window.js.0.dr	false		high
https://play.google.com	5c008219-c240-4c35-bbf0-11dc479b3950.tmp.1.dr, 4c337d50-3b31-4751-80fc-6c511f5e8080.tmp.1.dr	false		high
https://payments.google.com/payments/v4/js/integrator.js	craw_window.js.0.dr, manifest.json.0.dr	false		high
https://sandbox.google.com/payments/v4/js/integrator.js	craw_window.js.0.dr, manifest.json.0.dr	false		high
https://www.google.com/images/x2.gif	craw_window.js.0.dr	false		high
https://accounts.google.com/MergeSession	craw_window.js.0.dr	false		high
https://www.google.com	5c008219-c240-4c35-bbf0-11dc479b3950.tmp.1.dr, 4c337d50-3b31-4751-80fc-6c511f5e8080.tmp.1.dr	false		high
https://www.google.com/images/dot2.gif	craw_window.js.0.dr	false		high
https://accounts.google.com	5c008219-c240-4c35-bbf0-11dc479b3950.tmp.1.dr, 4c337d50-3b31-4751-80fc-6c511f5e8080.tmp.1.dr	false		high
https://clients2.googleusercontent.com	5c008219-c240-4c35-bbf0-11dc479b3950.tmp.1.dr, 4c337d50-3b31-4751-80fc-6c511f5e8080.tmp.1.dr	false		high
https://apis.google.com	5c008219-c240-4c35-bbf0-11dc479b3950.tmp.1.dr, 4c337d50-3b31-4751-80fc-6c511f5e8080.tmp.1.dr	false		high
https://www.google.com/accounts/OAuthLogin?issueuberauth=1	craw_window.js.0.dr	false		high
https://www.google.com/	manifest.json.0.dr	false		high
https://www-googleapis-staging.sandbox.google.com	craw_window.js.0.dr, craw_background.js.0.dr	false		high
https://clients2.google.com	5c008219-c240-4c35-bbf0-11dc479b3950.tmp.1.dr, 4c337d50-3b31-4751-80fc-6c511f5e8080.tmp.1.dr	false		high
https://clients2.google.com/service/update2/crx	manifest.json.0.dr	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.185.206	clients.l.google.com	United States	15169	GOOGLEUS	false
96.87.113.77	remoteaccess.fabtekaero.com	United States	7922	COMCAST-7922US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
152.199.23.37	cs1100.wpc.omegacdn.net	United States	15133	EDGECASTUS	false
142.250.186.77	accounts.google.com	United States	15169	GOOGLEUS	false

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	626232
Start date and time: 13/05/202218:10:50	2022-05-13 18:10:50 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	PaymentDetails170.htm
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	27
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal56.phis.winHTM@24/102@5/10
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .htm Adjust boot time Enable AMSI

Match	Associated Sample Name / URL	SHA 256	Detection	Link
239.255.255.250	https://yf8sdydq4n.myportfolio.com/	Get hash	malicious	Browse
	https://telegra.ph/Invoice-05-13	Get hash	malicious	Browse
	https://form.jotform.com/221323445206041	Get hash	malicious	Browse
	https://form.jotform.com/221323445206041	Get hash	malicious	Browse
	Markham_remittance71792.html	Get hash	malicious	Browse
	#Ud83d#Udcde_0072520589037.html (2).html	Get hash	malicious	Browse
	bsalazarSecuremail#Redriverbank2602VY8-FOAT7J-SNN6eYn999.html	Get hash	malicious	Browse
	http://www.robertwarner.co.uk/lim/consequences-of-not-meeting-deadlines	Get hash	malicious	Browse
	https://drive.google.com/uc?export=download&id=1mmXl38H2-j7e7hD_UJbEMMSnMTA0BtQV	Get hash	malicious	Browse
	https://w2globaldata.cabildodeagayu.com/1/?e=d2FycmVuLnJ1c3NlbGxAdzJnbG9iYWxkYXRhLmNvbQ==	Get hash	malicious	Browse
	https://microsoftonedriveportal.myportfolio.com/	Get hash	malicious	Browse
	https://leadscrapper.com/ev/ntsiaimi	Get hash	malicious	Browse
	https://linkprotect.cudasvc.com/url?a=https%3a%2f%2fclt1412957.bmetrack.com%2fc%2fl%3fu%3dD806837%26e%3d13CFAE0%26c%3d158F5D%26t%3d1%26l%3d76C219A5%26email%3d3mp%252BnyqgFv7EE0RTVybkWXnlkRjLUbPe%26seq%3d1%23c2VydmljZS5kZXNrQG5vdmVuY2kuZnI%3d&c=E,1,g5KC7BfAYUNqH4iZ_hW3t_kZvUUVOqNRIxS9hB3FjTl9MzSqzDpEvv02MymvQWQQvDNFoOozcYQtiwJkD9OLjklDAneS9G_9H4VgmMj6TGF1OjFXnzcIlw,,&typo=1	Get hash	malicious	Browse
	https://nationalconstructionservice.com/CD/Stewart/Stewart%20Password%20Authorization.htm	Get hash	malicious	Browse
	https://znap.link/andrea.selmo-michell.comandrea.selmo-michell.comandrea.selmo-michell.comandrea.selmo-michell.com	Get hash	malicious	Browse
	Payment Remittance098.html	Get hash	malicious	Browse
	https://r20.rs6.net/tn.jsp?f=001oz1azagslZ81flEkxXgs2g3SWRiYSVI7KLvslXPFYHpiSKl5P8n0JRyaTb053n1-IYmPdZzAeqzc8m1QqWhgBYanR5TxM8Pmp6lEt_CAet0tX8kv1LDJZxYM199gkyewzmUzjvOOGiQk0XAEDQr6vSBcDmqRIRKL&c=Ls_FXhJGmT-7dCWYrar2zAtHnYmvNhIhkZvg3gIMxkPDc7YmsXHD4A==&ch=H_DaN9CbHD7opQZZemXtv6GEfaRrLcSEIqSJA5_ukBfQogYXPuvtWA==	Get hash	malicious	Browse
	https://u26328446.ct.sendgrid.net/ls/click?upn=gf7UAK8wJS-2BWx6fZj4G2BBvAXxCrA2QWWbvz9SWnpwmXvLMTPaN99mi1ZBUMP-2BrEiAOaUOWtFHirX2-2FaqHwVcuvGKIoFZdw2ZrFyiho4r4v3PNsivKCwkGIMrdnnILSN9ILJEdVpct7xrBE5lCL-2BDg-3D-3DEpbG_UnLuEmQf-2FCMnLuK0HMUXSQv-2BgNUV902vD7oTziBuxkn3xNqdxDTK2qGWbBYWJ2JI0-2FXbwXRJkRbeTt6C-2BjjpEYXYCrMbmvTKGZRGNGG180-2Bi7-2BpLKXcKmukyb5F5Ei77lgNqot1X0x4LwTq-2FdwuTm6gdpP0YUsdKBpouRVOcTO5LmSRoqQ1olXsz161ESlbQ9BFINQb8ygMaG55OQWhjASnHp5JE2PLJCqk75-2F4jb0Q-3D	Get hash	malicious	Browse
	https://w2globaldata.cabildodeagayu.com/1/?e=bGVzLmZyZWVsYW5kQHcyZ2xvYmFsZGF0YS5jb20=	Get hash	malicious	Browse
	https://w2globaldata.cabildodeagayu.com/1/?e=bGVzLmZyZWVsYW5kQHcyZ2xvYmFsZGF0YS5jb20=	Get hash	malicious	Browse
152.199.23.37	Markham_remittance71792.html	Get hash	malicious	Browse
	bsalazarSecuremail#Redriverbank2602VY8-FOAT7J-SNN6eYn999.html	Get hash	malicious	Browse
	Payment Remittance098.html	Get hash	malicious	Browse
	Changellc 7725 .htm	Get hash	malicious	Browse
	Invoice_Copic-Copic.com628491.html	Get hash	malicious	Browse
	5162.htm	Get hash	malicious	Browse
	Invoice_Doubleline-Doubleline.com171883.html	Get hash	malicious	Browse
	Invreceipt7291XZ4-BWGI7X-RHL3xfh339.htm	Get hash	malicious	Browse
	https://blueskyy.mystrikingly.com/	Get hash	malicious	Browse
	VM_May 11, 2022_41 22 6524 836_wav.html	Get hash	malicious	Browse
	VM_May 11, 2022_41 22 6504 136_wav.html	Get hash	malicious	Browse
	Remittance Copy - 03142022.pdf.html	Get hash	malicious	Browse
	Clear Cache- Kashyapc.html	Get hash	malicious	Browse
	Kogbonds-Calling-Mail.html	Get hash	malicious	Browse
	https://powerbi0522.web.app/B3xristinaa2Xpanaa1Htr4PwY5Wrtransita2XB3xr4Pa2Xuk	Get hash	malicious	Browse
	https://powerbi0522.web.app/B3xristinaa2Xpanaa1Htr4PwY5Wrtransita2XB3xr4Pa2Xuk	Get hash	malicious	Browse
	file.html	Get hash	malicious	Browse
	ST10-COR4737-andrea.carranza@cdiglaw.com_Fax.htm	Get hash	malicious	Browse
	WAV20009-10.html	Get hash	malicious	Browse
	Clear Cache- Arvind.kumar.html	Get hash	malicious	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
37f463bf4616ecd445d4a1937da06e19	FedEx.exe	Get hash	malicious	Browse	152.199.23.37
	https://telegra.ph/Invoice-05-13	Get hash	malicious	Browse	152.199.23.37
	Markham_remittance71792.html	Get hash	malicious	Browse	152.199.23.37
	#Ud83d#Udcde_0072520589037.html (2).html	Get hash	malicious	Browse	152.199.23.37
	bsalazarSecuremail#Redriverbank2602VY8-FOAT7J-SNN6eYn999.html	Get hash	malicious	Browse	152.199.23.37
	http://www.robertwarner.co.uk/lim/consequences-of-not-meeting-deadlines	Get hash	malicious	Browse	152.199.23.37
	https://drive.google.com/uc?export=download&id=1mmXl38H2-j7e7hD_UJbEMMSnMTA0BtQV	Get hash	malicious	Browse	152.199.23.37
	Payment Remittance098.html	Get hash	malicious	Browse	152.199.23.37
	https://sharingonlinepdf.simplesite.com/	Get hash	malicious	Browse	152.199.23.37
	https://surveyatos.com	Get hash	malicious	Browse	152.199.23.37
	INV_660100.xlsx	Get hash	malicious	Browse	152.199.23.37
	http://auth0012outlook.atwebpages.com/office365/index.html	Get hash	malicious	Browse	152.199.23.37
	Scan_20221205_361305.xls	Get hash	malicious	Browse	152.199.23.37
	Fattura N 0000985-19 YBZ 12-05-2022.xls	Get hash	malicious	Browse	152.199.23.37
	2022IM00001489.xls	Get hash	malicious	Browse	152.199.23.37
	Changellc 7725 .htm	Get hash	malicious	Browse	152.199.23.37
	https://sync.crwdcntrl.net/map/c=9828/tp=ADBE/gdpr=0/gdpr_consent=/tpid=62553350917825036762023184708005776201?https%3A%2F%2Fsign-smpu724eb7r29qzs1gw162nd2cilb0gppxkyfq3q1rk.website%E2%80%8B.yandexcloud.net%23dbrodie@standrew.co.uk	Get hash	malicious	Browse	152.199.23.37
	Formular 2022.12.05_1202.xls	Get hash	malicious	Browse	152.199.23.37
	https://tmsteels.dotling.com/	Get hash	malicious	Browse	152.199.23.37
	Label_Details.exe	Get hash	malicious	Browse	152.199.23.37

