Edit tour

Windows Analysis Report
http://promogiveawayus.com

Overview

General Information

Sample URL:	http://promogiveawayus.com
Analysis ID:	635355
Infos:

Detection

Score:	72
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Antivirus detection for URL or domain

Classification

Process Tree

System is w10x64

chrome.exe (PID: 1944 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "http://promogiveawayus.com MD5: C139654B5C1438A95B321BB01AD63EF6)

chrome.exe (PID: 6164 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1520,6848685235432065,1421123194293115861,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1948 /prefetch:8 MD5: C139654B5C1438A95B321BB01AD63EF6)

cleanup

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: http://promogiveawayus.com/	Virustotal: Detection: 7%			Perma Link
Source: https://promogiveawayus.com/	Virustotal: Detection: 11%			Perma Link

Source: http://promogiveawayus.com/	Avira URL Cloud: Label: phishing
Source: https://promogiveawayus.com/favicon.ico	Avira URL Cloud: Label: phishing

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic			Jump to behavior

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfmX-Goog-Update-Updater: chromecrx-85.0.4183.121Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: promogiveawayus.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: promogiveawayus.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://promogiveawayus.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: promogiveawayus.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 27 May 2022 18:05:41 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeCF-Cache-Status: DYNAMICExpect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=p%2FKS4PWLimB3gEIXExotDrhbF2QbO23nDzhYmGaxZIFvCy8pmvp017RtJ7haHK3FiuCRJmc6VHrDVsX3t4c14RibUgubyxsWl%2F2QcV%2BwCsUnQZPPdqVwAN5QiWht4PIXf6GU36K7"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 7120ae1bab87732c-LHRalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 27 May 2022 18:05:41 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeCache-Control: max-age=14400CF-Cache-Status: EXPIREDExpect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UjPkQUBIivNit0QwC8H9VLsrRxeNaCwp8x1CaL%2BL0Blpt73kKQpDfayZ%2Fr3MtuyGbCFpEvfaEtpITSZArqe7Y8HZwMYExHbTQ%2BfvuHXRpLNStPc3SriHfAjByjeqUblgh9KZD0be"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 7120ae200fe006f9-LHRalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

Source: pnacl_public_x86_64_pnacl_sz_nexe.0.dr, pnacl_public_x86_64_pnacl_llc_nexe.0.dr	String found in binary or memory: http://llvm.org/):
Source: 9bdf7603-bf14-481d-8c0a-4914c77d46d4.tmp.1.dr, 50de740a-7357-46fb-82d6-5598c98f1086.tmp.1.dr	String found in binary or memory: https://accounts.google.com
Source: craw_window.js.0.dr	String found in binary or memory: https://accounts.google.com/MergeSession
Source: 9bdf7603-bf14-481d-8c0a-4914c77d46d4.tmp.1.dr, 50de740a-7357-46fb-82d6-5598c98f1086.tmp.1.dr	String found in binary or memory: https://apis.google.com
Source: pnacl_public_x86_64_libpnacl_irt_shim_dummy_a.0.dr	String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-clang.git
Source: pnacl_public_x86_64_libpnacl_irt_shim_dummy_a.0.dr	String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-llvm.git
Source: 9bdf7603-bf14-481d-8c0a-4914c77d46d4.tmp.1.dr, 50de740a-7357-46fb-82d6-5598c98f1086.tmp.1.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.0.dr, manifest.json.0.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 9bdf7603-bf14-481d-8c0a-4914c77d46d4.tmp.1.dr, 50de740a-7357-46fb-82d6-5598c98f1086.tmp.1.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: pnacl_public_x86_64_ld_nexe.0.dr	String found in binary or memory: https://code.google.com/p/nativeclient/issues/entry
Source: pnacl_public_x86_64_ld_nexe.0.dr	String found in binary or memory: https://code.google.com/p/nativeclient/issues/entry%s:
Source: 159745c5-262b-4053-9dfe-b1bbabfc6b9a.tmp.1.dr, 9bdf7603-bf14-481d-8c0a-4914c77d46d4.tmp.1.dr, 50de740a-7357-46fb-82d6-5598c98f1086.tmp.1.dr, 01684835-66c7-40ce-bbf5-cac2f7616f41.tmp.1.dr	String found in binary or memory: https://dns.google
Source: 9bdf7603-bf14-481d-8c0a-4914c77d46d4.tmp.1.dr, 50de740a-7357-46fb-82d6-5598c98f1086.tmp.1.dr	String found in binary or memory: https://fonts.googleapis.com
Source: 9bdf7603-bf14-481d-8c0a-4914c77d46d4.tmp.1.dr, 50de740a-7357-46fb-82d6-5598c98f1086.tmp.1.dr	String found in binary or memory: https://fonts.gstatic.com
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p
Source: 9bdf7603-bf14-481d-8c0a-4914c77d46d4.tmp.1.dr, 50de740a-7357-46fb-82d6-5598c98f1086.tmp.1.dr	String found in binary or memory: https://ogs.google.com
Source: craw_window.js.0.dr, manifest.json.0.dr	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: 9bdf7603-bf14-481d-8c0a-4914c77d46d4.tmp.1.dr	String found in binary or memory: https://r2---sn-4g5ednds.gvt1.com
Source: 9bdf7603-bf14-481d-8c0a-4914c77d46d4.tmp.1.dr	String found in binary or memory: https://redirector.gvt1.com
Source: craw_window.js.0.dr, manifest.json.0.dr	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: 9bdf7603-bf14-481d-8c0a-4914c77d46d4.tmp.1.dr, 50de740a-7357-46fb-82d6-5598c98f1086.tmp.1.dr	String found in binary or memory: https://ssl.gstatic.com
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://www-googleapis-staging.sandbox.google.com
Source: 9bdf7603-bf14-481d-8c0a-4914c77d46d4.tmp.1.dr, 50de740a-7357-46fb-82d6-5598c98f1086.tmp.1.dr	String found in binary or memory: https://www.google.com
Source: manifest.json.0.dr	String found in binary or memory: https://www.google.com/
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/accounts/OAuthLogin?issueuberauth=1
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/cleardot.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/dot2.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/x2.gif
Source: craw_background.js.0.dr	String found in binary or memory: https://www.google.com/intl/en-US/chrome/blank.html
Source: craw_window.js.0.dr, craw_background.js.0.dr, 9bdf7603-bf14-481d-8c0a-4914c77d46d4.tmp.1.dr, 50de740a-7357-46fb-82d6-5598c98f1086.tmp.1.dr	String found in binary or memory: https://www.googleapis.com
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: 9bdf7603-bf14-481d-8c0a-4914c77d46d4.tmp.1.dr, 50de740a-7357-46fb-82d6-5598c98f1086.tmp.1.dr	String found in binary or memory: https://www.gstatic.com

