Edit tour

Windows Analysis Report
https://u27457241.ct.sendgrid.net/ls/click?upn=gU5vgDjVhsr8xBWi9KbyhCmRGj-2Bhghe49Z0FiLcWjrB3-2BHjpRZrJUn0d0SGBkXrx6oN6ZDJ2BS4RqE-2FwX06Vp6CNzr5fnG8rLhZtVfnefSs-3DAxs4_-2BYPg4XG7CFcrtVeqe-2FEiJSrJo19pXwJ6tXzH5pmmxxnbXO272-2BI29kN-2BvjWAIpglbQXOPOiRaJAAdguTnhglHj-2BjiZuY-2Bl2yPjdcSrK-2F9ezebjhFVSInUR

Overview

General Information

Sample URL:	https://u27457241.ct.sendgrid.net/ls/click?upn=gU5vgDjVhsr8xBWi9KbyhCmRGj-2Bhghe49Z0FiLcWjrB3-2BHjpRZrJUn0d0SGBkXrx6oN6ZDJ2BS4RqE-2FwX06Vp6CNzr5fnG8rLhZtVfnefSs-3DAxs4_-2BYPg4XG7CFcrtVeqe-2FEiJSrJo19p
Analysis ID:	655824
Infos:

Detection

HTMLPhisher

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected HtmlPhish10

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

Yara signature match

Invalid 'forgot password' link found

No HTML title found

HTML body contains low number of good links

Suspicious form URL found

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5592 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "https://u27457241.ct.sendgrid.net/ls/click?upn=gU5vgDjVhsr8xBWi9KbyhCmRGj-2Bhghe49Z0FiLcWjrB3-2BHjpRZrJUn0d0SGBkXrx6oN6ZDJ2BS4RqE-2FwX06Vp6CNzr5fnG8rLhZtVfnefSs-3DAxs4_-2BYPg4XG7CFcrtVeqe-2FEiJSrJo19pXwJ6tXzH5pmmxxnbXO272-2BI29kN-2BvjWAIpglbQXOPOiRaJAAdguTnhglHj-2BjiZuY-2Bl2yPjdcSrK-2F9ezebjhFVSInURAAh0NL7wSvgIxrQfzCizFzhR7FuzvZGAC9IXJiD5MvT-2BM-2Bord7nJExCKq3jFy6KjuvaLIUZjyvy957XsqnMttci2nlXO0KBQ-3D-3D MD5: C139654B5C1438A95B321BB01AD63EF6)

chrome.exe (PID: 1012 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1576,5871500396177420018,11391610541881566734,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1920 /prefetch:8 MD5: C139654B5C1438A95B321BB01AD63EF6)

cleanup

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	SUSP_Base64_Encoded_Hex_Encoded_Code	Detects hex encoded code that has been base64 encoded	Florian Roth	0xf8548:$x1: 78 34 4E 7A 42 63 65 44 5A 6A 58 48 67 0xf86ee:$x1: 78 34 4E 6D 56 63 65 44 59 33 58 48 67 0xf8a7a:$x1: 78 34 4E 7A 5A 63 65 44 59 78 58 48 67 0xf8a8a:$x1: 78 34 4E 6A 6C 63 65 44 59 30 58 48 67 0xf8a9a:$x1: 78 34 4E 6A 6C 63 65 44 5A 6C 58 48 67 0xf8ac2:$x1: 78 34 4E 6A 4A 63 65 44 63 31 58 48 67 0xf8ad2:$x1: 78 34 4E 6A 5A 63 65 44 59 31 58 48 67 0xf8b4e:$x1: 78 34 4E 6D 5A 63 65 44 63 30 58 48 67 0xf8b5e:$x1: 78 34 4E 7A 52 63 65 44 63 35 58 48 67 0xf952c:$x1: 78 34 4E 6D 4E 63 65 44 59 31 58 48 67 0xf953c:$x1: 78 34 4E 6A 64 63 65 44 63 30 58 48 67 0xf995a:$x1: 78 34 4E 6A 56 63 65 44 5A 6C 58 48 67 0xf9fdc:$x1: 78 34 4E 6D 5A 63 65 44 5A 6B 58 48 67 0xf9fec:$x1: 78 34 4E 7A 4A 63 65 44 59 31 58 48 67 0xf9ffc:$x1: 78 34 4E 7A 4E 63 65 44 59 35 58 48 67 0xfa00c:$x1: 78 34 4E 6D 56 63 65 44 55 30 58 48 67 0xfa150:$x1: 78 34 4E 7A 56 63 65 44 5A 6B 58 48 67 0xfc1b8:$x1: 78 34 4E 7A 56 63 65 44 63 30 58 48 67 0xfc1c8:$x1: 78 34 4E 7A 56 63 65 44 63 30 58 48 67 0xfc1d8:$x1: 78 34 4E 6D 56 63 65 44 59 30 58 48 67 0xfc330:$x1: 78 34 4E 6D 5A 63 65 44 63 30 58 48 67

HTML

Source	Rule	Description	Author	Strings
91064.0.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plain; charset=utf-8Content-Length: 1Connection: closeDate: Fri, 01 Jul 2022 17:36:53 GMTServer: envoystrict-transport-security: max-age=63072000; includeSubDomains; preloadx-content-type-options: nosniffX-Cache: Error from cloudfrontVia: 1.1 7e81b1a3e22ce96cdfb0b6c2db121d58.cloudfront.net (CloudFront)X-Amz-Cf-Pop: ZRH50-C1X-Amz-Cf-Id: h9tn3HOj7fld8iDX00ahC_BOUdqYI2s8nHwa8U40xRdqavDq4uM5oA==

Source: History Provider Cache.0.dr	String found in binary or memory: http://h6yak-jqaaa-aaaad-qcysq-cai.raw.ic0.app/l#jwilson
Source: 08013fc1-37e3-4029-818c-fa3cc5c62fe6.tmp.1.dr	String found in binary or memory: https://accounts.google.com
Source: craw_window.js.0.dr	String found in binary or memory: https://accounts.google.com/MergeSession
Source: 08013fc1-37e3-4029-818c-fa3cc5c62fe6.tmp.1.dr	String found in binary or memory: https://apis.google.com
Source: 08013fc1-37e3-4029-818c-fa3cc5c62fe6.tmp.1.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json.0.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 08013fc1-37e3-4029-818c-fa3cc5c62fe6.tmp.1.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: 9d60acc6-fb66-47d1-be28-c795a5970d58.tmp.1.dr, 08013fc1-37e3-4029-818c-fa3cc5c62fe6.tmp.1.dr	String found in binary or memory: https://dns.google
Source: 08013fc1-37e3-4029-818c-fa3cc5c62fe6.tmp.1.dr	String found in binary or memory: https://fonts.googleapis.com
Source: 08013fc1-37e3-4029-818c-fa3cc5c62fe6.tmp.1.dr	String found in binary or memory: https://fonts.gstatic.com
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p
Source: History Provider Cache.0.dr	String found in binary or memory: https://h6yak-jqaaa-aaaad-qcysq-cai.raw.ic0.app/l#jwilson
Source: History Provider Cache.0.dr	String found in binary or memory: https://h6yak-jqaaa-aaaad-qcysq-cai.raw.ic0.app/login.html?okb=o8MWQ8otfZuw6QsAaLjPPIoQ&rhwh=Pu55NB1
Source: 08013fc1-37e3-4029-818c-fa3cc5c62fe6.tmp.1.dr	String found in binary or memory: https://ogs.google.com
Source: craw_window.js.0.dr, manifest.json.0.dr	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: 08013fc1-37e3-4029-818c-fa3cc5c62fe6.tmp.1.dr	String found in binary or memory: https://play.google.com
Source: craw_window.js.0.dr, manifest.json.0.dr	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: 08013fc1-37e3-4029-818c-fa3cc5c62fe6.tmp.1.dr	String found in binary or memory: https://ssl.gstatic.com
Source: History Provider Cache.0.dr	String found in binary or memory: https://u27457241.ct.sendgrid.net/ls/click?upn=gU5vgDjVhsr8xBWi9KbyhCmRGj-2Bhghe49Z0FiLcWjrB3-2BHjpR
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://www-googleapis-staging.sandbox.google.com
Source: 08013fc1-37e3-4029-818c-fa3cc5c62fe6.tmp.1.dr	String found in binary or memory: https://www.google.com
Source: manifest.json.0.dr	String found in binary or memory: https://www.google.com/
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/accounts/OAuthLogin?issueuberauth=1
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/cleardot.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/dot2.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/x2.gif
Source: craw_background.js.0.dr	String found in binary or memory: https://www.google.com/intl/en-US/chrome/blank.html
Source: 08013fc1-37e3-4029-818c-fa3cc5c62fe6.tmp.1.dr, craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://www.googleapis.com
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: 08013fc1-37e3-4029-818c-fa3cc5c62fe6.tmp.1.dr	String found in binary or memory: https://www.gstatic.com

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: unknown

DNS traffic detected: queries for: clients2.google.com

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfmX-Goog-Update-Updater: chromecrx-85.0.4183.121Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ls/click?upn=gU5vgDjVhsr8xBWi9KbyhCmRGj-2Bhghe49Z0FiLcWjrB3-2BHjpRZrJUn0d0SGBkXrx6oN6ZDJ2BS4RqE-2FwX06Vp6CNzr5fnG8rLhZtVfnefSs-3DAxs4_-2BYPg4XG7CFcrtVeqe-2FEiJSrJo19pXwJ6tXzH5pmmxxnbXO272-2BI29kN-2BvjWAIpglbQXOPOiRaJAAdguTnhglHj-2BjiZuY-2Bl2yPjdcSrK-2F9ezebjhFVSInURAAh0NL7wSvgIxrQfzCizFzhR7FuzvZGAC9IXJiD5MvT-2BM-2Bord7nJExCKq3jFy6KjuvaLIUZjyvy957XsqnMttci2nlXO0KBQ-3D-3D HTTP/1.1Host: u27457241.ct.sendgrid.netConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /l HTTP/1.1Host: h6yak-jqaaa-aaaad-qcysq-cai.raw.ic0.appConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /login.html?okb=o8MWQ8otfZuw6QsAaLjPPIoQ&rhwh=Pu55NB1yr2jpvYRqSE&plpb=azaaxBfNMnkncPlD1dbKCjabbV&pepwe=NNmUbBHh57IDtuVbpJCTiLbygyk HTTP/1.1Host: h6yak-jqaaa-aaaad-qcysq-cai.raw.ic0.appConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://h6yak-jqaaa-aaaad-qcysq-cai.raw.ic0.app/lAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /css/hover.css HTTP/1.1Host: h6yak-jqaaa-aaaad-qcysq-cai.raw.ic0.appConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://h6yak-jqaaa-aaaad-qcysq-cai.raw.ic0.app/login.html?okb=o8MWQ8otfZuw6QsAaLjPPIoQ&rhwh=Pu55NB1yr2jpvYRqSE&plpb=azaaxBfNMnkncPlD1dbKCjabbV&pepwe=NNmUbBHh57IDtuVbpJCTiLbygykAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrap/4.0.0/js/bootstrap.min.js HTTP/1.1Host: maxcdn.bootstrapcdn.comConnection: keep-aliveOrigin: https://h6yak-jqaaa-aaaad-qcysq-cai.raw.ic0.appUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://h6yak-jqaaa-aaaad-qcysq-cai.raw.ic0.app/login.html?okb=o8MWQ8otfZuw6QsAaLjPPIoQ&rhwh=Pu55NB1yr2jpvYRqSE&plpb=azaaxBfNMnkncPlD1dbKCjabbV&pepwe=NNmUbBHh57IDtuVbpJCTiLbygykAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/popper.js/1.12.9/umd/popper.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveOrigin: https://h6yak-jqaaa-aaaad-qcysq-cai.raw.ic0.appUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://h6yak-jqaaa-aaaad-qcysq-cai.raw.ic0.app/login.html?okb=o8MWQ8otfZuw6QsAaLjPPIoQ&rhwh=Pu55NB1yr2jpvYRqSE&plpb=azaaxBfNMnkncPlD1dbKCjabbV&pepwe=NNmUbBHh57IDtuVbpJCTiLbygykAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrap/4.1.3/js/bootstrap.min.js HTTP/1.1Host: stackpath.bootstrapcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://h6yak-jqaaa-aaaad-qcysq-cai.raw.ic0.app/login.html?okb=o8MWQ8otfZuw6QsAaLjPPIoQ&rhwh=Pu55NB1yr2jpvYRqSE&plpb=azaaxBfNMnkncPlD1dbKCjabbV&pepwe=NNmUbBHh57IDtuVbpJCTiLbygykAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /glenergy.com HTTP/1.1Host: logo.clearbit.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://h6yak-jqaaa-aaaad-qcysq-cai.raw.ic0.app/login.html?okb=o8MWQ8otfZuw6QsAaLjPPIoQ&rhwh=Pu55NB1yr2jpvYRqSE&plpb=azaaxBfNMnkncPlD1dbKCjabbV&pepwe=NNmUbBHh57IDtuVbpJCTiLbygykAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s2/favicons?domain=dell.com?v=BUILD_HASH HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://h6yak-jqaaa-aaaad-qcysq-cai.raw.ic0.app/login.html?okb=o8MWQ8otfZuw6QsAaLjPPIoQ&rhwh=Pu55NB1yr2jpvYRqSE&plpb=azaaxBfNMnkncPlD1dbKCjabbV&pepwe=NNmUbBHh57IDtuVbpJCTiLbygykAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s2/favicons?domain=dell.com?v=BUILD_HASH HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: www.google.com
Source: global traffic	HTTP traffic detected: GET /l HTTP/1.1Host: h6yak-jqaaa-aaaad-qcysq-cai.raw.ic0.appConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: unknown

HTTPS traffic detected: 172.217.23.100:443 -> 192.168.2.3:49787 version: TLS 1.2

Source: sslproxydump.pcap, type: PCAP

Matched rule: SUSP_Base64_Encoded_Hex_Encoded_Code date = 2019-04-29, author = Florian Roth, description = Detects hex encoded code that has been base64 encoded, score = https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example/

Source: http://h6yak-jqaaa-aaaad-qcysq-cai.raw.ic0.app/l#jwilson	Avira URL Cloud: Label: phishing
Source: http://h6yak-jqaaa-aaaad-qcysq-cai.raw.ic0.app/l	Avira URL Cloud: Label: phishing
Source: https://h6yak-jqaaa-aaaad-qcysq-cai.raw.ic0.app/l	Avira URL Cloud: Label: phishing
Source: https://h6yak-jqaaa-aaaad-qcysq-cai.raw.ic0.app/login.html?okb=o8MWQ8otfZuw6QsAaLjPPIoQ&rhwh=Pu55NB1yr2jpvYRqSE&plpb=azaaxBfNMnkncPlD1dbKCjabbV&pepwe=NNmUbBHh57IDtuVbpJCTiLbygyk	Avira URL Cloud: Label: phishing
Source: https://h6yak-jqaaa-aaaad-qcysq-cai.raw.ic0.app/l#jwilson	Avira URL Cloud: Label: phishing
Source: https://h6yak-jqaaa-aaaad-qcysq-cai.raw.ic0.app/css/hover.css	Avira URL Cloud: Label: phishing
Source: https://h6yak-jqaaa-aaaad-qcysq-cai.raw.ic0.app/login.html?okb=o8MWQ8otfZuw6QsAaLjPPIoQ&rhwh=Pu55NB1	Avira URL Cloud: Label: phishing

Source: http://h6yak-jqaaa-aaaad-qcysq-cai.raw.ic0.app/l#jwilson	Virustotal: Detection: 11%	Perma Link
Source: http://h6yak-jqaaa-aaaad-qcysq-cai.raw.ic0.app/l	Virustotal: Detection: 11%	Perma Link
Source: https://h6yak-jqaaa-aaaad-qcysq-cai.raw.ic0.app/l	Virustotal: Detection: 16%	Perma Link

Source: https://h6yak-jqaaa-aaaad-qcysq-cai.raw.ic0.app/login.html?okb=o8MWQ8otfZuw6QsAaLjPPIoQ&rhwh=Pu55NB1yr2jpvYRqSE&plpb=azaaxBfNMnkncPlD1dbKCjabbV&pepwe=NNmUbBHh57IDtuVbpJCTiLbygyk#jwilson@glenergy.com	HTTP Parser: Invalid link: Forgot Password?
Source: https://h6yak-jqaaa-aaaad-qcysq-cai.raw.ic0.app/login.html?okb=o8MWQ8otfZuw6QsAaLjPPIoQ&rhwh=Pu55NB1yr2jpvYRqSE&plpb=azaaxBfNMnkncPlD1dbKCjabbV&pepwe=NNmUbBHh57IDtuVbpJCTiLbygyk#jwilson@glenergy.com	HTTP Parser: Invalid link: Forgot Password?

Source: https://h6yak-jqaaa-aaaad-qcysq-cai.raw.ic0.app/login.html?okb=o8MWQ8otfZuw6QsAaLjPPIoQ&rhwh=Pu55NB1yr2jpvYRqSE&plpb=azaaxBfNMnkncPlD1dbKCjabbV&pepwe=NNmUbBHh57IDtuVbpJCTiLbygyk#jwilson@glenergy.com	HTTP Parser: HTML title missing
Source: https://h6yak-jqaaa-aaaad-qcysq-cai.raw.ic0.app/login.html?okb=o8MWQ8otfZuw6QsAaLjPPIoQ&rhwh=Pu55NB1yr2jpvYRqSE&plpb=azaaxBfNMnkncPlD1dbKCjabbV&pepwe=NNmUbBHh57IDtuVbpJCTiLbygyk#jwilson@glenergy.com	HTTP Parser: HTML title missing

Source: https://h6yak-jqaaa-aaaad-qcysq-cai.raw.ic0.app/login.html?okb=o8MWQ8otfZuw6QsAaLjPPIoQ&rhwh=Pu55NB1yr2jpvYRqSE&plpb=azaaxBfNMnkncPlD1dbKCjabbV&pepwe=NNmUbBHh57IDtuVbpJCTiLbygyk#jwilson@glenergy.com	HTTP Parser: Number of links: 0
Source: https://h6yak-jqaaa-aaaad-qcysq-cai.raw.ic0.app/login.html?okb=o8MWQ8otfZuw6QsAaLjPPIoQ&rhwh=Pu55NB1yr2jpvYRqSE&plpb=azaaxBfNMnkncPlD1dbKCjabbV&pepwe=NNmUbBHh57IDtuVbpJCTiLbygyk#jwilson@glenergy.com	HTTP Parser: Number of links: 0

Source: https://h6yak-jqaaa-aaaad-qcysq-cai.raw.ic0.app/login.html?okb=o8MWQ8otfZuw6QsAaLjPPIoQ&rhwh=Pu55NB1yr2jpvYRqSE&plpb=azaaxBfNMnkncPlD1dbKCjabbV&pepwe=NNmUbBHh57IDtuVbpJCTiLbygyk#jwilson@glenergy.com	HTTP Parser: Form action: next.php
Source: https://h6yak-jqaaa-aaaad-qcysq-cai.raw.ic0.app/login.html?okb=o8MWQ8otfZuw6QsAaLjPPIoQ&rhwh=Pu55NB1yr2jpvYRqSE&plpb=azaaxBfNMnkncPlD1dbKCjabbV&pepwe=NNmUbBHh57IDtuVbpJCTiLbygyk#jwilson@glenergy.com	HTTP Parser: Form action: next.php

Source: https://h6yak-jqaaa-aaaad-qcysq-cai.raw.ic0.app/login.html?okb=o8MWQ8otfZuw6QsAaLjPPIoQ&rhwh=Pu55NB1yr2jpvYRqSE&plpb=azaaxBfNMnkncPlD1dbKCjabbV&pepwe=NNmUbBHh57IDtuVbpJCTiLbygyk#jwilson@glenergy.com	HTTP Parser: No <meta name="author".. found
Source: https://h6yak-jqaaa-aaaad-qcysq-cai.raw.ic0.app/login.html?okb=o8MWQ8otfZuw6QsAaLjPPIoQ&rhwh=Pu55NB1yr2jpvYRqSE&plpb=azaaxBfNMnkncPlD1dbKCjabbV&pepwe=NNmUbBHh57IDtuVbpJCTiLbygyk#jwilson@glenergy.com	HTTP Parser: No <meta name="author".. found

Source: https://h6yak-jqaaa-aaaad-qcysq-cai.raw.ic0.app/login.html?okb=o8MWQ8otfZuw6QsAaLjPPIoQ&rhwh=Pu55NB1yr2jpvYRqSE&plpb=azaaxBfNMnkncPlD1dbKCjabbV&pepwe=NNmUbBHh57IDtuVbpJCTiLbygyk#jwilson@glenergy.com	HTTP Parser: No <meta name="copyright".. found
Source: https://h6yak-jqaaa-aaaad-qcysq-cai.raw.ic0.app/login.html?okb=o8MWQ8otfZuw6QsAaLjPPIoQ&rhwh=Pu55NB1yr2jpvYRqSE&plpb=azaaxBfNMnkncPlD1dbKCjabbV&pepwe=NNmUbBHh57IDtuVbpJCTiLbygyk#jwilson@glenergy.com	HTTP Parser: No <meta name="copyright".. found

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic			Jump to behavior

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	3 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	4 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	5 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	3 Ingress Tool Transfer	SIM Card Swap		Carrier Billing Fraud

Name	IP	Active	Malicious	Reputation
u27457241.ct.sendgrid.net	167.89.115.54	true	false	high
stackpath.bootstrapcdn.com	104.18.10.207	true	false	high
gstaticadssl.l.google.com	172.217.16.131	true	false	high
d26p066pn2w0s0.cloudfront.net	13.224.103.120	true	false	high
accounts.google.com	172.217.16.205	true	false	high
cdnjs.cloudflare.com	104.17.24.14	true	false	high
maxcdn.bootstrapcdn.com	104.18.10.207	true	false	high
boundary.dfinity.network	145.40.97.98	true	false	unknown
www.google.com	172.217.23.100	true	false	high
clients.l.google.com	142.250.185.142	true	false	high
clients2.google.com	unknown	unknown	false	high
ka-f.fontawesome.com	unknown	unknown	false	high
code.jquery.com	unknown	unknown	false	high
h6yak-jqaaa-aaaad-qcysq-cai.raw.ic0.app	unknown	unknown	false	unknown
kit.fontawesome.com	unknown	unknown	false	high
logo.clearbit.com	unknown	unknown	false	high

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "https://u27457241.ct.sendgrid.net/ls/click?upn=gU5vgDjVhsr8xBWi9KbyhCmRGj-2Bhghe49Z0FiLcWjrB3-2BHjpRZrJUn0d0SGBkXrx6oN6ZDJ2BS4RqE-2FwX06Vp6CNzr5fnG8rLhZtVfnefSs-3DAxs4_-2BYPg4XG7CFcrtVeqe-2FEiJSrJo19pXwJ6tXzH5pmmxxnbXO272-2BI29kN-2BvjWAIpglbQXOPOiRaJAAdguTnhglHj-2BjiZuY-2Bl2yPjdcSrK-2F9ezebjhFVSInURAAh0NL7wSvgIxrQfzCizFzhR7FuzvZGAC9IXJiD5MvT-2BM-2Bord7nJExCKq3jFy6KjuvaLIUZjyvy957XsqnMttci2nlXO0KBQ-3D-3D
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1576,5871500396177420018,11391610541881566734,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1920 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1576,5871500396177420018,11391610541881566734,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1920 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source	Detection	Scanner	Label	Link
http://h6yak-jqaaa-aaaad-qcysq-cai.raw.ic0.app/l#jwilson	11%	Virustotal		Browse
http://h6yak-jqaaa-aaaad-qcysq-cai.raw.ic0.app/l#jwilson	100%	Avira URL Cloud	phishing
https://dns.google	0%	URL Reputation	safe
http://h6yak-jqaaa-aaaad-qcysq-cai.raw.ic0.app/l	11%	Virustotal		Browse
http://h6yak-jqaaa-aaaad-qcysq-cai.raw.ic0.app/l	100%	Avira URL Cloud	phishing
https://h6yak-jqaaa-aaaad-qcysq-cai.raw.ic0.app/l	16%	Virustotal		Browse
https://h6yak-jqaaa-aaaad-qcysq-cai.raw.ic0.app/l	100%	Avira URL Cloud	phishing
https://h6yak-jqaaa-aaaad-qcysq-cai.raw.ic0.app/login.html?okb=o8MWQ8otfZuw6QsAaLjPPIoQ&rhwh=Pu55NB1yr2jpvYRqSE&plpb=azaaxBfNMnkncPlD1dbKCjabbV&pepwe=NNmUbBHh57IDtuVbpJCTiLbygyk	100%	Avira URL Cloud	phishing
https://h6yak-jqaaa-aaaad-qcysq-cai.raw.ic0.app/l#jwilson	100%	Avira URL Cloud	phishing
https://h6yak-jqaaa-aaaad-qcysq-cai.raw.ic0.app/css/hover.css	100%	Avira URL Cloud	phishing
https://h6yak-jqaaa-aaaad-qcysq-cai.raw.ic0.app/login.html?okb=o8MWQ8otfZuw6QsAaLjPPIoQ&rhwh=Pu55NB1	100%	Avira URL Cloud	phishing

Name	Malicious	Antivirus Detection	Reputation
http://h6yak-jqaaa-aaaad-qcysq-cai.raw.ic0.app/l	true	11%, Virustotal, Browse Avira URL Cloud: phishing	unknown
https://h6yak-jqaaa-aaaad-qcysq-cai.raw.ic0.app/l	true	16%, Virustotal, Browse Avira URL Cloud: phishing	unknown
https://h6yak-jqaaa-aaaad-qcysq-cai.raw.ic0.app/login.html?okb=o8MWQ8otfZuw6QsAaLjPPIoQ&rhwh=Pu55NB1yr2jpvYRqSE&plpb=azaaxBfNMnkncPlD1dbKCjabbV&pepwe=NNmUbBHh57IDtuVbpJCTiLbygyk	true	Avira URL Cloud: phishing	unknown
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1	false		high
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false		high
https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js	false		high
https://u27457241.ct.sendgrid.net/ls/click?upn=gU5vgDjVhsr8xBWi9KbyhCmRGj-2Bhghe49Z0FiLcWjrB3-2BHjpRZrJUn0d0SGBkXrx6oN6ZDJ2BS4RqE-2FwX06Vp6CNzr5fnG8rLhZtVfnefSs-3DAxs4_-2BYPg4XG7CFcrtVeqe-2FEiJSrJo19pXwJ6tXzH5pmmxxnbXO272-2BI29kN-2BvjWAIpglbQXOPOiRaJAAdguTnhglHj-2BjiZuY-2Bl2yPjdcSrK-2F9ezebjhFVSInURAAh0NL7wSvgIxrQfzCizFzhR7FuzvZGAC9IXJiD5MvT-2BM-2Bord7nJExCKq3jFy6KjuvaLIUZjyvy957XsqnMttci2nlXO0KBQ-3D-3D	false		high
https://h6yak-jqaaa-aaaad-qcysq-cai.raw.ic0.app/css/hover.css	true	Avira URL Cloud: phishing	unknown
https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js	false		high
https://www.google.com/s2/favicons?domain=dell.com?v=BUILD_HASH	false		high
https://logo.clearbit.com/glenergy.com	false		high
https://h6yak-jqaaa-aaaad-qcysq-cai.raw.ic0.app/login.html?okb=o8MWQ8otfZuw6QsAaLjPPIoQ&rhwh=Pu55NB1yr2jpvYRqSE&plpb=azaaxBfNMnkncPlD1dbKCjabbV&pepwe=NNmUbBHh57IDtuVbpJCTiLbygyk#jwilson@glenergy.com	true		unknown
https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js	false		high

Name	Source	Malicious	Antivirus Detection	Reputation
http://h6yak-jqaaa-aaaad-qcysq-cai.raw.ic0.app/l#jwilson	History Provider Cache.0.dr	true	11%, Virustotal, Browse Avira URL Cloud: phishing	unknown
https://dns.google	9d60acc6-fb66-47d1-be28-c795a5970d58.tmp.1.dr, 08013fc1-37e3-4029-818c-fa3cc5c62fe6.tmp.1.dr	false	URL Reputation: safe	unknown
https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p	craw_window.js.0.dr, craw_background.js.0.dr	false		high
https://www.google.com/intl/en-US/chrome/blank.html	craw_background.js.0.dr	false		high
https://ogs.google.com	08013fc1-37e3-4029-818c-fa3cc5c62fe6.tmp.1.dr	false		high
https://www.google.com/images/cleardot.gif	craw_window.js.0.dr	false		high
https://play.google.com	08013fc1-37e3-4029-818c-fa3cc5c62fe6.tmp.1.dr	false		high
https://payments.google.com/payments/v4/js/integrator.js	craw_window.js.0.dr, manifest.json.0.dr	false		high
https://h6yak-jqaaa-aaaad-qcysq-cai.raw.ic0.app/l#jwilson	History Provider Cache.0.dr	true	Avira URL Cloud: phishing	unknown
https://sandbox.google.com/payments/v4/js/integrator.js	craw_window.js.0.dr, manifest.json.0.dr	false		high
https://www.google.com/images/x2.gif	craw_window.js.0.dr	false		high
https://accounts.google.com/MergeSession	craw_window.js.0.dr	false		high
https://u27457241.ct.sendgrid.net/ls/click?upn=gU5vgDjVhsr8xBWi9KbyhCmRGj-2Bhghe49Z0FiLcWjrB3-2BHjpR	History Provider Cache.0.dr	false		high
https://www.google.com	08013fc1-37e3-4029-818c-fa3cc5c62fe6.tmp.1.dr	false		high
https://www.google.com/images/dot2.gif	craw_window.js.0.dr	false		high
https://accounts.google.com	08013fc1-37e3-4029-818c-fa3cc5c62fe6.tmp.1.dr	false		high
https://clients2.googleusercontent.com	08013fc1-37e3-4029-818c-fa3cc5c62fe6.tmp.1.dr	false		high
https://apis.google.com	08013fc1-37e3-4029-818c-fa3cc5c62fe6.tmp.1.dr	false		high
https://h6yak-jqaaa-aaaad-qcysq-cai.raw.ic0.app/login.html?okb=o8MWQ8otfZuw6QsAaLjPPIoQ&rhwh=Pu55NB1	History Provider Cache.0.dr	true	Avira URL Cloud: phishing	unknown
https://www.google.com/accounts/OAuthLogin?issueuberauth=1	craw_window.js.0.dr	false		high
https://www.google.com/	manifest.json.0.dr	false		high
https://www-googleapis-staging.sandbox.google.com	craw_window.js.0.dr, craw_background.js.0.dr	false		high
https://clients2.google.com	08013fc1-37e3-4029-818c-fa3cc5c62fe6.tmp.1.dr	false		high
https://clients2.google.com/service/update2/crx	manifest.json.0.dr	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
145.40.97.98	boundary.dfinity.network	Netherlands	34108	BREEDBANDDELFTNL	false
104.17.24.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
104.18.10.207	stackpath.bootstrapcdn.com	United States	13335	CLOUDFLARENETUS	false
172.217.16.205	accounts.google.com	United States	15169	GOOGLEUS	false
167.89.115.54	u27457241.ct.sendgrid.net	United States	11377	SENDGRIDUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.185.142	clients.l.google.com	United States	15169	GOOGLEUS	false
172.217.23.100	www.google.com	United States	15169	GOOGLEUS	false
13.224.103.120	d26p066pn2w0s0.cloudfront.net	United States	16509	AMAZON-02US	false
172.217.16.131	gstaticadssl.l.google.com	United States	15169	GOOGLEUS	false

Joe Sandbox Version:	35.0.0 Citrine
Analysis ID:	655824
Start date and time: 01/07/202219:35:41	2022-07-01 19:35:41 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 3m 18s
Hypervisor based Inspection enabled:	false
Report type:	light
Cookbook file name:	browseurl.jbs
Sample URL:	https://u27457241.ct.sendgrid.net/ls/click?upn=gU5vgDjVhsr8xBWi9KbyhCmRGj-2Bhghe49Z0FiLcWjrB3-2BHjpRZrJUn0d0SGBkXrx6oN6ZDJ2BS4RqE-2FwX06Vp6CNzr5fnG8rLhZtVfnefSs-3DAxs4_-2BYPg4XG7CFcrtVeqe-2FEiJSrJo19pXwJ6tXzH5pmmxxnbXO272-2BI29kN-2BvjWAIpglbQXOPOiRaJAAdguTnhglHj-2BjiZuY-2Bl2yPjdcSrK-2F9ezebjhFVSInURAAh0NL7wSvgIxrQfzCizFzhR7FuzvZGAC9IXJiD5MvT-2BM-2Bord7nJExCKq3jFy6KjuvaLIUZjyvy957XsqnMttci2nlXO0KBQ-3D-3D
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal64.phis.win@24/86@13/12
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	451603
Entropy (8bit):	5.009711072558331
Encrypted:	false
SSDEEP:	12288:ZHfRTyGZ6lup8Cfrvq4JBPKh+FBlESBw4p6:NfOCzvRKhGvwJ
MD5:	A78AD14E77147E7DE3647E61964C0335
SHA1:	CECC3DD41F4CEA0192B24300C71E1911BD4FCE45
SHA-256:	0D6803758FF8F87081FAFD62E90F0950DFB2DD7991E9607FE76A8F92D0E893FA
SHA-512:	DDE24D5AD50D68FC91E9E325D31E66EF8F624B6BB3A07D14FFED1104D3AB5F4EF1D7969A5CDE0DFBB19CB31C506F7DE97AF67C2F244F7E7E8E10648EA8321101
Malicious:	false
Reputation:	low
Preview:	BDic.... ....6...."..Z..4g....6.2...{/...3...5....AF 1363.AF nm.AF pt.AF n1.AF p.AF tc.AF SM.AF M.AF S.AF MS.AF MNR.AF GDS.AF MNT.AF MH.AF MR.AF SZMR.AF MJ.AF MT.AF MY.AF MRZ.AF MN.AF MG.AF RM.AF N.AF MV.AF XM.AF DSM.AF SD.AF G.AF R.AF MNX.AF MRS.AF MD.AF MNRB.AF B.AF ZSMR.AF PM.AF SMNGJ.AF SMN.AF ZMR.AF SMGB.AF MZR.AF GM.AF SMR.AF SMDG.AF RMZ.AF ZM.AF MDG.AF MDT.AF SMNXT.AF SDY.AF LSDG.AF LGDS.AF GLDS.AF UY.AF U.AF DSGNX.AF GNDSX.AF DSG.AF Y.AF GS.AF IEMS.AF YP.AF ZGDRS.AF XGNVDS.AF UT.AF GNDS.AF GVDS.AF MYPS.AF XGNDS.AF TPRY.AF MDSG.AF ZGSDR.AF DYSG.AF PMYTNS.AF AGDS.AF DRZGS.AF PY.AF GSPMDY.AF EGVDS.AF SL.AF GNXDS.AF DSBG.AF IM.AF I.AF MDGS.AF SMY.AF DSGN.AF DSLG.AF GMDS.AF MDSBG.AF SGD.AF IY.AF P.AF DSMG.AF BLZGDRS.AF TR.AF AGSD.AF ZGBDRSL.AF PTRY.AF ASDGV.AF ASM.AF ICANGSD.AF ICAM.AF IKY.AF AMS.AF PMYTRS.AF BZGVDRS.AF SDRBZG.AF GVMDS.AF PSM.AF DGLS.AF GNVXDS.AF AGDSL.AF DGS.AF XDSGNV.AF BZGDRS.AF AM.AF AS.AF A.AF LDSG.AF AGVDS.AF SDG.AF LDSMG.AF EDSMG.AF EY.AF DRSMZG.AF PRYT.AF LZ

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 1, 2022 19:36:47.213449001 CEST	49717	443	192.168.2.3	142.250.185.142
Jul 1, 2022 19:36:47.213505030 CEST	443	49717	142.250.185.142	192.168.2.3
Jul 1, 2022 19:36:47.213661909 CEST	49717	443	192.168.2.3	142.250.185.142
Jul 1, 2022 19:36:47.214323044 CEST	49719	443	192.168.2.3	167.89.115.54
Jul 1, 2022 19:36:47.214379072 CEST	443	49719	167.89.115.54	192.168.2.3
Jul 1, 2022 19:36:47.214459896 CEST	49719	443	192.168.2.3	167.89.115.54
Jul 1, 2022 19:36:47.215358973 CEST	49717	443	192.168.2.3	142.250.185.142
Jul 1, 2022 19:36:47.215409040 CEST	443	49717	142.250.185.142	192.168.2.3
Jul 1, 2022 19:36:47.216022968 CEST	49720	443	192.168.2.3	167.89.115.54
Jul 1, 2022 19:36:47.216063023 CEST	443	49720	167.89.115.54	192.168.2.3
Jul 1, 2022 19:36:47.216146946 CEST	49720	443	192.168.2.3	167.89.115.54
Jul 1, 2022 19:36:47.216300964 CEST	49719	443	192.168.2.3	167.89.115.54
Jul 1, 2022 19:36:47.216335058 CEST	443	49719	167.89.115.54	192.168.2.3
Jul 1, 2022 19:36:47.216598034 CEST	49720	443	192.168.2.3	167.89.115.54
Jul 1, 2022 19:36:47.216633081 CEST	443	49720	167.89.115.54	192.168.2.3
Jul 1, 2022 19:36:47.225791931 CEST	49721	443	192.168.2.3	172.217.16.205
Jul 1, 2022 19:36:47.225831032 CEST	443	49721	172.217.16.205	192.168.2.3
Jul 1, 2022 19:36:47.225918055 CEST	49721	443	192.168.2.3	172.217.16.205
Jul 1, 2022 19:36:47.226116896 CEST	49721	443	192.168.2.3	172.217.16.205
Jul 1, 2022 19:36:47.226140022 CEST	443	49721	172.217.16.205	192.168.2.3
Jul 1, 2022 19:36:47.276688099 CEST	443	49717	142.250.185.142	192.168.2.3
Jul 1, 2022 19:36:47.284410000 CEST	443	49721	172.217.16.205	192.168.2.3
Jul 1, 2022 19:36:47.291645050 CEST	49717	443	192.168.2.3	142.250.185.142
Jul 1, 2022 19:36:47.291704893 CEST	443	49717	142.250.185.142	192.168.2.3
Jul 1, 2022 19:36:47.291908026 CEST	49721	443	192.168.2.3	172.217.16.205
Jul 1, 2022 19:36:47.291950941 CEST	443	49721	172.217.16.205	192.168.2.3
Jul 1, 2022 19:36:47.292273045 CEST	443	49717	142.250.185.142	192.168.2.3
Jul 1, 2022 19:36:47.292365074 CEST	49717	443	192.168.2.3	142.250.185.142
Jul 1, 2022 19:36:47.293026924 CEST	443	49721	172.217.16.205	192.168.2.3
Jul 1, 2022 19:36:47.293127060 CEST	49721	443	192.168.2.3	172.217.16.205
Jul 1, 2022 19:36:47.293392897 CEST	443	49717	142.250.185.142	192.168.2.3
Jul 1, 2022 19:36:47.293478966 CEST	49717	443	192.168.2.3	142.250.185.142
Jul 1, 2022 19:36:47.493400097 CEST	49721	443	192.168.2.3	172.217.16.205
Jul 1, 2022 19:36:47.493614912 CEST	49717	443	192.168.2.3	142.250.185.142
Jul 1, 2022 19:36:47.493760109 CEST	443	49721	172.217.16.205	192.168.2.3
Jul 1, 2022 19:36:47.493933916 CEST	443	49717	142.250.185.142	192.168.2.3
Jul 1, 2022 19:36:47.493988991 CEST	49721	443	192.168.2.3	172.217.16.205
Jul 1, 2022 19:36:47.494035959 CEST	443	49721	172.217.16.205	192.168.2.3
Jul 1, 2022 19:36:47.494091988 CEST	49717	443	192.168.2.3	142.250.185.142
Jul 1, 2022 19:36:47.494118929 CEST	443	49717	142.250.185.142	192.168.2.3
Jul 1, 2022 19:36:47.524743080 CEST	443	49717	142.250.185.142	192.168.2.3
Jul 1, 2022 19:36:47.524849892 CEST	49717	443	192.168.2.3	142.250.185.142
Jul 1, 2022 19:36:47.524889946 CEST	443	49717	142.250.185.142	192.168.2.3
Jul 1, 2022 19:36:47.524945974 CEST	443	49717	142.250.185.142	192.168.2.3
Jul 1, 2022 19:36:47.525027037 CEST	49717	443	192.168.2.3	142.250.185.142
Jul 1, 2022 19:36:47.527450085 CEST	49717	443	192.168.2.3	142.250.185.142
Jul 1, 2022 19:36:47.527472973 CEST	443	49717	142.250.185.142	192.168.2.3
Jul 1, 2022 19:36:47.538497925 CEST	49721	443	192.168.2.3	172.217.16.205
Jul 1, 2022 19:36:47.546916008 CEST	443	49721	172.217.16.205	192.168.2.3
Jul 1, 2022 19:36:47.547121048 CEST	443	49721	172.217.16.205	192.168.2.3
Jul 1, 2022 19:36:47.547218084 CEST	49721	443	192.168.2.3	172.217.16.205
Jul 1, 2022 19:36:47.548535109 CEST	49721	443	192.168.2.3	172.217.16.205
Jul 1, 2022 19:36:47.548563004 CEST	443	49721	172.217.16.205	192.168.2.3
Jul 1, 2022 19:36:47.555594921 CEST	443	49720	167.89.115.54	192.168.2.3
Jul 1, 2022 19:36:47.555910110 CEST	49720	443	192.168.2.3	167.89.115.54
Jul 1, 2022 19:36:47.555948019 CEST	443	49720	167.89.115.54	192.168.2.3
Jul 1, 2022 19:36:47.557507038 CEST	443	49720	167.89.115.54	192.168.2.3
Jul 1, 2022 19:36:47.557611942 CEST	49720	443	192.168.2.3	167.89.115.54
Jul 1, 2022 19:36:47.559253931 CEST	49720	443	192.168.2.3	167.89.115.54
Jul 1, 2022 19:36:47.559365988 CEST	443	49720	167.89.115.54	192.168.2.3
Jul 1, 2022 19:36:47.559638023 CEST	49720	443	192.168.2.3	167.89.115.54
Jul 1, 2022 19:36:47.559664965 CEST	443	49720	167.89.115.54	192.168.2.3
Jul 1, 2022 19:36:47.600522041 CEST	49720	443	192.168.2.3	167.89.115.54
Jul 1, 2022 19:36:47.638500929 CEST	443	49719	167.89.115.54	192.168.2.3
Jul 1, 2022 19:36:47.638849974 CEST	49719	443	192.168.2.3	167.89.115.54
Jul 1, 2022 19:36:47.638896942 CEST	443	49719	167.89.115.54	192.168.2.3
Jul 1, 2022 19:36:47.641653061 CEST	443	49719	167.89.115.54	192.168.2.3
Jul 1, 2022 19:36:47.641772985 CEST	49719	443	192.168.2.3	167.89.115.54
Jul 1, 2022 19:36:47.642267942 CEST	49719	443	192.168.2.3	167.89.115.54
Jul 1, 2022 19:36:47.642433882 CEST	443	49719	167.89.115.54	192.168.2.3
Jul 1, 2022 19:36:47.667783022 CEST	443	49720	167.89.115.54	192.168.2.3
Jul 1, 2022 19:36:47.667913914 CEST	443	49720	167.89.115.54	192.168.2.3
Jul 1, 2022 19:36:47.667999029 CEST	49720	443	192.168.2.3	167.89.115.54
Jul 1, 2022 19:36:47.670984030 CEST	49720	443	192.168.2.3	167.89.115.54
Jul 1, 2022 19:36:47.671006918 CEST	443	49720	167.89.115.54	192.168.2.3
Jul 1, 2022 19:36:47.671019077 CEST	49720	443	192.168.2.3	167.89.115.54
Jul 1, 2022 19:36:47.671072960 CEST	49720	443	192.168.2.3	167.89.115.54
Jul 1, 2022 19:36:47.684509039 CEST	49719	443	192.168.2.3	167.89.115.54
Jul 1, 2022 19:36:47.684551954 CEST	443	49719	167.89.115.54	192.168.2.3
Jul 1, 2022 19:36:47.714970112 CEST	49729	80	192.168.2.3	145.40.97.98
Jul 1, 2022 19:36:47.724504948 CEST	49719	443	192.168.2.3	167.89.115.54
Jul 1, 2022 19:36:47.741218090 CEST	80	49729	145.40.97.98	192.168.2.3
Jul 1, 2022 19:36:47.741307020 CEST	49729	80	192.168.2.3	145.40.97.98
Jul 1, 2022 19:36:47.742677927 CEST	49729	80	192.168.2.3	145.40.97.98
Jul 1, 2022 19:36:47.768801928 CEST	80	49729	145.40.97.98	192.168.2.3
Jul 1, 2022 19:36:47.768855095 CEST	80	49729	145.40.97.98	192.168.2.3
Jul 1, 2022 19:36:47.772783995 CEST	49730	443	192.168.2.3	145.40.97.98
Jul 1, 2022 19:36:47.772823095 CEST	443	49730	145.40.97.98	192.168.2.3
Jul 1, 2022 19:36:47.772906065 CEST	49730	443	192.168.2.3	145.40.97.98
Jul 1, 2022 19:36:47.773113012 CEST	49730	443	192.168.2.3	145.40.97.98
Jul 1, 2022 19:36:47.773128033 CEST	443	49730	145.40.97.98	192.168.2.3
Jul 1, 2022 19:36:47.838536978 CEST	49729	80	192.168.2.3	145.40.97.98
Jul 1, 2022 19:36:47.874027967 CEST	443	49730	145.40.97.98	192.168.2.3
Jul 1, 2022 19:36:47.887300014 CEST	49730	443	192.168.2.3	145.40.97.98
Jul 1, 2022 19:36:47.887367010 CEST	443	49730	145.40.97.98	192.168.2.3
Jul 1, 2022 19:36:47.888921976 CEST	443	49730	145.40.97.98	192.168.2.3
Jul 1, 2022 19:36:47.889103889 CEST	49730	443	192.168.2.3	145.40.97.98
Jul 1, 2022 19:36:47.896389961 CEST	49730	443	192.168.2.3	145.40.97.98
Jul 1, 2022 19:36:47.896706104 CEST	443	49730	145.40.97.98	192.168.2.3
Jul 1, 2022 19:36:47.897461891 CEST	49730	443	192.168.2.3	145.40.97.98

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 1, 2022 19:36:47.176666975 CEST	58116	53	192.168.2.3	8.8.8.8
Jul 1, 2022 19:36:47.192575932 CEST	65358	53	192.168.2.3	8.8.8.8
Jul 1, 2022 19:36:47.196717024 CEST	49873	53	192.168.2.3	8.8.8.8
Jul 1, 2022 19:36:47.203021049 CEST	53	58116	8.8.8.8	192.168.2.3
Jul 1, 2022 19:36:47.212493896 CEST	53	65358	8.8.8.8	192.168.2.3
Jul 1, 2022 19:36:47.224339962 CEST	53	49873	8.8.8.8	192.168.2.3
Jul 1, 2022 19:36:47.683639050 CEST	63548	53	192.168.2.3	8.8.8.8
Jul 1, 2022 19:36:47.712694883 CEST	53	63548	8.8.8.8	192.168.2.3
Jul 1, 2022 19:36:49.917135954 CEST	49329	443	192.168.2.3	142.250.185.142
Jul 1, 2022 19:36:49.943701982 CEST	443	49329	142.250.185.142	192.168.2.3
Jul 1, 2022 19:36:50.170734882 CEST	49329	443	192.168.2.3	142.250.185.142
Jul 1, 2022 19:36:50.197693110 CEST	443	49329	142.250.185.142	192.168.2.3
Jul 1, 2022 19:36:50.197778940 CEST	443	49329	142.250.185.142	192.168.2.3
Jul 1, 2022 19:36:50.197830915 CEST	443	49329	142.250.185.142	192.168.2.3
Jul 1, 2022 19:36:50.197880983 CEST	443	49329	142.250.185.142	192.168.2.3
Jul 1, 2022 19:36:50.246514082 CEST	49329	443	192.168.2.3	142.250.185.142
Jul 1, 2022 19:36:50.249963999 CEST	49329	443	192.168.2.3	142.250.185.142
Jul 1, 2022 19:36:50.274307966 CEST	49329	443	192.168.2.3	142.250.185.142
Jul 1, 2022 19:36:50.274683952 CEST	49329	443	192.168.2.3	142.250.185.142
Jul 1, 2022 19:36:50.307795048 CEST	443	49329	142.250.185.142	192.168.2.3
Jul 1, 2022 19:36:50.308310032 CEST	49329	443	192.168.2.3	142.250.185.142
Jul 1, 2022 19:36:50.319575071 CEST	443	49329	142.250.185.142	192.168.2.3
Jul 1, 2022 19:36:50.319613934 CEST	443	49329	142.250.185.142	192.168.2.3
Jul 1, 2022 19:36:50.320630074 CEST	49329	443	192.168.2.3	142.250.185.142
Jul 1, 2022 19:36:50.358232975 CEST	58981	53	192.168.2.3	8.8.8.8
Jul 1, 2022 19:36:50.358510971 CEST	61380	53	192.168.2.3	8.8.8.8
Jul 1, 2022 19:36:50.358671904 CEST	63146	53	192.168.2.3	8.8.8.8
Jul 1, 2022 19:36:50.358814001 CEST	52985	53	192.168.2.3	8.8.8.8
Jul 1, 2022 19:36:50.380568981 CEST	53	63146	8.8.8.8	192.168.2.3
Jul 1, 2022 19:36:50.380671024 CEST	53	52985	8.8.8.8	192.168.2.3
Jul 1, 2022 19:36:50.381628036 CEST	58625	53	192.168.2.3	8.8.8.8
Jul 1, 2022 19:36:50.404050112 CEST	53	58625	8.8.8.8	192.168.2.3
Jul 1, 2022 19:36:50.758922100 CEST	50778	53	192.168.2.3	8.8.8.8
Jul 1, 2022 19:36:52.843076944 CEST	64816	53	192.168.2.3	8.8.8.8
Jul 1, 2022 19:36:52.885008097 CEST	53	64816	8.8.8.8	192.168.2.3
Jul 1, 2022 19:36:53.251976967 CEST	53816	53	192.168.2.3	8.8.8.8
Jul 1, 2022 19:36:53.271858931 CEST	53	53816	8.8.8.8	192.168.2.3
Jul 1, 2022 19:36:53.807864904 CEST	60640	53	192.168.2.3	8.8.8.8
Jul 1, 2022 19:36:53.827784061 CEST	53	60640	8.8.8.8	192.168.2.3
Jul 1, 2022 19:37:05.342541933 CEST	49329	443	192.168.2.3	142.250.185.142
Jul 1, 2022 19:37:05.386953115 CEST	443	49329	142.250.185.142	192.168.2.3

Timestamp	kBytes transferred	Direction	Data
Jul 1, 2022 19:36:47.742677927 CEST	646	OUT	GET /l HTTP/1.1 Host: h6yak-jqaaa-aaaad-qcysq-cai.raw.ic0.app Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jul 1, 2022 19:36:47.768855095 CEST	943	IN	HTTP/1.1 301 Moved Permanently Server: nginx/1.21.3 Date: Fri, 01 Jul 2022 17:36:47 GMT Content-Type: text/html Content-Length: 169 Connection: keep-alive Location: https://h6yak-jqaaa-aaaad-qcysq-cai.raw.ic0.app/l Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 31 2e 33 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx/1.21.3</center></body></html>

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

HTML

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic

C:\Users\user\AppData\Local\Google\Chrome\User Data\35d993f3-3535-46f4-a92b-c21b003497f7.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\08013fc1-37e3-4029-818c-fa3cc5c62fe6.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\184b41a6-afc8-484e-a19a-e1cc295332cf.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\60e85aac-3225-4c81-a66c-c8d56f9b66e0.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\61c5e631-3a9f-4a3a-b1d7-ef931f88b611.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\6bbafcc4-c63c-4c9f-bd44-a74afef1074b.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata\computed_hashes.json

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\000003.log

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG.old (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Provider Cache

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network Persistent State (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Preferences (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\9d60acc6-fb66-47d1-be28-c795a5970d58.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\GPUCache\data_1

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Network Persistent State (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000004.dbtmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\CURRENT (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Last Browser

C:\Users\user\AppData\Local\Google\Chrome\User Data\Last Version

C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Module Info Cache (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\b870082c-126a-43f3-bb6a-3a9096fbf1cc.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\d315f094-ef97-4a38-9412-dc04e5a72028.tmp

Timestamp	kBytes transferred	Direction	Data
2022-07-01 17:36:47 UTC	0	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-07-01 17:36:47 UTC	0	OUT	Data Raw: 20 Data Ascii:
2022-07-01 17:36:47 UTC	2	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 01 Jul 2022 17:36:47 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-eFgZ9H7TwAikekjvaZJ7PQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'nonce-eFgZ9H7TwAikekjvaZJ7PQ' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-07-01 17:36:47 UTC	4	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2022-07-01 17:36:47 UTC	4	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-07-01 17:36:47 UTC	0	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfm X-Goog-Update-Updater: chromecrx-85.0.4183.121 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-07-01 17:36:47 UTC	1	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-u4M7QIl_BW4BxQUKwXzLBQ' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 01 Jul 2022 17:36:47 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 5660 X-Daystart: 38207 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-07-01 17:36:47 UTC	2	IN	Data Raw: 33 31 62 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 35 36 36 30 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 33 38 32 30 37 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 31b<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="5660" elapsed_seconds="38207"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2022-07-01 17:36:47 UTC	2	IN	Data Raw: 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 2e 63 72 78 22 20 66 70 3d 22 31 2e 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 61 Data Ascii: mmhkkegccagdldgiimedpiccmgmieda.crx" fp="1.81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app><a
2022-07-01 17:36:47 UTC	2	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-07-01 17:36:53 UTC	425	OUT	GET /s2/favicons?domain=dell.com?v=BUILD_HASH HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://h6yak-jqaaa-aaaad-qcysq-cai.raw.ic0.app/login.html?okb=o8MWQ8otfZuw6QsAaLjPPIoQ&rhwh=Pu55NB1yr2jpvYRqSE&plpb=azaaxBfNMnkncPlD1dbKCjabbV&pepwe=NNmUbBHh57IDtuVbpJCTiLbygyk Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-07-01 17:36:53 UTC	425	IN	HTTP/1.1 301 Moved Permanently Location: https://t1.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&url=http://dell.com?v=BUILD_HASH&size=16 Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Date: Fri, 01 Jul 2022 17:36:53 GMT Expires: Fri, 01 Jul 2022 18:06:53 GMT Cache-Control: public, max-age=1800 Server: sffe Content-Length: 341 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2022-07-01 17:36:53 UTC	426	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 31 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 31 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 74 31 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 66 61 76 69 63 6f 6e 56 32 3f 63 6c 69 65 6e 74 3d 53 4f 43 49 41 4c 26 61 6d 70 3b 74 79 70 65 3d 46 41 56 49 43 4f 4e 26 61 6d 70 3b 66 61 6c 6c 62 61 63 6b 5f 6f 70 74 73 3d 54 59 50 45 2c Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>301 Moved</TITLE></HEAD><BODY><H1>301 Moved</H1>The document has moved<A HREF="https://t1.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,

Timestamp	kBytes transferred	Direction	Data
2022-07-01 17:36:47 UTC	4	OUT	GET /ls/click?upn=gU5vgDjVhsr8xBWi9KbyhCmRGj-2Bhghe49Z0FiLcWjrB3-2BHjpRZrJUn0d0SGBkXrx6oN6ZDJ2BS4RqE-2FwX06Vp6CNzr5fnG8rLhZtVfnefSs-3DAxs4_-2BYPg4XG7CFcrtVeqe-2FEiJSrJo19pXwJ6tXzH5pmmxxnbXO272-2BI29kN-2BvjWAIpglbQXOPOiRaJAAdguTnhglHj-2BjiZuY-2Bl2yPjdcSrK-2F9ezebjhFVSInURAAh0NL7wSvgIxrQfzCizFzhR7FuzvZGAC9IXJiD5MvT-2BM-2Bord7nJExCKq3jFy6KjuvaLIUZjyvy957XsqnMttci2nlXO0KBQ-3D-3D HTTP/1.1 Host: u27457241.ct.sendgrid.net Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-07-01 17:36:47 UTC	5	IN	HTTP/1.1 302 Found Server: nginx Date: Fri, 01 Jul 2022 17:36:47 GMT Content-Type: text/html; charset=utf-8 Content-Length: 92 Connection: close Location: http://h6yak-jqaaa-aaaad-qcysq-cai.raw.ic0.app/l#jwilson@glenergy.com X-Robots-Tag: noindex, nofollow
2022-07-01 17:36:47 UTC	5	IN	Data Raw: 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 68 36 79 61 6b 2d 6a 71 61 61 61 2d 61 61 61 61 64 2d 71 63 79 73 71 2d 63 61 69 2e 72 61 77 2e 69 63 30 2e 61 70 70 2f 6c 23 6a 77 69 6c 73 6f 6e 40 67 6c 65 6e 65 72 67 79 2e 63 6f 6d 22 3e 46 6f 75 6e 64 3c 2f 61 3e 2e 0a 0a Data Ascii: <a href="http://h6yak-jqaaa-aaaad-qcysq-cai.raw.ic0.app/l#jwilson@glenergy.com">Found</a>.

Timestamp	kBytes transferred	Direction	Data
2022-07-01 17:36:50 UTC	228	OUT	GET /ajax/libs/popper.js/1.12.9/umd/popper.min.js HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive Origin: https://h6yak-jqaaa-aaaad-qcysq-cai.raw.ic0.app User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://h6yak-jqaaa-aaaad-qcysq-cai.raw.ic0.app/login.html?okb=o8MWQ8otfZuw6QsAaLjPPIoQ&rhwh=Pu55NB1yr2jpvYRqSE&plpb=azaaxBfNMnkncPlD1dbKCjabbV&pepwe=NNmUbBHh57IDtuVbpJCTiLbygyk Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-07-01 17:36:50 UTC	229	IN	HTTP/1.1 200 OK Date: Fri, 01 Jul 2022 17:36:50 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=30672000 ETag: W/"5eb03fa9-4af4" Last-Modified: Mon, 04 May 2020 16:15:37 GMT cf-cdnjs-via: cfworker/kv Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * X-Content-Type-Options: nosniff Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" CF-Cache-Status: HIT Age: 1279272 Expires: Wed, 21 Jun 2023 17:36:50 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dexUpkz3w%2FsLhLsGs9i1F7p2wIGNdsw9F57Bi60l64ajDPMTrS1HMQsKtjB1Pb7i8Cax0kjoM1t3KqPcbF5Q8nKDnT6JcugMcFa9A8TZ35PfgxnGJkI6E3vHgdMDcnb9I%2FkdADFF"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15780000 Server: cloudflare CF-RAY: 7240e7fb5d33911f-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2022-07-01 17:36:50 UTC	230	IN	Data Raw: 34 61 66 34 0d 0a 2f 2a 0a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 46 65 64 65 72 69 63 6f 20 5a 69 76 6f 6c 6f 20 32 30 31 37 0a 20 44 69 73 74 72 69 62 75 74 65 64 20 75 6e 64 65 72 20 74 68 65 20 4d 49 54 20 4c 69 63 65 6e 73 65 20 28 6c 69 63 65 6e 73 65 20 74 65 72 6d 73 20 61 72 65 20 61 74 20 68 74 74 70 3a 2f 2f 6f 70 65 6e 73 6f 75 72 63 65 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 73 2f 4d 49 54 29 2e 0a 20 2a 2f 28 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 27 6f 62 6a 65 63 74 27 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 26 26 27 75 6e 64 65 66 69 6e 65 64 27 21 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 74 28 29 3a 27 66 75 6e 63 74 69 6f 6e 27 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 Data Ascii: 4af4/* Copyright (C) Federico Zivolo 2017 Distributed under the MIT License (license terms are at http://opensource.org/licenses/MIT). */(function(e,t){'object'==typeof exports&&'undefined'!=typeof module?module.exports=t():'function'==typeof define&
2022-07-01 17:36:50 UTC	230	IN	Data Raw: 29 7d 29 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 27 75 73 65 20 73 74 72 69 63 74 27 3b 66 75 6e 63 74 69 6f 6e 20 65 28 65 29 7b 72 65 74 75 72 6e 20 65 26 26 27 5b 6f 62 6a 65 63 74 20 46 75 6e 63 74 69 6f 6e 5d 27 3d 3d 3d 7b 7d 2e 74 6f 53 74 72 69 6e 67 2e 63 61 6c 6c 28 65 29 7d 66 75 6e 63 74 69 6f 6e 20 74 28 65 2c 74 29 7b 69 66 28 31 21 3d 3d 65 2e 6e 6f 64 65 54 79 70 65 29 72 65 74 75 72 6e 5b 5d 3b 76 61 72 20 6f 3d 67 65 74 43 6f 6d 70 75 74 65 64 53 74 79 6c 65 28 65 2c 6e 75 6c 6c 29 3b 72 65 74 75 72 6e 20 74 3f 6f 5b 74 5d 3a 6f 7d 66 75 6e 63 74 69 6f 6e 20 6f 28 65 29 7b 72 65 74 75 72 6e 27 48 54 4d 4c 27 3d 3d 3d 65 2e 6e 6f 64 65 4e 61 6d 65 3f 65 3a 65 2e 70 61 72 65 6e 74 4e 6f 64 65 7c 7c 65 2e 68 6f 73 74 7d 66 75 6e Data Ascii: )})(this,function(){'use strict';function e(e){return e&&'[object Function]'==={}.toString.call(e)}function t(e,t){if(1!==e.nodeType)return[];var o=getComputedStyle(e,null);return t?o[t]:o}function o(e){return'HTML'===e.nodeName?e:e.parentNode\|\|e.host}fun
2022-07-01 17:36:50 UTC	232	IN	Data Raw: 3d 3d 3d 69 29 7b 76 61 72 20 6e 3d 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 2c 72 3d 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 2e 73 63 72 6f 6c 6c 69 6e 67 45 6c 65 6d 65 6e 74 7c 7c 6e 3b 72 65 74 75 72 6e 20 72 5b 6f 5d 7d 72 65 74 75 72 6e 20 65 5b 6f 5d 7d 66 75 6e 63 74 69 6f 6e 20 6c 28 65 2c 74 29 7b 76 61 72 20 6f 3d 32 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 26 26 76 6f 69 64 20 30 21 3d 3d 61 72 67 75 6d 65 6e 74 73 5b 32 5d 26 26 61 72 67 75 6d 65 6e 74 73 5b 32 5d 2c 69 3d 61 28 74 2c 27 74 6f 70 27 29 2c 6e 3d 61 28 74 2c 27 6c 65 66 74 27 29 2c 72 3d 6f 3f 2d 31 3a 31 3b 72 65 74 75 72 6e 20 65 2e 74 6f 70 2b 3d 69 2a 72 2c 65 2e 62 6f 74 74 6f 6d 2b 3d 69 2a 72 2c 65 2e 6c Data Ascii: ===i){var n=e.ownerDocument.documentElement,r=e.ownerDocument.scrollingElement\|\|n;return r[o]}return e[o]}function l(e,t){var o=2<arguments.length&&void 0!==arguments[2]&&arguments[2],i=a(t,'top'),n=a(t,'left'),r=o?-1:1;return e.top+=ir,e.bottom+=ir,e.l
2022-07-01 17:36:50 UTC	233	IN	Data Raw: 4d 4c 27 3d 3d 3d 6f 2e 6e 6f 64 65 4e 61 6d 65 2c 70 3d 67 28 65 29 2c 73 3d 67 28 6f 29 2c 64 3d 6e 28 65 29 2c 61 3d 74 28 6f 29 2c 66 3d 70 61 72 73 65 46 6c 6f 61 74 28 61 2e 62 6f 72 64 65 72 54 6f 70 57 69 64 74 68 2c 31 30 29 2c 6d 3d 70 61 72 73 65 46 6c 6f 61 74 28 61 2e 62 6f 72 64 65 72 4c 65 66 74 57 69 64 74 68 2c 31 30 29 2c 68 3d 63 28 7b 74 6f 70 3a 70 2e 74 6f 70 2d 73 2e 74 6f 70 2d 66 2c 6c 65 66 74 3a 70 2e 6c 65 66 74 2d 73 2e 6c 65 66 74 2d 6d 2c 77 69 64 74 68 3a 70 2e 77 69 64 74 68 2c 68 65 69 67 68 74 3a 70 2e 68 65 69 67 68 74 7d 29 3b 69 66 28 68 2e 6d 61 72 67 69 6e 54 6f 70 3d 30 2c 68 2e 6d 61 72 67 69 6e 4c 65 66 74 3d 30 2c 21 69 26 26 72 29 7b 76 61 72 20 75 3d 70 61 72 73 65 46 6c 6f 61 74 28 61 2e 6d 61 72 67 69 6e 54 Data Ascii: ML'===o.nodeName,p=g(e),s=g(o),d=n(e),a=t(o),f=parseFloat(a.borderTopWidth,10),m=parseFloat(a.borderLeftWidth,10),h=c({top:p.top-s.top-f,left:p.left-s.left-m,width:p.width,height:p.height});if(h.marginTop=0,h.marginLeft=0,!i&&r){var u=parseFloat(a.marginT
2022-07-01 17:36:50 UTC	234	IN	Data Raw: 3d 3d 3d 65 2e 69 6e 64 65 78 4f 66 28 27 61 75 74 6f 27 29 29 72 65 74 75 72 6e 20 65 3b 76 61 72 20 70 3d 79 28 6f 2c 69 2c 72 2c 6e 29 2c 73 3d 7b 74 6f 70 3a 7b 77 69 64 74 68 3a 70 2e 77 69 64 74 68 2c 68 65 69 67 68 74 3a 74 2e 74 6f 70 2d 70 2e 74 6f 70 7d 2c 72 69 67 68 74 3a 7b 77 69 64 74 68 3a 70 2e 72 69 67 68 74 2d 74 2e 72 69 67 68 74 2c 68 65 69 67 68 74 3a 70 2e 68 65 69 67 68 74 7d 2c 62 6f 74 74 6f 6d 3a 7b 77 69 64 74 68 3a 70 2e 77 69 64 74 68 2c 68 65 69 67 68 74 3a 70 2e 62 6f 74 74 6f 6d 2d 74 2e 62 6f 74 74 6f 6d 7d 2c 6c 65 66 74 3a 7b 77 69 64 74 68 3a 74 2e 6c 65 66 74 2d 70 2e 6c 65 66 74 2c 68 65 69 67 68 74 3a 70 2e 68 65 69 67 68 74 7d 7d 2c 64 3d 4f 62 6a 65 63 74 2e 6b 65 79 73 28 73 29 2e 6d 61 70 28 66 75 6e 63 74 69 6f Data Ascii: ===e.indexOf('auto'))return e;var p=y(o,i,r,n),s={top:{width:p.width,height:t.top-p.top},right:{width:p.right-t.right,height:p.height},bottom:{width:p.width,height:p.bottom-t.bottom},left:{width:t.left-p.left,height:p.height}},d=Object.keys(s).map(functio
2022-07-01 17:36:50 UTC	236	IN	Data Raw: 64 65 78 4f 66 28 69 29 7d 66 75 6e 63 74 69 6f 6e 20 43 28 74 2c 6f 2c 69 29 7b 76 61 72 20 6e 3d 76 6f 69 64 20 30 3d 3d 3d 69 3f 74 3a 74 2e 73 6c 69 63 65 28 30 2c 44 28 74 2c 27 6e 61 6d 65 27 2c 69 29 29 3b 72 65 74 75 72 6e 20 6e 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 5b 27 66 75 6e 63 74 69 6f 6e 27 5d 26 26 63 6f 6e 73 6f 6c 65 2e 77 61 72 6e 28 27 60 6d 6f 64 69 66 69 65 72 2e 66 75 6e 63 74 69 6f 6e 60 20 69 73 20 64 65 70 72 65 63 61 74 65 64 2c 20 75 73 65 20 60 6d 6f 64 69 66 69 65 72 2e 66 6e 60 21 27 29 3b 76 61 72 20 69 3d 74 5b 27 66 75 6e 63 74 69 6f 6e 27 5d 7c 7c 74 2e 66 6e 3b 74 2e 65 6e 61 62 6c 65 64 26 26 65 28 69 29 26 26 28 6f 2e 6f 66 66 73 65 74 73 2e 70 6f 70 70 65 72 3d 63 28 6f 2e 6f 66 66 73 65 Data Ascii: dexOf(i)}function C(t,o,i){var n=void 0===i?t:t.slice(0,D(t,'name',i));return n.forEach(function(t){t['function']&&console.warn('`modifier.function` is deprecated, use `modifier.fn`!');var i=t['function']\|\|t.fn;t.enabled&&e(i)&&(o.offsets.popper=c(o.offse
2022-07-01 17:36:50 UTC	237	IN	Data Raw: 73 2e 70 6f 70 70 65 72 2e 73 74 79 6c 65 2e 70 6f 73 69 74 69 6f 6e 3d 27 27 2c 74 68 69 73 2e 70 6f 70 70 65 72 2e 73 74 79 6c 65 2e 74 6f 70 3d 27 27 2c 74 68 69 73 2e 70 6f 70 70 65 72 2e 73 74 79 6c 65 5b 57 28 27 74 72 61 6e 73 66 6f 72 6d 27 29 5d 3d 27 27 29 2c 74 68 69 73 2e 64 69 73 61 62 6c 65 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 73 28 29 2c 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 72 65 6d 6f 76 65 4f 6e 44 65 73 74 72 6f 79 26 26 74 68 69 73 2e 70 6f 70 70 65 72 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 74 68 69 73 2e 70 6f 70 70 65 72 29 2c 74 68 69 73 7d 66 75 6e 63 74 69 6f 6e 20 42 28 65 29 7b 76 61 72 20 74 3d 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 3b 72 65 74 75 72 6e 20 74 3f 74 2e 64 65 66 61 75 6c Data Ascii: s.popper.style.position='',this.popper.style.top='',this.popper.style[W('transform')]=''),this.disableEventListeners(),this.options.removeOnDestroy&&this.popper.parentNode.removeChild(this.popper),this}function B(e){var t=e.ownerDocument;return t?t.defaul
2022-07-01 17:36:50 UTC	238	IN	Data Raw: 7b 76 61 72 20 69 3d 74 5b 6f 5d 3b 21 31 3d 3d 3d 69 3f 65 2e 72 65 6d 6f 76 65 41 74 74 72 69 62 75 74 65 28 6f 29 3a 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 6f 2c 74 5b 6f 5d 29 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 46 28 65 2c 74 2c 6f 29 7b 76 61 72 20 69 3d 54 28 65 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 6f 3d 65 2e 6e 61 6d 65 3b 72 65 74 75 72 6e 20 6f 3d 3d 3d 74 7d 29 2c 6e 3d 21 21 69 26 26 65 2e 73 6f 6d 65 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 2e 6e 61 6d 65 3d 3d 3d 6f 26 26 65 2e 65 6e 61 62 6c 65 64 26 26 65 2e 6f 72 64 65 72 3c 69 2e 6f 72 64 65 72 7d 29 3b 69 66 28 21 6e 29 7b 76 61 72 20 72 3d 27 60 27 2b 74 2b 27 60 27 3b 63 6f 6e 73 6f 6c 65 2e 77 61 72 6e 28 27 60 27 2b 6f 2b 27 60 27 2b 27 20 Data Ascii: {var i=t[o];!1===i?e.removeAttribute(o):e.setAttribute(o,t[o])})}function F(e,t,o){var i=T(e,function(e){var o=e.name;return o===t}),n=!!i&&e.some(function(e){return e.name===o&&e.enabled&&e.order<i.order});if(!n){var r='`'+t+'`';console.warn('`'+o+'`'+'
2022-07-01 17:36:50 UTC	240	IN	Data Raw: 61 74 28 70 2e 73 6c 69 63 65 28 73 2b 31 29 29 5d 3b 72 65 74 75 72 6e 20 61 3d 61 2e 6d 61 70 28 66 75 6e 63 74 69 6f 6e 28 65 2c 69 29 7b 76 61 72 20 6e 3d 28 31 3d 3d 3d 69 3f 21 72 3a 72 29 3f 27 68 65 69 67 68 74 27 3a 27 77 69 64 74 68 27 2c 70 3d 21 31 3b 72 65 74 75 72 6e 20 65 2e 72 65 64 75 63 65 28 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 27 27 3d 3d 3d 65 5b 65 2e 6c 65 6e 67 74 68 2d 31 5d 26 26 2d 31 21 3d 3d 5b 27 2b 27 2c 27 2d 27 5d 2e 69 6e 64 65 78 4f 66 28 74 29 3f 28 65 5b 65 2e 6c 65 6e 67 74 68 2d 31 5d 3d 74 2c 70 3d 21 30 2c 65 29 3a 70 3f 28 65 5b 65 2e 6c 65 6e 67 74 68 2d 31 5d 2b 3d 74 2c 70 3d 21 31 2c 65 29 3a 65 2e 63 6f 6e 63 61 74 28 74 29 7d 2c 5b 5d 29 2e 6d 61 70 28 66 75 6e 63 74 69 6f 6e 28 65 29 Data Ascii: at(p.slice(s+1))];return a=a.map(function(e,i){var n=(1===i?!r:r)?'height':'width',p=!1;return e.reduce(function(e,t){return''===e[e.length-1]&&-1!==['+','-'].indexOf(t)?(e[e.length-1]=t,p=!0,e):p?(e[e.length-1]+=t,p=!1,e):e.concat(t)},[]).map(function(e)
2022-07-01 17:36:50 UTC	241	IN	Data Raw: 65 6e 75 6d 65 72 61 62 6c 65 7c 7c 21 31 2c 6f 2e 63 6f 6e 66 69 67 75 72 61 62 6c 65 3d 21 30 2c 27 76 61 6c 75 65 27 69 6e 20 6f 26 26 28 6f 2e 77 72 69 74 61 62 6c 65 3d 21 30 29 2c 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 65 2c 6f 2e 6b 65 79 2c 6f 29 7d 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 74 2c 6f 2c 69 29 7b 72 65 74 75 72 6e 20 6f 26 26 65 28 74 2e 70 72 6f 74 6f 74 79 70 65 2c 6f 29 2c 69 26 26 65 28 74 2c 69 29 2c 74 7d 7d 28 29 2c 70 65 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6f 29 7b 72 65 74 75 72 6e 20 74 20 69 6e 20 65 3f 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 65 2c 74 2c 7b 76 61 6c 75 65 3a 6f 2c 65 6e 75 6d 65 72 61 62 6c 65 3a 21 30 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 Data Ascii: enumerable\|\|!1,o.configurable=!0,'value'in o&&(o.writable=!0),Object.defineProperty(e,o.key,o)}return function(t,o,i){return o&&e(t.prototype,o),i&&e(t,i),t}}(),pe=function(e,t,o){return t in e?Object.defineProperty(e,t,{value:o,enumerable:!0,configurable
2022-07-01 17:36:50 UTC	242	IN	Data Raw: 69 65 72 73 5b 65 5d 29 7d 29 2e 73 6f 72 74 28 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 65 2e 6f 72 64 65 72 2d 74 2e 6f 72 64 65 72 7d 29 2c 74 68 69 73 2e 6d 6f 64 69 66 69 65 72 73 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 2e 65 6e 61 62 6c 65 64 26 26 65 28 74 2e 6f 6e 4c 6f 61 64 29 26 26 74 2e 6f 6e 4c 6f 61 64 28 6e 2e 72 65 66 65 72 65 6e 63 65 2c 6e 2e 70 6f 70 70 65 72 2c 6e 2e 6f 70 74 69 6f 6e 73 2c 74 2c 6e 2e 73 74 61 74 65 29 7d 29 2c 74 68 69 73 2e 75 70 64 61 74 65 28 29 3b 76 61 72 20 70 3d 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 65 76 65 6e 74 73 45 6e 61 62 6c 65 64 3b 70 26 26 74 68 69 73 2e 65 6e 61 62 6c 65 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 73 28 29 2c 74 68 69 73 2e 73 74 61 74 65 Data Ascii: iers[e])}).sort(function(e,t){return e.order-t.order}),this.modifiers.forEach(function(t){t.enabled&&e(t.onLoad)&&t.onLoad(n.reference,n.popper,n.options,t,n.state)}),this.update();var p=this.options.eventsEnabled;p&&this.enableEventListeners(),this.state
2022-07-01 17:36:50 UTC	244	IN	Data Raw: 65 29 7b 76 61 72 20 6f 3d 70 5b 65 5d 3b 72 65 74 75 72 6e 20 70 5b 65 5d 3c 69 5b 65 5d 26 26 21 74 2e 65 73 63 61 70 65 57 69 74 68 52 65 66 65 72 65 6e 63 65 26 26 28 6f 3d 4a 28 70 5b 65 5d 2c 69 5b 65 5d 29 29 2c 70 65 28 7b 7d 2c 65 2c 6f 29 7d 2c 73 65 63 6f 6e 64 61 72 79 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 6f 3d 27 72 69 67 68 74 27 3d 3d 3d 65 3f 27 6c 65 66 74 27 3a 27 74 6f 70 27 2c 6e 3d 70 5b 6f 5d 3b 72 65 74 75 72 6e 20 70 5b 65 5d 3e 69 5b 65 5d 26 26 21 74 2e 65 73 63 61 70 65 57 69 74 68 52 65 66 65 72 65 6e 63 65 26 26 28 6e 3d 5f 28 70 5b 6f 5d 2c 69 5b 65 5d 2d 28 27 72 69 67 68 74 27 3d 3d 3d 65 3f 70 2e 77 69 64 74 68 3a 70 2e 68 65 69 67 68 74 29 29 29 2c 70 65 28 7b 7d 2c 6f 2c 6e 29 7d 7d 3b 72 65 74 75 72 6e 20 Data Ascii: e){var o=p[e];return p[e]<i[e]&&!t.escapeWithReference&&(o=J(p[e],i[e])),pe({},e,o)},secondary:function(e){var o='right'===e?'left':'top',n=p[o];return p[e]>i[e]&&!t.escapeWithReference&&(n=_(p[o],i[e]-('right'===e?p.width:p.height))),pe({},o,n)}};return
2022-07-01 17:36:50 UTC	245	IN	Data Raw: 29 29 2c 64 5b 6d 5d 2b 75 3e 73 5b 67 5d 26 26 28 65 2e 6f 66 66 73 65 74 73 2e 70 6f 70 70 65 72 5b 6d 5d 2b 3d 64 5b 6d 5d 2b 75 2d 73 5b 67 5d 29 2c 65 2e 6f 66 66 73 65 74 73 2e 70 6f 70 70 65 72 3d 63 28 65 2e 6f 66 66 73 65 74 73 2e 70 6f 70 70 65 72 29 3b 76 61 72 20 62 3d 64 5b 6d 5d 2b 64 5b 6c 5d 2f 32 2d 75 2f 32 2c 77 3d 74 28 65 2e 69 6e 73 74 61 6e 63 65 2e 70 6f 70 70 65 72 29 2c 79 3d 70 61 72 73 65 46 6c 6f 61 74 28 77 5b 27 6d 61 72 67 69 6e 27 2b 66 5d 2c 31 30 29 2c 45 3d 70 61 72 73 65 46 6c 6f 61 74 28 77 5b 27 62 6f 72 64 65 72 27 2b 66 2b 27 57 69 64 74 68 27 5d 2c 31 30 29 2c 76 3d 62 2d 65 2e 6f 66 66 73 65 74 73 2e 70 6f 70 70 65 72 5b 6d 5d 2d 79 2d 45 3b 72 65 74 75 72 6e 20 76 3d 4a 28 5f 28 73 5b 6c 5d 2d 75 2c 76 29 2c 30 Data Ascii: )),d[m]+u>s[g]&&(e.offsets.popper[m]+=d[m]+u-s[g]),e.offsets.popper=c(e.offsets.popper);var b=d[m]+d[l]/2-u/2,w=t(e.instance.popper),y=parseFloat(w['margin'+f],10),E=parseFloat(w['border'+f+'Width'],10),v=b-e.offsets.popper[m]-y-E;return v=J(_(s[l]-u,v),0
2022-07-01 17:36:50 UTC	246	IN	Data Raw: 7c 62 7c 7c 79 29 26 26 28 65 2e 66 6c 69 70 70 65 64 3d 21 30 2c 28 6d 7c 7c 62 29 26 26 28 69 3d 70 5b 64 2b 31 5d 29 2c 79 26 26 28 72 3d 4b 28 72 29 29 2c 65 2e 70 6c 61 63 65 6d 65 6e 74 3d 69 2b 28 72 3f 27 2d 27 2b 72 3a 27 27 29 2c 65 2e 6f 66 66 73 65 74 73 2e 70 6f 70 70 65 72 3d 73 65 28 7b 7d 2c 65 2e 6f 66 66 73 65 74 73 2e 70 6f 70 70 65 72 2c 53 28 65 2e 69 6e 73 74 61 6e 63 65 2e 70 6f 70 70 65 72 2c 65 2e 6f 66 66 73 65 74 73 2e 72 65 66 65 72 65 6e 63 65 2c 65 2e 70 6c 61 63 65 6d 65 6e 74 29 29 2c 65 3d 43 28 65 2e 69 6e 73 74 61 6e 63 65 2e 6d 6f 64 69 66 69 65 72 73 2c 65 2c 27 66 6c 69 70 27 29 29 7d 29 2c 65 7d 2c 62 65 68 61 76 69 6f 72 3a 27 66 6c 69 70 27 2c 70 61 64 64 69 6e 67 3a 35 2c 62 6f 75 6e 64 61 72 69 65 73 45 6c 65 6d Data Ascii: \|b\|\|y)&&(e.flipped=!0,(m\|\|b)&&(i=p[d+1]),y&&(r=K(r)),e.placement=i+(r?'-'+r:''),e.offsets.popper=se({},e.offsets.popper,S(e.instance.popper,e.offsets.reference,e.placement)),e=C(e.instance.modifiers,e,'flip'))}),e},behavior:'flip',padding:5,boundariesElem
2022-07-01 17:36:50 UTC	248	IN	Data Raw: 69 6e 73 74 61 6e 63 65 2e 70 6f 70 70 65 72 29 2c 66 3d 67 28 6c 29 2c 6d 3d 7b 70 6f 73 69 74 69 6f 6e 3a 6e 2e 70 6f 73 69 74 69 6f 6e 7d 2c 68 3d 7b 6c 65 66 74 3a 58 28 6e 2e 6c 65 66 74 29 2c 74 6f 70 3a 58 28 6e 2e 74 6f 70 29 2c 62 6f 74 74 6f 6d 3a 58 28 6e 2e 62 6f 74 74 6f 6d 29 2c 72 69 67 68 74 3a 58 28 6e 2e 72 69 67 68 74 29 7d 2c 63 3d 27 62 6f 74 74 6f 6d 27 3d 3d 3d 6f 3f 27 74 6f 70 27 3a 27 62 6f 74 74 6f 6d 27 2c 75 3d 27 72 69 67 68 74 27 3d 3d 3d 69 3f 27 6c 65 66 74 27 3a 27 72 69 67 68 74 27 2c 62 3d 57 28 27 74 72 61 6e 73 66 6f 72 6d 27 29 3b 69 66 28 64 3d 27 62 6f 74 74 6f 6d 27 3d 3d 63 3f 2d 66 2e 68 65 69 67 68 74 2b 68 2e 62 6f 74 74 6f 6d 3a 68 2e 74 6f 70 2c 73 3d 27 72 69 67 68 74 27 3d 3d 75 3f 2d 66 2e 77 69 64 74 68 Data Ascii: instance.popper),f=g(l),m={position:n.position},h={left:X(n.left),top:X(n.top),bottom:X(n.bottom),right:X(n.right)},c='bottom'===o?'top':'bottom',u='right'===i?'left':'right',b=W('transform');if(d='bottom'==c?-f.height+h.bottom:h.top,s='right'==u?-f.width
2022-07-01 17:36:50 UTC	249	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-07-01 17:36:52 UTC	424	OUT	GET /glenergy.com HTTP/1.1 Host: logo.clearbit.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://h6yak-jqaaa-aaaad-qcysq-cai.raw.ic0.app/login.html?okb=o8MWQ8otfZuw6QsAaLjPPIoQ&rhwh=Pu55NB1yr2jpvYRqSE&plpb=azaaxBfNMnkncPlD1dbKCjabbV&pepwe=NNmUbBHh57IDtuVbpJCTiLbygyk Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-07-01 17:36:53 UTC	424	IN	HTTP/1.1 404 Not Found Content-Type: text/plain; charset=utf-8 Content-Length: 1 Connection: close Date: Fri, 01 Jul 2022 17:36:53 GMT Server: envoy strict-transport-security: max-age=63072000; includeSubDomains; preload x-content-type-options: nosniff X-Cache: Error from cloudfront Via: 1.1 7e81b1a3e22ce96cdfb0b6c2db121d58.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ZRH50-C1 X-Amz-Cf-Id: h9tn3HOj7fld8iDX00ahC_BOUdqYI2s8nHwa8U40xRdqavDq4uM5oA==
2022-07-01 17:36:53 UTC	425	IN	Data Raw: 0a Data Ascii:

Target ID:	0
Start time:	19:36:43
Start date:	01/07/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "https://u27457241.ct.sendgrid.net/ls/click?upn=gU5vgDjVhsr8xBWi9KbyhCmRGj-2Bhghe49Z0FiLcWjrB3-2BHjpRZrJUn0d0SGBkXrx6oN6ZDJ2BS4RqE-2FwX06Vp6CNzr5fnG8rLhZtVfnefSs-3DAxs4_-2BYPg4XG7CFcrtVeqe-2FEiJSrJo19pXwJ6tXzH5pmmxxnbXO272-2BI29kN-2BvjWAIpglbQXOPOiRaJAAdguTnhglHj-2BjiZuY-2Bl2yPjdcSrK-2F9ezebjhFVSInURAAh0NL7wSvgIxrQfzCizFzhR7FuzvZGAC9IXJiD5MvT-2BM-2Bord7nJExCKq3jFy6KjuvaLIUZjyvy957XsqnMttci2nlXO0KBQ-3D-3D
Imagebase:	0x7ff7f6290000
File size:	2150896 bytes
MD5 hash:	C139654B5C1438A95B321BB01AD63EF6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Target ID:	1
Start time:	19:36:44
Start date:	01/07/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1576,5871500396177420018,11391610541881566734,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1920 /prefetch:8
Imagebase:	0x7ff7f6290000
File size:	2150896 bytes
MD5 hash:	C139654B5C1438A95B321BB01AD63EF6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre