Edit tour

Windows Analysis Report
Invoice#0036473 .xlsx

Overview

General Information

Sample Name:	Invoice#0036473 .xlsx
Analysis ID:	655755
MD5:	c93e6dcf32928e1da7346b6ca3a1dc85
SHA1:	b90d66412b4d6669a175fd30e32bbe44428bd245
SHA256:	3ffe69c9e2e2f8a350f7d2ff6e64acf8cffbf390489807b81cf8e4eec87d4047
Infos:

Detection

HTMLPhisher

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected HtmlPhish10

Antivirus detection for URL or domain

Yara detected HtmlPhish7

Multi AV Scanner detection for domain / URL

Document exploit detected (process start blacklist hit)

Potential document exploit detected (unknown TCP traffic)

No HTML title found

JA3 SSL client fingerprint seen in connection with other malware

Potential document exploit detected (performs DNS queries)

HTML body contains low number of good links

Potential document exploit detected (performs HTTP gets)

Suspicious form URL found

IP address seen in connection with other malware

Document misses a certain OLE stream usually present in this Microsoft Office document type

Classification

Process Tree

System is w7x64

EXCEL.EXE (PID: 1600 cmdline: "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding MD5: D53B85E21886D2AF9815C377537BCAC3)

chrome.exe (PID: 3808 cmdline: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation -- "https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.html MD5: 6ACAE527E744C80997B25EF2A0485D5E)

chrome.exe (PID: 3984 cmdline: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=980,3874853447565799984,15077386689876222862,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1380 /prefetch:8 MD5: 6ACAE527E744C80997B25EF2A0485D5E)

chrome.exe (PID: 1212 cmdline: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.html MD5: 6ACAE527E744C80997B25EF2A0485D5E)

chrome.exe (PID: 2252 cmdline: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1008,1868451693323365442,12850068766914001285,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1468 /prefetch:8 MD5: 6ACAE527E744C80997B25EF2A0485D5E)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\index[1].htm	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\index[1].htm	JoeSecurity_HtmlPhish_7	Yara detected HtmlPhish_7	Joe Security

HTML

Source	Rule	Description	Author	Strings
67505.0.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
67505.0.pages.csv	JoeSecurity_HtmlPhish_7	Yara detected HtmlPhish_7	Joe Security

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CONSENT=WP.289365

Source: https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.html	SlashNext: Label: Credential Stealing type: Phishing & Social Engineering
Source: https://eyecandylashcompany.com/payment/frontend_paper_lantern/images/office3651.png	Avira URL Cloud: Label: phishing
Source: https://eyecandylashcompany.com/payment/frontend_paper_lantern/images/gmail.png	Avira URL Cloud: Label: phishing
Source: https://eyecandylashcompany.com/payment/frontend_paper_lantern/css/hover.css	Avira URL Cloud: Label: phishing
Source: https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.html2	Avira URL Cloud: Label: phishing

Source: eyecandylashcompany.com	Virustotal: Detection: 6%			Perma Link
Source: https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.html	Virustotal: Detection: 20%			Perma Link

Source: Yara match	File source: 67505.0.pages.csv, type: HTML
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\index[1].htm, type: DROPPED

Source: https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.html	HTTP Parser: HTML title missing
Source: https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.html	HTTP Parser: HTML title missing

Source: https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.html	HTTP Parser: Number of links: 0
Source: https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.html	HTTP Parser: Number of links: 0

Source: https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.html	HTTP Parser: Form action: azn.php
Source: https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.html	HTTP Parser: Form action: azn.php

Source: https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.html	HTTP Parser: No <meta name="author".. found
Source: https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.html	HTTP Parser: No <meta name="author".. found

Source: https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.html	HTTP Parser: No <meta name="copyright".. found
Source: https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.html	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 69.49.244.155:443 -> 192.168.2.22:49216 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.161:443 -> 192.168.2.22:49217 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.64.150.12:443 -> 192.168.2.22:49222 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 69.49.244.155:443 -> 192.168.2.22:49219 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 69.49.244.155:443 -> 192.168.2.22:49220 version: TLS 1.2

Source: Joe Sandbox View	IP Address: 104.18.10.207 104.18.10.207
Source: Joe Sandbox View	IP Address: 104.18.11.207 104.18.11.207

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 01 Jul 2022 14:21:58 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Type: text/html; charset=UTF-8X-Content-Type-Options: nosniffDate: Fri, 01 Jul 2022 14:22:00 GMTServer: fifeCache-Control: privateX-XSS-Protection: 0Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"Accept-Ranges: noneVary: Accept-EncodingConnection: closeTransfer-Encoding: chunked
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Type: text/html; charset=UTF-8X-Content-Type-Options: nosniffDate: Fri, 01 Jul 2022 14:22:22 GMTServer: fifeCache-Control: privateX-XSS-Protection: 0Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"Accept-Ranges: noneVary: Accept-EncodingConnection: closeTransfer-Encoding: chunked
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 01 Jul 2022 14:22:22 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 01 Jul 2022 14:22:25 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1