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	204410
Entropy (8bit):	6.073619368259267
Encrypted:	false
SSDEEP:	6144:g9ssvoWpYtR9rOKeSMyI9+aqfIlUOoSiuR5:g9sh3XSJSh+oO
MD5:	4FBFBB12989408BB6101FBBE13761E94
SHA1:	7ADE574C56E6527108EF2095BA521DBA5EE419FD
SHA-256:	CEE07CA397DB93175C14CE9E8F4A65EFBDB37FDD908C6E8209EA6363BBC7BA81
SHA-512:	25BB5ECD079A2536D252DEE1623C7DE9537077C398D34E04BA8FA1489564E6CFFA0653D59002FC08A74CAA403FAE550C7A8E32F9D78DD39EDC0286DC1956E6B5
Malicious:	false
Reputation:	low
Preview:	{"browser":{"last_redirect_origin":"","shortcut_migration_version":"85.0.4183.121"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en-GB"},"legacy":{"profile":{"name":{"migrated":true}}},"network_time":{"network_time_mapping":{"local":1.652458315639888e+12,"network":1.652458317e+12,"ticks":111620851.0,"uncertainty":4890311.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABaHlwIoHYlQKZwuwW8V0yxAAAAAAIAAAAAABBmAAAAAQAAIAAAAOT4j8Zm9U1zXX6oEUpPqIYBIjSlOiLGeiMKiIFJZDroAAAAAA6AAAAAAgAAIAAAAFW1OavBhyV7qwszPZbindD+KU2Osh5O7HSmDPpFnuCDMAAAAGEkmqbufgFUSmOzx4cW7Aup7spqps4DvqbPrwRgUGqSpRZvQkbO+yVH56WF9zMTt0AAAAAyRwtYxjf7/AqYrFr0JZ6kbTiUt0/2PKkCw7ntLtbN2qrad7I3MeL4iNGDFgqRlhWgsb/6w0gJzQxAfL6rdzxi"},"password_manager":{"os_password_blank":true,"os_password_last_changed":"13245922715401452"},"plugins":{"metadata":{"adobe-flash-player":{"d

File type:	HTML document, ASCII text, with very long lines, with CRLF line terminators
Entropy (8bit):	3.183194730075498
TrID:
File name:	PaymentDetails170.htm
File size:	44504
MD5:	74814c82959caf161fec96e3603d206b
SHA1:	b7335dd4368545350234cb0861757447c5c1e3c7
SHA256:	1170b449d6be84da2421316280563c7c607582addfd63f66d594f1dd5c7edea8
SHA512:	125796bba3f71eca308813aeead780053d38de989b19f2db8c0cf85c7eb3abac4423f099ad65ffdcbc7388874585498c73c7807917821fba92181ebee575a7c4
SSDEEP:	384:CfnYxXes4VpG+5PxNaLpvzf9gfZ5hUo7Y1PCKpZMG/:chGeWkfBU6e
TLSH:	8A13813C7261D88DA9B3AA3FFC942B25C1449F07ECD8A7C8041584962FF257AB5047EB
File Content Preview:	<script language="javascript">..document.write( unescape( '%20%0A%0A%3C%21%44%4F%43%54%59%50%45%20%68%74%6D%6C%20%50%55%42%4C%49%43%20%22%2D%2F%2F%57%33%43%2F%2F%44%54%44%20%58%48%54%4D%4C%20%31%2E%30%20%54%72%61%6E%73%69%74%69%6F%6E%61%6C%2F%2F%45%4E%22%

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 13, 2022 18:11:56.741214991 CEST	56076	53	192.168.2.4	8.8.8.8
May 13, 2022 18:11:56.767371893 CEST	53	56076	8.8.8.8	192.168.2.4
May 13, 2022 18:11:56.954735994 CEST	60758	53	192.168.2.4	8.8.8.8
May 13, 2022 18:11:56.995537043 CEST	53	60758	8.8.8.8	192.168.2.4
May 13, 2022 18:11:57.025242090 CEST	60647	53	192.168.2.4	8.8.8.8
May 13, 2022 18:11:57.044414997 CEST	53	60647	8.8.8.8	192.168.2.4
May 13, 2022 18:11:58.626149893 CEST	54069	53	192.168.2.4	8.8.8.8
May 13, 2022 18:11:58.645555019 CEST	53	54069	8.8.8.8	192.168.2.4
May 13, 2022 18:12:00.517831087 CEST	60512	53	192.168.2.4	8.8.8.8
May 13, 2022 18:12:00.539324999 CEST	53	60512	8.8.8.8	192.168.2.4
May 13, 2022 18:12:05.811203003 CEST	51681	443	192.168.2.4	142.250.185.206
May 13, 2022 18:12:05.837357044 CEST	443	51681	142.250.185.206	192.168.2.4
May 13, 2022 18:12:05.838077068 CEST	51681	443	192.168.2.4	142.250.185.206
May 13, 2022 18:12:05.863826036 CEST	443	51681	142.250.185.206	192.168.2.4
May 13, 2022 18:12:05.863887072 CEST	443	51681	142.250.185.206	192.168.2.4
May 13, 2022 18:12:05.863930941 CEST	443	51681	142.250.185.206	192.168.2.4
May 13, 2022 18:12:05.863970041 CEST	443	51681	142.250.185.206	192.168.2.4
May 13, 2022 18:12:05.902585983 CEST	51681	443	192.168.2.4	142.250.185.206
May 13, 2022 18:12:05.906133890 CEST	51681	443	192.168.2.4	142.250.185.206
May 13, 2022 18:12:05.922302961 CEST	443	51681	142.250.185.206	192.168.2.4
May 13, 2022 18:12:05.922357082 CEST	443	51681	142.250.185.206	192.168.2.4
May 13, 2022 18:12:06.009294987 CEST	51681	443	192.168.2.4	142.250.185.206
May 13, 2022 18:12:06.015594959 CEST	51681	443	192.168.2.4	142.250.185.206
May 13, 2022 18:12:06.016171932 CEST	51681	443	192.168.2.4	142.250.185.206
May 13, 2022 18:12:06.018369913 CEST	443	51681	142.250.185.206	192.168.2.4
May 13, 2022 18:12:06.021130085 CEST	51681	443	192.168.2.4	142.250.185.206
May 13, 2022 18:12:06.048850060 CEST	443	51681	142.250.185.206	192.168.2.4
May 13, 2022 18:12:06.057871103 CEST	443	51681	142.250.185.206	192.168.2.4
May 13, 2022 18:12:06.058554888 CEST	443	51681	142.250.185.206	192.168.2.4
May 13, 2022 18:12:06.058650017 CEST	443	51681	142.250.185.206	192.168.2.4
May 13, 2022 18:12:06.058682919 CEST	443	51681	142.250.185.206	192.168.2.4
May 13, 2022 18:12:06.085299969 CEST	51681	443	192.168.2.4	142.250.185.206
May 13, 2022 18:12:06.085562944 CEST	51681	443	192.168.2.4	142.250.185.206
May 13, 2022 18:12:06.101131916 CEST	443	51681	142.250.185.206	192.168.2.4
May 13, 2022 18:12:06.168134928 CEST	443	51681	142.250.185.206	192.168.2.4
May 13, 2022 18:12:06.189956903 CEST	51681	443	192.168.2.4	142.250.185.206
May 13, 2022 18:12:06.190011978 CEST	51681	443	192.168.2.4	142.250.185.206

Timestamp	kBytes transferred	Direction	Data
2022-05-13 16:11:57 UTC	0	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
2022-05-13 16:11:57 UTC	0	OUT	Data Raw: 20 Data Ascii:
2022-05-13 16:11:57 UTC	3	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 13 May 2022 16:11:57 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Content-Security-Policy: script-src 'report-sample' 'nonce-O56cnVJllMlhVGlwK2Ecjw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'nonce-O56cnVJllMlhVGlwK2Ecjw' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-05-13 16:11:57 UTC	4	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2022-05-13 16:11:57 UTC	4	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report PaymentDetails170.htm

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Google\Chrome\User Data\337c0e7d-5f5a-4ed6-b724-6bc883ddb786.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\6029e53e-c49b-48c5-a8eb-d0b332def790.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\73a060b1-f2a9-4012-a77f-efbc4cab39da.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\85f7a97e-db3e-409a-9420-c27d88484342.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\9d4da297-21f7-4340-9086-9e72c6947783.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\0e258697-0c84-4ec9-9b4e-1aa1a3fac446.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\203ddfad-738a-4eca-9cc4-22e43acdeec8.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\287540e4-be9c-4403-b1bc-016c4905e097.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\39aeb02e-edab-4d16-a875-e8d2262fdb22.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\4c337d50-3b31-4751-80fc-6c511f5e8080.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\5c008219-c240-4c35-bbf0-11dc479b3950.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\61ad371e-ec5d-4f11-b45d-28fcfa9d9cd4.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\84ccc60f-c098-490b-90bd-7d0b5badd753.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\88adc95f-dbf3-4f1e-bf6b-b64345311b88.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\8b7a0534-497c-4ea0-a26b-8c0b5ea25acc.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\9490d946-cd8e-454d-a689-56192d21b80b.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata\computed_hashes.json

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\000003.log

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG.old (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Provider Cache

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network Persistent State (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Preferences (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\GPUCache\data_1

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Network Persistent State (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\f6100422-ed05-40bb-9230-d7af9ca091ca.tmp

Windows Analysis Report
PaymentDetails170.htm

Timestamp	kBytes transferred	Direction	Data
2022-05-13 16:11:57 UTC	0	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-GB&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfm X-Goog-Update-Updater: chromecrx-85.0.4183.121 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
2022-05-13 16:11:57 UTC	1	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-gI-hWGBmIybEHGWNb-F8Eg' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 13 May 2022 16:11:57 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 5611 X-Daystart: 33117 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-05-13 16:11:57 UTC	2	IN	Data Raw: 33 36 64 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 35 36 31 31 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 33 33 31 31 37 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 36d<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="5611" elapsed_seconds="33117"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2022-05-13 16:11:57 UTC	2	IN	Data Raw: 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 2e 63 72 78 22 20 66 70 3d 22 31 2e 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 61 Data Ascii: mmhkkegccagdldgiimedpiccmgmieda.crx" fp="1.81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app><a
2022-05-13 16:11:57 UTC	3	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-05-13 16:11:58 UTC	42	OUT	GET /Remote/Javascript/ramjsfx.js HTTP/1.1 Host: remoteaccess.fabtekaero.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
2022-05-13 16:11:58 UTC	55	IN	HTTP/1.1 200 OK Content-Type: application/javascript Last-Modified: Sat, 16 Jul 2016 13:19:44 GMT Accept-Ranges: bytes ETag: "5ca7adb764dfd11:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET Date: Fri, 13 May 2022 16:11:58 GMT Connection: close Content-Length: 3590
2022-05-13 16:11:58 UTC	55	IN	Data Raw: 2f 2f 0d 0a 2f 2f 20 20 3c 63 6f 70 79 72 69 67 68 74 20 66 69 6c 65 3d 22 72 61 6d 6a 73 66 78 2e 6a 73 22 20 63 6f 6d 70 61 6e 79 3d 22 4d 69 63 72 6f 73 6f 66 74 22 3e 0d 0a 2f 2f 20 20 20 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 4d 69 63 72 6f 73 6f 66 74 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0d 0a 2f 2f 20 20 3c 2f 63 6f 70 79 72 69 67 68 74 3e 0d 0a 2f 2f 0d 0a 0d 0a 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 52 3d 77 69 6e 64 6f 77 2e 24 52 3b 76 61 72 20 45 58 50 41 4e 44 5f 4b 45 59 3d 27 52 41 4e 44 4f 4d 33 45 37 43 32 42 35 30 44 36 34 36 31 31 44 44 42 34 38 31 30 27 3b 76 61 72 20 54 59 50 45 5f 45 4c 45 4d 45 4e 54 3d 31 2c 54 59 50 45 5f 43 4f 4d 4d 45 4e 54 3d 38 2c 54 59 50 45 5f 44 4f 43 55 4d 45 4e Data Ascii: //// <copyright file="ramjsfx.js" company="Microsoft">// Copyright (C) Microsoft. All rights reserved.// </copyright>//(function(){var R=window.$R;var EXPAND_KEY='RANDOM3E7C2B50D64611DDB4810';var TYPE_ELEMENT=1,TYPE_COMMENT=8,TYPE_DOCUMEN