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "http://promogiveawayus.com
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1520,6848685235432065,1421123194293115861,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1948 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1520,6848685235432065,1421123194293115861,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1948 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	3 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	4 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	5 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	3 Ingress Tool Transfer	SIM Card Swap		Carrier Billing Fraud

Source	Detection	Scanner	Label	Link
http://promogiveawayus.com	8%	Virustotal		Browse
http://promogiveawayus.com	100%	Avira URL Cloud	phishing

Name	IP	Active	Malicious	Reputation
a.nel.cloudflare.com	35.190.80.1	true	false	high
accounts.google.com	142.250.203.109	true	false	high
promogiveawayus.com	104.21.83.215	true	false	unknown
clients.l.google.com	216.58.215.238	true	false	high
clients2.google.com	unknown	unknown	false	high

IP	Domain	Country	ASN	ASN Name	Malicious
239.255.255.250	unknown	Reserved	unknown	unknown	false
216.58.215.238	clients.l.google.com	United States	15169	GOOGLEUS	false
104.21.83.215	promogiveawayus.com	United States	13335	CLOUDFLARENETUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
142.250.203.109	accounts.google.com	United States	15169	GOOGLEUS	false

IP
192.168.2.1
127.0.0.1

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	635355
Start date and time: 27/05/202220:04:29	2022-05-27 20:04:29 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://promogiveawayus.com
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal72.win@28/111@5/7
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\1944_1712713930\_platform_specific\x86_64\pnacl_public_x86_64_ld_nexe	0%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\1944_1712713930\_platform_specific\x86_64\pnacl_public_x86_64_ld_nexe	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
https://dns.google	0%	URL Reputation	safe
http://promogiveawayus.com/	8%	Virustotal		Browse
http://promogiveawayus.com/	100%	Avira URL Cloud	phishing
https://promogiveawayus.com/favicon.ico	100%	Avira URL Cloud	phishing
https://promogiveawayus.com/	12%	Virustotal		Browse

Name	Malicious	Antivirus Detection	Reputation
http://promogiveawayus.com/	true	8%, Virustotal, Browse Avira URL Cloud: phishing	unknown
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1	false		high
https://a.nel.cloudflare.com/report/v3?s=p%2FKS4PWLimB3gEIXExotDrhbF2QbO23nDzhYmGaxZIFvCy8pmvp017RtJ7haHK3FiuCRJmc6VHrDVsX3t4c14RibUgubyxsWl%2F2QcV%2BwCsUnQZPPdqVwAN5QiWht4PIXf6GU36K7	false		high
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false		high
https://promogiveawayus.com/favicon.ico	true	Avira URL Cloud: phishing	unknown
https://a.nel.cloudflare.com/report/v3?s=UjPkQUBIivNit0QwC8H9VLsrRxeNaCwp8x1CaL%2BL0Blpt73kKQpDfayZ%2Fr3MtuyGbCFpEvfaEtpITSZArqe7Y8HZwMYExHbTQ%2BfvuHXRpLNStPc3SriHfAjByjeqUblgh9KZD0be	false		high
https://promogiveawayus.com/	true	12%, Virustotal, Browse	unknown
https://promogiveawayus.com/	false	12%, Virustotal, Browse	unknown

Name	Source	Malicious	Antivirus Detection	Reputation
https://dns.google	159745c5-262b-4053-9dfe-b1bbabfc6b9a.tmp.1.dr, 9bdf7603-bf14-481d-8c0a-4914c77d46d4.tmp.1.dr, 50de740a-7357-46fb-82d6-5598c98f1086.tmp.1.dr, 01684835-66c7-40ce-bbf5-cac2f7616f41.tmp.1.dr	false	URL Reputation: safe	unknown
https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p	craw_window.js.0.dr, craw_background.js.0.dr	false		high
https://www.google.com/intl/en-US/chrome/blank.html	craw_background.js.0.dr	false		high
https://ogs.google.com	9bdf7603-bf14-481d-8c0a-4914c77d46d4.tmp.1.dr, 50de740a-7357-46fb-82d6-5598c98f1086.tmp.1.dr	false		high
https://www.google.com/images/cleardot.gif	craw_window.js.0.dr	false		high
https://payments.google.com/payments/v4/js/integrator.js	craw_window.js.0.dr, manifest.json.0.dr	false		high
https://chromium.googlesource.com/a/native_client/pnacl-llvm.git	pnacl_public_x86_64_libpnacl_irt_shim_dummy_a.0.dr	false		high
https://sandbox.google.com/payments/v4/js/integrator.js	craw_window.js.0.dr, manifest.json.0.dr	false		high
https://www.google.com/images/x2.gif	craw_window.js.0.dr	false		high
https://accounts.google.com/MergeSession	craw_window.js.0.dr	false		high
http://llvm.org/):	pnacl_public_x86_64_pnacl_sz_nexe.0.dr, pnacl_public_x86_64_pnacl_llc_nexe.0.dr	false		high
https://www.google.com	9bdf7603-bf14-481d-8c0a-4914c77d46d4.tmp.1.dr, 50de740a-7357-46fb-82d6-5598c98f1086.tmp.1.dr	false		high
https://www.google.com/images/dot2.gif	craw_window.js.0.dr	false		high
https://code.google.com/p/nativeclient/issues/entry%s:	pnacl_public_x86_64_ld_nexe.0.dr	false		high
https://code.google.com/p/nativeclient/issues/entry	pnacl_public_x86_64_ld_nexe.0.dr	false		high
https://accounts.google.com	9bdf7603-bf14-481d-8c0a-4914c77d46d4.tmp.1.dr, 50de740a-7357-46fb-82d6-5598c98f1086.tmp.1.dr	false		high
https://clients2.googleusercontent.com	9bdf7603-bf14-481d-8c0a-4914c77d46d4.tmp.1.dr, 50de740a-7357-46fb-82d6-5598c98f1086.tmp.1.dr	false		high
https://apis.google.com	9bdf7603-bf14-481d-8c0a-4914c77d46d4.tmp.1.dr, 50de740a-7357-46fb-82d6-5598c98f1086.tmp.1.dr	false		high
https://www.google.com/accounts/OAuthLogin?issueuberauth=1	craw_window.js.0.dr	false		high
https://www.google.com/	manifest.json.0.dr	false		high
https://www-googleapis-staging.sandbox.google.com	craw_window.js.0.dr, craw_background.js.0.dr	false		high
https://chromium.googlesource.com/a/native_client/pnacl-clang.git	pnacl_public_x86_64_libpnacl_irt_shim_dummy_a.0.dr	false		high
https://clients2.google.com	9bdf7603-bf14-481d-8c0a-4914c77d46d4.tmp.1.dr, 50de740a-7357-46fb-82d6-5598c98f1086.tmp.1.dr	false		high
https://clients2.google.com/service/update2/crx	manifest.json0.0.dr, manifest.json.0.dr	false		high