Source: index[1].htm.0.dr	String found in binary or memory: http://www.gmail.com
Source: ef55ff91-ca42-48c2-8615-538469a3af8b.tmp.3.dr	String found in binary or memory: https://accounts.google.com
Source: craw_window.js.2.dr	String found in binary or memory: https://accounts.google.com/MergeSession
Source: ef55ff91-ca42-48c2-8615-538469a3af8b.tmp.3.dr	String found in binary or memory: https://adservice.google.com
Source: ef55ff91-ca42-48c2-8615-538469a3af8b.tmp.3.dr	String found in binary or memory: https://ajax.googleapis.com
Source: index[1].htm.0.dr	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
Source: ef55ff91-ca42-48c2-8615-538469a3af8b.tmp.3.dr	String found in binary or memory: https://apis.google.com
Source: index[1].htm.0.dr	String found in binary or memory: https://cdn.iconscout.com/icon/free/png-512/microsoft-sharepoint-3-599372.png
Source: index[1].htm.0.dr	String found in binary or memory: https://cdn.pixabay.com/photo/2018/03/10/12/00/paper-3213924_1280.jpg
Source: index[1].htm.0.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js
Source: ef55ff91-ca42-48c2-8615-538469a3af8b.tmp.3.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json.2.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: ef55ff91-ca42-48c2-8615-538469a3af8b.tmp.3.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: index[1].htm.0.dr	String found in binary or memory: https://code.jquery.com/jquery-3.1.1.min.js
Source: index[1].htm.0.dr	String found in binary or memory: https://code.jquery.com/jquery-3.2.1.slim.min.js
Source: index[1].htm.0.dr	String found in binary or memory: https://code.jquery.com/jquery-3.3.1.js
Source: ef55ff91-ca42-48c2-8615-538469a3af8b.tmp.3.dr	String found in binary or memory: https://consent.google.com
Source: ef55ff91-ca42-48c2-8615-538469a3af8b.tmp.3.dr	String found in binary or memory: https://content-autofill.googleapis.com
Source: ef55ff91-ca42-48c2-8615-538469a3af8b.tmp.3.dr	String found in binary or memory: https://encrypted-tbn0.gstatic.com
Source: History Provider Cache.2.dr	String found in binary or memory: https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.html2
Source: ef55ff91-ca42-48c2-8615-538469a3af8b.tmp.3.dr	String found in binary or memory: https://fonts.googleapis.com
Source: index[1].htm.0.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Archivo
Source: craw_window.js.2.dr, craw_background.js.2.dr	String found in binary or memory: https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p
Source: index[1].htm.0.dr	String found in binary or memory: https://kit.fontawesome.com/585b051251.js
Source: ef55ff91-ca42-48c2-8615-538469a3af8b.tmp.3.dr	String found in binary or memory: https://lh3.googleusercontent.com
Source: index[1].htm.0.dr	String found in binary or memory: https://lh3.googleusercontent.com/proxy/bATQDWurvLlY3z2KTwUlb1gMxwLZoCk7CvqzrLqN1JioLU4nXkElVj-rMrvN
Source: index[1].htm.0.dr	String found in binary or memory: https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css
Source: index[1].htm.0.dr	String found in binary or memory: https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js
Source: ef55ff91-ca42-48c2-8615-538469a3af8b.tmp.3.dr	String found in binary or memory: https://ogs.google.com
Source: craw_window.js.2.dr, manifest.json.2.dr	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: ef55ff91-ca42-48c2-8615-538469a3af8b.tmp.3.dr	String found in binary or memory: https://redirector.gvt1.com
Source: craw_window.js.2.dr, manifest.json.2.dr	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: index[1].htm.0.dr	String found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js
Source: ef55ff91-ca42-48c2-8615-538469a3af8b.tmp.3.dr	String found in binary or memory: https://update.googleapis.com
Source: craw_window.js.2.dr, craw_background.js.2.dr	String found in binary or memory: https://www-googleapis-staging.sandbox.google.com
Source: ef55ff91-ca42-48c2-8615-538469a3af8b.tmp.3.dr	String found in binary or memory: https://www.google.com
Source: manifest.json.2.dr	String found in binary or memory: https://www.google.com/
Source: craw_window.js.2.dr	String found in binary or memory: https://www.google.com/accounts/OAuthLogin?issueuberauth=1
Source: craw_window.js.2.dr	String found in binary or memory: https://www.google.com/images/cleardot.gif
Source: craw_window.js.2.dr	String found in binary or memory: https://www.google.com/images/dot2.gif

Source: ~DF600634D9D62A1024.TMP.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: 24CF.tmp.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: unknown	Process created: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.html
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1008,1868451693323365442,12850068766914001285,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1468 /prefetch:8
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation -- "https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.html
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=980,3874853447565799984,15077386689876222862,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1380 /prefetch:8
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation -- "https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.html	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1008,1868451693323365442,12850068766914001285,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1468 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=980,3874853447565799984,15077386689876222862,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1380 /prefetch:8	Jump to behavior

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49204
Source: unknown	Network traffic detected: HTTP traffic on port 49219 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49222
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49220
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49241
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49184
Source: unknown	Network traffic detected: HTTP traffic on port 49204 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49231 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49197 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49193 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49174 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49191 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49178 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49219
Source: unknown	Network traffic detected: HTTP traffic on port 49216 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49217
Source: unknown	Network traffic detected: HTTP traffic on port 49184 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49216
Source: unknown	Network traffic detected: HTTP traffic on port 49220 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49179
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49234
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49178
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49232
Source: unknown	Network traffic detected: HTTP traffic on port 49190 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49198
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49231
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49175
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49197
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49174
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49173
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49194
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49193
Source: unknown	Network traffic detected: HTTP traffic on port 49222 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49192
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49191
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49190
Source: unknown	Network traffic detected: HTTP traffic on port 49241 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49198 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49175 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49194 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49192 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49173 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49179 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49234 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49217 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49232 -> 443

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=84.0.4147.135&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfmX-Goog-Update-Updater: chromecrx-84.0.4147.135Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /payment/frontend_paper_lantern/index.html HTTP/1.1Host: eyecandylashcompany.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /payment/frontend_paper_lantern/css/hover.css HTTP/1.1Host: eyecandylashcompany.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrap/4.0.0/css/bootstrap.min.css HTTP/1.1Host: maxcdn.bootstrapcdn.comConnection: keep-aliveOrigin: https://eyecandylashcompany.comUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /payment/frontend_paper_lantern/images/office3651.png HTTP/1.1Host: eyecandylashcompany.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36Accept: image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrap/4.0.0/js/bootstrap.min.js HTTP/1.1Host: maxcdn.bootstrapcdn.comConnection: keep-aliveOrigin: https://eyecandylashcompany.comUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrap/4.1.3/js/bootstrap.min.js HTTP/1.1Host: stackpath.bootstrapcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/popper.js/1.12.9/umd/popper.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveOrigin: https://eyecandylashcompany.comUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /icon/free/png-512/microsoft-sharepoint-3-599372.png HTTP/1.1Host: cdn.iconscout.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36Accept: image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /payment/frontend_paper_lantern/images/gmail.png HTTP/1.1Host: eyecandylashcompany.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36Accept: image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /photo/2018/03/10/12/00/paper-3213924_1280.jpg HTTP/1.1Host: cdn.pixabay.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36Accept: image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /proxy/bATQDWurvLlY3z2KTwUlb1gMxwLZoCk7CvqzrLqN1JioLU4nXkElVj-rMrvNZjuUXh3c1WhNOGX5_Cg18Wmltm3vvna-uZDqOkUISXU4XOYsUyt-4962tq2u0WiI358gef4ewWcVp0PA6YiTnICV2Cg7wLzdb0DlXw HTTP/1.1Host: lh3.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36Accept: image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /payment/frontend_paper_lantern/index.html HTTP/1.1Accept: /User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; ms-office)UA-CPU: AMD64Accept-Encoding: gzip, deflateHost: eyecandylashcompany.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /proxy/bATQDWurvLlY3z2KTwUlb1gMxwLZoCk7CvqzrLqN1JioLU4nXkElVj-rMrvNZjuUXh3c1WhNOGX5_Cg18Wmltm3vvna-uZDqOkUISXU4XOYsUyt-4962tq2u0WiI358gef4ewWcVp0PA6YiTnICV2Cg7wLzdb0DlXw HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: lh3.googleusercontent.com
Source: global traffic	HTTP traffic detected: GET /photo/2018/03/10/12/00/paper-3213924_1280.jpg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cdn.pixabay.com
Source: global traffic	HTTP traffic detected: GET /payment/frontend_paper_lantern/images/office3651.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: eyecandylashcompany.com
Source: global traffic	HTTP traffic detected: GET /payment/frontend_paper_lantern/images/gmail.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: eyecandylashcompany.com
Source: global traffic	HTTP traffic detected: GET /payment/frontend_paper_lantern/images/gmail.png HTTP/1.1Host: eyecandylashcompany.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36Accept: image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	13 Exploitation for Client Execution	Path Interception	1 Process Injection	1 Masquerading	OS Credential Dumping	1 File and Directory Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	2 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	4 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	5 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	4 Ingress Tool Transfer	SIM Card Swap		Carrier Billing Fraud

