Edit tour

Windows Analysis Report
Invoice#0036473 .xlsx

Overview

General Information

Sample Name:	Invoice#0036473 .xlsx
Analysis ID:	655570
MD5:	c93e6dcf32928e1da7346b6ca3a1dc85
SHA1:	b90d66412b4d6669a175fd30e32bbe44428bd245
SHA256:	3ffe69c9e2e2f8a350f7d2ff6e64acf8cffbf390489807b81cf8e4eec87d4047
Infos:

Detection

HTMLPhisher

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected HtmlPhish10

Antivirus detection for URL or domain

Yara detected HtmlPhish7

Multi AV Scanner detection for domain / URL

Document exploit detected (process start blacklist hit)

Potential document exploit detected (unknown TCP traffic)

No HTML title found

JA3 SSL client fingerprint seen in connection with other malware

Potential document exploit detected (performs DNS queries)

HTML body contains low number of good links

Potential document exploit detected (performs HTTP gets)

Suspicious form URL found

IP address seen in connection with other malware

Document misses a certain OLE stream usually present in this Microsoft Office document type

Classification

Process Tree

System is w7x64

EXCEL.EXE (PID: 832 cmdline: "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding MD5: D53B85E21886D2AF9815C377537BCAC3)

chrome.exe (PID: 1040 cmdline: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation -- "https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.html MD5: 6ACAE527E744C80997B25EF2A0485D5E)

chrome.exe (PID: 1520 cmdline: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=932,13148372515324661737,10505591573509331624,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1376 /prefetch:8 MD5: 6ACAE527E744C80997B25EF2A0485D5E)

chrome.exe (PID: 1688 cmdline: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.html MD5: 6ACAE527E744C80997B25EF2A0485D5E)

chrome.exe (PID: 2192 cmdline: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=968,11663495452235836402,10867097982774653214,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1452 /prefetch:8 MD5: 6ACAE527E744C80997B25EF2A0485D5E)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\index[1].htm	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\index[1].htm	JoeSecurity_HtmlPhish_7	Yara detected HtmlPhish_7	Joe Security

HTML

Source	Rule	Description	Author	Strings
67505.0.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
67505.0.pages.csv	JoeSecurity_HtmlPhish_7	Yara detected HtmlPhish_7	Joe Security

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CONSENT=WP.289365

Source: https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.html	SlashNext: Label: Credential Stealing type: Phishing & Social Engineering
Source: https://eyecandylashcompany.com/payment/frontend_paper_lantern/images/office3651.png	Avira URL Cloud: Label: phishing
Source: https://eyecandylashcompany.com/payment/frontend_paper_lantern/images/gmail.png	Avira URL Cloud: Label: phishing
Source: https://eyecandylashcompany.com/payment/frontend_paper_lantern/css/hover.css	Avira URL Cloud: Label: phishing
Source: https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.html2	Avira URL Cloud: Label: phishing

Source: Yara match	File source: 67505.0.pages.csv, type: HTML
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\index[1].htm, type: DROPPED

Source: https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.html	HTTP Parser: HTML title missing
Source: https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.html	HTTP Parser: HTML title missing

Source: https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.html	HTTP Parser: Number of links: 0
Source: https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.html	HTTP Parser: Number of links: 0

Source: https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.html	HTTP Parser: Form action: azn.php
Source: https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.html	HTTP Parser: Form action: azn.php

Source: https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.html	HTTP Parser: No <meta name="author".. found
Source: https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.html	HTTP Parser: No <meta name="author".. found

Source: https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.html	HTTP Parser: No <meta name="copyright".. found
Source: https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.html	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 69.49.244.155:443 -> 192.168.2.22:49209 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.161:443 -> 192.168.2.22:49217 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.28.243:443 -> 192.168.2.22:49220 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.37.244:443 -> 192.168.2.22:49221 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 69.49.244.155:443 -> 192.168.2.22:49219 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 69.49.244.155:443 -> 192.168.2.22:49218 version: TLS 1.2

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49227
Source: unknown	Network traffic detected: HTTP traffic on port 49185 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49219 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49226
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49189
Source: unknown	Network traffic detected: HTTP traffic on port 49183 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49221
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49220
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49186
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49185
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49184
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49183
Source: unknown	Network traffic detected: HTTP traffic on port 49189 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49209 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49221 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49227 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49172 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49195 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49174 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49191 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49219
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49218
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49217
Source: unknown	Network traffic detected: HTTP traffic on port 49184 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49218 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49220 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49186 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49177
Source: unknown	Network traffic detected: HTTP traffic on port 49190 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49230
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49174
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49173
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49195
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49172
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49171
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49192
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49191
Source: unknown	Network traffic detected: HTTP traffic on port 49226 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49190
Source: unknown	Network traffic detected: HTTP traffic on port 49171 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49192 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49173 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49177 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49209
Source: unknown	Network traffic detected: HTTP traffic on port 49217 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49230 -> 443

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 01 Jul 2022 08:04:16 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Type: text/html; charset=UTF-8X-Content-Type-Options: nosniffDate: Fri, 01 Jul 2022 08:04:17 GMTServer: fifeCache-Control: privateX-XSS-Protection: 0Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"Accept-Ranges: noneVary: Accept-EncodingConnection: closeTransfer-Encoding: chunked
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Type: text/html; charset=UTF-8X-Content-Type-Options: nosniffDate: Fri, 01 Jul 2022 08:04:40 GMTServer: fifeCache-Control: privateX-XSS-Protection: 0Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"Accept-Ranges: noneVary: Accept-EncodingConnection: closeTransfer-Encoding: chunked
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 01 Jul 2022 08:04:40 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 01 Jul 2022 08:04:41 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1