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	451603
Entropy (8bit):	5.009711072558331
Encrypted:	false
SSDEEP:	12288:ZHfRTyGZ6lup8Cfrvq4JBPKh+FBlESBw4p6:NfOCzvRKhGvwJ
MD5:	A78AD14E77147E7DE3647E61964C0335
SHA1:	CECC3DD41F4CEA0192B24300C71E1911BD4FCE45
SHA-256:	0D6803758FF8F87081FAFD62E90F0950DFB2DD7991E9607FE76A8F92D0E893FA
SHA-512:	DDE24D5AD50D68FC91E9E325D31E66EF8F624B6BB3A07D14FFED1104D3AB5F4EF1D7969A5CDE0DFBB19CB31C506F7DE97AF67C2F244F7E7E8E10648EA8321101
Malicious:	false
Reputation:	low
Preview:	BDic.... ....6...."..Z..4g....6.2...{/...3...5....AF 1363.AF nm.AF pt.AF n1.AF p.AF tc.AF SM.AF M.AF S.AF MS.AF MNR.AF GDS.AF MNT.AF MH.AF MR.AF SZMR.AF MJ.AF MT.AF MY.AF MRZ.AF MN.AF MG.AF RM.AF N.AF MV.AF XM.AF DSM.AF SD.AF G.AF R.AF MNX.AF MRS.AF MD.AF MNRB.AF B.AF ZSMR.AF PM.AF SMNGJ.AF SMN.AF ZMR.AF SMGB.AF MZR.AF GM.AF SMR.AF SMDG.AF RMZ.AF ZM.AF MDG.AF MDT.AF SMNXT.AF SDY.AF LSDG.AF LGDS.AF GLDS.AF UY.AF U.AF DSGNX.AF GNDSX.AF DSG.AF Y.AF GS.AF IEMS.AF YP.AF ZGDRS.AF XGNVDS.AF UT.AF GNDS.AF GVDS.AF MYPS.AF XGNDS.AF TPRY.AF MDSG.AF ZGSDR.AF DYSG.AF PMYTNS.AF AGDS.AF DRZGS.AF PY.AF GSPMDY.AF EGVDS.AF SL.AF GNXDS.AF DSBG.AF IM.AF I.AF MDGS.AF SMY.AF DSGN.AF DSLG.AF GMDS.AF MDSBG.AF SGD.AF IY.AF P.AF DSMG.AF BLZGDRS.AF TR.AF AGSD.AF ZGBDRSL.AF PTRY.AF ASDGV.AF ASM.AF ICANGSD.AF ICAM.AF IKY.AF AMS.AF PMYTRS.AF BZGVDRS.AF SDRBZG.AF GVMDS.AF PSM.AF DGLS.AF GNVXDS.AF AGDSL.AF DGS.AF XDSGNV.AF BZGDRS.AF AM.AF AS.AF A.AF LDSG.AF AGVDS.AF SDG.AF LDSMG.AF EDSMG.AF EY.AF DRSMZG.AF PRYT.AF LZ

