Edit tour

Windows Analysis Report
ClosingDoc.html

Overview

General Information

Sample Name:	ClosingDoc.html
Analysis ID:	655873
MD5:	3755ba4cfcde83ecc11643096b157366
SHA1:	058fa6f78bf7369e33c0881cb8bf6d07a6bbb9ba
SHA256:	1b174509a2b0400085d634439672ed977c4cd733537ad47e6c0061d4d60c767a
Infos:

Detection

HTMLPhisher

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Phishing site detected (based on favicon image match)

Yara detected HtmlPhish10

HTML document with suspicious title

Phishing site detected (based on logo template match)

Phishing site detected (based on image similarity)

Invalid 'forgot password' link found

None HTTPS page querying sensitive user data (password, username or email)

No HTML title found

JA3 SSL client fingerprint seen in connection with other malware

HTML body contains low number of good links

IP address seen in connection with other malware

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5412 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "C:\Users\user\Desktop\ClosingDoc.html MD5: C139654B5C1438A95B321BB01AD63EF6)

chrome.exe (PID: 5052 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1580,15663332800411292547,1156807434197202323,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1920 /prefetch:8 MD5: C139654B5C1438A95B321BB01AD63EF6)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author	Strings
87841.0.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: file:///C:/Users/user/Desktop/ClosingDoc.html	HTTP Parser: Invalid link: Forgot my password
Source: file:///C:/Users/user/Desktop/ClosingDoc.html	HTTP Parser: Invalid link: Forgot my password

Source: file:///C:/Users/user/Desktop/ClosingDoc.html	HTTP Parser: Has password / email / username input fields
Source: file:///C:/Users/user/Desktop/ClosingDoc.html	HTTP Parser: Has password / email / username input fields

Source: file:///C:/Users/user/Desktop/ClosingDoc.html	HTTP Parser: HTML title missing
Source: file:///C:/Users/user/Desktop/ClosingDoc.html	HTTP Parser: HTML title missing

Source: file:///C:/Users/user/Desktop/ClosingDoc.html	HTTP Parser: Number of links: 0
Source: file:///C:/Users/user/Desktop/ClosingDoc.html	HTTP Parser: Number of links: 0

Source: file:///C:/Users/user/Desktop/ClosingDoc.html	HTTP Parser: No <meta name="author".. found
Source: file:///C:/Users/user/Desktop/ClosingDoc.html	HTTP Parser: No <meta name="author".. found

Source: file:///C:/Users/user/Desktop/ClosingDoc.html	HTTP Parser: No <meta name="copyright".. found
Source: file:///C:/Users/user/Desktop/ClosingDoc.html	HTTP Parser: No <meta name="copyright".. found

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic			Jump to behavior

Source: unknown	HTTPS traffic detected: 13.107.219.60:443 -> 192.168.2.6:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.23.37:443 -> 192.168.2.6:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.23.37:443 -> 192.168.2.6:49780 version: TLS 1.2

Source: Joe Sandbox View	IP Address: 13.107.219.60 13.107.219.60
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443

Source: Ruleset Data.0.dr	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: Filtering Rules.0.dr, Ruleset Data.0.dr	String found in binary or memory: www.facebook.com/ajax/ads/ equals www.facebook.com (Facebook)
Source: Filtering Rules.0.dr	String found in binary or memory: www.facebook.com0 equals www.facebook.com (Facebook)

Source: pnacl_public_x86_64_pnacl_sz_nexe.0.dr, pnacl_public_x86_64_pnacl_llc_nexe.0.dr	String found in binary or memory: http://llvm.org/):
Source: ef0232b0-f2c9-454e-8a64-e82d66657865.tmp.1.dr	String found in binary or memory: https://accounts.google.com
Source: craw_window.js.0.dr	String found in binary or memory: https://accounts.google.com/MergeSession
Source: ef0232b0-f2c9-454e-8a64-e82d66657865.tmp.1.dr	String found in binary or memory: https://apis.google.com
Source: pnacl_public_x86_64_crtend_o.0.dr, pnacl_public_x86_64_ld_nexe.0.dr	String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-clang.git
Source: pnacl_public_x86_64_crtend_o.0.dr, pnacl_public_x86_64_ld_nexe.0.dr	String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-llvm.git
Source: ef0232b0-f2c9-454e-8a64-e82d66657865.tmp.1.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json1.0.dr, manifest.json.0.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: ef0232b0-f2c9-454e-8a64-e82d66657865.tmp.1.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: pnacl_public_x86_64_ld_nexe.0.dr	String found in binary or memory: https://code.google.com/p/nativeclient/issues/entry
Source: pnacl_public_x86_64_ld_nexe.0.dr	String found in binary or memory: https://code.google.com/p/nativeclient/issues/entry%s:
Source: LICENSE.txt.0.dr	String found in binary or memory: https://creativecommons.org/.
Source: LICENSE.txt.0.dr	String found in binary or memory: https://creativecommons.org/compatiblelicenses
Source: d5b098ac-4631-4a9e-b4a4-5f95b793f089.tmp.1.dr, ef0232b0-f2c9-454e-8a64-e82d66657865.tmp.1.dr	String found in binary or memory: https://dns.google
Source: LICENSE.txt.0.dr	String found in binary or memory: https://easylist.to/)
Source: ef0232b0-f2c9-454e-8a64-e82d66657865.tmp.1.dr	String found in binary or memory: https://fonts.gstatic.com
Source: LICENSE.txt.0.dr	String found in binary or memory: https://github.com/easylist)
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p
Source: ef0232b0-f2c9-454e-8a64-e82d66657865.tmp.1.dr	String found in binary or memory: https://ogs.google.com
Source: craw_window.js.0.dr, manifest.json.0.dr	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: ef0232b0-f2c9-454e-8a64-e82d66657865.tmp.1.dr	String found in binary or memory: https://r1---sn-1gi7znek.gvt1.com
Source: ef0232b0-f2c9-454e-8a64-e82d66657865.tmp.1.dr	String found in binary or memory: https://redirector.gvt1.com
Source: craw_window.js.0.dr, manifest.json.0.dr	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: ef0232b0-f2c9-454e-8a64-e82d66657865.tmp.1.dr	String found in binary or memory: https://ssl.gstatic.com
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://www-googleapis-staging.sandbox.google.com
Source: ef0232b0-f2c9-454e-8a64-e82d66657865.tmp.1.dr	String found in binary or memory: https://www.google.com
Source: manifest.json.0.dr	String found in binary or memory: https://www.google.com/
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/accounts/OAuthLogin?issueuberauth=1
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/cleardot.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/dot2.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/x2.gif
Source: craw_background.js.0.dr	String found in binary or memory: https://www.google.com/intl/en-US/chrome/blank.html
Source: craw_window.js.0.dr, craw_background.js.0.dr, ef0232b0-f2c9-454e-8a64-e82d66657865.tmp.1.dr	String found in binary or memory: https://www.googleapis.com
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: ef0232b0-f2c9-454e-8a64-e82d66657865.tmp.1.dr	String found in binary or memory: https://www.gstatic.com

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	3 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	3 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	4 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	1 Ingress Tool Transfer	SIM Card Swap		Carrier Billing Fraud

Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/applogos/53_8b36337037cff88c3df203bb73d58e41.png HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfmX-Goog-Update-Updater: chromecrx-85.0.4183.121Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/appbackgrounds/49-small_e58aafc980614a9cd7796bea7b5ea8f0.jpg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/signin-options_4e48046ce74f4b89d45037c90576bfac.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: aadcdn.msauth.net
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/appbackgrounds/49-small_e58aafc980614a9cd7796bea7b5ea8f0.jpg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: aadcdn.msauth.net
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: aadcdn.msftauth.net
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/applogos/53_8b36337037cff88c3df203bb73d58e41.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: aadcdn.msftauth.net
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/signin-options_4e48046ce74f4b89d45037c90576bfac.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: aadcdn.msftauth.net

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "C:\Users\user\Desktop\ClosingDoc.html
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1580,15663332800411292547,1156807434197202323,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1920 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1580,15663332800411292547,1156807434197202323,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1920 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source	Detection	Scanner	Link
C:\Users\user\AppData\Local\Temp\5412_515056959\_platform_specific\x86_64\pnacl_public_x86_64_ld_nexe	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\5412_515056959\_platform_specific\x86_64\pnacl_public_x86_64_ld_nexe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\5412_515056959\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_llc_nexe	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\5412_515056959\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_llc_nexe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\5412_515056959\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_sz_nexe	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\5412_515056959\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_sz_nexe	0%	ReversingLabs

Source	Detection	Scanner	Label
https://dns.google	0%	URL Reputation	safe
https://aadcdn.msftauth.net/shared/1.0/content/images/signin-options_4e48046ce74f4b89d45037c90576bfac.svg	0%	URL Reputation	safe
https://aadcdn.msftauth.net/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg	0%	URL Reputation	safe
https://aadcdn.msftauth.net/shared/1.0/content/images/applogos/53_8b36337037cff88c3df203bb73d58e41.png	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
cs1100.wpc.omegacdn.net	152.199.23.37	true	false	unknown
accounts.google.com	172.217.16.205	true	false	high
clients.l.google.com	142.250.185.142	true	false	high
part-0032.t-0009.fbs1-t-msedge.net	13.107.219.60	true	false	unknown
clients2.google.com	unknown	unknown	false	high
code.jquery.com	unknown	unknown	false	high
aadcdn.msftauth.net	unknown	unknown	false	unknown

Name	Malicious	Antivirus Detection	Reputation
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1	false		high
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false		high
file:///C:/Users/user/Desktop/ClosingDoc.html	true		low
https://aadcdn.msftauth.net/shared/1.0/content/images/signin-options_4e48046ce74f4b89d45037c90576bfac.svg	false	URL Reputation: safe	unknown
https://aadcdn.msftauth.net/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg	false	URL Reputation: safe	unknown
https://aadcdn.msftauth.net/shared/1.0/content/images/applogos/53_8b36337037cff88c3df203bb73d58e41.png	false	Avira URL Cloud: safe	unknown

Name	Source	Malicious	Antivirus Detection	Reputation
https://dns.google	d5b098ac-4631-4a9e-b4a4-5f95b793f089.tmp.1.dr, ef0232b0-f2c9-454e-8a64-e82d66657865.tmp.1.dr	false	URL Reputation: safe	unknown
https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p	craw_window.js.0.dr, craw_background.js.0.dr	false		high
https://www.google.com/intl/en-US/chrome/blank.html	craw_background.js.0.dr	false		high
https://ogs.google.com	ef0232b0-f2c9-454e-8a64-e82d66657865.tmp.1.dr	false		high
https://www.google.com/images/cleardot.gif	craw_window.js.0.dr	false		high
https://payments.google.com/payments/v4/js/integrator.js	craw_window.js.0.dr, manifest.json.0.dr	false		high
https://chromium.googlesource.com/a/native_client/pnacl-llvm.git	pnacl_public_x86_64_crtend_o.0.dr, pnacl_public_x86_64_ld_nexe.0.dr	false		high
https://easylist.to/)	LICENSE.txt.0.dr	false		high
https://sandbox.google.com/payments/v4/js/integrator.js	craw_window.js.0.dr, manifest.json.0.dr	false		high
https://www.google.com/images/x2.gif	craw_window.js.0.dr	false		high
https://accounts.google.com/MergeSession	craw_window.js.0.dr	false		high
http://llvm.org/):	pnacl_public_x86_64_pnacl_sz_nexe.0.dr, pnacl_public_x86_64_pnacl_llc_nexe.0.dr	false		high
https://creativecommons.org/compatiblelicenses	LICENSE.txt.0.dr	false		high
https://www.google.com	ef0232b0-f2c9-454e-8a64-e82d66657865.tmp.1.dr	false		high
https://www.google.com/images/dot2.gif	craw_window.js.0.dr	false		high
https://github.com/easylist)	LICENSE.txt.0.dr	false		high
https://creativecommons.org/.	LICENSE.txt.0.dr	false		high
https://code.google.com/p/nativeclient/issues/entry%s:	pnacl_public_x86_64_ld_nexe.0.dr	false		high
https://code.google.com/p/nativeclient/issues/entry	pnacl_public_x86_64_ld_nexe.0.dr	false		high
https://accounts.google.com	ef0232b0-f2c9-454e-8a64-e82d66657865.tmp.1.dr	false		high
https://clients2.googleusercontent.com	ef0232b0-f2c9-454e-8a64-e82d66657865.tmp.1.dr	false		high
https://apis.google.com	ef0232b0-f2c9-454e-8a64-e82d66657865.tmp.1.dr	false		high
https://www.google.com/accounts/OAuthLogin?issueuberauth=1	craw_window.js.0.dr	false		high
https://www.google.com/	manifest.json.0.dr	false		high
https://www-googleapis-staging.sandbox.google.com	craw_window.js.0.dr, craw_background.js.0.dr	false		high
https://chromium.googlesource.com/a/native_client/pnacl-clang.git	pnacl_public_x86_64_crtend_o.0.dr, pnacl_public_x86_64_ld_nexe.0.dr	false		high
https://clients2.google.com	ef0232b0-f2c9-454e-8a64-e82d66657865.tmp.1.dr	false		high
https://clients2.google.com/service/update2/crx	manifest.json1.0.dr, manifest.json.0.dr	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.219.60	part-0032.t-0009.fbs1-t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.217.16.205	accounts.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.185.142	clients.l.google.com	United States	15169	GOOGLEUS	false
152.199.23.37	cs1100.wpc.omegacdn.net	United States	15133	EDGECASTUS	false

Joe Sandbox Version:	35.0.0 Citrine
Analysis ID:	655873
Start date and time: 01/07/202220:55:44	2022-07-01 20:55:44 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 23s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	ClosingDoc.html
Cookbook file name:	defaultwindowshtmlcookbook.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal68.phis.winHTML@29/128@5/7
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .html Adjust boot time Enable AMSI

Match	Associated Sample Name / URL	SHA 256	Detection	Link
13.107.219.60	https://huhulihu.com/	Get hash	malicious	Browse
	https://1drv.ms:443/o/s!BH45_lCByG8fgpJ9gXzw1ulhl-qQkQ?e=yvEgUVzG9ES2PfoKuGIEfw&at=9	Get hash	malicious	Browse
	ACH-paymentDetails.htm	Get hash	malicious	Browse
	https://r20.rs6.net/tn.jsp?t=3Dqcuzd54ab.0.0.sqy9yutab.0&1d=preview&r=3&p=http://unsZ3g50Nlu.psbf.co.za?dg=amagnemi@blythedale.org	Get hash	malicious	Browse
	message.html	Get hash	malicious	Browse
	Igor June MT103 Part PO8Z12L080.html	Get hash	malicious	Browse
	DOC_DAVID _ 27TH_JUNE_2022 _.HTML	Get hash	malicious	Browse
	https://drycreekpt-fax.weebly.com/	Get hash	malicious	Browse
	Payee_Request_Form.htm	Get hash	malicious	Browse
	Kogbonds-Calling-Mail.html	Get hash	malicious	Browse
	June 17, 2022, 84243 AM 0300037689.htm	Get hash	malicious	Browse
	https://electricitysaudi.net/ZYVfarp/elNabfK	Get hash	malicious	Browse
	ATT67233.html	Get hash	malicious	Browse
	http://cm.znian.kmctnursingcollege.org./#.aHR0cHM6Ly9iYWZ5YmVpZnprZzRwdWFveGV6M3J3cWM0NzZjM3o0Z3VkZ2s2bnR4YnBkbXhhNDI1ZmljdDI0eWttZS5pcGZzLm5mdHN0b3JhZ2UubGluayNzdWdkZW5kQGJlaW4uY29t	Get hash	malicious	Browse
	Remittance04162022.html	Get hash	malicious	Browse
	http://5q.vjcex.rpcodetool.com./#.aHR0cHM6Ly9iYWZ5YmVpZTR6NWJneXZsZ296djNvN3FxdTI0NGdhdHRwM2U3dnp2M3hibXQybDVnc3poMncyYWx6eS5pcGZzLm5mdHN0b3JhZ2UubGluayNiaGF1c2VyQHN0YXBsZXNlbmVyZ3kuY29t	Get hash	malicious	Browse
	https://1drv.ms/u/s!AmWdNxJR5yYRgQ1Cp7YIjCfpePrI?e=E3bRoR	Get hash	malicious	Browse
	INV#4226 .html	Get hash	malicious	Browse
	Payment 12824.html	Get hash	malicious	Browse
	https://www.miniremittanceadvice.com/	Get hash	malicious	Browse
239.255.255.250	http://d0edsbfmqucaulbq5ew3tn6o.greathem.ws/ozljha.php/1A0u168m9jilc04y9rn61gx1wd90ta330v/skk/017g2	Get hash	malicious	Browse
	https://yielding-cliff-weather.glitch.me/JHindex.html	Get hash	malicious	Browse
	https://mso.vm-service.xyz	Get hash	malicious	Browse
	https://u27457241.ct.sendgrid.net/ls/click?upn=gU5vgDjVhsr8xBWi9KbyhCmRGj-2Bhghe49Z0FiLcWjrB3-2BHjpRZrJUn0d0SGBkXrx6oN6ZDJ2BS4RqE-2FwX06Vp6CNzr5fnG8rLhZtVfnefSs-3DAxs4_-2BYPg4XG7CFcrtVeqe-2FEiJSrJo19pXwJ6tXzH5pmmxxnbXO272-2BI29kN-2BvjWAIpglbQXOPOiRaJAAdguTnhglHj-2BjiZuY-2Bl2yPjdcSrK-2F9ezebjhFVSInURAAh0NL7wSvgIxrQfzCizFzhR7FuzvZGAC9IXJiD5MvT-2BM-2Bord7nJExCKq3jFy6KjuvaLIUZjyvy957XsqnMttci2nlXO0KBQ-3D-3D	Get hash	malicious	Browse
	https://magothy.alphabuildr.com/	Get hash	malicious	Browse
	http://jornetfac.eastasia.cloudapp.azure.com/EMKT_CURSO_775-5693/47940.024663/	Get hash	malicious	Browse
	https://u27733051.ct.sendgrid.net/ls/click?upn=HCGWKV8XHxZ4j6JAvUqU85qmUstX9ujQf79frd5sn49jV1VgryMAoVIQf2IGsGbr8mb3MByyFDCK-2FozDw04RRQwUpt-2FUJFUNFyKRmHqeuCo-3D8613_YQqOrPDtXbRfXaWHaKXmxS8MuXPUoYgcqzaTYWlixJ1Mkt8ZA0IO1wM-2BzFjRFZv00QAhDMzXHC6LEePuTaRud-2Bu6mRjrWo4y8Ajd68Q059d2B3W4naosfLFT-2Fpsxoz9-2FtpNjsUVHpTBnFulHSKYgj239U8BSndlVFfop-2BNco07si36w-2BeJXVxQPlZlzyE-2Fz7Vg2YTziEIHtyVwtt4AGajw-3D-3D	Get hash	malicious	Browse
	https://lostbussiness.com/add2.exe	Get hash	malicious	Browse
	Invoice#0036473 .xlsx	Get hash	malicious	Browse
	Invoice#0036473 .xlsx	Get hash	malicious	Browse
	https://access-payment-request.com	Get hash	malicious	Browse
	https://2caxbnk.me/PSD2/clients/	Get hash	malicious	Browse
	http://rdpolo.xyz/xLXTqRmT?	Get hash	malicious	Browse
	https://officesharepoint-microsoft.nimbusweb.me/share/7180759/nrwc6k8nkclqdtv309ot	Get hash	malicious	Browse
	http://185.220.101.42	Get hash	malicious	Browse
	https://plate.seamonkey.es/gotodate/go%20seamonkey.es/gotodate/	Get hash	malicious	Browse
	test@somewhere.com.html	Get hash	malicious	Browse
	test@barclays.com.html	Get hash	malicious	Browse
	https://gmail.us14.list-manage.com/track/click?u=957e6b6833ddd63bbe471b4e4&id=18858b02d6&e=7ce018b90e#giangaddo.prati@barilla.com	Get hash	malicious	Browse
	https://gmail.us14.list-manage.com/track/click?u=957e6b6833ddd63bbe471b4e4&id=18858b02d6&e=7ce018b90e#giangaddo.prati@barilla.com	Get hash	malicious	Browse

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ClosingDoc.html

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

HTML

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Persistence and Installation Behavior

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic

C:\Users\user\AppData\Local\Google\Chrome\User Data\05177d59-1ac6-4172-bf90-9d4d0db75458.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\1fdbc81e-f4a3-46ca-976b-5297dc767efc.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\3d732c96-1dcf-4e61-bc21-37146533d5ef.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\45a7e7c8-6f04-47c9-8c63-6dcef45a9b89.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\53914a93-2093-4aa7-bad6-935287d288ca.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\5cdc808e-57e4-41f1-a10d-f9e756319a36.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\6f8db5c9-c440-491e-8eaa-2f7057031dca.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\712d8625-191a-4a96-a318-238daa121581.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\71a01078-cc72-4fff-b45e-ed1d8da38a74.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\7d14a367-b8b6-461c-813a-e2d51bb03563.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\837a1e94-5d5e-4253-a0d2-1101a64e776f.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\91617a51-4ee5-494c-9fe1-a96fc9306244.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\00afc427-620e-441b-9d55-f2fccb3b72e8.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\1958cd92-269a-440d-94ce-21e9cf707246.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\64fa19b3-e5c0-44bf-bb7e-f771696cfb5c.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\8573d12c-b96a-4d16-917b-88ec3b064883.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\969bdb64-81a0-4122-9156-01dfb77266cc.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata\computed_hashes.json

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\000003.log

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG.old (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Provider Cache

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network Persistent State (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Preferences (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences (copy)

Windows Analysis Report
ClosingDoc.html

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
37f463bf4616ecd445d4a1937da06e19	http://d0edsbfmqucaulbq5ew3tn6o.greathem.ws/ozljha.php/1A0u168m9jilc04y9rn61gx1wd90ta330v/skk/017g2	Get hash	malicious	Browse	13.107.219.60 152.199.23.37
	https://yielding-cliff-weather.glitch.me/JHindex.html	Get hash	malicious	Browse	13.107.219.60 152.199.23.37
	https://u27457241.ct.sendgrid.net/ls/click?upn=gU5vgDjVhsr8xBWi9KbyhCmRGj-2Bhghe49Z0FiLcWjrB3-2BHjpRZrJUn0d0SGBkXrx6oN6ZDJ2BS4RqE-2FwX06Vp6CNzr5fnG8rLhZtVfnefSs-3DAxs4_-2BYPg4XG7CFcrtVeqe-2FEiJSrJo19pXwJ6tXzH5pmmxxnbXO272-2BI29kN-2BvjWAIpglbQXOPOiRaJAAdguTnhglHj-2BjiZuY-2Bl2yPjdcSrK-2F9ezebjhFVSInURAAh0NL7wSvgIxrQfzCizFzhR7FuzvZGAC9IXJiD5MvT-2BM-2Bord7nJExCKq3jFy6KjuvaLIUZjyvy957XsqnMttci2nlXO0KBQ-3D-3D	Get hash	malicious	Browse	13.107.219.60 152.199.23.37
	General Terms and Conditions for Purchase-pdf.exe	Get hash	malicious	Browse	13.107.219.60 152.199.23.37
	RFQ-Documentation-20220630085917-pdf.exe	Get hash	malicious	Browse	13.107.219.60 152.199.23.37
	Non-Disclosure Secrecy Agreement-pdf.exe	Get hash	malicious	Browse	13.107.219.60 152.199.23.37
	New Order 56723SCF..exe	Get hash	malicious	Browse	13.107.219.60 152.199.23.37
	Invoice#0036473 .xlsx	Get hash	malicious	Browse	13.107.219.60 152.199.23.37
	kCOumBbsqj.exe	Get hash	malicious	Browse	13.107.219.60 152.199.23.37
	kCOumBbsqj.exe	Get hash	malicious	Browse	13.107.219.60 152.199.23.37
	Jvcfjyquhiqpaeumsljfzajfmzhrlkhzot.exe	Get hash	malicious	Browse	13.107.219.60 152.199.23.37
	fUw7YerT47.exe	Get hash	malicious	Browse	13.107.219.60 152.199.23.37
	https://gmail.us14.list-manage.com/track/click?u=957e6b6833ddd63bbe471b4e4&id=18858b02d6&e=7ce018b90e#giangaddo.prati@barilla.com	Get hash	malicious	Browse	13.107.219.60 152.199.23.37
	https://gmail.us14.list-manage.com/track/click?u=957e6b6833ddd63bbe471b4e4&id=18858b02d6&e=7ce018b90e#giangaddo.prati@barilla.com	Get hash	malicious	Browse	13.107.219.60 152.199.23.37
	SecuriteInfo.com.Variant.Zusy.427939.15383.exe	Get hash	malicious	Browse	13.107.219.60 152.199.23.37
	SecuriteInfo.com.Variant.Zusy.427939.774.exe	Get hash	malicious	Browse	13.107.219.60 152.199.23.37
	SecuriteInfo.com.Variant.Zusy.427939.11600.exe	Get hash	malicious	Browse	13.107.219.60 152.199.23.37
	Invoice#0036473 .xlsx	Get hash	malicious	Browse	13.107.219.60 152.199.23.37
	VbB5NfogWg.exe	Get hash	malicious	Browse	13.107.219.60 152.199.23.37
	COA_PL_INV_BL_098765432123456789098765.exe	Get hash	malicious	Browse	13.107.219.60 152.199.23.37

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	451603
Entropy (8bit):	5.009711072558331
Encrypted:	false
SSDEEP:	12288:ZHfRTyGZ6lup8Cfrvq4JBPKh+FBlESBw4p6:NfOCzvRKhGvwJ
MD5:	A78AD14E77147E7DE3647E61964C0335
SHA1:	CECC3DD41F4CEA0192B24300C71E1911BD4FCE45
SHA-256:	0D6803758FF8F87081FAFD62E90F0950DFB2DD7991E9607FE76A8F92D0E893FA
SHA-512:	DDE24D5AD50D68FC91E9E325D31E66EF8F624B6BB3A07D14FFED1104D3AB5F4EF1D7969A5CDE0DFBB19CB31C506F7DE97AF67C2F244F7E7E8E10648EA8321101
Malicious:	false
Reputation:	high, very likely benign file
Preview:	BDic.... ....6...."..Z..4g....6.2...{/...3...5....AF 1363.AF nm.AF pt.AF n1.AF p.AF tc.AF SM.AF M.AF S.AF MS.AF MNR.AF GDS.AF MNT.AF MH.AF MR.AF SZMR.AF MJ.AF MT.AF MY.AF MRZ.AF MN.AF MG.AF RM.AF N.AF MV.AF XM.AF DSM.AF SD.AF G.AF R.AF MNX.AF MRS.AF MD.AF MNRB.AF B.AF ZSMR.AF PM.AF SMNGJ.AF SMN.AF ZMR.AF SMGB.AF MZR.AF GM.AF SMR.AF SMDG.AF RMZ.AF ZM.AF MDG.AF MDT.AF SMNXT.AF SDY.AF LSDG.AF LGDS.AF GLDS.AF UY.AF U.AF DSGNX.AF GNDSX.AF DSG.AF Y.AF GS.AF IEMS.AF YP.AF ZGDRS.AF XGNVDS.AF UT.AF GNDS.AF GVDS.AF MYPS.AF XGNDS.AF TPRY.AF MDSG.AF ZGSDR.AF DYSG.AF PMYTNS.AF AGDS.AF DRZGS.AF PY.AF GSPMDY.AF EGVDS.AF SL.AF GNXDS.AF DSBG.AF IM.AF I.AF MDGS.AF SMY.AF DSGN.AF DSLG.AF GMDS.AF MDSBG.AF SGD.AF IY.AF P.AF DSMG.AF BLZGDRS.AF TR.AF AGSD.AF ZGBDRSL.AF PTRY.AF ASDGV.AF ASM.AF ICANGSD.AF ICAM.AF IKY.AF AMS.AF PMYTRS.AF BZGVDRS.AF SDRBZG.AF GVMDS.AF PSM.AF DGLS.AF GNVXDS.AF AGDSL.AF DGS.AF XDSGNV.AF BZGDRS.AF AM.AF AS.AF A.AF LDSG.AF AGVDS.AF SDG.AF LDSMG.AF EDSMG.AF EY.AF DRSMZG.AF PRYT.AF LZ

File type:	HTML document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
Entropy (8bit):	5.494595862449742
TrID:	HyperText Markup Language (31031/1) 100.00%
File name:	ClosingDoc.html
File size:	13026
MD5:	3755ba4cfcde83ecc11643096b157366
SHA1:	058fa6f78bf7369e33c0881cb8bf6d07a6bbb9ba
SHA256:	1b174509a2b0400085d634439672ed977c4cd733537ad47e6c0061d4d60c767a
SHA512:	2b3ba3734e05d7ce5917809fefb4f74e6f7cb423c07d7e20684c87dfc05c4dcc8f0294af9eea66df63a563a8128e93aa94d68430384ee2210856706c50285ece
SSDEEP:	384:qzhN62qXvhMhKehjpEEJPe680mmRM970OEZfI4mEZN38R0:q1KvhMhKehjGEJPe680mmRM99MfI4lN1
TLSH:	4C42EA80FE96802E4C450E991F7DEC29E5DF9C751DE89322EB4688DDB5CC860C5B8CB9
File Content Preview:	<script type="text/javascript">..// <![CDATA[..function rot13(i){return i.replace(/[a-zA-Z]/g,function(c){return String.fromCharCode((c<="Z"?90:122)>=(c=c.charCodeAt(0)+13)?c:c-26)})}..function WriteHTMLtoJS(){..document.write(rot13("<?cuc\nvs (vffrg($_TR

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 1, 2022 20:56:59.650552988 CEST	49752	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:56:59.650594950 CEST	443	49752	152.199.23.37	192.168.2.6
Jul 1, 2022 20:56:59.650655031 CEST	49753	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:56:59.650686026 CEST	443	49753	152.199.23.37	192.168.2.6
Jul 1, 2022 20:56:59.650769949 CEST	49753	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:56:59.651458025 CEST	49754	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:56:59.651495934 CEST	49752	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:56:59.651506901 CEST	443	49754	152.199.23.37	192.168.2.6
Jul 1, 2022 20:56:59.651593924 CEST	49754	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:56:59.652249098 CEST	49756	443	192.168.2.6	172.217.16.205
Jul 1, 2022 20:56:59.652280092 CEST	443	49756	172.217.16.205	192.168.2.6
Jul 1, 2022 20:56:59.652355909 CEST	49756	443	192.168.2.6	172.217.16.205
Jul 1, 2022 20:56:59.652688026 CEST	49757	443	192.168.2.6	142.250.185.142
Jul 1, 2022 20:56:59.652719975 CEST	443	49757	142.250.185.142	192.168.2.6
Jul 1, 2022 20:56:59.652889013 CEST	49757	443	192.168.2.6	142.250.185.142
Jul 1, 2022 20:56:59.654237032 CEST	49752	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:56:59.654262066 CEST	443	49752	152.199.23.37	192.168.2.6
Jul 1, 2022 20:56:59.661186934 CEST	49753	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:56:59.661225080 CEST	443	49753	152.199.23.37	192.168.2.6
Jul 1, 2022 20:56:59.661474943 CEST	49754	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:56:59.661504030 CEST	443	49754	152.199.23.37	192.168.2.6
Jul 1, 2022 20:56:59.661856890 CEST	49756	443	192.168.2.6	172.217.16.205
Jul 1, 2022 20:56:59.661886930 CEST	443	49756	172.217.16.205	192.168.2.6
Jul 1, 2022 20:56:59.662316084 CEST	49757	443	192.168.2.6	142.250.185.142
Jul 1, 2022 20:56:59.662343979 CEST	443	49757	142.250.185.142	192.168.2.6
Jul 1, 2022 20:56:59.662708044 CEST	49758	443	192.168.2.6	13.107.219.60
Jul 1, 2022 20:56:59.662736893 CEST	443	49758	13.107.219.60	192.168.2.6
Jul 1, 2022 20:56:59.662838936 CEST	49758	443	192.168.2.6	13.107.219.60
Jul 1, 2022 20:56:59.663167953 CEST	49758	443	192.168.2.6	13.107.219.60
Jul 1, 2022 20:56:59.663186073 CEST	443	49758	13.107.219.60	192.168.2.6
Jul 1, 2022 20:56:59.717387915 CEST	443	49757	142.250.185.142	192.168.2.6
Jul 1, 2022 20:56:59.720567942 CEST	49757	443	192.168.2.6	142.250.185.142
Jul 1, 2022 20:56:59.720588923 CEST	443	49757	142.250.185.142	192.168.2.6
Jul 1, 2022 20:56:59.721013069 CEST	443	49757	142.250.185.142	192.168.2.6
Jul 1, 2022 20:56:59.721571922 CEST	443	49756	172.217.16.205	192.168.2.6
Jul 1, 2022 20:56:59.721854925 CEST	443	49757	142.250.185.142	192.168.2.6
Jul 1, 2022 20:56:59.721889019 CEST	49757	443	192.168.2.6	142.250.185.142
Jul 1, 2022 20:56:59.721905947 CEST	443	49757	142.250.185.142	192.168.2.6
Jul 1, 2022 20:56:59.721941948 CEST	49757	443	192.168.2.6	142.250.185.142
Jul 1, 2022 20:56:59.722049952 CEST	443	49752	152.199.23.37	192.168.2.6
Jul 1, 2022 20:56:59.727895975 CEST	49756	443	192.168.2.6	172.217.16.205
Jul 1, 2022 20:56:59.727930069 CEST	443	49756	172.217.16.205	192.168.2.6
Jul 1, 2022 20:56:59.729331017 CEST	49752	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:56:59.729340076 CEST	443	49754	152.199.23.37	192.168.2.6
Jul 1, 2022 20:56:59.729379892 CEST	443	49752	152.199.23.37	192.168.2.6
Jul 1, 2022 20:56:59.729875088 CEST	49754	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:56:59.729907990 CEST	443	49754	152.199.23.37	192.168.2.6
Jul 1, 2022 20:56:59.730326891 CEST	443	49753	152.199.23.37	192.168.2.6
Jul 1, 2022 20:56:59.730493069 CEST	443	49752	152.199.23.37	192.168.2.6
Jul 1, 2022 20:56:59.730664015 CEST	49752	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:56:59.730860949 CEST	49753	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:56:59.730889082 CEST	443	49753	152.199.23.37	192.168.2.6
Jul 1, 2022 20:56:59.731182098 CEST	443	49756	172.217.16.205	192.168.2.6
Jul 1, 2022 20:56:59.731281042 CEST	49756	443	192.168.2.6	172.217.16.205
Jul 1, 2022 20:56:59.731817961 CEST	443	49754	152.199.23.37	192.168.2.6
Jul 1, 2022 20:56:59.731924057 CEST	49754	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:56:59.733412981 CEST	443	49753	152.199.23.37	192.168.2.6
Jul 1, 2022 20:56:59.733431101 CEST	443	49758	13.107.219.60	192.168.2.6
Jul 1, 2022 20:56:59.733537912 CEST	49753	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:56:59.733889103 CEST	49758	443	192.168.2.6	13.107.219.60
Jul 1, 2022 20:56:59.733952045 CEST	443	49758	13.107.219.60	192.168.2.6
Jul 1, 2022 20:56:59.735017061 CEST	443	49758	13.107.219.60	192.168.2.6
Jul 1, 2022 20:56:59.735166073 CEST	49758	443	192.168.2.6	13.107.219.60
Jul 1, 2022 20:56:59.816518068 CEST	49757	443	192.168.2.6	142.250.185.142
Jul 1, 2022 20:57:00.409077883 CEST	49752	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:57:00.409285069 CEST	443	49752	152.199.23.37	192.168.2.6
Jul 1, 2022 20:57:00.409497023 CEST	49756	443	192.168.2.6	172.217.16.205
Jul 1, 2022 20:57:00.409638882 CEST	49757	443	192.168.2.6	142.250.185.142
Jul 1, 2022 20:57:00.409704924 CEST	443	49756	172.217.16.205	192.168.2.6
Jul 1, 2022 20:57:00.409853935 CEST	443	49757	142.250.185.142	192.168.2.6
Jul 1, 2022 20:57:00.411454916 CEST	49758	443	192.168.2.6	13.107.219.60
Jul 1, 2022 20:57:00.411623955 CEST	443	49758	13.107.219.60	192.168.2.6
Jul 1, 2022 20:57:00.411633968 CEST	49754	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:57:00.411792040 CEST	443	49754	152.199.23.37	192.168.2.6
Jul 1, 2022 20:57:00.412892103 CEST	49753	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:57:00.413127899 CEST	443	49753	152.199.23.37	192.168.2.6
Jul 1, 2022 20:57:00.413362980 CEST	49752	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:57:00.413393974 CEST	443	49752	152.199.23.37	192.168.2.6
Jul 1, 2022 20:57:00.413621902 CEST	49756	443	192.168.2.6	172.217.16.205
Jul 1, 2022 20:57:00.413647890 CEST	443	49756	172.217.16.205	192.168.2.6
Jul 1, 2022 20:57:00.413743973 CEST	49757	443	192.168.2.6	142.250.185.142
Jul 1, 2022 20:57:00.413760900 CEST	443	49757	142.250.185.142	192.168.2.6
Jul 1, 2022 20:57:00.414211988 CEST	49758	443	192.168.2.6	13.107.219.60
Jul 1, 2022 20:57:00.414237976 CEST	443	49758	13.107.219.60	192.168.2.6
Jul 1, 2022 20:57:00.414279938 CEST	49754	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:57:00.414316893 CEST	443	49754	152.199.23.37	192.168.2.6
Jul 1, 2022 20:57:00.414381981 CEST	49753	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:57:00.414407969 CEST	443	49753	152.199.23.37	192.168.2.6
Jul 1, 2022 20:57:00.434899092 CEST	443	49758	13.107.219.60	192.168.2.6
Jul 1, 2022 20:57:00.434911013 CEST	443	49752	152.199.23.37	192.168.2.6
Jul 1, 2022 20:57:00.434981108 CEST	49758	443	192.168.2.6	13.107.219.60
Jul 1, 2022 20:57:00.435003996 CEST	443	49758	13.107.219.60	192.168.2.6
Jul 1, 2022 20:57:00.435022116 CEST	443	49758	13.107.219.60	192.168.2.6
Jul 1, 2022 20:57:00.435043097 CEST	49752	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:57:00.435059071 CEST	443	49752	152.199.23.37	192.168.2.6
Jul 1, 2022 20:57:00.435082912 CEST	443	49752	152.199.23.37	192.168.2.6
Jul 1, 2022 20:57:00.435092926 CEST	49758	443	192.168.2.6	13.107.219.60
Jul 1, 2022 20:57:00.435162067 CEST	49752	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:57:00.436729908 CEST	443	49754	152.199.23.37	192.168.2.6
Jul 1, 2022 20:57:00.436803102 CEST	443	49754	152.199.23.37	192.168.2.6
Jul 1, 2022 20:57:00.436825991 CEST	49754	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:57:00.436861992 CEST	49754	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:57:00.441171885 CEST	443	49753	152.199.23.37	192.168.2.6
Jul 1, 2022 20:57:00.441270113 CEST	443	49753	152.199.23.37	192.168.2.6
Jul 1, 2022 20:57:00.441291094 CEST	49753	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:57:00.441344976 CEST	49753	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:57:00.446188927 CEST	49758	443	192.168.2.6	13.107.219.60
Jul 1, 2022 20:57:00.446223021 CEST	443	49758	13.107.219.60	192.168.2.6
Jul 1, 2022 20:57:00.446741104 CEST	443	49757	142.250.185.142	192.168.2.6
Jul 1, 2022 20:57:00.446827888 CEST	49757	443	192.168.2.6	142.250.185.142
Jul 1, 2022 20:57:00.446851015 CEST	443	49757	142.250.185.142	192.168.2.6
Jul 1, 2022 20:57:00.446945906 CEST	443	49757	142.250.185.142	192.168.2.6
Jul 1, 2022 20:57:00.447004080 CEST	49757	443	192.168.2.6	142.250.185.142
Jul 1, 2022 20:57:00.451980114 CEST	49757	443	192.168.2.6	142.250.185.142
Jul 1, 2022 20:57:00.452011108 CEST	443	49757	142.250.185.142	192.168.2.6
Jul 1, 2022 20:57:00.465024948 CEST	443	49756	172.217.16.205	192.168.2.6
Jul 1, 2022 20:57:00.465154886 CEST	49756	443	192.168.2.6	172.217.16.205
Jul 1, 2022 20:57:00.465162992 CEST	443	49756	172.217.16.205	192.168.2.6
Jul 1, 2022 20:57:00.465241909 CEST	49756	443	192.168.2.6	172.217.16.205
Jul 1, 2022 20:57:00.472222090 CEST	49756	443	192.168.2.6	172.217.16.205
Jul 1, 2022 20:57:00.472250938 CEST	443	49756	172.217.16.205	192.168.2.6
Jul 1, 2022 20:57:00.492984056 CEST	49752	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:57:00.493037939 CEST	443	49752	152.199.23.37	192.168.2.6
Jul 1, 2022 20:57:00.558363914 CEST	49754	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:57:00.558402061 CEST	443	49754	152.199.23.37	192.168.2.6
Jul 1, 2022 20:57:00.559659958 CEST	49753	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:57:00.559714079 CEST	443	49753	152.199.23.37	192.168.2.6
Jul 1, 2022 20:57:00.732403994 CEST	49766	443	192.168.2.6	13.107.219.60
Jul 1, 2022 20:57:00.732428074 CEST	443	49766	13.107.219.60	192.168.2.6
Jul 1, 2022 20:57:00.732501030 CEST	49766	443	192.168.2.6	13.107.219.60
Jul 1, 2022 20:57:00.732845068 CEST	49766	443	192.168.2.6	13.107.219.60
Jul 1, 2022 20:57:00.732858896 CEST	443	49766	13.107.219.60	192.168.2.6
Jul 1, 2022 20:57:00.800945997 CEST	443	49766	13.107.219.60	192.168.2.6
Jul 1, 2022 20:57:00.812597990 CEST	49766	443	192.168.2.6	13.107.219.60
Jul 1, 2022 20:57:00.812643051 CEST	443	49766	13.107.219.60	192.168.2.6
Jul 1, 2022 20:57:00.813422918 CEST	443	49766	13.107.219.60	192.168.2.6
Jul 1, 2022 20:57:00.814023972 CEST	49766	443	192.168.2.6	13.107.219.60
Jul 1, 2022 20:57:00.814172029 CEST	49766	443	192.168.2.6	13.107.219.60
Jul 1, 2022 20:57:00.814182997 CEST	443	49766	13.107.219.60	192.168.2.6
Jul 1, 2022 20:57:00.814204931 CEST	443	49766	13.107.219.60	192.168.2.6
Jul 1, 2022 20:57:00.837119102 CEST	443	49766	13.107.219.60	192.168.2.6
Jul 1, 2022 20:57:00.837162971 CEST	443	49766	13.107.219.60	192.168.2.6
Jul 1, 2022 20:57:00.837213993 CEST	49766	443	192.168.2.6	13.107.219.60
Jul 1, 2022 20:57:00.837253094 CEST	443	49766	13.107.219.60	192.168.2.6
Jul 1, 2022 20:57:00.837270975 CEST	49766	443	192.168.2.6	13.107.219.60
Jul 1, 2022 20:57:00.837285042 CEST	443	49766	13.107.219.60	192.168.2.6
Jul 1, 2022 20:57:00.837327957 CEST	49766	443	192.168.2.6	13.107.219.60
Jul 1, 2022 20:57:00.837344885 CEST	443	49766	13.107.219.60	192.168.2.6
Jul 1, 2022 20:57:00.837389946 CEST	49766	443	192.168.2.6	13.107.219.60
Jul 1, 2022 20:57:00.837393999 CEST	443	49766	13.107.219.60	192.168.2.6
Jul 1, 2022 20:57:00.837480068 CEST	49766	443	192.168.2.6	13.107.219.60
Jul 1, 2022 20:57:00.843039036 CEST	49766	443	192.168.2.6	13.107.219.60
Jul 1, 2022 20:57:00.843075991 CEST	443	49766	13.107.219.60	192.168.2.6
Jul 1, 2022 20:57:01.559931993 CEST	49775	443	192.168.2.6	13.107.219.60
Jul 1, 2022 20:57:01.559974909 CEST	443	49775	13.107.219.60	192.168.2.6
Jul 1, 2022 20:57:01.560122013 CEST	49775	443	192.168.2.6	13.107.219.60
Jul 1, 2022 20:57:01.563168049 CEST	49775	443	192.168.2.6	13.107.219.60
Jul 1, 2022 20:57:01.563185930 CEST	443	49775	13.107.219.60	192.168.2.6
Jul 1, 2022 20:57:01.630620956 CEST	443	49775	13.107.219.60	192.168.2.6
Jul 1, 2022 20:57:01.630747080 CEST	49775	443	192.168.2.6	13.107.219.60
Jul 1, 2022 20:57:01.663147926 CEST	49775	443	192.168.2.6	13.107.219.60
Jul 1, 2022 20:57:01.663177967 CEST	443	49775	13.107.219.60	192.168.2.6
Jul 1, 2022 20:57:01.663697958 CEST	443	49775	13.107.219.60	192.168.2.6
Jul 1, 2022 20:57:01.663772106 CEST	49775	443	192.168.2.6	13.107.219.60
Jul 1, 2022 20:57:01.665554047 CEST	49775	443	192.168.2.6	13.107.219.60
Jul 1, 2022 20:57:01.675112009 CEST	49778	443	192.168.2.6	13.107.219.60
Jul 1, 2022 20:57:01.675157070 CEST	443	49778	13.107.219.60	192.168.2.6
Jul 1, 2022 20:57:01.675237894 CEST	49778	443	192.168.2.6	13.107.219.60
Jul 1, 2022 20:57:01.675558090 CEST	49778	443	192.168.2.6	13.107.219.60
Jul 1, 2022 20:57:01.675575972 CEST	443	49778	13.107.219.60	192.168.2.6
Jul 1, 2022 20:57:01.680284023 CEST	49779	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:57:01.680352926 CEST	443	49779	152.199.23.37	192.168.2.6
Jul 1, 2022 20:57:01.680399895 CEST	49780	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:57:01.680438042 CEST	443	49780	152.199.23.37	192.168.2.6
Jul 1, 2022 20:57:01.680464983 CEST	49779	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:57:01.680499077 CEST	49780	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:57:01.680824041 CEST	49779	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:57:01.680855989 CEST	443	49779	152.199.23.37	192.168.2.6
Jul 1, 2022 20:57:01.680917978 CEST	49780	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:57:01.680941105 CEST	443	49780	152.199.23.37	192.168.2.6
Jul 1, 2022 20:57:01.688662052 CEST	443	49775	13.107.219.60	192.168.2.6
Jul 1, 2022 20:57:01.688719988 CEST	443	49775	13.107.219.60	192.168.2.6
Jul 1, 2022 20:57:01.688759089 CEST	443	49775	13.107.219.60	192.168.2.6
Jul 1, 2022 20:57:01.688816071 CEST	49775	443	192.168.2.6	13.107.219.60
Jul 1, 2022 20:57:01.688872099 CEST	49775	443	192.168.2.6	13.107.219.60
Jul 1, 2022 20:57:01.688888073 CEST	443	49775	13.107.219.60	192.168.2.6
Jul 1, 2022 20:57:01.688930988 CEST	443	49775	13.107.219.60	192.168.2.6
Jul 1, 2022 20:57:01.688972950 CEST	49775	443	192.168.2.6	13.107.219.60
Jul 1, 2022 20:57:01.689008951 CEST	49775	443	192.168.2.6	13.107.219.60
Jul 1, 2022 20:57:01.692974091 CEST	49775	443	192.168.2.6	13.107.219.60
Jul 1, 2022 20:57:01.693001986 CEST	443	49775	13.107.219.60	192.168.2.6
Jul 1, 2022 20:57:01.738890886 CEST	443	49779	152.199.23.37	192.168.2.6
Jul 1, 2022 20:57:01.739104986 CEST	49779	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:57:01.740571976 CEST	443	49778	13.107.219.60	192.168.2.6
Jul 1, 2022 20:57:01.740767002 CEST	49778	443	192.168.2.6	13.107.219.60
Jul 1, 2022 20:57:01.742280960 CEST	49778	443	192.168.2.6	13.107.219.60
Jul 1, 2022 20:57:01.742302895 CEST	443	49778	13.107.219.60	192.168.2.6
Jul 1, 2022 20:57:01.743971109 CEST	49778	443	192.168.2.6	13.107.219.60
Jul 1, 2022 20:57:01.743990898 CEST	443	49778	13.107.219.60	192.168.2.6
Jul 1, 2022 20:57:01.745950937 CEST	49779	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:57:01.746000051 CEST	443	49779	152.199.23.37	192.168.2.6
Jul 1, 2022 20:57:01.746474028 CEST	443	49779	152.199.23.37	192.168.2.6
Jul 1, 2022 20:57:01.746572018 CEST	49779	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:57:01.746993065 CEST	49779	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:57:01.747227907 CEST	443	49780	152.199.23.37	192.168.2.6
Jul 1, 2022 20:57:01.747330904 CEST	49780	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:57:01.750909090 CEST	49780	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:57:01.750926018 CEST	443	49780	152.199.23.37	192.168.2.6
Jul 1, 2022 20:57:01.751292944 CEST	443	49780	152.199.23.37	192.168.2.6
Jul 1, 2022 20:57:01.751404047 CEST	49780	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:57:01.751852036 CEST	49780	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:57:01.764864922 CEST	443	49778	13.107.219.60	192.168.2.6
Jul 1, 2022 20:57:01.764942884 CEST	443	49778	13.107.219.60	192.168.2.6
Jul 1, 2022 20:57:01.764990091 CEST	49778	443	192.168.2.6	13.107.219.60
Jul 1, 2022 20:57:01.765031099 CEST	49778	443	192.168.2.6	13.107.219.60
Jul 1, 2022 20:57:01.768573999 CEST	49778	443	192.168.2.6	13.107.219.60
Jul 1, 2022 20:57:01.768616915 CEST	443	49778	13.107.219.60	192.168.2.6
Jul 1, 2022 20:57:01.771938086 CEST	443	49779	152.199.23.37	192.168.2.6
Jul 1, 2022 20:57:01.772079945 CEST	49779	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:57:01.772209883 CEST	443	49779	152.199.23.37	192.168.2.6
Jul 1, 2022 20:57:01.772320986 CEST	49779	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:57:01.772335052 CEST	443	49779	152.199.23.37	192.168.2.6
Jul 1, 2022 20:57:01.772377014 CEST	443	49779	152.199.23.37	192.168.2.6
Jul 1, 2022 20:57:01.772399902 CEST	49779	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:57:01.772448063 CEST	49779	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:57:01.777461052 CEST	49779	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:57:01.777503014 CEST	443	49779	152.199.23.37	192.168.2.6
Jul 1, 2022 20:57:01.778018951 CEST	49782	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:57:01.778055906 CEST	443	49782	152.199.23.37	192.168.2.6
Jul 1, 2022 20:57:01.778141022 CEST	49782	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:57:01.778548002 CEST	49782	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:57:01.778564930 CEST	443	49782	152.199.23.37	192.168.2.6
Jul 1, 2022 20:57:01.786602974 CEST	443	49780	152.199.23.37	192.168.2.6
Jul 1, 2022 20:57:01.786674023 CEST	443	49780	152.199.23.37	192.168.2.6
Jul 1, 2022 20:57:01.786704063 CEST	49780	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:57:01.786717892 CEST	443	49780	152.199.23.37	192.168.2.6
Jul 1, 2022 20:57:01.786737919 CEST	443	49780	152.199.23.37	192.168.2.6
Jul 1, 2022 20:57:01.786761045 CEST	49780	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:57:01.786830902 CEST	49780	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:57:01.790770054 CEST	49780	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:57:01.790795088 CEST	443	49780	152.199.23.37	192.168.2.6
Jul 1, 2022 20:57:01.842137098 CEST	443	49782	152.199.23.37	192.168.2.6
Jul 1, 2022 20:57:01.842263937 CEST	49782	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:57:01.844693899 CEST	49782	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:57:01.844712019 CEST	443	49782	152.199.23.37	192.168.2.6
Jul 1, 2022 20:57:01.846390963 CEST	49782	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:57:01.846406937 CEST	443	49782	152.199.23.37	192.168.2.6
Jul 1, 2022 20:57:01.882572889 CEST	443	49782	152.199.23.37	192.168.2.6
Jul 1, 2022 20:57:01.882669926 CEST	443	49782	152.199.23.37	192.168.2.6
Jul 1, 2022 20:57:01.882713079 CEST	49782	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:57:01.882735014 CEST	443	49782	152.199.23.37	192.168.2.6
Jul 1, 2022 20:57:01.882749081 CEST	49782	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:57:01.882756948 CEST	443	49782	152.199.23.37	192.168.2.6
Jul 1, 2022 20:57:01.882792950 CEST	49782	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:57:01.882823944 CEST	49782	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:57:01.884548903 CEST	49782	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:57:01.884579897 CEST	443	49782	152.199.23.37	192.168.2.6
Jul 1, 2022 20:57:12.751346111 CEST	49798	443	192.168.2.6	142.250.185.142
Jul 1, 2022 20:57:12.751400948 CEST	443	49798	142.250.185.142	192.168.2.6
Jul 1, 2022 20:57:12.751540899 CEST	49798	443	192.168.2.6	142.250.185.142
Jul 1, 2022 20:57:12.753351927 CEST	49798	443	192.168.2.6	142.250.185.142
Jul 1, 2022 20:57:12.753372908 CEST	443	49798	142.250.185.142	192.168.2.6
Jul 1, 2022 20:57:12.802247047 CEST	443	49798	142.250.185.142	192.168.2.6
Jul 1, 2022 20:57:12.803514004 CEST	49798	443	192.168.2.6	142.250.185.142
Jul 1, 2022 20:57:12.803549051 CEST	443	49798	142.250.185.142	192.168.2.6
Jul 1, 2022 20:57:12.804132938 CEST	443	49798	142.250.185.142	192.168.2.6
Jul 1, 2022 20:57:12.805459023 CEST	49798	443	192.168.2.6	142.250.185.142
Jul 1, 2022 20:57:12.805612087 CEST	443	49798	142.250.185.142	192.168.2.6
Jul 1, 2022 20:57:12.917820930 CEST	49798	443	192.168.2.6	142.250.185.142
Jul 1, 2022 20:57:22.909215927 CEST	49798	443	192.168.2.6	142.250.185.142
Jul 1, 2022 20:57:22.909550905 CEST	443	49798	142.250.185.142	192.168.2.6
Jul 1, 2022 20:57:22.909600973 CEST	443	49798	142.250.185.142	192.168.2.6
Jul 1, 2022 20:57:22.909624100 CEST	49798	443	192.168.2.6	142.250.185.142
Jul 1, 2022 20:57:22.909655094 CEST	49798	443	192.168.2.6	142.250.185.142

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 1, 2022 20:56:59.607244968 CEST	51748	53	192.168.2.6	8.8.8.8
Jul 1, 2022 20:56:59.607728004 CEST	61116	53	192.168.2.6	8.8.8.8
Jul 1, 2022 20:56:59.609332085 CEST	50958	53	192.168.2.6	8.8.8.8
Jul 1, 2022 20:56:59.610646963 CEST	49695	53	192.168.2.6	8.8.8.8
Jul 1, 2022 20:56:59.632010937 CEST	53	61116	8.8.8.8	192.168.2.6
Jul 1, 2022 20:56:59.637995958 CEST	53	51748	8.8.8.8	192.168.2.6
Jul 1, 2022 20:56:59.638426065 CEST	53	49695	8.8.8.8	192.168.2.6
Jul 1, 2022 20:57:01.659256935 CEST	51666	53	192.168.2.6	8.8.8.8
Jul 1, 2022 20:57:01.679250002 CEST	53	51666	8.8.8.8	192.168.2.6
Jul 1, 2022 20:57:10.410531998 CEST	52091	443	192.168.2.6	142.250.185.142
Jul 1, 2022 20:57:10.437146902 CEST	443	52091	142.250.185.142	192.168.2.6
Jul 1, 2022 20:57:10.466590881 CEST	52091	443	192.168.2.6	142.250.185.142
Jul 1, 2022 20:57:10.492902994 CEST	443	52091	142.250.185.142	192.168.2.6
Jul 1, 2022 20:57:10.492961884 CEST	443	52091	142.250.185.142	192.168.2.6
Jul 1, 2022 20:57:10.493002892 CEST	443	52091	142.250.185.142	192.168.2.6
Jul 1, 2022 20:57:10.493043900 CEST	443	52091	142.250.185.142	192.168.2.6
Jul 1, 2022 20:57:10.616821051 CEST	443	52091	142.250.185.142	192.168.2.6
Jul 1, 2022 20:57:10.616863966 CEST	443	52091	142.250.185.142	192.168.2.6
Jul 1, 2022 20:57:10.616890907 CEST	443	52091	142.250.185.142	192.168.2.6
Jul 1, 2022 20:57:10.616914988 CEST	443	52091	142.250.185.142	192.168.2.6
Jul 1, 2022 20:57:10.763015985 CEST	443	52091	142.250.185.142	192.168.2.6
Jul 1, 2022 20:57:10.763045073 CEST	443	52091	142.250.185.142	192.168.2.6
Jul 1, 2022 20:57:10.763062954 CEST	443	52091	142.250.185.142	192.168.2.6
Jul 1, 2022 20:57:10.763079882 CEST	443	52091	142.250.185.142	192.168.2.6
Jul 1, 2022 20:57:11.056320906 CEST	443	52091	142.250.185.142	192.168.2.6
Jul 1, 2022 20:57:11.056355000 CEST	443	52091	142.250.185.142	192.168.2.6
Jul 1, 2022 20:57:11.056380987 CEST	443	52091	142.250.185.142	192.168.2.6
Jul 1, 2022 20:57:11.056389093 CEST	443	52091	142.250.185.142	192.168.2.6
Jul 1, 2022 20:57:11.640305042 CEST	443	52091	142.250.185.142	192.168.2.6
Jul 1, 2022 20:57:11.640341997 CEST	443	52091	142.250.185.142	192.168.2.6
Jul 1, 2022 20:57:11.640360117 CEST	443	52091	142.250.185.142	192.168.2.6
Jul 1, 2022 20:57:11.640373945 CEST	443	52091	142.250.185.142	192.168.2.6
Jul 1, 2022 20:57:12.681159973 CEST	52091	443	192.168.2.6	142.250.185.142
Jul 1, 2022 20:57:12.700391054 CEST	443	52091	142.250.185.142	192.168.2.6
Jul 1, 2022 20:57:12.700427055 CEST	443	52091	142.250.185.142	192.168.2.6
Jul 1, 2022 20:57:12.741673946 CEST	52091	443	192.168.2.6	142.250.185.142
Jul 1, 2022 20:57:12.751703024 CEST	52091	443	192.168.2.6	142.250.185.142
Jul 1, 2022 20:57:12.751874924 CEST	52091	443	192.168.2.6	142.250.185.142
Jul 1, 2022 20:57:12.752037048 CEST	52091	443	192.168.2.6	142.250.185.142
Jul 1, 2022 20:57:12.752121925 CEST	52091	443	192.168.2.6	142.250.185.142
Jul 1, 2022 20:57:12.752190113 CEST	52091	443	192.168.2.6	142.250.185.142
Jul 1, 2022 20:57:12.752394915 CEST	52091	443	192.168.2.6	142.250.185.142
Jul 1, 2022 20:57:12.752456903 CEST	52091	443	192.168.2.6	142.250.185.142
Jul 1, 2022 20:57:12.752531052 CEST	52091	443	192.168.2.6	142.250.185.142
Jul 1, 2022 20:57:12.752603054 CEST	52091	443	192.168.2.6	142.250.185.142
Jul 1, 2022 20:57:12.768074036 CEST	52091	443	192.168.2.6	142.250.185.142
Jul 1, 2022 20:57:12.770061970 CEST	52091	443	192.168.2.6	142.250.185.142
Jul 1, 2022 20:57:12.801403046 CEST	443	52091	142.250.185.142	192.168.2.6
Jul 1, 2022 20:57:12.803262949 CEST	52091	443	192.168.2.6	142.250.185.142
Jul 1, 2022 20:57:12.813108921 CEST	443	52091	142.250.185.142	192.168.2.6
Jul 1, 2022 20:57:12.813138008 CEST	443	52091	142.250.185.142	192.168.2.6
Jul 1, 2022 20:57:12.813152075 CEST	443	52091	142.250.185.142	192.168.2.6
Jul 1, 2022 20:57:12.814902067 CEST	52091	443	192.168.2.6	142.250.185.142
Jul 1, 2022 20:57:12.840781927 CEST	52091	443	192.168.2.6	142.250.185.142

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jul 1, 2022 20:56:59.630891085 CEST	8.8.8.8	192.168.2.6	0xf6ca	No error (0)	code.jquery.com	cds.s5x3j6q5.hwcdn.net		CNAME (Canonical name)	IN (0x0001)
Jul 1, 2022 20:56:59.632010937 CEST	8.8.8.8	192.168.2.6	0x79bd	No error (0)	aadcdn.msftauth.net	cs1100.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)
Jul 1, 2022 20:56:59.632010937 CEST	8.8.8.8	192.168.2.6	0x79bd	No error (0)	cs1100.wpc.omegacdn.net		152.199.23.37	A (IP address)	IN (0x0001)
Jul 1, 2022 20:56:59.637995958 CEST	8.8.8.8	192.168.2.6	0x8e69	No error (0)	accounts.google.com		172.217.16.205	A (IP address)	IN (0x0001)
Jul 1, 2022 20:56:59.638426065 CEST	8.8.8.8	192.168.2.6	0x59d0	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)
Jul 1, 2022 20:56:59.638426065 CEST	8.8.8.8	192.168.2.6	0x59d0	No error (0)	clients.l.google.com		142.250.185.142	A (IP address)	IN (0x0001)
Jul 1, 2022 20:56:59.652978897 CEST	8.8.8.8	192.168.2.6	0x2fc9	No error (0)	dual.part-0032.t-0009.t-msedge.net	global-entry-afdthirdparty-fallback.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)
Jul 1, 2022 20:56:59.652978897 CEST	8.8.8.8	192.168.2.6	0x2fc9	No error (0)	dual.part-0032.t-0009.fbs1-t-msedge.net	part-0032.t-0009.fbs1-t-msedge.net		CNAME (Canonical name)	IN (0x0001)
Jul 1, 2022 20:56:59.652978897 CEST	8.8.8.8	192.168.2.6	0x2fc9	No error (0)	part-0032.t-0009.fbs1-t-msedge.net		13.107.219.60	A (IP address)	IN (0x0001)
Jul 1, 2022 20:56:59.652978897 CEST	8.8.8.8	192.168.2.6	0x2fc9	No error (0)	part-0032.t-0009.fbs1-t-msedge.net		13.107.227.60	A (IP address)	IN (0x0001)
Jul 1, 2022 20:57:01.542516947 CEST	8.8.8.8	192.168.2.6	0xe482	No error (0)	dual.part-0032.t-0009.t-msedge.net	global-entry-afdthirdparty-fallback.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)
Jul 1, 2022 20:57:01.542516947 CEST	8.8.8.8	192.168.2.6	0xe482	No error (0)	dual.part-0032.t-0009.fbs1-t-msedge.net	part-0032.t-0009.fbs1-t-msedge.net		CNAME (Canonical name)	IN (0x0001)
Jul 1, 2022 20:57:01.542516947 CEST	8.8.8.8	192.168.2.6	0xe482	No error (0)	part-0032.t-0009.fbs1-t-msedge.net		13.107.219.60	A (IP address)	IN (0x0001)
Jul 1, 2022 20:57:01.542516947 CEST	8.8.8.8	192.168.2.6	0xe482	No error (0)	part-0032.t-0009.fbs1-t-msedge.net		13.107.227.60	A (IP address)	IN (0x0001)
Jul 1, 2022 20:57:01.679250002 CEST	8.8.8.8	192.168.2.6	0xa0a4	No error (0)	aadcdn.msftauth.net	cs1100.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)
Jul 1, 2022 20:57:01.679250002 CEST	8.8.8.8	192.168.2.6	0xa0a4	No error (0)	cs1100.wpc.omegacdn.net		152.199.23.37	A (IP address)	IN (0x0001)

Timestamp	kBytes transferred	Direction	Data
2022-07-01 18:57:00 UTC	0	OUT	GET /shared/1.0/content/images/applogos/53_8b36337037cff88c3df203bb73d58e41.png HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-07-01 18:57:00 UTC	3	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding Age: 833388 Cache-Control: public, max-age=31536000 Content-MD5: izYzcDfP+Iw98gO7c9WOQQ== Content-Type: image/png Date: Fri, 01 Jul 2022 18:57:00 GMT Etag: 0x8D7AF695D6C58F2 Last-Modified: Wed, 12 Feb 2020 03:12:17 GMT Server: ECAcc (frc/8FBC) X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 1182cd20-c01e-004f-3ae7-851dc4000000 x-ms-version: 2009-09-19 Content-Length: 5139 Connection: close
2022-07-01 18:57:00 UTC	5	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 56 00 00 00 48 08 06 00 00 00 ad 04 dd dc 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 25 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 38 20 37 39 2e 31 36 34 30 33 36 2c 20 32 30 31 39 2f 30 38 2f 31 33 2d 30 31 3a 30 36 3a 35 37 20 20 Data Ascii: PNGIHDRVHtEXtSoftwareAdobe ImageReadyqe<%iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57

Timestamp	kBytes transferred	Direction	Data
2022-07-01 18:57:00 UTC	0	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-07-01 18:57:00 UTC	0	OUT	Data Raw: 20 Data Ascii:
2022-07-01 18:57:00 UTC	18	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 01 Jul 2022 18:57:00 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-tqYaZrQ1VOt65Xt1We3JxQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'nonce-tqYaZrQ1VOt65Xt1We3JxQ' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Report-To: {"group":"IdentityListAccountsHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/IdentityListAccountsHttp/external"}]} Cross-Origin-Opener-Policy: same-origin; report-to="IdentityListAccountsHttp" Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-07-01 18:57:00 UTC	20	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2022-07-01 18:57:00 UTC	20	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-07-01 18:57:01 UTC	57	OUT	GET /shared/1.0/content/images/applogos/53_8b36337037cff88c3df203bb73d58e41.png HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36 Host: aadcdn.msftauth.net
2022-07-01 18:57:01 UTC	63	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding Age: 833389 Cache-Control: public, max-age=31536000 Content-MD5: izYzcDfP+Iw98gO7c9WOQQ== Content-Type: image/png Date: Fri, 01 Jul 2022 18:57:01 GMT Etag: 0x8D7AF695D6C58F2 Last-Modified: Wed, 12 Feb 2020 03:12:17 GMT Server: ECAcc (frc/8FBC) X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 1182cd20-c01e-004f-3ae7-851dc4000000 x-ms-version: 2009-09-19 Content-Length: 5139 Connection: close
2022-07-01 18:57:01 UTC	63	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 56 00 00 00 48 08 06 00 00 00 ad 04 dd dc 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 25 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 38 20 37 39 2e 31 36 34 30 33 36 2c 20 32 30 31 39 2f 30 38 2f 31 33 2d 30 31 3a 30 36 3a 35 37 20 20 Data Ascii: PNGIHDRVHtEXtSoftwareAdobe ImageReadyqe<%iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57

Timestamp	kBytes transferred	Direction	Data
2022-07-01 18:57:01 UTC	68	OUT	GET /shared/1.0/content/images/signin-options_4e48046ce74f4b89d45037c90576bfac.svg HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36 Host: aadcdn.msftauth.net
2022-07-01 18:57:01 UTC	69	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 29356739 Cache-Control: public, max-age=31536000 Content-MD5: R2FAVxfpONfnQAuxVxXbHg== Content-Type: image/svg+xml Date: Fri, 01 Jul 2022 18:57:01 GMT Etag: 0x8D8852A740F01B9 Last-Modified: Tue, 10 Nov 2020 03:41:05 GMT Server: ECAcc (frc/8FFC) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: a3f9aa36-901e-008e-257c-82e72e000000 x-ms-version: 2009-09-19 Content-Length: 1592 Connection: close
2022-07-01 18:57:01 UTC	69	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 34 38 22 20 68 65 69 67 68 74 3d 22 34 38 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 34 38 20 34 38 22 3e 3c 64 65 66 73 3e 3c 73 74 79 6c 65 3e 2e 61 7b 66 69 6c 6c 3a 6e 6f 6e 65 3b 7d 2e 62 7b 66 69 6c 6c 3a 23 34 30 34 30 34 30 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 64 65 66 73 3e 3c 72 65 63 74 20 63 6c 61 73 73 3d 22 61 22 20 77 69 64 74 68 3d 22 34 38 22 20 68 65 69 67 68 74 3d 22 34 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 62 22 20 64 3d 22 4d 34 30 2c 33 32 2e 35 37 38 56 34 30 48 33 32 56 33 36 48 32 38 56 33 32 48 32 34 56 32 38 2e 37 36 36 41 31 30 2e 36 38 39 2c 31 30 2e 36 38 39 2c 30 2c 30 2c Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 48 48"><defs><style>.a{fill:none;}.b{fill:#404040;}</style></defs><rect class="a" width="48" height="48"/><path class="b" d="M40,32.578V40H32V36H28V32H24V28.766A10.689,10.689,0,0,