Source: index[1].htm.0.dr	String found in binary or memory: http://www.gmail.com
Source: 08bcfff1-5e8d-42bb-a394-0d3c1979af63.tmp.3.dr	String found in binary or memory: https://accounts.google.com
Source: craw_window.js.2.dr	String found in binary or memory: https://accounts.google.com/MergeSession
Source: 08bcfff1-5e8d-42bb-a394-0d3c1979af63.tmp.3.dr	String found in binary or memory: https://adservice.google.com
Source: 08bcfff1-5e8d-42bb-a394-0d3c1979af63.tmp.3.dr	String found in binary or memory: https://ajax.googleapis.com
Source: index[1].htm.0.dr	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
Source: 08bcfff1-5e8d-42bb-a394-0d3c1979af63.tmp.3.dr	String found in binary or memory: https://apis.google.com
Source: index[1].htm.0.dr	String found in binary or memory: https://cdn.iconscout.com/icon/free/png-512/microsoft-sharepoint-3-599372.png
Source: index[1].htm.0.dr	String found in binary or memory: https://cdn.pixabay.com/photo/2018/03/10/12/00/paper-3213924_1280.jpg
Source: index[1].htm.0.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js
Source: 08bcfff1-5e8d-42bb-a394-0d3c1979af63.tmp.3.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json.2.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 08bcfff1-5e8d-42bb-a394-0d3c1979af63.tmp.3.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: index[1].htm.0.dr	String found in binary or memory: https://code.jquery.com/jquery-3.1.1.min.js
Source: index[1].htm.0.dr	String found in binary or memory: https://code.jquery.com/jquery-3.2.1.slim.min.js
Source: index[1].htm.0.dr	String found in binary or memory: https://code.jquery.com/jquery-3.3.1.js
Source: 08bcfff1-5e8d-42bb-a394-0d3c1979af63.tmp.3.dr	String found in binary or memory: https://consent.google.com
Source: 08bcfff1-5e8d-42bb-a394-0d3c1979af63.tmp.3.dr	String found in binary or memory: https://content-autofill.googleapis.com
Source: 08bcfff1-5e8d-42bb-a394-0d3c1979af63.tmp.3.dr	String found in binary or memory: https://encrypted-tbn0.gstatic.com
Source: History Provider Cache.2.dr	String found in binary or memory: https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.html2
Source: 08bcfff1-5e8d-42bb-a394-0d3c1979af63.tmp.3.dr	String found in binary or memory: https://fonts.googleapis.com
Source: index[1].htm.0.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Archivo
Source: craw_window.js.2.dr, craw_background.js.2.dr	String found in binary or memory: https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p
Source: index[1].htm.0.dr	String found in binary or memory: https://kit.fontawesome.com/585b051251.js
Source: 08bcfff1-5e8d-42bb-a394-0d3c1979af63.tmp.3.dr	String found in binary or memory: https://lh3.googleusercontent.com
Source: index[1].htm.0.dr	String found in binary or memory: https://lh3.googleusercontent.com/proxy/bATQDWurvLlY3z2KTwUlb1gMxwLZoCk7CvqzrLqN1JioLU4nXkElVj-rMrvN
Source: index[1].htm.0.dr	String found in binary or memory: https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css
Source: index[1].htm.0.dr	String found in binary or memory: https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js
Source: 08bcfff1-5e8d-42bb-a394-0d3c1979af63.tmp.3.dr	String found in binary or memory: https://ogs.google.com
Source: craw_window.js.2.dr, manifest.json.2.dr	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: 08bcfff1-5e8d-42bb-a394-0d3c1979af63.tmp.3.dr	String found in binary or memory: https://redirector.gvt1.com
Source: craw_window.js.2.dr, manifest.json.2.dr	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: index[1].htm.0.dr	String found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js
Source: 08bcfff1-5e8d-42bb-a394-0d3c1979af63.tmp.3.dr	String found in binary or memory: https://update.googleapis.com
Source: craw_window.js.2.dr, craw_background.js.2.dr	String found in binary or memory: https://www-googleapis-staging.sandbox.google.com
Source: 08bcfff1-5e8d-42bb-a394-0d3c1979af63.tmp.3.dr	String found in binary or memory: https://www.google.com
Source: manifest.json.2.dr	String found in binary or memory: https://www.google.com/
Source: craw_window.js.2.dr	String found in binary or memory: https://www.google.com/accounts/OAuthLogin?issueuberauth=1
Source: craw_window.js.2.dr	String found in binary or memory: https://www.google.com/images/cleardot.gif
Source: craw_window.js.2.dr	String found in binary or memory: https://www.google.com/images/dot2.gif

Source: 3054.tmp.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: ~DF6AEEABD9704EA844.TMP.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: unknown	Process created: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.html
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=968,11663495452235836402,10867097982774653214,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1452 /prefetch:8
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation -- "https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.html
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=932,13148372515324661737,10505591573509331624,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1376 /prefetch:8
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation -- "https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.html	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=968,11663495452235836402,10867097982774653214,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1452 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=932,13148372515324661737,10505591573509331624,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1376 /prefetch:8	Jump to behavior

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=84.0.4147.135&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfmX-Goog-Update-Updater: chromecrx-84.0.4147.135Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /payment/frontend_paper_lantern/index.html HTTP/1.1Host: eyecandylashcompany.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /payment/frontend_paper_lantern/css/hover.css HTTP/1.1Host: eyecandylashcompany.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrap/4.0.0/css/bootstrap.min.css HTTP/1.1Host: maxcdn.bootstrapcdn.comConnection: keep-aliveOrigin: https://eyecandylashcompany.comUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrap/4.0.0/js/bootstrap.min.js HTTP/1.1Host: maxcdn.bootstrapcdn.comConnection: keep-aliveOrigin: https://eyecandylashcompany.comUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrap/4.1.3/js/bootstrap.min.js HTTP/1.1Host: stackpath.bootstrapcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /icon/free/png-512/microsoft-sharepoint-3-599372.png HTTP/1.1Host: cdn.iconscout.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36Accept: image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/popper.js/1.12.9/umd/popper.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveOrigin: https://eyecandylashcompany.comUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /payment/frontend_paper_lantern/images/office3651.png HTTP/1.1Host: eyecandylashcompany.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36Accept: image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /payment/frontend_paper_lantern/images/gmail.png HTTP/1.1Host: eyecandylashcompany.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36Accept: image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /photo/2018/03/10/12/00/paper-3213924_1280.jpg HTTP/1.1Host: cdn.pixabay.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36Accept: image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /proxy/bATQDWurvLlY3z2KTwUlb1gMxwLZoCk7CvqzrLqN1JioLU4nXkElVj-rMrvNZjuUXh3c1WhNOGX5_Cg18Wmltm3vvna-uZDqOkUISXU4XOYsUyt-4962tq2u0WiI358gef4ewWcVp0PA6YiTnICV2Cg7wLzdb0DlXw HTTP/1.1Host: lh3.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36Accept: image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /payment/frontend_paper_lantern/index.html HTTP/1.1Accept: /User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; ms-office)UA-CPU: AMD64Accept-Encoding: gzip, deflateHost: eyecandylashcompany.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /proxy/bATQDWurvLlY3z2KTwUlb1gMxwLZoCk7CvqzrLqN1JioLU4nXkElVj-rMrvNZjuUXh3c1WhNOGX5_Cg18Wmltm3vvna-uZDqOkUISXU4XOYsUyt-4962tq2u0WiI358gef4ewWcVp0PA6YiTnICV2Cg7wLzdb0DlXw HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh3.googleusercontent.com
Source: global traffic	HTTP traffic detected: GET /icon/free/png-512/microsoft-sharepoint-3-599372.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cdn.iconscout.com
Source: global traffic	HTTP traffic detected: GET /photo/2018/03/10/12/00/paper-3213924_1280.jpg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cdn.pixabay.com
Source: global traffic	HTTP traffic detected: GET /payment/frontend_paper_lantern/images/office3651.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: eyecandylashcompany.com
Source: global traffic	HTTP traffic detected: GET /payment/frontend_paper_lantern/images/gmail.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: eyecandylashcompany.com
Source: global traffic	HTTP traffic detected: GET /payment/frontend_paper_lantern/images/gmail.png HTTP/1.1Host: eyecandylashcompany.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36Accept: image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	13 Exploitation for Client Execution	Path Interception	1 Process Injection	1 Masquerading	OS Credential Dumping	1 File and Directory Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	2 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	4 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	5 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	4 Ingress Tool Transfer	SIM Card Swap		Carrier Billing Fraud

Source	Detection	Scanner	Label	Link
Invoice#0036473 .xlsx	5%	Virustotal		Browse
Invoice#0036473 .xlsx	8%	ReversingLabs	Document-Excel.Trojan.Heuristic

Source	Detection	Scanner	Label
https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.html	100%	SlashNext	Credential Stealing type: Phishing & Social Engineering
https://eyecandylashcompany.com/payment/frontend_paper_lantern/images/office3651.png	100%	Avira URL Cloud	phishing
https://eyecandylashcompany.com/payment/frontend_paper_lantern/images/gmail.png	100%	Avira URL Cloud	phishing
https://eyecandylashcompany.com/payment/frontend_paper_lantern/css/hover.css	100%	Avira URL Cloud	phishing
https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.html2	100%	Avira URL Cloud	phishing

Name	IP	Active	Malicious	Antivirus Detection	Reputation
eyecandylashcompany.com	69.49.244.155	true	true	6%, Virustotal, Browse	unknown
gstaticadssl.l.google.com	142.251.36.227	true	false		high
stackpath.bootstrapcdn.com	104.18.11.207	true	false		high
accounts.google.com	142.251.36.205	true	false		high
cdnjs.cloudflare.com	104.17.25.14	true	false		high
maxcdn.bootstrapcdn.com	104.18.11.207	true	false		high
clients.l.google.com	142.251.36.238	true	false		high
cdn.iconscout.com	104.18.28.243	true	false		high
cdn.pixabay.com	104.18.37.244	true	false		high
googlehosted.l.googleusercontent.com	172.217.16.161	true	false		high
clients2.google.com	unknown	unknown	false		high
ka-f.fontawesome.com	unknown	unknown	false		high
code.jquery.com	unknown	unknown	false		high
kit.fontawesome.com	unknown	unknown	false		high
lh3.googleusercontent.com	unknown	unknown	false		high

Name	Malicious	Antivirus Detection	Reputation
https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.html	true	SlashNext: Credential Stealing type: Phishing & Social Engineering	unknown
https://cdn.pixabay.com/photo/2018/03/10/12/00/paper-3213924_1280.jpg	false		high
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false		high
https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js	false		high
https://eyecandylashcompany.com/payment/frontend_paper_lantern/images/office3651.png	true	Avira URL Cloud: phishing	unknown
https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css	false		high
https://lh3.googleusercontent.com/proxy/bATQDWurvLlY3z2KTwUlb1gMxwLZoCk7CvqzrLqN1JioLU4nXkElVj-rMrvNZjuUXh3c1WhNOGX5_Cg18Wmltm3vvna-uZDqOkUISXU4XOYsUyt-4962tq2u0WiI358gef4ewWcVp0PA6YiTnICV2Cg7wLzdb0DlXw	false		high
https://eyecandylashcompany.com/payment/frontend_paper_lantern/images/gmail.png	true	Avira URL Cloud: phishing	unknown
https://eyecandylashcompany.com/payment/frontend_paper_lantern/css/hover.css	true	Avira URL Cloud: phishing	unknown
https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js	false		high
https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.html	true	SlashNext: Credential Stealing type: Phishing & Social Engineering	unknown
https://cdn.iconscout.com/icon/free/png-512/microsoft-sharepoint-3-599372.png	false		high
https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js	false		high
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=84.0.4147.135&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1	false		high

Name	Source	Malicious	Antivirus Detection	Reputation
https://consent.google.com	08bcfff1-5e8d-42bb-a394-0d3c1979af63.tmp.3.dr	false		high
https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p	craw_window.js.2.dr, craw_background.js.2.dr	false		high
https://www.google.com/intl/en-US/chrome/blank.html	craw_background.js.2.dr	false		high
https://ogs.google.com	08bcfff1-5e8d-42bb-a394-0d3c1979af63.tmp.3.dr	false		high
https://www.google.com/images/cleardot.gif	craw_window.js.2.dr	false		high
https://code.jquery.com/jquery-3.2.1.slim.min.js	index[1].htm.0.dr	false		high
http://www.gmail.com	index[1].htm.0.dr	false		high
https://code.jquery.com/jquery-3.1.1.min.js	index[1].htm.0.dr	false		high
https://payments.google.com/payments/v4/js/integrator.js	craw_window.js.2.dr, manifest.json.2.dr	false		high
https://adservice.google.com	08bcfff1-5e8d-42bb-a394-0d3c1979af63.tmp.3.dr	false		high
https://lh3.googleusercontent.com	08bcfff1-5e8d-42bb-a394-0d3c1979af63.tmp.3.dr	false		high
https://lh3.googleusercontent.com/proxy/bATQDWurvLlY3z2KTwUlb1gMxwLZoCk7CvqzrLqN1JioLU4nXkElVj-rMrvN	index[1].htm.0.dr	false		high
https://sandbox.google.com/payments/v4/js/integrator.js	craw_window.js.2.dr, manifest.json.2.dr	false		high
https://www.google.com/images/x2.gif	craw_window.js.2.dr	false		high
https://code.jquery.com/jquery-3.3.1.js	index[1].htm.0.dr	false		high
https://accounts.google.com/MergeSession	craw_window.js.2.dr	false		high
https://www.google.com	08bcfff1-5e8d-42bb-a394-0d3c1979af63.tmp.3.dr	false		high
https://www.google.com/images/dot2.gif	craw_window.js.2.dr	false		high
https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.html2	History Provider Cache.2.dr	true	Avira URL Cloud: phishing	unknown
https://accounts.google.com	08bcfff1-5e8d-42bb-a394-0d3c1979af63.tmp.3.dr	false		high
https://clients2.googleusercontent.com	08bcfff1-5e8d-42bb-a394-0d3c1979af63.tmp.3.dr	false		high
https://apis.google.com	08bcfff1-5e8d-42bb-a394-0d3c1979af63.tmp.3.dr	false		high
https://kit.fontawesome.com/585b051251.js	index[1].htm.0.dr	false		high
https://www.google.com/accounts/OAuthLogin?issueuberauth=1	craw_window.js.2.dr	false		high
https://www.google.com/	manifest.json.2.dr	false		high
https://www-googleapis-staging.sandbox.google.com	craw_window.js.2.dr, craw_background.js.2.dr	false		high
https://clients2.google.com	08bcfff1-5e8d-42bb-a394-0d3c1979af63.tmp.3.dr	false		high
https://clients2.google.com/service/update2/crx	manifest.json.2.dr	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
142.251.36.238	clients.l.google.com	United States	15169	GOOGLEUS	false
142.251.36.205	accounts.google.com	United States	15169	GOOGLEUS	false
142.251.36.227	gstaticadssl.l.google.com	United States	15169	GOOGLEUS	false
104.18.11.207	stackpath.bootstrapcdn.com	United States	13335	CLOUDFLARENETUS	false
104.18.37.244	cdn.pixabay.com	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
104.18.28.243	cdn.iconscout.com	United States	13335	CLOUDFLARENETUS	false
69.49.244.155	eyecandylashcompany.com	United States	46606	UNIFIEDLAYER-AS-1US	true
172.217.16.161	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
104.17.25.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false

Joe Sandbox Version:	35.0.0 Citrine
Analysis ID:	655570
Start date and time: 01/07/202210:02:40	2022-07-01 10:02:40 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 44s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Invoice#0036473 .xlsx
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	4
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal76.phis.expl.winXLSX@33/126@17/14
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .xlsx Adjust boot time Enable AMSI Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Browse link: https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.html Scroll down Close Viewer

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Invoice#0036473 .xlsx

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

HTML

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Google\Chrome\User Data\10a36c76-179f-4b6c-8570-4068d7b95038.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\2e7ae45e-292f-4c2c-8644-46887721f59e.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\32f73c54-cdaa-4123-8c7e-734a8f628d3d.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\462d2348-cde6-4394-b88d-3ef7a690546b.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\5cc29f6a-f57d-4269-b4a5-b35882368e40.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\08bcfff1-5e8d-42bb-a394-0d3c1979af63.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\137e88e9-eb57-40f4-b989-72e2595c97aa.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\1b81d574-d17f-43d8-b909-8aad5c117009.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\1e6a7797-f867-41d1-8962-183f08016f0e.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\23d6aa7d-ae0f-44fb-8098-8671aa3c36c0.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\4ffaf27a-581e-4744-82c7-561c030c5cfd.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\68b69776-d590-40a8-9e70-f14c909f8c8d.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata\computed_hashes.json

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\000003.log

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG.old (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Provider Cache

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network Persistent State (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Preferences (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\28273922-1a26-4399-a23a-25fab8ef8ef9.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Code Cache\js\index

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Code Cache\js\index-dir\temp-index

Windows Analysis Report
Invoice#0036473 .xlsx

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
stackpath.bootstrapcdn.com	https://u27682479.ct.sendgrid.net/ls/click?upn=cvn9ZJclWWM77Z1KQ7AGNLTvG6cbD4GX8IMOUAv7Il1TwF-2FSwC0ndnhCUjyoxiEOCXxDaQAoXgRqBYYJR7U29h8tGIfMMmGkPyrnyXHjvGg-3DkPrg_MjFPikWoCmv8aAb7xuiZzKL0X73XL-2FMW1JZjnAAaINuMtLzPu5K1Hhv5p2MF13uzmPDFBxuI57kgtVQvUG2IosuFPE-2FMMS5IW1aVH8NqkQMRiwpky-2F-2FNp1gZ-2FGiCUPjocxs-2FDPLBvlAlIQWA1uMKhzWpmU-2BtLYCDbErCCU-2BthWLST0GPo5CYeXNIokcBG39RzNjn2bc4byB5TJFFS9MVknJ7qd3XJmWVjB-2F2Q5Md6g4-3D	Get hash	malicious	Browse	104.18.11.207
	https://gmail.us14.list-manage.com/track/click?u=957e6b6833ddd63bbe471b4e4&id=18858b02d6&e=7ce018b90e#peter.boyd@southside.com	Get hash	malicious	Browse	104.18.10.207
	https://www.trekkdesigngroup.online	Get hash	malicious	Browse	104.18.11.207
	https://typeyournamehereueuee.zyrosite.com/	Get hash	malicious	Browse	104.18.10.207
	https://u27682479.ct.sendgrid.net/ls/click?upn=cvn9ZJclWWM77Z1KQ7AGNLTvG6cbD4GX8IMOUAv7Il0CScb6ZYT3Okqv8ttKWjhV61bU7wZVg-2BRwpPEz5BxnlpZAXxWZhwu4A5T7Xmub5i4-3D8kdN_BQTHDHIGBY8bVXALtPGM7gO667eXi0Rxjw6Ja5tIhIHl4jbBM8FcsT0sDPhrKTJuPA8c0hJbJUedqDm0dZ1N5q6HFPXMyNiqLMnaTKX-2BjvxEQqKmS9AIBthNPL271WvH8x6O0192ihJ9vhKUW-2B1WIoITJImLF7rC2kCSY-2FOeXXbB54AsMvKkV7xrJUut0RtOJ0YkHUdgPc7qyyqcpC6RYNpOh5HCDF73R1mUOTiYID4-3D	Get hash	malicious	Browse	104.18.10.207
	https://u27682479.ct.sendgrid.net/ls/click?upn=cvn9ZJclWWM77Z1KQ7AGNC0PVfxk-2FZAkqKGkvkmLbTQCvY6iLgzNv-2BV4aPDtjsQ7-2FUjHA4Ezf37BL6lIDmqDzZ5QwOgEaGwQHGjPZyO4y9I-3D2KjD_NhZfEg-2BwL4Si0T6ox4qwLXT0uvP3TGOsRmDvGnsx8NmbWDOD0T104M0mqtiCsg1QuMoN2ety2fP6sPaWMOfVtQNydQ82LQ3vPo3xGGbEfEAmaeNrhU8n4LJRzywBbN-2Fl-2BFKw0kG-2F5-2FIhHpc-2FlqmtGkVTufMkyfF3QaxaMyimxEQIJekgwOcW51oGbqIeK8cT318mKaXU7xGBSjLDgeB179x-2BJost4ap4F11wJTU27kI-3D	Get hash	malicious	Browse	104.18.11.207
	https://sharepdf.info/vs/ab/004bk.shtml?sjones@pfeiffer-vacuum.com+&_x__tr_hl=97	Get hash	malicious	Browse	104.18.10.207
	https://t.co/xvLS8NTzBo	Get hash	malicious	Browse	104.18.11.207
	https://u27352119.ct.sendgrid.net/ls/click?upn=wmyrTikp4cU6UIreToLK5apa3UVWzls5i-2FnivdzqxJDXieeYhuAfDPrkrYAXhWjT05v1DliJzvFZ-2FrXdWWTtQJtar7d5f45LKMUDkQsF-2FhCOZ1yqNe3s6XzNjygGMsgA5GocRr6RXqtxW4PVFk-2Fpd4dvCNbIBWK4BuFppc8wj6wYdWWkKWGexqKkSDY9kS1UfXnqeVFTSWVDo5tEXEx0GIw-2BcXzdvgg3OprL-2Fex9yzxOPbw1GIMw2f2mk3htVwXnNkUGvjTCdqmdU7LukpDPVR53kuZ-2F7LiipfcsxReKBGQ-3D6ToV_AELWtZjInQuuwQQi428pxLeMEKB6ACloON6bXLSJPk6x1Rv5IRZqeoiu2AIdYoTabUi4-2BVj2BH66zn-2FG9M3s3vQV85T3GkdCn7MTAgY11UdHC5lpqBui4-2BhRM9-2FU2NhMbDfP1ThNXVSMy7-2FODBB0Yct9bvAuZ7ww8xxUmuvx-2BoIFMa-2BmLdFyh3XDDxXMba6nNz7ZJmxt8ZM-2F-2FupIag6Levet5r6l76sorlP5myLYrcSHhAV0Yc-2BcPhmEBFrwkY0W	Get hash	malicious	Browse	104.18.11.207
	https://5a5edz2o3ugnqdrsidauf23pm3td4wqmlnuq5l7qnu-ipfs-nftstorage-link.translate.goog/?_x_tr_hp=bafkreigasd7iihvg&_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en-US&_x_tr_pto=wapp#	Get hash	malicious	Browse	104.18.10.207
	https://62bc10e82f39dc00752b3f25--jocular-speculoos-88b519.netlify.app/#anika@khk.co.za	Get hash	malicious	Browse	104.18.11.207
	https://gcp.olympus.io/api/v1/share/file/download-via-public-link?linkId=bdaa6e3d-aab8-4e16-8d04-3c7d34d3871c&responseType=file	Get hash	malicious	Browse	104.18.10.207
	https://employmentas-my.sharepoint.com/:o:/g/personal/roxy_employerprotect_com_au/Ek2R_hZAFkJNsMTTpTIyUIIB6QxcToCUDU2EYLrzeglOrA?e=sSX1Ih	Get hash	malicious	Browse	104.18.11.207
	https://krytoninternationalinc-my.sharepoint.com/:f:/g/personal/bnami_kryton_com/EhDLdLgQrLxCn66if43sGLsBf6Ij5ihiOcxREvaqxt_nug?e=jVDghv	Get hash	malicious	Browse	104.18.10.207
	Overdue Invoice.xlsx	Get hash	malicious	Browse	104.18.10.207
	https://ec.europa.eu/newsroom/empl/redirection/link/aHR0cHM6Ly94LXRwMy5vbmxpbmUvP2U9WTJGdGNHSnZjM011WkdselkyOTJaWEpsY2tCdFlXVnljMnRrY21sc2JHbHVaeTVqYjIwPQ==	Get hash	malicious	Browse	104.18.10.207
	PastDue#Germaincars760555Germaincars476-#Ud83d#Udcde00848.HTM	Get hash	malicious	Browse	104.18.11.207
	https://storageapi.fleek.co/b8c69782-8395-4e27-b6c2-14599daf3f88-bucket/admienaudate/innnnnndex.html?email=lbh24@georgetown.edu	Get hash	malicious	Browse	104.18.11.207
	http://www.haynun.market/klsrbljajj/uxgd861832hxrudoa/4yLoWMq8GZoV-T_OMk7RhaV2bfeD9NL8SzMXVM66Y9g/hXstoBmTS4iEityW7B2Bq_kGa-PZEIWghzLSkHBUYdr6zWlsZK5ifaV-tgHWbVJcfkBu00UH_N9QF_JW7HZ3zodWVXkHsMX2N9o-guC0fnjQc2MH388-uNXffVXZJapd	Get hash	malicious	Browse	104.18.10.207
	https://kmctcoeemergingtechnology.org/vld	Get hash	malicious	Browse	104.18.11.207

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
CLOUDFLARENETUS	0700122.exe	Get hash	malicious	Browse	162.159.130.233
	SecuriteInfo.com.Suspicious.Linux.Save.a.17324.427	Get hash	malicious	Browse	104.29.132.188
	COA_PL_INV_BL_098765432123456789098765.exe	Get hash	malicious	Browse	162.159.134.233
	https://huhulihu.com/	Get hash	malicious	Browse	172.67.223.147
	start.ps1	Get hash	malicious	Browse	188.114.96.3
	Rico.apk	Get hash	malicious	Browse	104.16.126.175
	tAp1AgSBEM.exe	Get hash	malicious	Browse	162.159.134.233
	RFQ.com	Get hash	malicious	Browse	188.114.96.3
	https://u27682479.ct.sendgrid.net/ls/click?upn=cvn9ZJclWWM77Z1KQ7AGNLTvG6cbD4GX8IMOUAv7Il1TwF-2FSwC0ndnhCUjyoxiEOCXxDaQAoXgRqBYYJR7U29h8tGIfMMmGkPyrnyXHjvGg-3DkPrg_MjFPikWoCmv8aAb7xuiZzKL0X73XL-2FMW1JZjnAAaINuMtLzPu5K1Hhv5p2MF13uzmPDFBxuI57kgtVQvUG2IosuFPE-2FMMS5IW1aVH8NqkQMRiwpky-2F-2FNp1gZ-2FGiCUPjocxs-2FDPLBvlAlIQWA1uMKhzWpmU-2BtLYCDbErCCU-2BthWLST0GPo5CYeXNIokcBG39RzNjn2bc4byB5TJFFS9MVknJ7qd3XJmWVjB-2F2Q5Md6g4-3D	Get hash	malicious	Browse	104.18.11.207
	https://gmail.us14.list-manage.com/track/click?u=957e6b6833ddd63bbe471b4e4&id=18858b02d6&e=7ce018b90e#peter.boyd@southside.com	Get hash	malicious	Browse	104.18.11.207
	https://bip.so/@cvpk/Comp-ZbQsc/Comp-GF67/	Get hash	malicious	Browse	104.17.24.14
	http://fbmedia-bls.com/get?cid=1889&kw=Iron-Clad+Java++Building+Secure+Web+Applications+%28Oracle+Press%29.pdf	Get hash	malicious	Browse	104.26.8.128
	https://www.trekkdesigngroup.online	Get hash	malicious	Browse	104.17.25.14
	http://mylifebygogogoff.com	Get hash	malicious	Browse	104.16.138.31
	https://1drv.ms:443/o/s!BH45_lCByG8fgpJ9gXzw1ulhl-qQkQ?e=yvEgUVzG9ES2PfoKuGIEfw&at=9	Get hash	malicious	Browse	104.17.25.14
	https://trk.klclick3.com/ls/click?upn=fcdlx2xQNRrFD8xAwIYMwhPhot2OWoHM58DvvsNUmgyW5E8YJoB55TCkBXxoFyBS6iVvdjsc3V8A1nRXMtkrSSJt-2Bk-2BdZMjMKv-2BSIUUaBSdYI3PZjYK-2BVwe4knii0pOzZpTPH9nZBwzk0rp6rcWtdeP6viAHyEgLZmxw3BkyLUaESiNfSJWjhW-2F6RUcvtKY98tKD_IIxngKJTzoJRg3BKRiQyXA7-2FwAHoDJaQzukQaT-2F-2B7TR78stGBod6FQPBct81-2BaNXQk1lrVjAhcgzPO-2FeldmGu9msThoa-2FYxHzdsLw5Z4YrKBdZsb3vdKZ9inWYgsWVziTs5xkNbFQvTHr2fV28gcrxOktliviLjkDZaoku6yxQhxam9ismJEKXRMtThYPCLar-2FC9rm7IoQFmJ7PbY3bbGiea-2F-2FqXbsuKXrkyeIb5M-2BTX7CA1nl6C6kUwMR3ItPkU-2FJjZGba-2FpKmDsiRS0G1tcJP-2BFl2TMjWhmdoKVJtXrmcid2KCjoiNkoF-2Bovgqaoc-2Fist0z-2Bkm2CZhk02VO1YQAcBRSab9pNII0cnUiAOv7wad1WwyNxv-2FsjE7ba2MIWpkHEOe8bP5SLnnVigYA7rXuE35Byebn454CiHXdlKHl4M-3D#YXNhZGphZEBjZW50cmFsMS5jb20=	Get hash	malicious	Browse	104.18.27.135
	bqsH7xpdMf.exe	Get hash	malicious	Browse	162.159.128.233
	https://cutt.ly/EKC8VM0	Get hash	malicious	Browse	104.22.1.232
	Scan #0003531-RFQ.exe	Get hash	malicious	Browse	66.235.200.146
	https://harry37ea96.clickfunnels.com/webinar-registration1656583105237	Get hash	malicious	Browse	104.16.16.194
CLOUDFLARENETUS	0700122.exe	Get hash	malicious	Browse	162.159.130.233
	SecuriteInfo.com.Suspicious.Linux.Save.a.17324.427	Get hash	malicious	Browse	104.29.132.188
	COA_PL_INV_BL_098765432123456789098765.exe	Get hash	malicious	Browse	162.159.134.233
	https://huhulihu.com/	Get hash	malicious	Browse	172.67.223.147
	start.ps1	Get hash	malicious	Browse	188.114.96.3
	Rico.apk	Get hash	malicious	Browse	104.16.126.175
	tAp1AgSBEM.exe	Get hash	malicious	Browse	162.159.134.233
	RFQ.com	Get hash	malicious	Browse	188.114.96.3
	https://u27682479.ct.sendgrid.net/ls/click?upn=cvn9ZJclWWM77Z1KQ7AGNLTvG6cbD4GX8IMOUAv7Il1TwF-2FSwC0ndnhCUjyoxiEOCXxDaQAoXgRqBYYJR7U29h8tGIfMMmGkPyrnyXHjvGg-3DkPrg_MjFPikWoCmv8aAb7xuiZzKL0X73XL-2FMW1JZjnAAaINuMtLzPu5K1Hhv5p2MF13uzmPDFBxuI57kgtVQvUG2IosuFPE-2FMMS5IW1aVH8NqkQMRiwpky-2F-2FNp1gZ-2FGiCUPjocxs-2FDPLBvlAlIQWA1uMKhzWpmU-2BtLYCDbErCCU-2BthWLST0GPo5CYeXNIokcBG39RzNjn2bc4byB5TJFFS9MVknJ7qd3XJmWVjB-2F2Q5Md6g4-3D	Get hash	malicious	Browse	104.18.11.207
	https://gmail.us14.list-manage.com/track/click?u=957e6b6833ddd63bbe471b4e4&id=18858b02d6&e=7ce018b90e#peter.boyd@southside.com	Get hash	malicious	Browse	104.18.11.207
	https://bip.so/@cvpk/Comp-ZbQsc/Comp-GF67/	Get hash	malicious	Browse	104.17.24.14
	http://fbmedia-bls.com/get?cid=1889&kw=Iron-Clad+Java++Building+Secure+Web+Applications+%28Oracle+Press%29.pdf	Get hash	malicious	Browse	104.26.8.128
	https://www.trekkdesigngroup.online	Get hash	malicious	Browse	104.17.25.14
	http://mylifebygogogoff.com	Get hash	malicious	Browse	104.16.138.31
	https://1drv.ms:443/o/s!BH45_lCByG8fgpJ9gXzw1ulhl-qQkQ?e=yvEgUVzG9ES2PfoKuGIEfw&at=9	Get hash	malicious	Browse	104.17.25.14
	https://trk.klclick3.com/ls/click?upn=fcdlx2xQNRrFD8xAwIYMwhPhot2OWoHM58DvvsNUmgyW5E8YJoB55TCkBXxoFyBS6iVvdjsc3V8A1nRXMtkrSSJt-2Bk-2BdZMjMKv-2BSIUUaBSdYI3PZjYK-2BVwe4knii0pOzZpTPH9nZBwzk0rp6rcWtdeP6viAHyEgLZmxw3BkyLUaESiNfSJWjhW-2F6RUcvtKY98tKD_IIxngKJTzoJRg3BKRiQyXA7-2FwAHoDJaQzukQaT-2F-2B7TR78stGBod6FQPBct81-2BaNXQk1lrVjAhcgzPO-2FeldmGu9msThoa-2FYxHzdsLw5Z4YrKBdZsb3vdKZ9inWYgsWVziTs5xkNbFQvTHr2fV28gcrxOktliviLjkDZaoku6yxQhxam9ismJEKXRMtThYPCLar-2FC9rm7IoQFmJ7PbY3bbGiea-2F-2FqXbsuKXrkyeIb5M-2BTX7CA1nl6C6kUwMR3ItPkU-2FJjZGba-2FpKmDsiRS0G1tcJP-2BFl2TMjWhmdoKVJtXrmcid2KCjoiNkoF-2Bovgqaoc-2Fist0z-2Bkm2CZhk02VO1YQAcBRSab9pNII0cnUiAOv7wad1WwyNxv-2FsjE7ba2MIWpkHEOe8bP5SLnnVigYA7rXuE35Byebn454CiHXdlKHl4M-3D#YXNhZGphZEBjZW50cmFsMS5jb20=	Get hash	malicious	Browse	104.18.27.135
	bqsH7xpdMf.exe	Get hash	malicious	Browse	162.159.128.233
	https://cutt.ly/EKC8VM0	Get hash	malicious	Browse	104.22.1.232
	Scan #0003531-RFQ.exe	Get hash	malicious	Browse	66.235.200.146
	https://harry37ea96.clickfunnels.com/webinar-registration1656583105237	Get hash	malicious	Browse	104.16.16.194

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
7dcce5b76c8b17472d024758970a406b	Scan-2906.xls	Get hash	malicious	Browse	104.18.37.244 69.49.244.155 172.217.16.161 104.18.28.243
	doc_5665183.xls	Get hash	malicious	Browse	104.18.37.244 69.49.244.155 172.217.16.161 104.18.28.243
	ARCHIVO 42.xls	Get hash	malicious	Browse	104.18.37.244 69.49.244.155 172.217.16.161 104.18.28.243
	ARCHIVO 42.xls	Get hash	malicious	Browse	104.18.37.244 69.49.244.155 172.217.16.161 104.18.28.243
	ARCHIVO 42.xls	Get hash	malicious	Browse	104.18.37.244 69.49.244.155 172.217.16.161 104.18.28.243
	attachments_22629765514.xls	Get hash	malicious	Browse	104.18.37.244 69.49.244.155 172.217.16.161 104.18.28.243
	4_IT05242144277_14_29062022_073000.xlsm	Get hash	malicious	Browse	104.18.37.244 69.49.244.155 172.217.16.161 104.18.28.243
	https://forms.gle/UUWec3HjgemxRctM9	Get hash	malicious	Browse	104.18.37.244 69.49.244.155 172.217.16.161 104.18.28.243
	06089.xls	Get hash	malicious	Browse	104.18.37.244 69.49.244.155 172.217.16.161 104.18.28.243
	100168531727380051.xls	Get hash	malicious	Browse	104.18.37.244 69.49.244.155 172.217.16.161 104.18.28.243
	SCAN 29062022.xls	Get hash	malicious	Browse	104.18.37.244 69.49.244.155 172.217.16.161 104.18.28.243
	EFT.xls	Get hash	malicious	Browse	104.18.37.244 69.49.244.155 172.217.16.161 104.18.28.243
	Form - Jun 29, 2022.xls	Get hash	malicious	Browse	104.18.37.244 69.49.244.155 172.217.16.161 104.18.28.243
	Payment.xls	Get hash	malicious	Browse	104.18.37.244 69.49.244.155 172.217.16.161 104.18.28.243
	cmshnr_private.xlsx	Get hash	malicious	Browse	104.18.37.244 69.49.244.155 172.217.16.161 104.18.28.243
	ACH Payment Advice.xls	Get hash	malicious	Browse	104.18.37.244 69.49.244.155 172.217.16.161 104.18.28.243
	file_1.xls	Get hash	malicious	Browse	104.18.37.244 69.49.244.155 172.217.16.161 104.18.28.243
	29062022.xls	Get hash	malicious	Browse	104.18.37.244 69.49.244.155 172.217.16.161 104.18.28.243
	gescanntes-Dokument_2022.29.06_1555.xls	Get hash	malicious	Browse	104.18.37.244 69.49.244.155 172.217.16.161 104.18.28.243
	2906.xls	Get hash	malicious	Browse	104.18.37.244 69.49.244.155 172.217.16.161 104.18.28.243

Process:	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	131829
Entropy (8bit):	6.0295424997011455
Encrypted:	false
SSDEEP:	3072:96hz5W20fwPJEpzCaULx8j2hNuSaWyY9wUgew5S:96N/0fwPJC0x8j2rhyYCUNR
MD5:	2DD6C034973CF571D96911E3AC544F49
SHA1:	CE7F3EA64D912A868D95D2EFB6526823DCF7E20E
SHA-256:	10D7AD758AC9143F05C8E4306D0ED61126E575E2A739BBC9813448891A5C9A9D
SHA-512:	FEFDE603A9866BACE4EB713552ABEF2830B62461C4C01023C50FDE2C2E37ED51ED65B85CC5559A6ADE7414B63B74A934CB6614D203BC1272D370957A518D5CB0
Malicious:	false
Reputation:	low
Preview:	{"browser":{"last_redirect_origin":"","shortcut_migration_version":"84.0.4147.89"},"easy_unlock":{"device_id":"f691bb0f-1b4f-4339-aef5-321b65f13447"},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en"},"legacy":{"profile":{"name":{"migrated":true}}},"network_time":{"network_time_mapping":{"local":1.656695037716855e+12,"network":1.656662656e+12,"ticks":460380857.0,"uncertainty":8293444.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAADCJQEpL4peQLs/tCx05ts1AAAAAAIAAAAAABBmAAAAAQAAIAAAAHMdBSm688AB9E4ujGBlc8b12w9pH8Ho0MG5KX0s9TvsAAAAAA6AAAAAAgAAIAAAAKp70FMSZVCDUsFN1iNo5k0cdS+uI3XobvqN11pz11FbMAAAAHEgEYBv3dbmfqLRp8KY9FTYBCEdPLIJnBuQSIy6PW6ieb+TQlX0tlf+joBO06Pyo0AAAADT82DjaNvFLY7T0RywXTGepumesXXBFeM5MLg7ZlErGegSazITBqJVemjLdeT3R2c6H7dl+tlEXxt1m8SJWLUl"},"policy":{"last_statistics_update":"13301168631623671"},"profile":{"info_cache":{"Default":{"active_time":1656695033.740193,"avatar_icon":"chrome://theme/IDR_PROFILE_AVATAR_26","background_apps":false,"

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	HTML document, UTF-8 Unicode text, with CRLF line terminators
Category:	downloaded
Size (bytes):	21845
Entropy (8bit):	4.959781554055647
Encrypted:	false
SSDEEP:	384:ytzDc2rA6aD44Rw89cmW221/sxZMZKs0nOBY:ozAXL444BY
MD5:	9C7A316E607FC1C11A3EF10056BD3AFD
SHA1:	473BA685597DE37A40649C7F1DE933A107D09119
SHA-256:	DDFE1F54DF786A3B0AC73789E9761691BA6B00539DC8AF70A37CCDACD17BF070
SHA-512:	BE97B489AE94036B6520D75971EA1A76A11D145880F91FBA6B312F97F44F07171FCBC29B215D211CB58FDF84E25302456B0D04528616340F073C6603FA5FC26B
Malicious:	true
Yara Hits:	Rule: JoeSecurity_HtmlPhish_10, Description: Yara detected HtmlPhish_10, Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\index[1].htm, Author: Joe Security Rule: JoeSecurity_HtmlPhish_7, Description: Yara detected HtmlPhish_7, Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\index[1].htm, Author: Joe Security
IE Cache URL:	https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.html
Preview:	..<!doctype html>..<html lang="en">..<head>.. <script src="https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script>.. <script src="https://code.jquery.com/jquery-3.1.1.min.js">.. <script src="https://code.jquery.com/jquery-3.3.1.js" integrity="sha256-2Kok7MbOyxpgUVvAk/HJ2jigOSYS2auK4Pfzbm7uH60=" crossorigin="anonymous"></script>.. Required meta tags -->.. <meta charset="utf-8">.. <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">.... Bootstrap CSS -->.. <link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css" integrity="sha384-Gn5384xqQ1aoWXA+058RXPxPg6fy4IWvTNh0E263XmFcJlSAwiGgFAW/dAiS6JXm" crossorigin="anonymous">.. <link href="https://fonts.googleapis.com/css?family=Archivo+Narrow&display=swap" rel="stylesheet">.. <script src="https://kit.fontawesome.com/585b051251.js" crossorigin="anonymous"></script>.. <title>MS SharePoint</title>.... <link re

File type:	Microsoft Excel 2007+
Entropy (8bit):	7.991276862113107
TrID:	Excel Microsoft Office Open XML Format document (40004/1) 83.33% ZIP compressed archive (8000/1) 16.67%
File name:	Invoice#0036473 .xlsx
File size:	935361
MD5:	c93e6dcf32928e1da7346b6ca3a1dc85
SHA1:	b90d66412b4d6669a175fd30e32bbe44428bd245
SHA256:	3ffe69c9e2e2f8a350f7d2ff6e64acf8cffbf390489807b81cf8e4eec87d4047
SHA512:	285b0a357b59b8c0cfc0bcbd91706e12e90e3d4f56b516b05ba745ec3b036b217c9029a250269c947c40108d3d9431ab5b26a54da7df88b56ffbf2ac8d9fc533
SSDEEP:	24576:4rQU57GpJk69mCNDPCBpY+bikHII5Bqn13dhW7:/y7jClPsDJ55B67W7
TLSH:	C21533D9983763EDE23F9CB1126BA700742474871970C4D14ECAAA9C1FE94EF794BB12
File Content Preview:	PK..........!..'`p............[Content_Types].xml ...(.........................................................................................................................................................................................................

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 1, 2022 10:04:05.697657108 CEST	138	138	192.168.2.22	192.168.2.255
Jul 1, 2022 10:04:10.024965048 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 10:04:10.227499962 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 10:04:10.384015083 CEST	55275	53	192.168.2.22	8.8.8.8
Jul 1, 2022 10:04:10.386384010 CEST	59915	53	192.168.2.22	8.8.8.8
Jul 1, 2022 10:04:10.387994051 CEST	54408	53	192.168.2.22	8.8.8.8
Jul 1, 2022 10:04:10.403214931 CEST	53	59915	8.8.8.8	192.168.2.22
Jul 1, 2022 10:04:10.410881042 CEST	53	55275	8.8.8.8	192.168.2.22
Jul 1, 2022 10:04:10.415344954 CEST	53	54408	8.8.8.8	192.168.2.22
Jul 1, 2022 10:04:10.774784088 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 10:04:10.930162907 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 10:04:10.977807999 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 10:04:11.530909061 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 10:04:11.680151939 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 10:04:11.728177071 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 10:04:12.431051016 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 10:04:16.140827894 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 10:04:16.155576944 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 10:04:16.290930986 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 10:04:16.404300928 CEST	51020	53	192.168.2.22	8.8.8.8
Jul 1, 2022 10:04:16.407136917 CEST	53160	53	192.168.2.22	8.8.8.8
Jul 1, 2022 10:04:16.427536964 CEST	53	53160	8.8.8.8	192.168.2.22
Jul 1, 2022 10:04:16.456041098 CEST	63396	53	192.168.2.22	8.8.8.8
Jul 1, 2022 10:04:16.738718987 CEST	52585	53	192.168.2.22	8.8.8.8
Jul 1, 2022 10:04:16.743444920 CEST	52129	53	192.168.2.22	8.8.8.8
Jul 1, 2022 10:04:16.744057894 CEST	57078	53	192.168.2.22	8.8.8.8
Jul 1, 2022 10:04:16.764163017 CEST	52276	53	192.168.2.22	8.8.8.8
Jul 1, 2022 10:04:16.766959906 CEST	53	57078	8.8.8.8	192.168.2.22
Jul 1, 2022 10:04:16.767860889 CEST	53	52129	8.8.8.8	192.168.2.22
Jul 1, 2022 10:04:16.788728952 CEST	53	52276	8.8.8.8	192.168.2.22
Jul 1, 2022 10:04:16.890814066 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 10:04:16.905719995 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 10:04:16.999139071 CEST	53057	53	192.168.2.22	8.8.8.8
Jul 1, 2022 10:04:17.018352985 CEST	53	53057	8.8.8.8	192.168.2.22
Jul 1, 2022 10:04:17.040930986 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 10:04:17.580507040 CEST	63728	53	192.168.2.22	8.8.8.8
Jul 1, 2022 10:04:17.608580112 CEST	53	63728	8.8.8.8	192.168.2.22
Jul 1, 2022 10:04:17.641036987 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 10:04:17.657706022 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 10:04:17.798326015 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 10:04:18.818362951 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 10:04:18.818428993 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 10:04:19.581588030 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 10:04:19.581788063 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 10:04:20.332521915 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 10:04:20.332694054 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 10:04:22.113096952 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 10:04:22.113218069 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 10:04:22.114057064 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 10:04:22.875516891 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 10:04:22.875593901 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 10:04:22.875597000 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 10:04:23.626172066 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 10:04:23.626199961 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 10:04:23.626455069 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 10:04:24.113342047 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 10:04:24.872744083 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 10:04:25.601042032 CEST	59254	443	192.168.2.22	142.251.36.238
Jul 1, 2022 10:04:25.637187958 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 10:04:25.641870022 CEST	443	59254	142.251.36.238	192.168.2.22
Jul 1, 2022 10:04:25.642385006 CEST	59254	443	192.168.2.22	142.251.36.238
Jul 1, 2022 10:04:25.669404030 CEST	59254	443	192.168.2.22	142.251.36.238
Jul 1, 2022 10:04:25.683286905 CEST	443	59254	142.251.36.238	192.168.2.22
Jul 1, 2022 10:04:25.683361053 CEST	443	59254	142.251.36.238	192.168.2.22
Jul 1, 2022 10:04:25.683422089 CEST	443	59254	142.251.36.238	192.168.2.22
Jul 1, 2022 10:04:25.683485031 CEST	443	59254	142.251.36.238	192.168.2.22
Jul 1, 2022 10:04:25.685658932 CEST	59254	443	192.168.2.22	142.251.36.238
Jul 1, 2022 10:04:25.686743021 CEST	59254	443	192.168.2.22	142.251.36.238
Jul 1, 2022 10:04:25.744507074 CEST	59254	443	192.168.2.22	142.251.36.238
Jul 1, 2022 10:04:25.745147943 CEST	59254	443	192.168.2.22	142.251.36.238
Jul 1, 2022 10:04:25.797498941 CEST	443	59254	142.251.36.238	192.168.2.22
Jul 1, 2022 10:04:25.812618971 CEST	443	59254	142.251.36.238	192.168.2.22
Jul 1, 2022 10:04:25.820483923 CEST	59254	443	192.168.2.22	142.251.36.238
Jul 1, 2022 10:04:25.820578098 CEST	59254	443	192.168.2.22	142.251.36.238
Jul 1, 2022 10:04:25.848391056 CEST	443	59254	142.251.36.238	192.168.2.22
Jul 1, 2022 10:04:25.848891973 CEST	59254	443	192.168.2.22	142.251.36.238
Jul 1, 2022 10:04:25.853352070 CEST	443	59254	142.251.36.238	192.168.2.22
Jul 1, 2022 10:04:25.861715078 CEST	443	59254	142.251.36.238	192.168.2.22
Jul 1, 2022 10:04:25.862598896 CEST	59254	443	192.168.2.22	142.251.36.238
Jul 1, 2022 10:04:25.873903990 CEST	443	59254	142.251.36.238	192.168.2.22
Jul 1, 2022 10:04:25.873944044 CEST	443	59254	142.251.36.238	192.168.2.22
Jul 1, 2022 10:04:25.874011993 CEST	443	59254	142.251.36.238	192.168.2.22
Jul 1, 2022 10:04:25.874609947 CEST	59254	443	192.168.2.22	142.251.36.238
Jul 1, 2022 10:04:25.903147936 CEST	59254	443	192.168.2.22	142.251.36.238
Jul 1, 2022 10:04:36.501557112 CEST	62627	53	192.168.2.22	8.8.8.8
Jul 1, 2022 10:04:36.520643950 CEST	53	62627	8.8.8.8	192.168.2.22
Jul 1, 2022 10:04:40.285816908 CEST	51302	53	192.168.2.22	8.8.8.8
Jul 1, 2022 10:04:40.313333035 CEST	53	51302	8.8.8.8	192.168.2.22
Jul 1, 2022 10:04:40.479454041 CEST	58384	53	192.168.2.22	8.8.8.8
Jul 1, 2022 10:04:40.488339901 CEST	54031	53	192.168.2.22	8.8.8.8
Jul 1, 2022 10:04:40.498692989 CEST	53	58384	8.8.8.8	192.168.2.22
Jul 1, 2022 10:04:40.507412910 CEST	53	54031	8.8.8.8	192.168.2.22
Jul 1, 2022 10:04:40.562350035 CEST	57939	53	192.168.2.22	8.8.8.8
Jul 1, 2022 10:04:40.584270954 CEST	53	57939	8.8.8.8	192.168.2.22
Jul 1, 2022 10:04:42.400933981 CEST	57941	443	192.168.2.22	172.217.16.161
Jul 1, 2022 10:04:42.441690922 CEST	443	57941	172.217.16.161	192.168.2.22
Jul 1, 2022 10:04:42.551510096 CEST	57941	443	192.168.2.22	172.217.16.161
Jul 1, 2022 10:04:42.554327011 CEST	57941	443	192.168.2.22	172.217.16.161
Jul 1, 2022 10:04:42.581892014 CEST	57941	443	192.168.2.22	172.217.16.161
Jul 1, 2022 10:04:42.582005978 CEST	443	57941	172.217.16.161	192.168.2.22
Jul 1, 2022 10:04:42.591938019 CEST	443	57941	172.217.16.161	192.168.2.22
Jul 1, 2022 10:04:42.595052958 CEST	443	57941	172.217.16.161	192.168.2.22
Jul 1, 2022 10:04:42.595088959 CEST	443	57941	172.217.16.161	192.168.2.22
Jul 1, 2022 10:04:42.595149994 CEST	443	57941	172.217.16.161	192.168.2.22
Jul 1, 2022 10:04:42.595180988 CEST	443	57941	172.217.16.161	192.168.2.22
Jul 1, 2022 10:04:42.595354080 CEST	57941	443	192.168.2.22	172.217.16.161
Jul 1, 2022 10:04:42.595448017 CEST	57941	443	192.168.2.22	172.217.16.161
Jul 1, 2022 10:04:42.634207010 CEST	57941	443	192.168.2.22	172.217.16.161
Jul 1, 2022 10:04:42.671538115 CEST	57941	443	192.168.2.22	172.217.16.161
Jul 1, 2022 10:04:42.672511101 CEST	57941	443	192.168.2.22	172.217.16.161
Jul 1, 2022 10:04:42.725054979 CEST	443	57941	172.217.16.161	192.168.2.22
Jul 1, 2022 10:04:42.739175081 CEST	443	57941	172.217.16.161	192.168.2.22
Jul 1, 2022 10:04:42.774326086 CEST	57941	443	192.168.2.22	172.217.16.161
Jul 1, 2022 10:04:42.774420977 CEST	57941	443	192.168.2.22	172.217.16.161
Jul 1, 2022 10:04:42.800246000 CEST	57941	443	192.168.2.22	172.217.16.161
Jul 1, 2022 10:04:42.802063942 CEST	443	57941	172.217.16.161	192.168.2.22
Jul 1, 2022 10:04:42.807320118 CEST	443	57941	172.217.16.161	192.168.2.22
Jul 1, 2022 10:04:42.815689087 CEST	443	57941	172.217.16.161	192.168.2.22
Jul 1, 2022 10:04:42.821795940 CEST	443	57941	172.217.16.161	192.168.2.22
Jul 1, 2022 10:04:42.821826935 CEST	443	57941	172.217.16.161	192.168.2.22
Jul 1, 2022 10:04:42.864624977 CEST	57941	443	192.168.2.22	172.217.16.161
Jul 1, 2022 10:04:42.864798069 CEST	57941	443	192.168.2.22	172.217.16.161
Jul 1, 2022 10:04:42.867966890 CEST	57941	443	192.168.2.22	172.217.16.161
Jul 1, 2022 10:04:42.912729025 CEST	443	57941	172.217.16.161	192.168.2.22
Jul 1, 2022 10:04:54.374507904 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 10:04:55.129563093 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 10:04:55.894045115 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 10:05:09.655822039 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 10:05:10.419034004 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 10:05:11.183487892 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 10:05:35.251054049 CEST	138	138	192.168.2.22	192.168.2.255

Timestamp	kBytes transferred	Direction	Data
2022-07-01 08:04:10 UTC	0	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=84.0.4147.135&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfm X-Goog-Update-Updater: chromecrx-84.0.4147.135 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-07-01 08:04:10 UTC	1	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-NEMd561oazEq_22rAXiZDQ' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 01 Jul 2022 08:04:10 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 5660 X-Daystart: 3850 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-07-01 08:04:10 UTC	2	IN	Data Raw: 33 31 39 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 35 36 36 30 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 33 38 35 30 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 20 Data Ascii: 319<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="5660" elapsed_seconds="3850"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2022-07-01 08:04:10 UTC	3	IN	Data Raw: 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 2e 63 72 78 22 20 66 70 3d 22 31 2e 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 61 70 70 20 Data Ascii: kkegccagdldgiimedpiccmgmieda.crx" fp="1.81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app><app
2022-07-01 08:04:10 UTC	3	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-07-01 08:04:10 UTC	0	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: CONSENT=WP.289365
2022-07-01 08:04:10 UTC	1	OUT	Data Raw: 20 Data Ascii:
2022-07-01 08:04:10 UTC	3	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 01 Jul 2022 08:04:10 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Content-Security-Policy: script-src 'report-sample' 'nonce-kinoGTgFnYo7NbCxTjE1Rw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'nonce-kinoGTgFnYo7NbCxTjE1Rw' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-07-01 08:04:10 UTC	5	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2022-07-01 08:04:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-07-01 08:04:17 UTC	410	OUT	GET /payment/frontend_paper_lantern/images/gmail.png HTTP/1.1 Host: eyecandylashcompany.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36 Accept: image/webp,image/apng,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-07-01 08:04:17 UTC	419	IN	HTTP/1.1 404 Not Found Date: Fri, 01 Jul 2022 08:04:16 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2022-07-01 08:04:17 UTC	419	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use