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 27, 2022 20:05:40.563956022 CEST	49761	80	192.168.2.5	104.21.83.215
May 27, 2022 20:05:40.565105915 CEST	49762	80	192.168.2.5	104.21.83.215
May 27, 2022 20:05:40.594367027 CEST	49764	443	192.168.2.5	142.250.203.109
May 27, 2022 20:05:40.594435930 CEST	443	49764	142.250.203.109	192.168.2.5
May 27, 2022 20:05:40.594523907 CEST	49764	443	192.168.2.5	142.250.203.109
May 27, 2022 20:05:40.594758987 CEST	49765	443	192.168.2.5	216.58.215.238
May 27, 2022 20:05:40.594822884 CEST	443	49765	216.58.215.238	192.168.2.5
May 27, 2022 20:05:40.594892025 CEST	49765	443	192.168.2.5	216.58.215.238
May 27, 2022 20:05:40.595364094 CEST	49764	443	192.168.2.5	142.250.203.109
May 27, 2022 20:05:40.595402002 CEST	443	49764	142.250.203.109	192.168.2.5
May 27, 2022 20:05:40.595542908 CEST	49765	443	192.168.2.5	216.58.215.238
May 27, 2022 20:05:40.595576048 CEST	443	49765	216.58.215.238	192.168.2.5
May 27, 2022 20:05:40.596424103 CEST	80	49761	104.21.83.215	192.168.2.5
May 27, 2022 20:05:40.596553087 CEST	49761	80	192.168.2.5	104.21.83.215
May 27, 2022 20:05:40.597117901 CEST	49761	80	192.168.2.5	104.21.83.215
May 27, 2022 20:05:40.597207069 CEST	80	49762	104.21.83.215	192.168.2.5
May 27, 2022 20:05:40.597374916 CEST	49762	80	192.168.2.5	104.21.83.215
May 27, 2022 20:05:40.629671097 CEST	80	49761	104.21.83.215	192.168.2.5
May 27, 2022 20:05:40.650933981 CEST	80	49761	104.21.83.215	192.168.2.5
May 27, 2022 20:05:40.656857014 CEST	443	49764	142.250.203.109	192.168.2.5
May 27, 2022 20:05:40.658415079 CEST	443	49765	216.58.215.238	192.168.2.5
May 27, 2022 20:05:40.663683891 CEST	49765	443	192.168.2.5	216.58.215.238
May 27, 2022 20:05:40.663712025 CEST	443	49765	216.58.215.238	192.168.2.5
May 27, 2022 20:05:40.664086103 CEST	443	49765	216.58.215.238	192.168.2.5
May 27, 2022 20:05:40.664097071 CEST	49764	443	192.168.2.5	142.250.203.109
May 27, 2022 20:05:40.664134979 CEST	443	49764	142.250.203.109	192.168.2.5
May 27, 2022 20:05:40.664164066 CEST	49765	443	192.168.2.5	216.58.215.238
May 27, 2022 20:05:40.665064096 CEST	443	49765	216.58.215.238	192.168.2.5
May 27, 2022 20:05:40.665154934 CEST	49765	443	192.168.2.5	216.58.215.238
May 27, 2022 20:05:40.665611029 CEST	443	49764	142.250.203.109	192.168.2.5
May 27, 2022 20:05:40.665716887 CEST	49764	443	192.168.2.5	142.250.203.109
May 27, 2022 20:05:40.705986977 CEST	49761	80	192.168.2.5	104.21.83.215
May 27, 2022 20:05:40.791042089 CEST	49767	443	192.168.2.5	104.21.83.215
May 27, 2022 20:05:40.791090012 CEST	443	49767	104.21.83.215	192.168.2.5
May 27, 2022 20:05:40.791205883 CEST	49767	443	192.168.2.5	104.21.83.215
May 27, 2022 20:05:40.791460991 CEST	49767	443	192.168.2.5	104.21.83.215
May 27, 2022 20:05:40.791475058 CEST	443	49767	104.21.83.215	192.168.2.5
May 27, 2022 20:05:40.877218008 CEST	443	49767	104.21.83.215	192.168.2.5
May 27, 2022 20:05:40.877602100 CEST	49767	443	192.168.2.5	104.21.83.215
May 27, 2022 20:05:40.877634048 CEST	443	49767	104.21.83.215	192.168.2.5
May 27, 2022 20:05:40.878752947 CEST	443	49767	104.21.83.215	192.168.2.5
May 27, 2022 20:05:40.878878117 CEST	49767	443	192.168.2.5	104.21.83.215
May 27, 2022 20:05:41.052454948 CEST	49764	443	192.168.2.5	142.250.203.109
May 27, 2022 20:05:41.052759886 CEST	443	49764	142.250.203.109	192.168.2.5
May 27, 2022 20:05:41.052809954 CEST	49765	443	192.168.2.5	216.58.215.238
May 27, 2022 20:05:41.053174019 CEST	443	49765	216.58.215.238	192.168.2.5
May 27, 2022 20:05:41.053622961 CEST	49767	443	192.168.2.5	104.21.83.215
May 27, 2022 20:05:41.053963900 CEST	443	49767	104.21.83.215	192.168.2.5
May 27, 2022 20:05:41.054249048 CEST	49764	443	192.168.2.5	142.250.203.109
May 27, 2022 20:05:41.054276943 CEST	443	49764	142.250.203.109	192.168.2.5
May 27, 2022 20:05:41.054371119 CEST	49765	443	192.168.2.5	216.58.215.238
May 27, 2022 20:05:41.054408073 CEST	443	49765	216.58.215.238	192.168.2.5
May 27, 2022 20:05:41.054718018 CEST	49767	443	192.168.2.5	104.21.83.215
May 27, 2022 20:05:41.054759026 CEST	443	49767	104.21.83.215	192.168.2.5
May 27, 2022 20:05:41.088928938 CEST	443	49765	216.58.215.238	192.168.2.5
May 27, 2022 20:05:41.089076996 CEST	443	49765	216.58.215.238	192.168.2.5
May 27, 2022 20:05:41.089085102 CEST	49765	443	192.168.2.5	216.58.215.238
May 27, 2022 20:05:41.089176893 CEST	49765	443	192.168.2.5	216.58.215.238
May 27, 2022 20:05:41.101497889 CEST	49765	443	192.168.2.5	216.58.215.238
May 27, 2022 20:05:41.101541042 CEST	443	49765	216.58.215.238	192.168.2.5
May 27, 2022 20:05:41.106657028 CEST	443	49764	142.250.203.109	192.168.2.5
May 27, 2022 20:05:41.106826067 CEST	49764	443	192.168.2.5	142.250.203.109
May 27, 2022 20:05:41.106853008 CEST	443	49764	142.250.203.109	192.168.2.5
May 27, 2022 20:05:41.106920958 CEST	49767	443	192.168.2.5	104.21.83.215
May 27, 2022 20:05:41.106941938 CEST	49764	443	192.168.2.5	142.250.203.109
May 27, 2022 20:05:41.131705999 CEST	49764	443	192.168.2.5	142.250.203.109
May 27, 2022 20:05:41.131752014 CEST	443	49764	142.250.203.109	192.168.2.5
May 27, 2022 20:05:41.249594927 CEST	443	49767	104.21.83.215	192.168.2.5
May 27, 2022 20:05:41.305921078 CEST	49767	443	192.168.2.5	104.21.83.215
May 27, 2022 20:05:41.305943012 CEST	443	49767	104.21.83.215	192.168.2.5
May 27, 2022 20:05:41.344660997 CEST	49771	443	192.168.2.5	35.190.80.1
May 27, 2022 20:05:41.344727039 CEST	443	49771	35.190.80.1	192.168.2.5
May 27, 2022 20:05:41.344850063 CEST	49771	443	192.168.2.5	35.190.80.1
May 27, 2022 20:05:41.345061064 CEST	49771	443	192.168.2.5	35.190.80.1
May 27, 2022 20:05:41.345081091 CEST	443	49771	35.190.80.1	192.168.2.5
May 27, 2022 20:05:41.345910072 CEST	49767	443	192.168.2.5	104.21.83.215
May 27, 2022 20:05:41.346246004 CEST	443	49767	104.21.83.215	192.168.2.5
May 27, 2022 20:05:41.346313000 CEST	443	49767	104.21.83.215	192.168.2.5
May 27, 2022 20:05:41.346337080 CEST	49767	443	192.168.2.5	104.21.83.215
May 27, 2022 20:05:41.346374989 CEST	49767	443	192.168.2.5	104.21.83.215
May 27, 2022 20:05:41.397672892 CEST	443	49771	35.190.80.1	192.168.2.5
May 27, 2022 20:05:41.397963047 CEST	49771	443	192.168.2.5	35.190.80.1
May 27, 2022 20:05:41.397988081 CEST	443	49771	35.190.80.1	192.168.2.5
May 27, 2022 20:05:41.399713039 CEST	443	49771	35.190.80.1	192.168.2.5
May 27, 2022 20:05:41.399789095 CEST	49771	443	192.168.2.5	35.190.80.1
May 27, 2022 20:05:41.410151958 CEST	49771	443	192.168.2.5	35.190.80.1