Source	Detection	Scanner	Label	Link
Invoice#0036473 .xlsx	5%	Virustotal		Browse
Invoice#0036473 .xlsx	8%	ReversingLabs	Document-Excel.Trojan.Heuristic

Source	Detection	Scanner	Label	Link
https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.html	100%	SlashNext	Credential Stealing type: Phishing & Social Engineering
https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.html	20%	Virustotal		Browse
https://eyecandylashcompany.com/payment/frontend_paper_lantern/images/office3651.png	100%	Avira URL Cloud	phishing
https://eyecandylashcompany.com/payment/frontend_paper_lantern/images/gmail.png	100%	Avira URL Cloud	phishing
https://eyecandylashcompany.com/payment/frontend_paper_lantern/css/hover.css	100%	Avira URL Cloud	phishing
https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.html2	100%	Avira URL Cloud	phishing

Name	IP	Active	Malicious	Antivirus Detection	Reputation
eyecandylashcompany.com	69.49.244.155	true	true	6%, Virustotal, Browse	unknown
gstaticadssl.l.google.com	142.251.36.227	true	false		high
stackpath.bootstrapcdn.com	104.18.11.207	true	false		high
accounts.google.com	142.251.36.205	true	false		high
cdnjs.cloudflare.com	104.17.25.14	true	false		high
maxcdn.bootstrapcdn.com	104.18.10.207	true	false		high
clients.l.google.com	142.250.185.78	true	false		high
cdn.iconscout.com	104.18.29.243	true	false		high
cdn.pixabay.com	172.64.150.12	true	false		high
googlehosted.l.googleusercontent.com	172.217.16.161	true	false		high
clients2.google.com	unknown	unknown	false		high
ka-f.fontawesome.com	unknown	unknown	false		high
code.jquery.com	unknown	unknown	false		high
kit.fontawesome.com	unknown	unknown	false		high
lh3.googleusercontent.com	unknown	unknown	false		high

Name	Malicious	Antivirus Detection	Reputation
https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.html	true	20%, Virustotal, Browse SlashNext: Credential Stealing type: Phishing & Social Engineering	unknown
https://cdn.pixabay.com/photo/2018/03/10/12/00/paper-3213924_1280.jpg	false		high
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false		high
https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js	false		high
https://eyecandylashcompany.com/payment/frontend_paper_lantern/images/office3651.png	true	Avira URL Cloud: phishing	unknown
https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css	false		high
https://lh3.googleusercontent.com/proxy/bATQDWurvLlY3z2KTwUlb1gMxwLZoCk7CvqzrLqN1JioLU4nXkElVj-rMrvNZjuUXh3c1WhNOGX5_Cg18Wmltm3vvna-uZDqOkUISXU4XOYsUyt-4962tq2u0WiI358gef4ewWcVp0PA6YiTnICV2Cg7wLzdb0DlXw	false		high
https://eyecandylashcompany.com/payment/frontend_paper_lantern/images/gmail.png	true	Avira URL Cloud: phishing	unknown
https://eyecandylashcompany.com/payment/frontend_paper_lantern/css/hover.css	true	Avira URL Cloud: phishing	unknown
https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js	false		high
https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.html	true	20%, Virustotal, Browse SlashNext: Credential Stealing type: Phishing & Social Engineering	unknown
https://cdn.iconscout.com/icon/free/png-512/microsoft-sharepoint-3-599372.png	false		high
https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js	false		high
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=84.0.4147.135&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1	false		high

Name	Source	Malicious	Antivirus Detection	Reputation
https://consent.google.com	ef55ff91-ca42-48c2-8615-538469a3af8b.tmp.3.dr	false		high
https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p	craw_window.js.2.dr, craw_background.js.2.dr	false		high
https://www.google.com/intl/en-US/chrome/blank.html	craw_background.js.2.dr	false		high
https://ogs.google.com	ef55ff91-ca42-48c2-8615-538469a3af8b.tmp.3.dr	false		high
https://www.google.com/images/cleardot.gif	craw_window.js.2.dr	false		high
https://code.jquery.com/jquery-3.2.1.slim.min.js	index[1].htm.0.dr	false		high
http://www.gmail.com	index[1].htm.0.dr	false		high
https://code.jquery.com/jquery-3.1.1.min.js	index[1].htm.0.dr	false		high
https://payments.google.com/payments/v4/js/integrator.js	craw_window.js.2.dr, manifest.json.2.dr	false		high
https://adservice.google.com	ef55ff91-ca42-48c2-8615-538469a3af8b.tmp.3.dr	false		high
https://lh3.googleusercontent.com	ef55ff91-ca42-48c2-8615-538469a3af8b.tmp.3.dr	false		high
https://lh3.googleusercontent.com/proxy/bATQDWurvLlY3z2KTwUlb1gMxwLZoCk7CvqzrLqN1JioLU4nXkElVj-rMrvN	index[1].htm.0.dr	false		high
https://sandbox.google.com/payments/v4/js/integrator.js	craw_window.js.2.dr, manifest.json.2.dr	false		high
https://www.google.com/images/x2.gif	craw_window.js.2.dr	false		high
https://code.jquery.com/jquery-3.3.1.js	index[1].htm.0.dr	false		high
https://accounts.google.com/MergeSession	craw_window.js.2.dr	false		high
https://www.google.com	ef55ff91-ca42-48c2-8615-538469a3af8b.tmp.3.dr	false		high
https://www.google.com/images/dot2.gif	craw_window.js.2.dr	false		high
https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.html2	History Provider Cache.2.dr	true	Avira URL Cloud: phishing	unknown
https://accounts.google.com	ef55ff91-ca42-48c2-8615-538469a3af8b.tmp.3.dr	false		high
https://clients2.googleusercontent.com	ef55ff91-ca42-48c2-8615-538469a3af8b.tmp.3.dr	false		high
https://apis.google.com	ef55ff91-ca42-48c2-8615-538469a3af8b.tmp.3.dr	false		high
https://kit.fontawesome.com/585b051251.js	index[1].htm.0.dr	false		high
https://www.google.com/accounts/OAuthLogin?issueuberauth=1	craw_window.js.2.dr	false		high
https://www.google.com/	manifest.json.2.dr	false		high
https://www-googleapis-staging.sandbox.google.com	craw_window.js.2.dr, craw_background.js.2.dr	false		high
https://clients2.google.com	ef55ff91-ca42-48c2-8615-538469a3af8b.tmp.3.dr	false		high
https://clients2.google.com/service/update2/crx	manifest.json.2.dr	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.185.78	clients.l.google.com	United States	15169	GOOGLEUS	false
104.18.10.207	maxcdn.bootstrapcdn.com	United States	13335	CLOUDFLARENETUS	false
142.251.36.205	accounts.google.com	United States	15169	GOOGLEUS	false
142.251.36.227	gstaticadssl.l.google.com	United States	15169	GOOGLEUS	false
104.18.11.207	stackpath.bootstrapcdn.com	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
104.18.29.243	cdn.iconscout.com	United States	13335	CLOUDFLARENETUS	false
172.64.150.12	cdn.pixabay.com	United States	13335	CLOUDFLARENETUS	false
69.49.244.155	eyecandylashcompany.com	United States	46606	UNIFIEDLAYER-AS-1US	true
172.217.16.161	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
104.17.25.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Invoice#0036473 .xlsx

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

HTML

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Google\Chrome\User Data\0f9da6dd-02d1-4716-bb65-0ecc794f8349.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\24bfe171-efe7-4072-8cd7-5dd0ecaef267.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\26d44847-f29b-44b4-83c5-a4e6cc440bf9.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\31067a2a-5ce7-4ec9-98cd-89c86b9b1309.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\3a1d6b1f-342a-4802-8123-4b45d21f9eab.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\51a627a5-22fb-4a4b-9790-73b801998960.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\51b2f774-2252-48f6-923d-fd7fac7b6110.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\8658dadd-071f-4fed-a194-d19faaa6b86c.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\055edf99-becc-45c4-be14-4dc525a5432e.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\0a6c3045-da8d-47a3-8153-9afce256711f.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\0eb7fe35-30bc-48b6-8257-0982ee1a4890.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\1f2324ab-adab-45fc-a3ab-9367bc32878e.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\2277d4eb-77ab-4279-9966-ee1e49db086b.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\262f10db-b419-4f57-98ae-ce9fa3a50196.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\61c8e5c5-f16b-4c38-9921-56f055e52cd4.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata\computed_hashes.json

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\000003.log

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG.old (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Provider Cache

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network Persistent State (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Preferences (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences (copy)

Windows Analysis Report
Invoice#0036473 .xlsx

Joe Sandbox Version:	35.0.0 Citrine
Analysis ID:	655755
Start date and time: 01/07/202216:20:25	2022-07-01 16:20:25 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Invoice#0036473 .xlsx
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	4
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal76.phis.expl.winXLSX@32/126@17/13
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .xlsx Adjust boot time Enable AMSI Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Browse link: https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.html Scroll down Close Viewer

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
104.18.11.207	http://emfs.co.za/wp-content/uploads/emfs-popia-privacy-policy-final.pdf	Get hash	malicious	Browse	netdna.bootstrapcdn.com/font-awesome/4.0.1/css/font-awesome.css
104.18.10.207	test@somewhere.com.html	Get hash	malicious	Browse
	test@barclays.com.html	Get hash	malicious	Browse
	https://gmail.us14.list-manage.com/track/click?u=957e6b6833ddd63bbe471b4e4&id=18858b02d6&e=7ce018b90e#giangaddo.prati@barilla.com	Get hash	malicious	Browse
	Invoice#0036473 .xlsx	Get hash	malicious	Browse
	https://gmail.us14.list-manage.com/track/click?u=957e6b6833ddd63bbe471b4e4&id=18858b02d6&e=7ce018b90e#peter.boyd@southside.com	Get hash	malicious	Browse
	https://www.trekkdesigngroup.online	Get hash	malicious	Browse
	INVOICE SOA 6302022.html	Get hash	malicious	Browse
	https://typeyournamehereueuee.zyrosite.com/	Get hash	malicious	Browse
	https://u27682479.ct.sendgrid.net/ls/click?upn=cvn9ZJclWWM77Z1KQ7AGNLTvG6cbD4GX8IMOUAv7Il0CScb6ZYT3Okqv8ttKWjhV61bU7wZVg-2BRwpPEz5BxnlpZAXxWZhwu4A5T7Xmub5i4-3D8kdN_BQTHDHIGBY8bVXALtPGM7gO667eXi0Rxjw6Ja5tIhIHl4jbBM8FcsT0sDPhrKTJuPA8c0hJbJUedqDm0dZ1N5q6HFPXMyNiqLMnaTKX-2BjvxEQqKmS9AIBthNPL271WvH8x6O0192ihJ9vhKUW-2B1WIoITJImLF7rC2kCSY-2FOeXXbB54AsMvKkV7xrJUut0RtOJ0YkHUdgPc7qyyqcpC6RYNpOh5HCDF73R1mUOTiYID4-3D	Get hash	malicious	Browse
	Statement06292022.html	Get hash	malicious	Browse
	https://theunfused.be/reactivate/index2.html	Get hash	malicious	Browse
	https://sharepdf.info/vs/ab/004bk.shtml?sjones@pfeiffer-vacuum.com+&_x__tr_hl=97	Get hash	malicious	Browse
	https://5a5edz2o3ugnqdrsidauf23pm3td4wqmlnuq5l7qnu-ipfs-nftstorage-link.translate.goog/?_x_tr_hp=bafkreigasd7iihvg&_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en-US&_x_tr_pto=wapp#	Get hash	malicious	Browse
	https://62bc10e82f39dc00752b3f25--jocular-speculoos-88b519.netlify.app/#anika@khk.co.za	Get hash	malicious	Browse
	https://gcp.olympus.io/api/v1/share/file/download-via-public-link?linkId=bdaa6e3d-aab8-4e16-8d04-3c7d34d3871c&responseType=file	Get hash	malicious	Browse
	ACH-paymentDetails.htm	Get hash	malicious	Browse
	https://employmentas-my.sharepoint.com/:o:/g/personal/roxy_employerprotect_com_au/Ek2R_hZAFkJNsMTTpTIyUIIB6QxcToCUDU2EYLrzeglOrA?e=sSX1Ih	Get hash	malicious	Browse
	https://infograph.venngage.com/pl/62Ho0n746Ag	Get hash	malicious	Browse
	https://krytoninternationalinc-my.sharepoint.com/:f:/g/personal/bnami_kryton_com/EhDLdLgQrLxCn66if43sGLsBf6Ij5ihiOcxREvaqxt_nug?e=jVDghv	Get hash	malicious	Browse
	Overdue Invoice.xlsx	Get hash	malicious	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
CLOUDFLARENETUS	https://access-payment-request.com	Get hash	malicious	Browse	104.20.185.68
	DATA-5695696.xls	Get hash	malicious	Browse	188.114.96.3
	ukYq0S6e1m	Get hash	malicious	Browse	172.67.211.35
	http://rdpolo.xyz/xLXTqRmT?	Get hash	malicious	Browse	104.21.55.18
	ARCHIVO_86.xls	Get hash	malicious	Browse	188.114.97.3
	https://officesharepoint-microsoft.nimbusweb.me/share/7180759/nrwc6k8nkclqdtv309ot	Get hash	malicious	Browse	104.16.125.175
	https://plate.seamonkey.es/gotodate/go%20seamonkey.es/gotodate/	Get hash	malicious	Browse	172.67.162.247
	Jvcfjyquhiqpaeumsljfzajfmzhrlkhzot.exe	Get hash	malicious	Browse	104.21.15.66
	test@somewhere.com.html	Get hash	malicious	Browse	172.67.38.66
	#U03a4#U0399#U039c#U039f#U039b#U039f#U0393#U0399#U0391 608595.exe	Get hash	malicious	Browse	23.227.38.74
	test@barclays.com.html	Get hash	malicious	Browse	104.17.25.14
	https://gmail.us14.list-manage.com/track/click?u=957e6b6833ddd63bbe471b4e4&id=18858b02d6&e=7ce018b90e#giangaddo.prati@barilla.com	Get hash	malicious	Browse	104.17.25.14
	https://gmail.us14.list-manage.com/track/click?u=957e6b6833ddd63bbe471b4e4&id=18858b02d6&e=7ce018b90e#giangaddo.prati@barilla.com	Get hash	malicious	Browse	104.17.25.14
	SecuriteInfo.com.Variant.Zusy.427939.15383.exe	Get hash	malicious	Browse	162.159.134.233
	SecuriteInfo.com.Variant.Zusy.427939.774.exe	Get hash	malicious	Browse	162.159.134.233
	SecuriteInfo.com.Variant.Zusy.427939.11600.exe	Get hash	malicious	Browse	162.159.133.233
	Invoice#0036473 .xlsx	Get hash	malicious	Browse	172.64.150.12
	Invoice#0036473 .xlsx	Get hash	malicious	Browse	104.17.25.14
	0700122.exe	Get hash	malicious	Browse	162.159.130.233
	SecuriteInfo.com.Suspicious.Linux.Save.a.17324.427	Get hash	malicious	Browse	104.29.132.188
CLOUDFLARENETUS	https://access-payment-request.com	Get hash	malicious	Browse	104.20.185.68
	DATA-5695696.xls	Get hash	malicious	Browse	188.114.96.3
	ukYq0S6e1m	Get hash	malicious	Browse	172.67.211.35
	http://rdpolo.xyz/xLXTqRmT?	Get hash	malicious	Browse	104.21.55.18
	ARCHIVO_86.xls	Get hash	malicious	Browse	188.114.97.3
	https://officesharepoint-microsoft.nimbusweb.me/share/7180759/nrwc6k8nkclqdtv309ot	Get hash	malicious	Browse	104.16.125.175
	https://plate.seamonkey.es/gotodate/go%20seamonkey.es/gotodate/	Get hash	malicious	Browse	172.67.162.247
	Jvcfjyquhiqpaeumsljfzajfmzhrlkhzot.exe	Get hash	malicious	Browse	104.21.15.66
	test@somewhere.com.html	Get hash	malicious	Browse	172.67.38.66
	#U03a4#U0399#U039c#U039f#U039b#U039f#U0393#U0399#U0391 608595.exe	Get hash	malicious	Browse	23.227.38.74
	test@barclays.com.html	Get hash	malicious	Browse	104.17.25.14
	https://gmail.us14.list-manage.com/track/click?u=957e6b6833ddd63bbe471b4e4&id=18858b02d6&e=7ce018b90e#giangaddo.prati@barilla.com	Get hash	malicious	Browse	104.17.25.14
	https://gmail.us14.list-manage.com/track/click?u=957e6b6833ddd63bbe471b4e4&id=18858b02d6&e=7ce018b90e#giangaddo.prati@barilla.com	Get hash	malicious	Browse	104.17.25.14
	SecuriteInfo.com.Variant.Zusy.427939.15383.exe	Get hash	malicious	Browse	162.159.134.233
	SecuriteInfo.com.Variant.Zusy.427939.774.exe	Get hash	malicious	Browse	162.159.134.233
	SecuriteInfo.com.Variant.Zusy.427939.11600.exe	Get hash	malicious	Browse	162.159.133.233
	Invoice#0036473 .xlsx	Get hash	malicious	Browse	172.64.150.12
	Invoice#0036473 .xlsx	Get hash	malicious	Browse	104.17.25.14
	0700122.exe	Get hash	malicious	Browse	162.159.130.233
	SecuriteInfo.com.Suspicious.Linux.Save.a.17324.427	Get hash	malicious	Browse	104.29.132.188

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
7dcce5b76c8b17472d024758970a406b	DATA-5695696.xls	Get hash	malicious	Browse	69.49.244.155 172.217.16.161 172.64.150.12
	ARCHIVO_86.xls	Get hash	malicious	Browse	69.49.244.155 172.217.16.161 172.64.150.12
	NOTICE-3006.xls	Get hash	malicious	Browse	69.49.244.155 172.217.16.161 172.64.150.12
	informe_30062022.xls	Get hash	malicious	Browse	69.49.244.155 172.217.16.161 172.64.150.12
	DOC 18860.xls	Get hash	malicious	Browse	69.49.244.155 172.217.16.161 172.64.150.12
	YEY78662051339816_202207011740.xls	Get hash	malicious	Browse	69.49.244.155 172.217.16.161 172.64.150.12
	report_21953.xls	Get hash	malicious	Browse	69.49.244.155 172.217.16.161 172.64.150.12
	Invoice#0036473 .xlsx	Get hash	malicious	Browse	69.49.244.155 172.217.16.161 172.64.150.12
	Scan-2906.xls	Get hash	malicious	Browse	69.49.244.155 172.217.16.161 172.64.150.12
	doc_5665183.xls	Get hash	malicious	Browse	69.49.244.155 172.217.16.161 172.64.150.12
	ARCHIVO 42.xls	Get hash	malicious	Browse	69.49.244.155 172.217.16.161 172.64.150.12
	ARCHIVO 42.xls	Get hash	malicious	Browse	69.49.244.155 172.217.16.161 172.64.150.12
	ARCHIVO 42.xls	Get hash	malicious	Browse	69.49.244.155 172.217.16.161 172.64.150.12
	attachments_22629765514.xls	Get hash	malicious	Browse	69.49.244.155 172.217.16.161 172.64.150.12
	4_IT05242144277_14_29062022_073000.xlsm	Get hash	malicious	Browse	69.49.244.155 172.217.16.161 172.64.150.12
	https://forms.gle/UUWec3HjgemxRctM9	Get hash	malicious	Browse	69.49.244.155 172.217.16.161 172.64.150.12
	06089.xls	Get hash	malicious	Browse	69.49.244.155 172.217.16.161 172.64.150.12
	100168531727380051.xls	Get hash	malicious	Browse	69.49.244.155 172.217.16.161 172.64.150.12
	SCAN 29062022.xls	Get hash	malicious	Browse	69.49.244.155 172.217.16.161 172.64.150.12
	EFT.xls	Get hash	malicious	Browse	69.49.244.155 172.217.16.161 172.64.150.12

Process:	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	135684
Entropy (8bit):	6.053651043845898
Encrypted:	false
SSDEEP:	3072:i6hz5W20fwPJEpzCaULx8j2hNuSaWyY9wUgew5L:i6N/0fwPJC0x8j2rhyYCUN8
MD5:	DCF7F9B27CF9581A5882128AF4190F60
SHA1:	54612CBF3EE18D6EF083A5AF17DF3723992584C6
SHA-256:	09202D7CE4EAD0C4152B69689D381085AA66C4545CB64EF322EB63E0E68C4461
SHA-512:	E7F4C68ED70D87016365AC25F599781D441BCE7202D3409F7CF0E2FD0F6C2001FD7FD3E40B5448106B64126F00E6B544EC8BA718A0854A2DE9A906A2B8C7F0CC
Malicious:	false
Reputation:	low
Preview:	{"browser":{"last_redirect_origin":"","shortcut_migration_version":"84.0.4147.89"},"easy_unlock":{"device_id":"f691bb0f-1b4f-4339-aef5-321b65f13447"},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en"},"legacy":{"profile":{"name":{"migrated":true}}},"network_time":{"network_time_mapping":{"local":1.656717655152594e+12,"network":1.656685314e+12,"ticks":457817612.0,"uncertainty":7814564.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAADCJQEpL4peQLs/tCx05ts1AAAAAAIAAAAAABBmAAAAAQAAIAAAAHMdBSm688AB9E4ujGBlc8b12w9pH8Ho0MG5KX0s9TvsAAAAAA6AAAAAAgAAIAAAAKp70FMSZVCDUsFN1iNo5k0cdS+uI3XobvqN11pz11FbMAAAAHEgEYBv3dbmfqLRp8KY9FTYBCEdPLIJnBuQSIy6PW6ieb+TQlX0tlf+joBO06Pyo0AAAADT82DjaNvFLY7T0RywXTGepumesXXBFeM5MLg7ZlErGegSazITBqJVemjLdeT3R2c6H7dl+tlEXxt1m8SJWLUl"},"password_manager":{"os_password_blank":true,"os_password_last_changed":"13291231200170207"},"plugins":{"metadata":{"adobe-flash-player":{"displayurl":true,"group_name_matcher":"Shockwave Flash","help

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	HTML document, UTF-8 Unicode text, with CRLF line terminators
Category:	downloaded
Size (bytes):	21845
Entropy (8bit):	4.959781554055647
Encrypted:	false
SSDEEP:	384:ytzDc2rA6aD44Rw89cmW221/sxZMZKs0nOBY:ozAXL444BY
MD5:	9C7A316E607FC1C11A3EF10056BD3AFD
SHA1:	473BA685597DE37A40649C7F1DE933A107D09119
SHA-256:	DDFE1F54DF786A3B0AC73789E9761691BA6B00539DC8AF70A37CCDACD17BF070
SHA-512:	BE97B489AE94036B6520D75971EA1A76A11D145880F91FBA6B312F97F44F07171FCBC29B215D211CB58FDF84E25302456B0D04528616340F073C6603FA5FC26B
Malicious:	true
Yara Hits:	Rule: JoeSecurity_HtmlPhish_10, Description: Yara detected HtmlPhish_10, Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\index[1].htm, Author: Joe Security Rule: JoeSecurity_HtmlPhish_7, Description: Yara detected HtmlPhish_7, Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\index[1].htm, Author: Joe Security
IE Cache URL:	https://eyecandylashcompany.com/payment/frontend_paper_lantern/index.html
Preview:	..<!doctype html>..<html lang="en">..<head>.. <script src="https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script>.. <script src="https://code.jquery.com/jquery-3.1.1.min.js">.. <script src="https://code.jquery.com/jquery-3.3.1.js" integrity="sha256-2Kok7MbOyxpgUVvAk/HJ2jigOSYS2auK4Pfzbm7uH60=" crossorigin="anonymous"></script>.. Required meta tags -->.. <meta charset="utf-8">.. <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">.... Bootstrap CSS -->.. <link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css" integrity="sha384-Gn5384xqQ1aoWXA+058RXPxPg6fy4IWvTNh0E263XmFcJlSAwiGgFAW/dAiS6JXm" crossorigin="anonymous">.. <link href="https://fonts.googleapis.com/css?family=Archivo+Narrow&display=swap" rel="stylesheet">.. <script src="https://kit.fontawesome.com/585b051251.js" crossorigin="anonymous"></script>.. <title>MS SharePoint</title>.... <link re

File type:	Microsoft Excel 2007+
Entropy (8bit):	7.991276862113107
TrID:	Excel Microsoft Office Open XML Format document (40004/1) 83.33% ZIP compressed archive (8000/1) 16.67%
File name:	Invoice#0036473 .xlsx
File size:	935361
MD5:	c93e6dcf32928e1da7346b6ca3a1dc85
SHA1:	b90d66412b4d6669a175fd30e32bbe44428bd245
SHA256:	3ffe69c9e2e2f8a350f7d2ff6e64acf8cffbf390489807b81cf8e4eec87d4047
SHA512:	285b0a357b59b8c0cfc0bcbd91706e12e90e3d4f56b516b05ba745ec3b036b217c9029a250269c947c40108d3d9431ab5b26a54da7df88b56ffbf2ac8d9fc533
SSDEEP:	24576:4rQU57GpJk69mCNDPCBpY+bikHII5Bqn13dhW7:/y7jClPsDJ55B67W7
TLSH:	C21533D9983763EDE23F9CB1126BA700742474871970C4D14ECAAA9C1FE94EF794BB12
File Content Preview:	PK..........!..'`p............[Content_Types].xml ...(.........................................................................................................................................................................................................

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 1, 2022 16:21:50.617330074 CEST	138	138	192.168.2.22	192.168.2.255
Jul 1, 2022 16:21:52.529335022 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 16:21:52.888406038 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 16:21:52.956621885 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 16:21:53.277487993 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 16:21:53.574980021 CEST	54408	53	192.168.2.22	8.8.8.8
Jul 1, 2022 16:21:53.577281952 CEST	50108	53	192.168.2.22	8.8.8.8
Jul 1, 2022 16:21:53.577595949 CEST	54723	53	192.168.2.22	8.8.8.8
Jul 1, 2022 16:21:53.593833923 CEST	53	54408	8.8.8.8	192.168.2.22
Jul 1, 2022 16:21:53.594136000 CEST	53	50108	8.8.8.8	192.168.2.22
Jul 1, 2022 16:21:53.595582008 CEST	53	54723	8.8.8.8	192.168.2.22
Jul 1, 2022 16:21:53.627573013 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 16:21:53.706542015 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 16:21:54.027765036 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 16:21:54.390569925 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 16:21:54.457314014 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 16:21:58.822437048 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 16:21:58.847316027 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 16:21:58.851979017 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 16:21:58.881850958 CEST	60622	53	192.168.2.22	8.8.8.8
Jul 1, 2022 16:21:58.882405996 CEST	53160	53	192.168.2.22	8.8.8.8
Jul 1, 2022 16:21:58.903615952 CEST	53	53160	8.8.8.8	192.168.2.22
Jul 1, 2022 16:21:58.932708979 CEST	64948	53	192.168.2.22	8.8.8.8
Jul 1, 2022 16:21:59.179634094 CEST	52585	53	192.168.2.22	8.8.8.8
Jul 1, 2022 16:21:59.181971073 CEST	52129	53	192.168.2.22	8.8.8.8
Jul 1, 2022 16:21:59.182203054 CEST	57078	53	192.168.2.22	8.8.8.8
Jul 1, 2022 16:21:59.201898098 CEST	53	52585	8.8.8.8	192.168.2.22
Jul 1, 2022 16:21:59.202836990 CEST	53	52129	8.8.8.8	192.168.2.22
Jul 1, 2022 16:21:59.228257895 CEST	52276	53	192.168.2.22	8.8.8.8
Jul 1, 2022 16:21:59.250169992 CEST	53	52276	8.8.8.8	192.168.2.22
Jul 1, 2022 16:21:59.560090065 CEST	53057	53	192.168.2.22	8.8.8.8
Jul 1, 2022 16:21:59.572175980 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 16:21:59.581110001 CEST	53	53057	8.8.8.8	192.168.2.22
Jul 1, 2022 16:21:59.597203970 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 16:21:59.601147890 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 16:22:00.086136103 CEST	63728	53	192.168.2.22	8.8.8.8
Jul 1, 2022 16:22:00.125507116 CEST	53	63728	8.8.8.8	192.168.2.22
Jul 1, 2022 16:22:00.322520971 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 16:22:00.347501993 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 16:22:00.351466894 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 16:22:01.428495884 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 16:22:01.893244028 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 16:22:01.970925093 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 16:22:02.188075066 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 16:22:02.656238079 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 16:22:02.734232903 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 16:22:02.944791079 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 16:22:03.412769079 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 16:22:03.490765095 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 16:22:04.818778038 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 16:22:04.820590973 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 16:22:04.822736025 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 16:22:05.021972895 CEST	59254	443	192.168.2.22	142.250.185.78
Jul 1, 2022 16:22:05.047342062 CEST	443	59254	142.250.185.78	192.168.2.22
Jul 1, 2022 16:22:05.047935009 CEST	59254	443	192.168.2.22	142.250.185.78
Jul 1, 2022 16:22:05.073364019 CEST	443	59254	142.250.185.78	192.168.2.22
Jul 1, 2022 16:22:05.073412895 CEST	443	59254	142.250.185.78	192.168.2.22
Jul 1, 2022 16:22:05.073452950 CEST	443	59254	142.250.185.78	192.168.2.22
Jul 1, 2022 16:22:05.073493958 CEST	443	59254	142.250.185.78	192.168.2.22
Jul 1, 2022 16:22:05.073594093 CEST	59254	443	192.168.2.22	142.250.185.78
Jul 1, 2022 16:22:05.087445974 CEST	59254	443	192.168.2.22	142.250.185.78
Jul 1, 2022 16:22:05.088587999 CEST	59254	443	192.168.2.22	142.250.185.78
Jul 1, 2022 16:22:05.143127918 CEST	59254	443	192.168.2.22	142.250.185.78
Jul 1, 2022 16:22:05.143511057 CEST	59254	443	192.168.2.22	142.250.185.78
Jul 1, 2022 16:22:05.176027060 CEST	443	59254	142.250.185.78	192.168.2.22
Jul 1, 2022 16:22:05.180511951 CEST	59254	443	192.168.2.22	142.250.185.78
Jul 1, 2022 16:22:05.184951067 CEST	443	59254	142.250.185.78	192.168.2.22
Jul 1, 2022 16:22:05.186472893 CEST	443	59254	142.250.185.78	192.168.2.22
Jul 1, 2022 16:22:05.186522007 CEST	443	59254	142.250.185.78	192.168.2.22
Jul 1, 2022 16:22:05.186552048 CEST	443	59254	142.250.185.78	192.168.2.22
Jul 1, 2022 16:22:05.187287092 CEST	59254	443	192.168.2.22	142.250.185.78
Jul 1, 2022 16:22:05.221755981 CEST	59254	443	192.168.2.22	142.250.185.78
Jul 1, 2022 16:22:05.566998005 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 16:22:05.568489075 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 16:22:05.568500042 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 16:22:06.321914911 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 16:22:06.321970940 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 16:22:06.321974039 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 16:22:21.271085024 CEST	62627	53	192.168.2.22	8.8.8.8
Jul 1, 2022 16:22:21.298602104 CEST	53	62627	8.8.8.8	192.168.2.22
Jul 1, 2022 16:22:21.948400021 CEST	51302	53	192.168.2.22	8.8.8.8
Jul 1, 2022 16:22:21.976463079 CEST	53	51302	8.8.8.8	192.168.2.22
Jul 1, 2022 16:22:23.196217060 CEST	58384	53	192.168.2.22	8.8.8.8
Jul 1, 2022 16:22:23.216845036 CEST	53	58384	8.8.8.8	192.168.2.22
Jul 1, 2022 16:22:23.244286060 CEST	54031	53	192.168.2.22	8.8.8.8
Jul 1, 2022 16:22:23.265218019 CEST	53	54031	8.8.8.8	192.168.2.22
Jul 1, 2022 16:22:23.290697098 CEST	57939	53	192.168.2.22	8.8.8.8
Jul 1, 2022 16:22:23.313370943 CEST	53	57939	8.8.8.8	192.168.2.22
Jul 1, 2022 16:22:27.099186897 CEST	57943	443	192.168.2.22	172.217.16.161
Jul 1, 2022 16:22:27.131270885 CEST	443	57943	172.217.16.161	192.168.2.22
Jul 1, 2022 16:22:27.245337009 CEST	57943	443	192.168.2.22	172.217.16.161
Jul 1, 2022 16:22:27.271354914 CEST	57943	443	192.168.2.22	172.217.16.161
Jul 1, 2022 16:22:27.277503014 CEST	443	57943	172.217.16.161	192.168.2.22
Jul 1, 2022 16:22:27.277533054 CEST	443	57943	172.217.16.161	192.168.2.22
Jul 1, 2022 16:22:27.277550936 CEST	443	57943	172.217.16.161	192.168.2.22
Jul 1, 2022 16:22:27.277570963 CEST	443	57943	172.217.16.161	192.168.2.22
Jul 1, 2022 16:22:27.351239920 CEST	57943	443	192.168.2.22	172.217.16.161
Jul 1, 2022 16:22:27.352368116 CEST	57943	443	192.168.2.22	172.217.16.161
Jul 1, 2022 16:22:27.464715958 CEST	57943	443	192.168.2.22	172.217.16.161
Jul 1, 2022 16:22:27.464943886 CEST	57943	443	192.168.2.22	172.217.16.161
Jul 1, 2022 16:22:27.508893013 CEST	443	57943	172.217.16.161	192.168.2.22
Jul 1, 2022 16:22:27.510418892 CEST	443	57943	172.217.16.161	192.168.2.22
Jul 1, 2022 16:22:27.510565042 CEST	443	57943	172.217.16.161	192.168.2.22
Jul 1, 2022 16:22:27.524852991 CEST	443	57943	172.217.16.161	192.168.2.22
Jul 1, 2022 16:22:27.524883032 CEST	443	57943	172.217.16.161	192.168.2.22
Jul 1, 2022 16:22:27.565773964 CEST	57943	443	192.168.2.22	172.217.16.161
Jul 1, 2022 16:22:27.565926075 CEST	57943	443	192.168.2.22	172.217.16.161
Jul 1, 2022 16:22:27.570782900 CEST	57943	443	192.168.2.22	172.217.16.161
Jul 1, 2022 16:22:27.615608931 CEST	443	57943	172.217.16.161	192.168.2.22
Jul 1, 2022 16:22:39.085002899 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 16:22:39.838624001 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 16:22:40.603260994 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 16:22:52.291241884 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 16:22:53.050411940 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 16:22:53.814914942 CEST	137	137	192.168.2.22	192.168.2.255
Jul 1, 2022 16:23:20.165044069 CEST	138	138	192.168.2.22	192.168.2.255

Timestamp	kBytes transferred	Direction	Data
2022-07-01 14:21:54 UTC	0	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=84.0.4147.135&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfm X-Goog-Update-Updater: chromecrx-84.0.4147.135 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-07-01 14:21:54 UTC	1	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-6aTlgnevi0cFEpeejijpHw' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 01 Jul 2022 14:21:54 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 5660 X-Daystart: 26514 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-07-01 14:21:54 UTC	2	IN	Data Raw: 33 31 61 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 35 36 36 30 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 32 36 35 31 34 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 31a<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="5660" elapsed_seconds="26514"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2022-07-01 14:21:54 UTC	3	IN	Data Raw: 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 2e 63 72 78 22 20 66 70 3d 22 31 2e 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 61 70 Data Ascii: mhkkegccagdldgiimedpiccmgmieda.crx" fp="1.81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app><ap
2022-07-01 14:21:54 UTC	3	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-07-01 14:21:54 UTC	0	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: CONSENT=WP.289365
2022-07-01 14:21:54 UTC	1	OUT	Data Raw: 20 Data Ascii:
2022-07-01 14:21:54 UTC	3	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 01 Jul 2022 14:21:54 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-7FwvDcYKY-69dfLChHqOMQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'nonce-7FwvDcYKY-69dfLChHqOMQ' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-07-01 14:21:54 UTC	5	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2022-07-01 14:21:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0