Timestamp	kBytes transferred	Direction	Data
2022-05-13 16:11:58 UTC	42	OUT	GET /Remote/ScriptResource.axd?d=hDtYIQpgHRviKRoBbknF_hwbz7W9qv1QuruF5fHeGY7aLvg0FZu8uo7oQM49G39kdLoq-10g3beffZ-r6bx56knWeXNtap5L52Zf4S9XgEebHL5Ym4ODB6s4m7yJEHzofWjAbR0llrqlCcaSElGrkYCa6ZfzGKQXhQgOo1HsReye0F_y5SNdgIllVG0APJ1s0&t=ffffffffcbc226b4 HTTP/1.1 Host: remoteaccess.fabtekaero.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
2022-05-13 16:11:58 UTC	93	IN	HTTP/1.1 200 OK Cache-Control: public Content-Type: application/x-javascript Content-Encoding: gzip Expires: Sat, 13 May 2023 16:11:58 GMT Last-Modified: Fri, 13 May 2022 16:11:58 GMT Server: Microsoft-IIS/10.0 X-AspNet-Version: 4.0.30319 X-XSS-Protection: 1; mode=block X-Powered-By: ASP.NET Date: Fri, 13 May 2022 16:11:58 GMT Connection: close Content-Length: 25609
2022-05-13 16:11:58 UTC	93	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 ed bd d9 72 1b 49 92 28 fa 3e 66 f3 0f 64 8e 8a 42 36 92 20 29 55 2f 05 28 c5 d1 da a5 1e 6d 47 52 75 77 0d c9 96 e5 06 20 49 10 c9 42 02 92 58 04 be ec 3c dc 4f ba bf 70 7d 89 3d 23 01 50 aa 3e 73 8f 59 97 95 a4 44 2c 1e 11 1e 1e 1e 1e 1e ee 1e ff ef ff fe 7f 0e 0e f6 bf fa bf 7f ff b7 83 83 9d 27 d5 d5 f5 ac 1c 8d e7 3b 9d 27 e1 ce ab 32 9b 55 75 35 9c 43 fa ec aa 9a 25 f3 b2 9a f6 76 1e 4d 26 3b 54 a8 de 99 15 75 31 fb 54 e4 3d ac fd 8d 6d ab d6 1e 9d 27 5f 7a e7 f5 bf ff db f3 c5 34 a3 26 3f 7e 9c 5f 5f 15 af 93 cb 22 0e 64 62 30 30 b2 b3 49 52 d7 f1 7c b6 28 74 6a 36 2b 92 79 f1 24 99 4c d2 24 bb 88 87 22 bd 93 46 49 78 33 2b e6 8b d9 74 47 25 86 37 9f 92 d9 4e 11 27 b3 d1 e2 b2 98 ce eb de a4 98 8e e6 e3 41 39 ec 14 0f Data Ascii: rI(>fdB6 )U/(mGRuw IBX<Op}=#P>sYD,';'2Uu5C%vM&;Tu1T=m'_z4&?~__"db00IR\|(tj6+y$L$"FIx3+tG%7N'A9
2022-05-13 16:11:58 UTC	109	IN	Data Raw: f8 ae d4 65 e4 36 0b 2a 67 03 61 b5 a0 72 bd a0 f2 e5 32 bf e5 82 c2 c5 34 a4 05 55 da 0b 8a 8f 31 3c 79 39 cc 58 b9 66 55 49 fd cb 56 33 b8 2d 92 37 ad aa 5d 7a b3 4f 12 c2 a6 65 55 38 cb 6a d8 58 56 c6 4b cc cc b2 10 c6 87 47 8f 5f 3e 03 f0 fc e3 a9 fc 22 8a 23 a0 6b 96 1b d2 d8 70 dd 8a 43 92 2b f9 e9 41 d5 50 47 d3 14 26 cf 8a 09 45 af 00 c6 61 67 18 83 73 ba 71 99 cc 46 e5 94 f6 ff 66 0f 38 13 11 88 8d 6f b9 e4 f3 af 5b f2 f9 fa 25 bf 35 c1 c8 b9 10 33 9d 6d bb e4 8b e6 92 1f ba 4b fe 36 d4 98 fe 26 13 de be 0b e3 e9 db 77 a8 2a 6b df 51 d5 f6 91 fc 68 16 ea f8 0f 67 c2 e6 a7 71 f8 cb a3 4c 9e 39 f0 e8 98 1b 67 49 f8 1d 61 3c 5d f5 88 18 3e d3 d4 95 ef 65 a5 f8 be 87 51 3c ee 18 6f 2b a5 21 96 eb ca 14 7a ad ba 2b 8f 0f 5d fd 20 51 28 9f a4 f7 77 19 Data Ascii: e6gar24U1<y9XfUIV3-7]zOeU8jXVKG_>"#kpC+APG&EagsqFf8o[%53mK6&wkQhgqL9gIa<]>eQ<o+!z+] Q(w

Timestamp	kBytes transferred	Direction	Data
2022-05-13 16:11:58 UTC	43	OUT	GET /Remote/Javascript/ramjsfx.menu.js HTTP/1.1 Host: remoteaccess.fabtekaero.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
2022-05-13 16:11:58 UTC	46	IN	HTTP/1.1 200 OK Content-Type: application/javascript Last-Modified: Sun, 20 Nov 2016 23:16:17 GMT Accept-Ranges: bytes ETag: "3b3ac2188443d21:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET Date: Fri, 13 May 2022 16:11:58 GMT Connection: close Content-Length: 8348
2022-05-13 16:11:58 UTC	47	IN	Data Raw: 2f 2f 0d 0a 2f 2f 20 20 3c 63 6f 70 79 72 69 67 68 74 20 66 69 6c 65 3d 22 72 61 6d 6a 73 66 78 2e 6d 65 6e 75 2e 6a 73 22 20 63 6f 6d 70 61 6e 79 3d 22 4d 69 63 72 6f 73 6f 66 74 22 3e 0d 0a 2f 2f 20 20 20 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 4d 69 63 72 6f 73 6f 66 74 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0d 0a 2f 2f 20 20 3c 2f 63 6f 70 79 72 69 67 68 74 3e 0d 0a 2f 2f 0d 0a 0d 0a 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 6d 65 6e 75 62 61 72 3b 76 61 72 20 6d 65 6e 75 73 65 74 3b 76 61 72 20 66 6f 63 75 73 65 64 5f 6d 65 6e 75 3b 76 61 72 20 6d 65 6e 75 73 65 74 5f 73 74 61 74 65 3d 30 3b 66 75 6e 63 74 69 6f 6e 20 63 68 61 6e 67 65 46 6f 63 75 73 65 64 4d 65 6e 75 28 6e 65 77 5f 66 6f 63 75 73 29 7b 69 66 28 Data Ascii: //// <copyright file="ramjsfx.menu.js" company="Microsoft">// Copyright (C) Microsoft. All rights reserved.// </copyright>//(function(){var menubar;var menuset;var focused_menu;var menuset_state=0;function changeFocusedMenu(new_focus){if(

Timestamp	kBytes transferred	Direction	Data
2022-05-13 16:11:58 UTC	43	OUT	GET /Remote/Javascript/ramjsfx.popupwindow.js HTTP/1.1 Host: remoteaccess.fabtekaero.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
2022-05-13 16:11:58 UTC	59	IN	HTTP/1.1 200 OK Content-Type: application/javascript Last-Modified: Sat, 16 Jul 2016 13:19:44 GMT Accept-Ranges: bytes ETag: "ad6bb2b764dfd11:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET Date: Fri, 13 May 2022 16:11:58 GMT Connection: close Content-Length: 3338
2022-05-13 16:11:58 UTC	59	IN	Data Raw: 2f 2f 0d 0a 2f 2f 20 20 3c 63 6f 70 79 72 69 67 68 74 20 66 69 6c 65 3d 22 72 61 6d 6a 73 66 78 2e 70 6f 70 75 70 77 69 6e 64 6f 77 2e 6a 73 22 20 63 6f 6d 70 61 6e 79 3d 22 4d 69 63 72 6f 73 6f 66 74 22 3e 0d 0a 2f 2f 20 20 20 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 4d 69 63 72 6f 73 6f 66 74 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0d 0a 2f 2f 20 20 3c 2f 63 6f 70 79 72 69 67 68 74 3e 0d 0a 2f 2f 0d 0a 0d 0a 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 75 6e 69 71 75 65 57 69 6e 64 6f 77 49 64 3d 30 3b 76 61 72 20 50 4f 50 55 50 5f 57 49 4e 44 4f 57 5f 52 45 41 44 59 5f 54 41 47 3d 22 52 41 4d 4a 73 46 78 57 69 6e 64 6f 77 52 65 61 64 79 22 3b 76 61 72 20 50 4f 50 55 50 5f 57 49 4e 44 4f 57 5f 45 56 45 4e 54 5f 41 54 54 Data Ascii: //// <copyright file="ramjsfx.popupwindow.js" company="Microsoft">// Copyright (C) Microsoft. All rights reserved.// </copyright>//(function(){var uniqueWindowId=0;var POPUP_WINDOW_READY_TAG="RAMJsFxWindowReady";var POPUP_WINDOW_EVENT_ATT

Timestamp	kBytes transferred	Direction	Data
2022-05-13 16:11:58 UTC	88	OUT	GET /shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
2022-05-13 16:11:58 UTC	89	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding Age: 1075769 Cache-Control: public, max-age=31536000 Content-MD5: nzaLxFgP7ZB3dfMcaybWzw== Content-Type: image/svg+xml Date: Fri, 13 May 2022 16:11:58 GMT Etag: 0x8D79A1B9F5E121A Last-Modified: Thu, 16 Jan 2020 00:32:52 GMT Server: ECAcc (frc/8E9E) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 3d61ac0e-001e-004e-351b-5de3c9000000 x-ms-version: 2009-09-19 Content-Length: 3651 Connection: close
2022-05-13 16:11:58 UTC	89	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 31 30 38 22 20 68 65 69 67 68 74 3d 22 32 34 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 30 38 20 32 34 22 3e 3c 74 69 74 6c 65 3e 61 73 73 65 74 73 3c 2f 74 69 74 6c 65 3e 3c 70 61 74 68 20 64 3d 22 4d 34 34 2e 38 33 36 2c 34 2e 36 56 31 38 2e 34 68 2d 32 2e 34 56 37 2e 35 38 33 48 34 32 2e 34 4c 33 38 2e 31 31 39 2c 31 38 2e 34 48 33 36 2e 35 33 31 4c 33 32 2e 31 34 32 2c 37 2e 35 38 33 68 2d 2e 30 32 39 56 31 38 2e 34 48 32 39 2e 39 56 34 2e 36 68 33 2e 34 33 36 4c 33 37 2e 33 2c 31 34 2e 38 33 68 2e 30 35 38 4c 34 31 2e 35 34 35 2c 34 2e 36 5a 6d 32 2c 31 2e 30 34 39 61 31 2e 32 36 38 2c 31 2e 32 36 38 2c 30 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="108" height="24" viewBox="0 0 108 24"><title>assets</title><path d="M44.836,4.6V18.4h-2.4V7.583H42.4L38.119,18.4H36.531L32.142,7.583h-.029V18.4H29.9V4.6h3.436L37.3,14.83h.058L41.545,4.6Zm2,1.049a1.268,1.268,0

Timestamp	kBytes transferred	Direction	Data
2022-05-13 16:11:58 UTC	118	OUT	GET /Remote/WebResource.axd?d=AtCAlJUCI67JA5mLHP_GDH_TlFS1EPFlMSz7ePpjtskBytpgY5DU6WpuCDLw8BaEhKFfMorY015VRWJfsGo8EkiPIzDFmL7aAZrNZV3XhdA1&t=637719884927241407 HTTP/1.1 Host: remoteaccess.fabtekaero.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
2022-05-13 16:11:59 UTC	127	IN	HTTP/1.1 200 OK Cache-Control: public Content-Type: application/x-javascript Expires: Sat, 13 May 2023 10:28:36 GMT Last-Modified: Mon, 08 Nov 2021 23:14:52 GMT Server: Microsoft-IIS/10.0 X-AspNet-Version: 4.0.30319 X-XSS-Protection: 1; mode=block X-Powered-By: ASP.NET Date: Fri, 13 May 2022 16:11:59 GMT Connection: close Content-Length: 23063
2022-05-13 16:11:59 UTC	128	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 20 57 65 62 46 6f 72 6d 5f 50 6f 73 74 42 61 63 6b 4f 70 74 69 6f 6e 73 28 65 76 65 6e 74 54 61 72 67 65 74 2c 20 65 76 65 6e 74 41 72 67 75 6d 65 6e 74 2c 20 76 61 6c 69 64 61 74 69 6f 6e 2c 20 76 61 6c 69 64 61 74 69 6f 6e 47 72 6f 75 70 2c 20 61 63 74 69 6f 6e 55 72 6c 2c 20 74 72 61 63 6b 46 6f 63 75 73 2c 20 63 6c 69 65 6e 74 53 75 62 6d 69 74 29 20 7b 0d 0a 20 20 20 20 74 68 69 73 2e 65 76 65 6e 74 54 61 72 67 65 74 20 3d 20 65 76 65 6e 74 54 61 72 67 65 74 3b 0d 0a 20 20 20 20 74 68 69 73 2e 65 76 65 6e 74 41 72 67 75 6d 65 6e 74 20 3d 20 65 76 65 6e 74 41 72 67 75 6d 65 6e 74 3b 0d 0a 20 20 20 20 74 68 69 73 2e 76 61 6c 69 64 61 74 69 6f 6e 20 3d 20 76 61 6c 69 64 61 74 69 6f 6e 3b 0d 0a 20 20 20 20 74 68 69 73 2e 76 61 6c Data Ascii: function WebForm_PostBackOptions(eventTarget, eventArgument, validation, validationGroup, actionUrl, trackFocus, clientSubmit) { this.eventTarget = eventTarget; this.eventArgument = eventArgument; this.validation = validation; this.val
2022-05-13 16:11:59 UTC	143	IN	Data Raw: 77 69 6e 64 6f 77 2e 70 61 67 65 58 4f 66 66 73 65 74 3b 0d 0a 20 20 20 20 7d 0d 0a 20 20 20 20 65 6c 73 65 20 7b 0d 0a 20 20 20 20 20 20 20 20 69 66 20 28 64 6f 63 75 6d 65 6e 74 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 20 26 26 20 64 6f 63 75 6d 65 6e 74 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 2e 73 63 72 6f 6c 6c 4c 65 66 74 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 64 6f 63 75 6d 65 6e 74 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 2e 73 63 72 6f 6c 6c 4c 65 66 74 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 65 6c 73 65 20 69 66 20 28 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 Data Ascii: window.pageXOffset; } else { if (document.documentElement && document.documentElement.scrollLeft) { return document.documentElement.scrollLeft; } else if (document.body) { return document.body

Timestamp	kBytes transferred	Direction	Data
2022-05-13 16:11:58 UTC	119	OUT	GET /Remote/javascript/ramjsfx.windowspool.js HTTP/1.1 Host: remoteaccess.fabtekaero.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
2022-05-13 16:11:59 UTC	125	IN	HTTP/1.1 200 OK Content-Type: application/javascript Last-Modified: Sat, 16 Jul 2016 13:19:44 GMT Accept-Ranges: bytes ETag: "5ca7adb764dfd11:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET Date: Fri, 13 May 2022 16:11:59 GMT Connection: close Content-Length: 1837
2022-05-13 16:11:59 UTC	126	IN	Data Raw: 2f 2f 0d 0a 2f 2f 20 20 3c 63 6f 70 79 72 69 67 68 74 20 66 69 6c 65 3d 22 72 61 6d 6a 73 66 78 2e 77 69 6e 64 6f 77 73 70 6f 6f 6c 2e 6a 73 22 20 63 6f 6d 70 61 6e 79 3d 22 4d 69 63 72 6f 73 6f 66 74 22 3e 0d 0a 2f 2f 20 20 20 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 4d 69 63 72 6f 73 6f 66 74 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0d 0a 2f 2f 20 20 3c 2f 63 6f 70 79 72 69 67 68 74 3e 0d 0a 2f 2f 0d 0a 0d 0a ef bb bf 76 61 72 20 52 65 6d 6f 74 65 41 63 63 65 73 73 57 69 6e 64 6f 77 73 50 6f 6f 6c 3d 7b 53 65 74 43 6f 6f 6b 69 65 3a 66 75 6e 63 74 69 6f 6e 28 6e 61 6d 65 2c 76 61 6c 75 65 29 7b 64 6f 63 75 6d 65 6e 74 2e 63 6f 6f 6b 69 65 3d 6e 61 6d 65 2b 22 3d 22 2b 65 73 63 61 70 65 28 76 61 6c 75 65 29 2b 22 3b 70 61 74 Data Ascii: //// <copyright file="ramjsfx.windowspool.js" company="Microsoft">// Copyright (C) Microsoft. All rights reserved.// </copyright>//var RemoteAccessWindowsPool={SetCookie:function(name,value){document.cookie=name+"="+escape(value)+";pat

Timestamp	kBytes transferred	Direction	Data
2022-05-13 16:11:58 UTC	119	OUT	GET /Remote/Javascript/ramjsfx.utils.js HTTP/1.1 Host: remoteaccess.fabtekaero.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
2022-05-13 16:11:59 UTC	120	IN	HTTP/1.1 200 OK Content-Type: application/javascript Last-Modified: Sun, 20 Nov 2016 23:16:17 GMT Accept-Ranges: bytes ETag: "3b3ac2188443d21:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET Date: Fri, 13 May 2022 16:11:59 GMT Connection: close Content-Length: 5391
2022-05-13 16:11:59 UTC	120	IN	Data Raw: 2f 2f 0d 0a 2f 2f 20 20 3c 63 6f 70 79 72 69 67 68 74 20 66 69 6c 65 3d 22 72 61 6d 6a 73 66 78 2e 75 74 69 6c 73 2e 6a 73 22 20 63 6f 6d 70 61 6e 79 3d 22 4d 69 63 72 6f 73 6f 66 74 22 3e 0d 0a 2f 2f 20 20 20 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 4d 69 63 72 6f 73 6f 66 74 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0d 0a 2f 2f 20 20 3c 2f 63 6f 70 79 72 69 67 68 74 3e 0d 0a 2f 2f 0d 0a 0d 0a ef bb bf 28 66 75 6e 63 74 69 6f 6e 28 29 7b 24 52 2e 65 78 74 65 6e 64 28 24 52 2e 62 72 6f 77 73 65 72 2c 7b 69 6e 69 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 75 61 3d 77 69 6e 64 6f 77 2e 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3b 74 68 69 73 2e 69 73 49 50 6f 64 3d Data Ascii: //// <copyright file="ramjsfx.utils.js" company="Microsoft">// Copyright (C) Microsoft. All rights reserved.// </copyright>//(function(){$R.extend($R.browser,{init:function(){var ua=window.navigator.userAgent.toLowerCase();this.isIPod=

Timestamp	kBytes transferred	Direction	Data
2022-05-13 16:12:00 UTC	150	OUT	GET /shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36 Host: aadcdn.msftauth.net
2022-05-13 16:12:00 UTC	151	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding Age: 1075771 Cache-Control: public, max-age=31536000 Content-MD5: nzaLxFgP7ZB3dfMcaybWzw== Content-Type: image/svg+xml Date: Fri, 13 May 2022 16:12:00 GMT Etag: 0x8D79A1B9F5E121A Last-Modified: Thu, 16 Jan 2020 00:32:52 GMT Server: ECAcc (frc/8E9E) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 3d61ac0e-001e-004e-351b-5de3c9000000 x-ms-version: 2009-09-19 Content-Length: 3651 Connection: close
2022-05-13 16:12:00 UTC	151	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 31 30 38 22 20 68 65 69 67 68 74 3d 22 32 34 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 30 38 20 32 34 22 3e 3c 74 69 74 6c 65 3e 61 73 73 65 74 73 3c 2f 74 69 74 6c 65 3e 3c 70 61 74 68 20 64 3d 22 4d 34 34 2e 38 33 36 2c 34 2e 36 56 31 38 2e 34 68 2d 32 2e 34 56 37 2e 35 38 33 48 34 32 2e 34 4c 33 38 2e 31 31 39 2c 31 38 2e 34 48 33 36 2e 35 33 31 4c 33 32 2e 31 34 32 2c 37 2e 35 38 33 68 2d 2e 30 32 39 56 31 38 2e 34 48 32 39 2e 39 56 34 2e 36 68 33 2e 34 33 36 4c 33 37 2e 33 2c 31 34 2e 38 33 68 2e 30 35 38 4c 34 31 2e 35 34 35 2c 34 2e 36 5a 6d 32 2c 31 2e 30 34 39 61 31 2e 32 36 38 2c 31 2e 32 36 38 2c 30 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="108" height="24" viewBox="0 0 108 24"><title>assets</title><path d="M44.836,4.6V18.4h-2.4V7.583H42.4L38.119,18.4H36.531L32.142,7.583h-.029V18.4H29.9V4.6h3.436L37.3,14.83h.058L41.545,4.6Zm2,1.049a1.268,1.268,0