May 27, 2022 20:05:41.410252094 CEST	443	49771	35.190.80.1	192.168.2.5
May 27, 2022 20:05:41.410336971 CEST	49771	443	192.168.2.5	35.190.80.1
May 27, 2022 20:05:41.410348892 CEST	443	49771	35.190.80.1	192.168.2.5
May 27, 2022 20:05:41.486895084 CEST	49771	443	192.168.2.5	35.190.80.1
May 27, 2022 20:05:41.537666082 CEST	443	49771	35.190.80.1	192.168.2.5
May 27, 2022 20:05:41.537779093 CEST	443	49771	35.190.80.1	192.168.2.5
May 27, 2022 20:05:41.537868977 CEST	49771	443	192.168.2.5	35.190.80.1
May 27, 2022 20:05:41.540205002 CEST	49771	443	192.168.2.5	35.190.80.1
May 27, 2022 20:05:41.540252924 CEST	443	49771	35.190.80.1	192.168.2.5
May 27, 2022 20:05:41.551548958 CEST	49774	443	192.168.2.5	35.190.80.1
May 27, 2022 20:05:41.551615953 CEST	443	49774	35.190.80.1	192.168.2.5
May 27, 2022 20:05:41.551759005 CEST	49774	443	192.168.2.5	35.190.80.1
May 27, 2022 20:05:41.552047014 CEST	49774	443	192.168.2.5	35.190.80.1
May 27, 2022 20:05:41.552079916 CEST	443	49774	35.190.80.1	192.168.2.5
May 27, 2022 20:05:41.594444990 CEST	443	49774	35.190.80.1	192.168.2.5
May 27, 2022 20:05:41.594875097 CEST	49774	443	192.168.2.5	35.190.80.1
May 27, 2022 20:05:41.594921112 CEST	443	49774	35.190.80.1	192.168.2.5
May 27, 2022 20:05:41.595562935 CEST	443	49774	35.190.80.1	192.168.2.5
May 27, 2022 20:05:41.596147060 CEST	49774	443	192.168.2.5	35.190.80.1
May 27, 2022 20:05:41.596309900 CEST	443	49774	35.190.80.1	192.168.2.5
May 27, 2022 20:05:41.596322060 CEST	49774	443	192.168.2.5	35.190.80.1
May 27, 2022 20:05:41.636498928 CEST	443	49774	35.190.80.1	192.168.2.5
May 27, 2022 20:05:41.653073072 CEST	49776	443	192.168.2.5	104.21.83.215
May 27, 2022 20:05:41.653116941 CEST	443	49776	104.21.83.215	192.168.2.5
May 27, 2022 20:05:41.653198957 CEST	49776	443	192.168.2.5	104.21.83.215
May 27, 2022 20:05:41.653892994 CEST	49776	443	192.168.2.5	104.21.83.215
May 27, 2022 20:05:41.653915882 CEST	443	49776	104.21.83.215	192.168.2.5
May 27, 2022 20:05:41.726317883 CEST	443	49776	104.21.83.215	192.168.2.5
May 27, 2022 20:05:41.728053093 CEST	49776	443	192.168.2.5	104.21.83.215
May 27, 2022 20:05:41.728091002 CEST	443	49776	104.21.83.215	192.168.2.5
May 27, 2022 20:05:41.728934050 CEST	443	49776	104.21.83.215	192.168.2.5
May 27, 2022 20:05:41.738871098 CEST	49776	443	192.168.2.5	104.21.83.215
May 27, 2022 20:05:41.739118099 CEST	49776	443	192.168.2.5	104.21.83.215
May 27, 2022 20:05:41.739155054 CEST	443	49776	104.21.83.215	192.168.2.5
May 27, 2022 20:05:41.743923903 CEST	443	49774	35.190.80.1	192.168.2.5
May 27, 2022 20:05:41.744035006 CEST	49774	443	192.168.2.5	35.190.80.1
May 27, 2022 20:05:41.745784044 CEST	49774	443	192.168.2.5	35.190.80.1
May 27, 2022 20:05:41.745816946 CEST	443	49774	35.190.80.1	192.168.2.5
May 27, 2022 20:05:41.805054903 CEST	49776	443	192.168.2.5	104.21.83.215
May 27, 2022 20:05:41.962091923 CEST	443	49776	104.21.83.215	192.168.2.5
May 27, 2022 20:05:41.962281942 CEST	443	49776	104.21.83.215	192.168.2.5
May 27, 2022 20:05:41.962358952 CEST	49776	443	192.168.2.5	104.21.83.215
May 27, 2022 20:05:41.980377913 CEST	49776	443	192.168.2.5	104.21.83.215
May 27, 2022 20:05:41.980403900 CEST	443	49776	104.21.83.215	192.168.2.5
May 27, 2022 20:05:52.406852961 CEST	49762	80	192.168.2.5	104.21.83.215
May 27, 2022 20:05:52.439553022 CEST	80	49762	104.21.83.215	192.168.2.5
May 27, 2022 20:05:52.439750910 CEST	49762	80	192.168.2.5	104.21.83.215
May 27, 2022 20:06:25.674123049 CEST	49761	80	192.168.2.5	104.21.83.215
May 27, 2022 20:06:25.706809998 CEST	80	49761	104.21.83.215	192.168.2.5
May 27, 2022 20:06:41.268253088 CEST	49838	443	192.168.2.5	35.190.80.1
May 27, 2022 20:06:41.268318892 CEST	443	49838	35.190.80.1	192.168.2.5
May 27, 2022 20:06:41.268414974 CEST	49838	443	192.168.2.5	35.190.80.1
May 27, 2022 20:06:41.274322033 CEST	49838	443	192.168.2.5	35.190.80.1
May 27, 2022 20:06:41.274357080 CEST	443	49838	35.190.80.1	192.168.2.5
May 27, 2022 20:06:41.315901995 CEST	443	49838	35.190.80.1	192.168.2.5
May 27, 2022 20:06:41.316277027 CEST	49838	443	192.168.2.5	35.190.80.1
May 27, 2022 20:06:41.316323996 CEST	443	49838	35.190.80.1	192.168.2.5
May 27, 2022 20:06:41.316663980 CEST	443	49838	35.190.80.1	192.168.2.5
May 27, 2022 20:06:41.317398071 CEST	49838	443	192.168.2.5	35.190.80.1
May 27, 2022 20:06:41.317507982 CEST	443	49838	35.190.80.1	192.168.2.5
May 27, 2022 20:06:41.317589045 CEST	49838	443	192.168.2.5	35.190.80.1
May 27, 2022 20:06:41.357172966 CEST	49838	443	192.168.2.5	35.190.80.1
May 27, 2022 20:06:41.360503912 CEST	443	49838	35.190.80.1	192.168.2.5
May 27, 2022 20:06:41.467144012 CEST	443	49838	35.190.80.1	192.168.2.5
May 27, 2022 20:06:41.467222929 CEST	443	49838	35.190.80.1	192.168.2.5
May 27, 2022 20:06:41.467356920 CEST	49838	443	192.168.2.5	35.190.80.1
May 27, 2022 20:06:41.467643976 CEST	49838	443	192.168.2.5	35.190.80.1
May 27, 2022 20:06:41.467664957 CEST	443	49838	35.190.80.1	192.168.2.5
May 27, 2022 20:06:41.490236998 CEST	49839	443	192.168.2.5	35.190.80.1
May 27, 2022 20:06:41.490264893 CEST	443	49839	35.190.80.1	192.168.2.5
May 27, 2022 20:06:41.490328074 CEST	49839	443	192.168.2.5	35.190.80.1
May 27, 2022 20:06:41.490557909 CEST	49839	443	192.168.2.5	35.190.80.1
May 27, 2022 20:06:41.490577936 CEST	443	49839	35.190.80.1	192.168.2.5
May 27, 2022 20:06:41.531303883 CEST	443	49839	35.190.80.1	192.168.2.5
May 27, 2022 20:06:41.531658888 CEST	49839	443	192.168.2.5	35.190.80.1
May 27, 2022 20:06:41.531694889 CEST	443	49839	35.190.80.1	192.168.2.5
May 27, 2022 20:06:41.531985044 CEST	443	49839	35.190.80.1	192.168.2.5
May 27, 2022 20:06:41.532505989 CEST	49839	443	192.168.2.5	35.190.80.1
May 27, 2022 20:06:41.532607079 CEST	443	49839	35.190.80.1	192.168.2.5
May 27, 2022 20:06:41.532680035 CEST	49839	443	192.168.2.5	35.190.80.1
May 27, 2022 20:06:41.576497078 CEST	443	49839	35.190.80.1	192.168.2.5
May 27, 2022 20:06:41.679019928 CEST	443	49839	35.190.80.1	192.168.2.5
May 27, 2022 20:06:41.679095984 CEST	443	49839	35.190.80.1	192.168.2.5
May 27, 2022 20:06:41.679146051 CEST	49839	443	192.168.2.5	35.190.80.1
May 27, 2022 20:06:41.679735899 CEST	49839	443	192.168.2.5	35.190.80.1
May 27, 2022 20:06:41.679754972 CEST	443	49839	35.190.80.1	192.168.2.5
May 27, 2022 20:07:10.777112961 CEST	49761	80	192.168.2.5	104.21.83.215
May 27, 2022 20:07:10.809518099 CEST	80	49761	104.21.83.215	192.168.2.5

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 27, 2022 20:05:40.467345953 CEST	53934	53	192.168.2.5	8.8.8.8
May 27, 2022 20:05:40.497651100 CEST	53	53934	8.8.8.8	192.168.2.5
May 27, 2022 20:05:40.502016068 CEST	63187	53	192.168.2.5	8.8.8.8
May 27, 2022 20:05:40.504239082 CEST	60658	53	192.168.2.5	8.8.8.8
May 27, 2022 20:05:40.521169901 CEST	53	63187	8.8.8.8	192.168.2.5
May 27, 2022 20:05:40.544614077 CEST	53	60658	8.8.8.8	192.168.2.5
May 27, 2022 20:05:41.253751993 CEST	62929	53	192.168.2.5	8.8.8.8
May 27, 2022 20:05:41.279424906 CEST	53	62929	8.8.8.8	192.168.2.5
May 27, 2022 20:05:48.648344040 CEST	61479	443	192.168.2.5	216.58.215.238
May 27, 2022 20:05:48.676726103 CEST	443	61479	216.58.215.238	192.168.2.5
May 27, 2022 20:05:48.677148104 CEST	61479	443	192.168.2.5	216.58.215.238
May 27, 2022 20:05:48.705933094 CEST	443	61479	216.58.215.238	192.168.2.5
May 27, 2022 20:05:48.705981016 CEST	443	61479	216.58.215.238	192.168.2.5
May 27, 2022 20:05:48.706023932 CEST	443	61479	216.58.215.238	192.168.2.5
May 27, 2022 20:05:48.706072092 CEST	443	61479	216.58.215.238	192.168.2.5
May 27, 2022 20:05:48.706298113 CEST	61479	443	192.168.2.5	216.58.215.238
May 27, 2022 20:05:48.708136082 CEST	61479	443	192.168.2.5	216.58.215.238
May 27, 2022 20:05:48.805269003 CEST	61479	443	192.168.2.5	216.58.215.238
May 27, 2022 20:05:48.805665016 CEST	61479	443	192.168.2.5	216.58.215.238
May 27, 2022 20:05:48.845290899 CEST	443	61479	216.58.215.238	192.168.2.5
May 27, 2022 20:05:48.847676992 CEST	443	61479	216.58.215.238	192.168.2.5
May 27, 2022 20:05:48.863605022 CEST	443	61479	216.58.215.238	192.168.2.5
May 27, 2022 20:05:48.863648891 CEST	443	61479	216.58.215.238	192.168.2.5
May 27, 2022 20:05:48.863676071 CEST	443	61479	216.58.215.238	192.168.2.5
May 27, 2022 20:05:48.870563030 CEST	443	61479	216.58.215.238	192.168.2.5
May 27, 2022 20:05:48.902044058 CEST	61479	443	192.168.2.5	216.58.215.238
May 27, 2022 20:05:48.902313948 CEST	61479	443	192.168.2.5	216.58.215.238
May 27, 2022 20:05:48.902458906 CEST	61479	443	192.168.2.5	216.58.215.238
May 27, 2022 20:06:03.822882891 CEST	61479	443	192.168.2.5	216.58.215.238
May 27, 2022 20:06:03.864939928 CEST	443	61479	216.58.215.238	192.168.2.5
May 27, 2022 20:06:41.470060110 CEST	55870	53	192.168.2.5	8.8.8.8
May 27, 2022 20:06:41.489204884 CEST	53	55870	8.8.8.8	192.168.2.5

Timestamp	kBytes transferred	Direction	Data
May 27, 2022 20:05:40.597117901 CEST	672	OUT	GET / HTTP/1.1 Host: promogiveawayus.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
May 27, 2022 20:05:40.650933981 CEST	674	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 27 May 2022 18:05:40 GMT Transfer-Encoding: chunked Connection: keep-alive Cache-Control: max-age=3600 Expires: Fri, 27 May 2022 19:05:40 GMT Location: https://promogiveawayus.com/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=a8iHhOYaF9EiGLHCekPod2foz%2F%2Fz9WjeHo%2FjfJnpjPEjtmN6VTnjYBlo4EXoJKymrykdjq0mW7nWjQhODCMSlvg3EyUP5liTqe4Q8%2FqP6IzgW55EkWdSq4KXmM%2B9ej75R2%2BU%2FVbG"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 7120ae18cd6e7719-LHR alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
May 27, 2022 20:06:25.674123049 CEST	2201	OUT	Data Raw: 00 Data Ascii:
May 27, 2022 20:07:10.777112961 CEST	14990	OUT	Data Raw: 00 Data Ascii:

Timestamp	kBytes transferred	Direction	Data
2022-05-27 18:05:41 UTC	0	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-05-27 18:05:41 UTC	0	OUT	Data Raw: 20 Data Ascii:
2022-05-27 18:05:41 UTC	3	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 27 May 2022 18:05:41 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Content-Security-Policy: script-src 'report-sample' 'nonce-KePUwmdF9UmNRnc3yQSsSg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'nonce-KePUwmdF9UmNRnc3yQSsSg' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-05-27 18:05:41 UTC	5	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2022-05-27 18:05:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-05-27 18:05:41 UTC	0	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfm X-Goog-Update-Updater: chromecrx-85.0.4183.121 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-05-27 18:05:41 UTC	1	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-3DIE2_9iDBey6AMAn3slEA' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 27 May 2022 18:05:41 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 5625 X-Daystart: 39941 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-05-27 18:05:41 UTC	2	IN	Data Raw: 33 36 64 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 35 36 32 35 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 33 39 39 34 31 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 36d<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="5625" elapsed_seconds="39941"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2022-05-27 18:05:41 UTC	3	IN	Data Raw: 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 2e 63 72 78 22 20 66 70 3d 22 31 2e 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 61 70 Data Ascii: mhkkegccagdldgiimedpiccmgmieda.crx" fp="1.81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app><ap
2022-05-27 18:05:41 UTC	3	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://promogiveawayus.com

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic

C:\Users\user\AppData\Local\Google\Chrome\User Data\2683957b-77d2-40f8-a1ae-39b4ab1e3560.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\2ecbf2cc-8b65-4ad5-8855-8b8fd400d880.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\5540380a-80f8-44f7-b0d7-d5d99ee3c731.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\6bfe6688-cae4-4f3a-830b-e2f12322df0e.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\992d2d70-492f-4e0f-a6be-fa812400084e.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\2e6a9517-9ce1-4e7a-a518-62f3cc199e05.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\40db85c3-83e3-439b-ad32-1efb235b43c0.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\4cde9abc-eb55-4f4e-b438-146aec54245f.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\50de740a-7357-46fb-82d6-5598c98f1086.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\66056bbf-5e06-40ff-b55e-70d3deb948bf.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\80b74831-8396-4da5-94a5-15225c455efe.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\9bdf7603-bf14-481d-8c0a-4914c77d46d4.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata\computed_hashes.json

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\000003.log

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG.old (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network Persistent State (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Preferences (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\01684835-66c7-40ce-bbf5-cac2f7616f41.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\GPUCache\data_1

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Network Persistent State (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\159745c5-262b-4053-9dfe-b1bbabfc6b9a.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network Persistent State (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\b6da48e4-6a9b-4b1e-81de-42a23b83e1b1.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000004.dbtmp

Windows Analysis Report
http://promogiveawayus.com

Timestamp	kBytes transferred	Direction	Data
2022-05-27 18:05:41 UTC	6	OUT	OPTIONS /report/v3?s=p%2FKS4PWLimB3gEIXExotDrhbF2QbO23nDzhYmGaxZIFvCy8pmvp017RtJ7haHK3FiuCRJmc6VHrDVsX3t4c14RibUgubyxsWl%2F2QcV%2BwCsUnQZPPdqVwAN5QiWht4PIXf6GU36K7 HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Origin: https://promogiveawayus.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-05-27 18:05:41 UTC	6	IN	HTTP/1.1 200 OK content-length: 0 access-control-max-age: 86400 access-control-allow-methods: OPTIONS, POST access-control-allow-origin: * access-control-allow-headers: content-length, content-type date: Fri, 27 May 2022 18:05:41 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	kBytes transferred	Direction	Data
2022-05-27 18:05:41 UTC	7	OUT	POST /report/v3?s=p%2FKS4PWLimB3gEIXExotDrhbF2QbO23nDzhYmGaxZIFvCy8pmvp017RtJ7haHK3FiuCRJmc6VHrDVsX3t4c14RibUgubyxsWl%2F2QcV%2BwCsUnQZPPdqVwAN5QiWht4PIXf6GU36K7 HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Content-Length: 393 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-05-27 18:05:41 UTC	7	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 31 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 34 35 39 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 30 34 2e 32 31 2e 38 33 2e 32 31 35 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 34 30 33 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 70 72 6f 6d 6f 67 69 76 65 61 77 61 79 75 73 2e Data Ascii: [{"age":1,"body":{"elapsed_time":459,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"","sampling_fraction":1.0,"server_ip":"104.21.83.215","status_code":403,"type":"http.error"},"type":"network-error","url":"https://promogiveawayus.
2022-05-27 18:05:41 UTC	8	IN	HTTP/1.1 200 OK content-length: 0 date: Fri, 27 May 2022 18:05:41 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	kBytes transferred	Direction	Data
2022-05-27 18:05:41 UTC	8	OUT	GET /favicon.ico HTTP/1.1 Host: promogiveawayus.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://promogiveawayus.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-05-27 18:05:41 UTC	8	IN	HTTP/1.1 404 Not Found Date: Fri, 27 May 2022 18:05:41 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Cache-Control: max-age=14400 CF-Cache-Status: EXPIRED Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UjPkQUBIivNit0QwC8H9VLsrRxeNaCwp8x1CaL%2BL0Blpt73kKQpDfayZ%2Fr3MtuyGbCFpEvfaEtpITSZArqe7Y8HZwMYExHbTQ%2BfvuHXRpLNStPc3SriHfAjByjeqUblgh9KZD0be"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7120ae200fe006f9-LHR alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2022-05-27 18:05:41 UTC	9	IN	Data Raw: 32 33 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 Data Ascii: 234<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to dis
2022-05-27 18:05:41 UTC	10	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-05-27 18:06:41 UTC	10	OUT	OPTIONS /report/v3?s=UjPkQUBIivNit0QwC8H9VLsrRxeNaCwp8x1CaL%2BL0Blpt73kKQpDfayZ%2Fr3MtuyGbCFpEvfaEtpITSZArqe7Y8HZwMYExHbTQ%2BfvuHXRpLNStPc3SriHfAjByjeqUblgh9KZD0be HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Origin: https://promogiveawayus.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-05-27 18:06:41 UTC	10	IN	HTTP/1.1 200 OK content-length: 0 access-control-max-age: 86400 access-control-allow-methods: POST, OPTIONS access-control-allow-origin: * access-control-allow-headers: content-type, content-length date: Fri, 27 May 2022 18:06:41 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	kBytes transferred	Direction	Data
2022-05-27 18:06:41 UTC	10	OUT	POST /report/v3?s=UjPkQUBIivNit0QwC8H9VLsrRxeNaCwp8x1CaL%2BL0Blpt73kKQpDfayZ%2Fr3MtuyGbCFpEvfaEtpITSZArqe7Y8HZwMYExHbTQ%2BfvuHXRpLNStPc3SriHfAjByjeqUblgh9KZD0be HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Content-Length: 436 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-05-27 18:06:41 UTC	11	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 35 39 32 39 36 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 33 30 39 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 68 74 74 70 73 3a 2f 2f 70 72 6f 6d 6f 67 69 76 65 61 77 61 79 75 73 2e 63 6f 6d 2f 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 30 34 2e 32 31 2e 38 33 2e 32 31 35 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 34 30 34 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 Data Ascii: [{"age":59296,"body":{"elapsed_time":309,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"https://promogiveawayus.com/","sampling_fraction":1.0,"server_ip":"104.21.83.215","status_code":404,"type":"http.error"},"type":"network-error"
2022-05-27 18:06:41 UTC	11	IN	HTTP/1.1 200 OK content-length: 0 date: Fri, 27 May 2022 18:06:41 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Target ID:	0
Start time:	20:05:34
Start date:	27/05/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "http://promogiveawayus.com
Imagebase:	0x7ff6a7220000
File size:	2150896 bytes
MD5 hash:	C139654B5C1438A95B321BB01AD63EF6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Target ID:	1
Start time:	20:05:36
Start date:	27/05/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1520,6848685235432065,1421123194293115861,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1948 /prefetch:8
Imagebase:	0x7ff6a7220000
File size:	2150896 bytes
MD5 hash:	C139654B5C1438A95B321BB01AD63EF6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre