Edit tour

Windows Analysis Report
ClosingDoc.html

Overview

General Information

Sample Name:	ClosingDoc.html
Analysis ID:	655873
MD5:	3755ba4cfcde83ecc11643096b157366
SHA1:	058fa6f78bf7369e33c0881cb8bf6d07a6bbb9ba
SHA256:	1b174509a2b0400085d634439672ed977c4cd733537ad47e6c0061d4d60c767a
Infos:

Detection

HTMLPhisher

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Phishing site detected (based on favicon image match)

Yara detected HtmlPhish10

HTML document with suspicious title

Phishing site detected (based on logo template match)

Phishing site detected (based on image similarity)

Invalid 'forgot password' link found

None HTTPS page querying sensitive user data (password, username or email)

No HTML title found

JA3 SSL client fingerprint seen in connection with other malware

HTML body contains low number of good links

IP address seen in connection with other malware

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5412 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "C:\Users\user\Desktop\ClosingDoc.html MD5: C139654B5C1438A95B321BB01AD63EF6)

chrome.exe (PID: 5052 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1580,15663332800411292547,1156807434197202323,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1920 /prefetch:8 MD5: C139654B5C1438A95B321BB01AD63EF6)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author	Strings
87841.0.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: file:///C:/Users/user/Desktop/ClosingDoc.html	HTTP Parser: Invalid link: Forgot my password
Source: file:///C:/Users/user/Desktop/ClosingDoc.html	HTTP Parser: Invalid link: Forgot my password

Source: file:///C:/Users/user/Desktop/ClosingDoc.html	HTTP Parser: Has password / email / username input fields
Source: file:///C:/Users/user/Desktop/ClosingDoc.html	HTTP Parser: Has password / email / username input fields

Source: file:///C:/Users/user/Desktop/ClosingDoc.html	HTTP Parser: HTML title missing
Source: file:///C:/Users/user/Desktop/ClosingDoc.html	HTTP Parser: HTML title missing

Source: file:///C:/Users/user/Desktop/ClosingDoc.html	HTTP Parser: Number of links: 0
Source: file:///C:/Users/user/Desktop/ClosingDoc.html	HTTP Parser: Number of links: 0

Source: file:///C:/Users/user/Desktop/ClosingDoc.html	HTTP Parser: No <meta name="author".. found
Source: file:///C:/Users/user/Desktop/ClosingDoc.html	HTTP Parser: No <meta name="author".. found

Source: file:///C:/Users/user/Desktop/ClosingDoc.html	HTTP Parser: No <meta name="copyright".. found
Source: file:///C:/Users/user/Desktop/ClosingDoc.html	HTTP Parser: No <meta name="copyright".. found

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic			Jump to behavior

Source: unknown	HTTPS traffic detected: 13.107.219.60:443 -> 192.168.2.6:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.23.37:443 -> 192.168.2.6:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.23.37:443 -> 192.168.2.6:49780 version: TLS 1.2

Source: Joe Sandbox View	IP Address: 13.107.219.60 13.107.219.60
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443

Source: Ruleset Data.0.dr	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: Filtering Rules.0.dr, Ruleset Data.0.dr	String found in binary or memory: www.facebook.com/ajax/ads/ equals www.facebook.com (Facebook)
Source: Filtering Rules.0.dr	String found in binary or memory: www.facebook.com0 equals www.facebook.com (Facebook)

Source: pnacl_public_x86_64_pnacl_sz_nexe.0.dr, pnacl_public_x86_64_pnacl_llc_nexe.0.dr	String found in binary or memory: http://llvm.org/):
Source: ef0232b0-f2c9-454e-8a64-e82d66657865.tmp.1.dr	String found in binary or memory: https://accounts.google.com
Source: craw_window.js.0.dr	String found in binary or memory: https://accounts.google.com/MergeSession
Source: ef0232b0-f2c9-454e-8a64-e82d66657865.tmp.1.dr	String found in binary or memory: https://apis.google.com
Source: pnacl_public_x86_64_crtend_o.0.dr, pnacl_public_x86_64_ld_nexe.0.dr	String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-clang.git
Source: pnacl_public_x86_64_crtend_o.0.dr, pnacl_public_x86_64_ld_nexe.0.dr	String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-llvm.git
Source: ef0232b0-f2c9-454e-8a64-e82d66657865.tmp.1.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json1.0.dr, manifest.json.0.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: ef0232b0-f2c9-454e-8a64-e82d66657865.tmp.1.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: pnacl_public_x86_64_ld_nexe.0.dr	String found in binary or memory: https://code.google.com/p/nativeclient/issues/entry
Source: pnacl_public_x86_64_ld_nexe.0.dr	String found in binary or memory: https://code.google.com/p/nativeclient/issues/entry%s:
Source: LICENSE.txt.0.dr	String found in binary or memory: https://creativecommons.org/.
Source: LICENSE.txt.0.dr	String found in binary or memory: https://creativecommons.org/compatiblelicenses
Source: d5b098ac-4631-4a9e-b4a4-5f95b793f089.tmp.1.dr, ef0232b0-f2c9-454e-8a64-e82d66657865.tmp.1.dr	String found in binary or memory: https://dns.google
Source: LICENSE.txt.0.dr	String found in binary or memory: https://easylist.to/)
Source: ef0232b0-f2c9-454e-8a64-e82d66657865.tmp.1.dr	String found in binary or memory: https://fonts.gstatic.com
Source: LICENSE.txt.0.dr	String found in binary or memory: https://github.com/easylist)
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p
Source: ef0232b0-f2c9-454e-8a64-e82d66657865.tmp.1.dr	String found in binary or memory: https://ogs.google.com
Source: craw_window.js.0.dr, manifest.json.0.dr	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: ef0232b0-f2c9-454e-8a64-e82d66657865.tmp.1.dr	String found in binary or memory: https://r1---sn-1gi7znek.gvt1.com
Source: ef0232b0-f2c9-454e-8a64-e82d66657865.tmp.1.dr	String found in binary or memory: https://redirector.gvt1.com
Source: craw_window.js.0.dr, manifest.json.0.dr	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: ef0232b0-f2c9-454e-8a64-e82d66657865.tmp.1.dr	String found in binary or memory: https://ssl.gstatic.com
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://www-googleapis-staging.sandbox.google.com
Source: ef0232b0-f2c9-454e-8a64-e82d66657865.tmp.1.dr	String found in binary or memory: https://www.google.com
Source: manifest.json.0.dr	String found in binary or memory: https://www.google.com/
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/accounts/OAuthLogin?issueuberauth=1
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/cleardot.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/dot2.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/x2.gif
Source: craw_background.js.0.dr	String found in binary or memory: https://www.google.com/intl/en-US/chrome/blank.html
Source: craw_window.js.0.dr, craw_background.js.0.dr, ef0232b0-f2c9-454e-8a64-e82d66657865.tmp.1.dr	String found in binary or memory: https://www.googleapis.com
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: ef0232b0-f2c9-454e-8a64-e82d66657865.tmp.1.dr	String found in binary or memory: https://www.gstatic.com

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	3 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	3 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	4 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	1 Ingress Tool Transfer	SIM Card Swap		Carrier Billing Fraud

Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/applogos/53_8b36337037cff88c3df203bb73d58e41.png HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfmX-Goog-Update-Updater: chromecrx-85.0.4183.121Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/appbackgrounds/49-small_e58aafc980614a9cd7796bea7b5ea8f0.jpg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/signin-options_4e48046ce74f4b89d45037c90576bfac.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: aadcdn.msauth.net
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/appbackgrounds/49-small_e58aafc980614a9cd7796bea7b5ea8f0.jpg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: aadcdn.msauth.net
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: aadcdn.msftauth.net
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/applogos/53_8b36337037cff88c3df203bb73d58e41.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: aadcdn.msftauth.net
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/signin-options_4e48046ce74f4b89d45037c90576bfac.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: aadcdn.msftauth.net

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "C:\Users\user\Desktop\ClosingDoc.html
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1580,15663332800411292547,1156807434197202323,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1920 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1580,15663332800411292547,1156807434197202323,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1920 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source	Detection	Scanner	Link
C:\Users\user\AppData\Local\Temp\5412_515056959\_platform_specific\x86_64\pnacl_public_x86_64_ld_nexe	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\5412_515056959\_platform_specific\x86_64\pnacl_public_x86_64_ld_nexe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\5412_515056959\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_llc_nexe	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\5412_515056959\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_llc_nexe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\5412_515056959\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_sz_nexe	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\5412_515056959\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_sz_nexe	0%	ReversingLabs

Source	Detection	Scanner	Label
https://dns.google	0%	URL Reputation	safe
https://aadcdn.msftauth.net/shared/1.0/content/images/signin-options_4e48046ce74f4b89d45037c90576bfac.svg	0%	URL Reputation	safe
https://aadcdn.msftauth.net/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg	0%	URL Reputation	safe
https://aadcdn.msftauth.net/shared/1.0/content/images/applogos/53_8b36337037cff88c3df203bb73d58e41.png	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
cs1100.wpc.omegacdn.net	152.199.23.37	true	false	unknown
accounts.google.com	172.217.16.205	true	false	high
clients.l.google.com	142.250.185.142	true	false	high
part-0032.t-0009.fbs1-t-msedge.net	13.107.219.60	true	false	unknown
clients2.google.com	unknown	unknown	false	high
code.jquery.com	unknown	unknown	false	high
aadcdn.msftauth.net	unknown	unknown	false	unknown

Name	Malicious	Antivirus Detection	Reputation
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1	false		high
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false		high
file:///C:/Users/user/Desktop/ClosingDoc.html	true		low
https://aadcdn.msftauth.net/shared/1.0/content/images/signin-options_4e48046ce74f4b89d45037c90576bfac.svg	false	URL Reputation: safe	unknown
https://aadcdn.msftauth.net/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg	false	URL Reputation: safe	unknown
https://aadcdn.msftauth.net/shared/1.0/content/images/applogos/53_8b36337037cff88c3df203bb73d58e41.png	false	Avira URL Cloud: safe	unknown

Name	Source	Malicious	Antivirus Detection	Reputation
https://dns.google	d5b098ac-4631-4a9e-b4a4-5f95b793f089.tmp.1.dr, ef0232b0-f2c9-454e-8a64-e82d66657865.tmp.1.dr	false	URL Reputation: safe	unknown
https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p	craw_window.js.0.dr, craw_background.js.0.dr	false		high
https://www.google.com/intl/en-US/chrome/blank.html	craw_background.js.0.dr	false		high
https://ogs.google.com	ef0232b0-f2c9-454e-8a64-e82d66657865.tmp.1.dr	false		high
https://www.google.com/images/cleardot.gif	craw_window.js.0.dr	false		high
https://payments.google.com/payments/v4/js/integrator.js	craw_window.js.0.dr, manifest.json.0.dr	false		high
https://chromium.googlesource.com/a/native_client/pnacl-llvm.git	pnacl_public_x86_64_crtend_o.0.dr, pnacl_public_x86_64_ld_nexe.0.dr	false		high
https://easylist.to/)	LICENSE.txt.0.dr	false		high
https://sandbox.google.com/payments/v4/js/integrator.js	craw_window.js.0.dr, manifest.json.0.dr	false		high
https://www.google.com/images/x2.gif	craw_window.js.0.dr	false		high
https://accounts.google.com/MergeSession	craw_window.js.0.dr	false		high
http://llvm.org/):	pnacl_public_x86_64_pnacl_sz_nexe.0.dr, pnacl_public_x86_64_pnacl_llc_nexe.0.dr	false		high
https://creativecommons.org/compatiblelicenses	LICENSE.txt.0.dr	false		high
https://www.google.com	ef0232b0-f2c9-454e-8a64-e82d66657865.tmp.1.dr	false		high
https://www.google.com/images/dot2.gif	craw_window.js.0.dr	false		high
https://github.com/easylist)	LICENSE.txt.0.dr	false		high
https://creativecommons.org/.	LICENSE.txt.0.dr	false		high
https://code.google.com/p/nativeclient/issues/entry%s:	pnacl_public_x86_64_ld_nexe.0.dr	false		high
https://code.google.com/p/nativeclient/issues/entry	pnacl_public_x86_64_ld_nexe.0.dr	false		high
https://accounts.google.com	ef0232b0-f2c9-454e-8a64-e82d66657865.tmp.1.dr	false		high
https://clients2.googleusercontent.com	ef0232b0-f2c9-454e-8a64-e82d66657865.tmp.1.dr	false		high
https://apis.google.com	ef0232b0-f2c9-454e-8a64-e82d66657865.tmp.1.dr	false		high
https://www.google.com/accounts/OAuthLogin?issueuberauth=1	craw_window.js.0.dr	false		high
https://www.google.com/	manifest.json.0.dr	false		high
https://www-googleapis-staging.sandbox.google.com	craw_window.js.0.dr, craw_background.js.0.dr	false		high
https://chromium.googlesource.com/a/native_client/pnacl-clang.git	pnacl_public_x86_64_crtend_o.0.dr, pnacl_public_x86_64_ld_nexe.0.dr	false		high
https://clients2.google.com	ef0232b0-f2c9-454e-8a64-e82d66657865.tmp.1.dr	false		high
https://clients2.google.com/service/update2/crx	manifest.json1.0.dr, manifest.json.0.dr	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.219.60	part-0032.t-0009.fbs1-t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.217.16.205	accounts.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.185.142	clients.l.google.com	United States	15169	GOOGLEUS	false
152.199.23.37	cs1100.wpc.omegacdn.net	United States	15133	EDGECASTUS	false

Joe Sandbox Version:	35.0.0 Citrine
Analysis ID:	655873
Start date and time: 01/07/202220:55:44	2022-07-01 20:55:44 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 23s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	ClosingDoc.html
Cookbook file name:	defaultwindowshtmlcookbook.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal68.phis.winHTML@29/128@5/7
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .html Adjust boot time Enable AMSI

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	451603
Entropy (8bit):	5.009711072558331
Encrypted:	false
SSDEEP:	12288:ZHfRTyGZ6lup8Cfrvq4JBPKh+FBlESBw4p6:NfOCzvRKhGvwJ
MD5:	A78AD14E77147E7DE3647E61964C0335
SHA1:	CECC3DD41F4CEA0192B24300C71E1911BD4FCE45
SHA-256:	0D6803758FF8F87081FAFD62E90F0950DFB2DD7991E9607FE76A8F92D0E893FA
SHA-512:	DDE24D5AD50D68FC91E9E325D31E66EF8F624B6BB3A07D14FFED1104D3AB5F4EF1D7969A5CDE0DFBB19CB31C506F7DE97AF67C2F244F7E7E8E10648EA8321101
Malicious:	false
Reputation:	high, very likely benign file
Preview:	BDic.... ....6...."..Z..4g....6.2...{/...3...5....AF 1363.AF nm.AF pt.AF n1.AF p.AF tc.AF SM.AF M.AF S.AF MS.AF MNR.AF GDS.AF MNT.AF MH.AF MR.AF SZMR.AF MJ.AF MT.AF MY.AF MRZ.AF MN.AF MG.AF RM.AF N.AF MV.AF XM.AF DSM.AF SD.AF G.AF R.AF MNX.AF MRS.AF MD.AF MNRB.AF B.AF ZSMR.AF PM.AF SMNGJ.AF SMN.AF ZMR.AF SMGB.AF MZR.AF GM.AF SMR.AF SMDG.AF RMZ.AF ZM.AF MDG.AF MDT.AF SMNXT.AF SDY.AF LSDG.AF LGDS.AF GLDS.AF UY.AF U.AF DSGNX.AF GNDSX.AF DSG.AF Y.AF GS.AF IEMS.AF YP.AF ZGDRS.AF XGNVDS.AF UT.AF GNDS.AF GVDS.AF MYPS.AF XGNDS.AF TPRY.AF MDSG.AF ZGSDR.AF DYSG.AF PMYTNS.AF AGDS.AF DRZGS.AF PY.AF GSPMDY.AF EGVDS.AF SL.AF GNXDS.AF DSBG.AF IM.AF I.AF MDGS.AF SMY.AF DSGN.AF DSLG.AF GMDS.AF MDSBG.AF SGD.AF IY.AF P.AF DSMG.AF BLZGDRS.AF TR.AF AGSD.AF ZGBDRSL.AF PTRY.AF ASDGV.AF ASM.AF ICANGSD.AF ICAM.AF IKY.AF AMS.AF PMYTRS.AF BZGVDRS.AF SDRBZG.AF GVMDS.AF PSM.AF DGLS.AF GNVXDS.AF AGDSL.AF DGS.AF XDSGNV.AF BZGDRS.AF AM.AF AS.AF A.AF LDSG.AF AGVDS.AF SDG.AF LDSMG.AF EDSMG.AF EY.AF DRSMZG.AF PRYT.AF LZ

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ClosingDoc.html

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

HTML

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Persistence and Installation Behavior

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic

C:\Users\user\AppData\Local\Google\Chrome\User Data\05177d59-1ac6-4172-bf90-9d4d0db75458.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\1fdbc81e-f4a3-46ca-976b-5297dc767efc.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\3d732c96-1dcf-4e61-bc21-37146533d5ef.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\45a7e7c8-6f04-47c9-8c63-6dcef45a9b89.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\53914a93-2093-4aa7-bad6-935287d288ca.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\5cdc808e-57e4-41f1-a10d-f9e756319a36.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\6f8db5c9-c440-491e-8eaa-2f7057031dca.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\712d8625-191a-4a96-a318-238daa121581.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\71a01078-cc72-4fff-b45e-ed1d8da38a74.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\7d14a367-b8b6-461c-813a-e2d51bb03563.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\837a1e94-5d5e-4253-a0d2-1101a64e776f.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\91617a51-4ee5-494c-9fe1-a96fc9306244.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\00afc427-620e-441b-9d55-f2fccb3b72e8.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\1958cd92-269a-440d-94ce-21e9cf707246.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\64fa19b3-e5c0-44bf-bb7e-f771696cfb5c.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\8573d12c-b96a-4d16-917b-88ec3b064883.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\969bdb64-81a0-4122-9156-01dfb77266cc.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata\computed_hashes.json

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\000003.log

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG.old (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Provider Cache

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network Persistent State (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Preferences (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences (copy)

Windows Analysis Report
ClosingDoc.html

File type:	HTML document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
Entropy (8bit):	5.494595862449742
TrID:	HyperText Markup Language (31031/1) 100.00%
File name:	ClosingDoc.html
File size:	13026
MD5:	3755ba4cfcde83ecc11643096b157366
SHA1:	058fa6f78bf7369e33c0881cb8bf6d07a6bbb9ba
SHA256:	1b174509a2b0400085d634439672ed977c4cd733537ad47e6c0061d4d60c767a
SHA512:	2b3ba3734e05d7ce5917809fefb4f74e6f7cb423c07d7e20684c87dfc05c4dcc8f0294af9eea66df63a563a8128e93aa94d68430384ee2210856706c50285ece
SSDEEP:	384:qzhN62qXvhMhKehjpEEJPe680mmRM970OEZfI4mEZN38R0:q1KvhMhKehjGEJPe680mmRM99MfI4lN1
TLSH:	4C42EA80FE96802E4C450E991F7DEC29E5DF9C751DE89322EB4688DDB5CC860C5B8CB9
File Content Preview:	<script type="text/javascript">..// <![CDATA[..function rot13(i){return i.replace(/[a-zA-Z]/g,function(c){return String.fromCharCode((c<="Z"?90:122)>=(c=c.charCodeAt(0)+13)?c:c-26)})}..function WriteHTMLtoJS(){..document.write(rot13("<?cuc\nvs (vffrg($_TR

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 1, 2022 20:56:59.650552988 CEST	49752	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:56:59.650594950 CEST	443	49752	152.199.23.37	192.168.2.6
Jul 1, 2022 20:56:59.650655031 CEST	49753	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:56:59.650686026 CEST	443	49753	152.199.23.37	192.168.2.6
Jul 1, 2022 20:56:59.650769949 CEST	49753	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:56:59.651458025 CEST	49754	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:56:59.651495934 CEST	49752	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:56:59.651506901 CEST	443	49754	152.199.23.37	192.168.2.6
Jul 1, 2022 20:56:59.651593924 CEST	49754	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:56:59.652249098 CEST	49756	443	192.168.2.6	172.217.16.205
Jul 1, 2022 20:56:59.652280092 CEST	443	49756	172.217.16.205	192.168.2.6
Jul 1, 2022 20:56:59.652355909 CEST	49756	443	192.168.2.6	172.217.16.205
Jul 1, 2022 20:56:59.652688026 CEST	49757	443	192.168.2.6	142.250.185.142
Jul 1, 2022 20:56:59.652719975 CEST	443	49757	142.250.185.142	192.168.2.6
Jul 1, 2022 20:56:59.652889013 CEST	49757	443	192.168.2.6	142.250.185.142
Jul 1, 2022 20:56:59.654237032 CEST	49752	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:56:59.654262066 CEST	443	49752	152.199.23.37	192.168.2.6
Jul 1, 2022 20:56:59.661186934 CEST	49753	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:56:59.661225080 CEST	443	49753	152.199.23.37	192.168.2.6
Jul 1, 2022 20:56:59.661474943 CEST	49754	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:56:59.661504030 CEST	443	49754	152.199.23.37	192.168.2.6
Jul 1, 2022 20:56:59.661856890 CEST	49756	443	192.168.2.6	172.217.16.205
Jul 1, 2022 20:56:59.661886930 CEST	443	49756	172.217.16.205	192.168.2.6
Jul 1, 2022 20:56:59.662316084 CEST	49757	443	192.168.2.6	142.250.185.142
Jul 1, 2022 20:56:59.662343979 CEST	443	49757	142.250.185.142	192.168.2.6
Jul 1, 2022 20:56:59.662708044 CEST	49758	443	192.168.2.6	13.107.219.60
Jul 1, 2022 20:56:59.662736893 CEST	443	49758	13.107.219.60	192.168.2.6
Jul 1, 2022 20:56:59.662838936 CEST	49758	443	192.168.2.6	13.107.219.60
Jul 1, 2022 20:56:59.663167953 CEST	49758	443	192.168.2.6	13.107.219.60
Jul 1, 2022 20:56:59.663186073 CEST	443	49758	13.107.219.60	192.168.2.6
Jul 1, 2022 20:56:59.717387915 CEST	443	49757	142.250.185.142	192.168.2.6
Jul 1, 2022 20:56:59.720567942 CEST	49757	443	192.168.2.6	142.250.185.142
Jul 1, 2022 20:56:59.720588923 CEST	443	49757	142.250.185.142	192.168.2.6
Jul 1, 2022 20:56:59.721013069 CEST	443	49757	142.250.185.142	192.168.2.6
Jul 1, 2022 20:56:59.721571922 CEST	443	49756	172.217.16.205	192.168.2.6
Jul 1, 2022 20:56:59.721854925 CEST	443	49757	142.250.185.142	192.168.2.6
Jul 1, 2022 20:56:59.721889019 CEST	49757	443	192.168.2.6	142.250.185.142
Jul 1, 2022 20:56:59.721905947 CEST	443	49757	142.250.185.142	192.168.2.6
Jul 1, 2022 20:56:59.721941948 CEST	49757	443	192.168.2.6	142.250.185.142
Jul 1, 2022 20:56:59.722049952 CEST	443	49752	152.199.23.37	192.168.2.6
Jul 1, 2022 20:56:59.727895975 CEST	49756	443	192.168.2.6	172.217.16.205
Jul 1, 2022 20:56:59.727930069 CEST	443	49756	172.217.16.205	192.168.2.6
Jul 1, 2022 20:56:59.729331017 CEST	49752	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:56:59.729340076 CEST	443	49754	152.199.23.37	192.168.2.6
Jul 1, 2022 20:56:59.729379892 CEST	443	49752	152.199.23.37	192.168.2.6
Jul 1, 2022 20:56:59.729875088 CEST	49754	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:56:59.729907990 CEST	443	49754	152.199.23.37	192.168.2.6
Jul 1, 2022 20:56:59.730326891 CEST	443	49753	152.199.23.37	192.168.2.6
Jul 1, 2022 20:56:59.730493069 CEST	443	49752	152.199.23.37	192.168.2.6
Jul 1, 2022 20:56:59.730664015 CEST	49752	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:56:59.730860949 CEST	49753	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:56:59.730889082 CEST	443	49753	152.199.23.37	192.168.2.6
Jul 1, 2022 20:56:59.731182098 CEST	443	49756	172.217.16.205	192.168.2.6
Jul 1, 2022 20:56:59.731281042 CEST	49756	443	192.168.2.6	172.217.16.205
Jul 1, 2022 20:56:59.731817961 CEST	443	49754	152.199.23.37	192.168.2.6
Jul 1, 2022 20:56:59.731924057 CEST	49754	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:56:59.733412981 CEST	443	49753	152.199.23.37	192.168.2.6
Jul 1, 2022 20:56:59.733431101 CEST	443	49758	13.107.219.60	192.168.2.6
Jul 1, 2022 20:56:59.733537912 CEST	49753	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:56:59.733889103 CEST	49758	443	192.168.2.6	13.107.219.60
Jul 1, 2022 20:56:59.733952045 CEST	443	49758	13.107.219.60	192.168.2.6
Jul 1, 2022 20:56:59.735017061 CEST	443	49758	13.107.219.60	192.168.2.6
Jul 1, 2022 20:56:59.735166073 CEST	49758	443	192.168.2.6	13.107.219.60
Jul 1, 2022 20:56:59.816518068 CEST	49757	443	192.168.2.6	142.250.185.142
Jul 1, 2022 20:57:00.409077883 CEST	49752	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:57:00.409285069 CEST	443	49752	152.199.23.37	192.168.2.6
Jul 1, 2022 20:57:00.409497023 CEST	49756	443	192.168.2.6	172.217.16.205
Jul 1, 2022 20:57:00.409638882 CEST	49757	443	192.168.2.6	142.250.185.142
Jul 1, 2022 20:57:00.409704924 CEST	443	49756	172.217.16.205	192.168.2.6
Jul 1, 2022 20:57:00.409853935 CEST	443	49757	142.250.185.142	192.168.2.6
Jul 1, 2022 20:57:00.411454916 CEST	49758	443	192.168.2.6	13.107.219.60
Jul 1, 2022 20:57:00.411623955 CEST	443	49758	13.107.219.60	192.168.2.6
Jul 1, 2022 20:57:00.411633968 CEST	49754	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:57:00.411792040 CEST	443	49754	152.199.23.37	192.168.2.6
Jul 1, 2022 20:57:00.412892103 CEST	49753	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:57:00.413127899 CEST	443	49753	152.199.23.37	192.168.2.6
Jul 1, 2022 20:57:00.413362980 CEST	49752	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:57:00.413393974 CEST	443	49752	152.199.23.37	192.168.2.6
Jul 1, 2022 20:57:00.413621902 CEST	49756	443	192.168.2.6	172.217.16.205
Jul 1, 2022 20:57:00.413647890 CEST	443	49756	172.217.16.205	192.168.2.6
Jul 1, 2022 20:57:00.413743973 CEST	49757	443	192.168.2.6	142.250.185.142
Jul 1, 2022 20:57:00.413760900 CEST	443	49757	142.250.185.142	192.168.2.6
Jul 1, 2022 20:57:00.414211988 CEST	49758	443	192.168.2.6	13.107.219.60
Jul 1, 2022 20:57:00.414237976 CEST	443	49758	13.107.219.60	192.168.2.6
Jul 1, 2022 20:57:00.414279938 CEST	49754	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:57:00.414316893 CEST	443	49754	152.199.23.37	192.168.2.6
Jul 1, 2022 20:57:00.414381981 CEST	49753	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:57:00.414407969 CEST	443	49753	152.199.23.37	192.168.2.6
Jul 1, 2022 20:57:00.434899092 CEST	443	49758	13.107.219.60	192.168.2.6
Jul 1, 2022 20:57:00.434911013 CEST	443	49752	152.199.23.37	192.168.2.6
Jul 1, 2022 20:57:00.434981108 CEST	49758	443	192.168.2.6	13.107.219.60
Jul 1, 2022 20:57:00.435003996 CEST	443	49758	13.107.219.60	192.168.2.6
Jul 1, 2022 20:57:00.435022116 CEST	443	49758	13.107.219.60	192.168.2.6
Jul 1, 2022 20:57:00.435043097 CEST	49752	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:57:00.435059071 CEST	443	49752	152.199.23.37	192.168.2.6
Jul 1, 2022 20:57:00.435082912 CEST	443	49752	152.199.23.37	192.168.2.6
Jul 1, 2022 20:57:00.435092926 CEST	49758	443	192.168.2.6	13.107.219.60
Jul 1, 2022 20:57:00.435162067 CEST	49752	443	192.168.2.6	152.199.23.37
Jul 1, 2022 20:57:00.436729908 CEST	443	49754	152.199.23.37	192.168.2.6
Jul 1, 2022 20:57:00.436803102 CEST	443	49754	152.199.23.37	192.168.2.6

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 1, 2022 20:56:59.607244968 CEST	51748	53	192.168.2.6	8.8.8.8
Jul 1, 2022 20:56:59.607728004 CEST	61116	53	192.168.2.6	8.8.8.8
Jul 1, 2022 20:56:59.609332085 CEST	50958	53	192.168.2.6	8.8.8.8
Jul 1, 2022 20:56:59.610646963 CEST	49695	53	192.168.2.6	8.8.8.8
Jul 1, 2022 20:56:59.632010937 CEST	53	61116	8.8.8.8	192.168.2.6
Jul 1, 2022 20:56:59.637995958 CEST	53	51748	8.8.8.8	192.168.2.6
Jul 1, 2022 20:56:59.638426065 CEST	53	49695	8.8.8.8	192.168.2.6
Jul 1, 2022 20:57:01.659256935 CEST	51666	53	192.168.2.6	8.8.8.8
Jul 1, 2022 20:57:01.679250002 CEST	53	51666	8.8.8.8	192.168.2.6
Jul 1, 2022 20:57:10.410531998 CEST	52091	443	192.168.2.6	142.250.185.142
Jul 1, 2022 20:57:10.437146902 CEST	443	52091	142.250.185.142	192.168.2.6
Jul 1, 2022 20:57:10.466590881 CEST	52091	443	192.168.2.6	142.250.185.142
Jul 1, 2022 20:57:10.492902994 CEST	443	52091	142.250.185.142	192.168.2.6
Jul 1, 2022 20:57:10.492961884 CEST	443	52091	142.250.185.142	192.168.2.6
Jul 1, 2022 20:57:10.493002892 CEST	443	52091	142.250.185.142	192.168.2.6
Jul 1, 2022 20:57:10.493043900 CEST	443	52091	142.250.185.142	192.168.2.6
Jul 1, 2022 20:57:10.616821051 CEST	443	52091	142.250.185.142	192.168.2.6
Jul 1, 2022 20:57:10.616863966 CEST	443	52091	142.250.185.142	192.168.2.6
Jul 1, 2022 20:57:10.616890907 CEST	443	52091	142.250.185.142	192.168.2.6
Jul 1, 2022 20:57:10.616914988 CEST	443	52091	142.250.185.142	192.168.2.6
Jul 1, 2022 20:57:10.763015985 CEST	443	52091	142.250.185.142	192.168.2.6
Jul 1, 2022 20:57:10.763045073 CEST	443	52091	142.250.185.142	192.168.2.6
Jul 1, 2022 20:57:10.763062954 CEST	443	52091	142.250.185.142	192.168.2.6
Jul 1, 2022 20:57:10.763079882 CEST	443	52091	142.250.185.142	192.168.2.6
Jul 1, 2022 20:57:11.056320906 CEST	443	52091	142.250.185.142	192.168.2.6
Jul 1, 2022 20:57:11.056355000 CEST	443	52091	142.250.185.142	192.168.2.6
Jul 1, 2022 20:57:11.056380987 CEST	443	52091	142.250.185.142	192.168.2.6
Jul 1, 2022 20:57:11.056389093 CEST	443	52091	142.250.185.142	192.168.2.6
Jul 1, 2022 20:57:11.640305042 CEST	443	52091	142.250.185.142	192.168.2.6
Jul 1, 2022 20:57:11.640341997 CEST	443	52091	142.250.185.142	192.168.2.6
Jul 1, 2022 20:57:11.640360117 CEST	443	52091	142.250.185.142	192.168.2.6
Jul 1, 2022 20:57:11.640373945 CEST	443	52091	142.250.185.142	192.168.2.6
Jul 1, 2022 20:57:12.681159973 CEST	52091	443	192.168.2.6	142.250.185.142
Jul 1, 2022 20:57:12.700391054 CEST	443	52091	142.250.185.142	192.168.2.6
Jul 1, 2022 20:57:12.700427055 CEST	443	52091	142.250.185.142	192.168.2.6
Jul 1, 2022 20:57:12.741673946 CEST	52091	443	192.168.2.6	142.250.185.142
Jul 1, 2022 20:57:12.751703024 CEST	52091	443	192.168.2.6	142.250.185.142
Jul 1, 2022 20:57:12.751874924 CEST	52091	443	192.168.2.6	142.250.185.142
Jul 1, 2022 20:57:12.752037048 CEST	52091	443	192.168.2.6	142.250.185.142
Jul 1, 2022 20:57:12.752121925 CEST	52091	443	192.168.2.6	142.250.185.142
Jul 1, 2022 20:57:12.752190113 CEST	52091	443	192.168.2.6	142.250.185.142
Jul 1, 2022 20:57:12.752394915 CEST	52091	443	192.168.2.6	142.250.185.142
Jul 1, 2022 20:57:12.752456903 CEST	52091	443	192.168.2.6	142.250.185.142
Jul 1, 2022 20:57:12.752531052 CEST	52091	443	192.168.2.6	142.250.185.142
Jul 1, 2022 20:57:12.752603054 CEST	52091	443	192.168.2.6	142.250.185.142
Jul 1, 2022 20:57:12.768074036 CEST	52091	443	192.168.2.6	142.250.185.142
Jul 1, 2022 20:57:12.770061970 CEST	52091	443	192.168.2.6	142.250.185.142
Jul 1, 2022 20:57:12.801403046 CEST	443	52091	142.250.185.142	192.168.2.6
Jul 1, 2022 20:57:12.803262949 CEST	52091	443	192.168.2.6	142.250.185.142
Jul 1, 2022 20:57:12.813108921 CEST	443	52091	142.250.185.142	192.168.2.6
Jul 1, 2022 20:57:12.813138008 CEST	443	52091	142.250.185.142	192.168.2.6
Jul 1, 2022 20:57:12.813152075 CEST	443	52091	142.250.185.142	192.168.2.6
Jul 1, 2022 20:57:12.814902067 CEST	52091	443	192.168.2.6	142.250.185.142
Jul 1, 2022 20:57:12.840781927 CEST	52091	443	192.168.2.6	142.250.185.142

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jul 1, 2022 20:56:59.630891085 CEST	8.8.8.8	192.168.2.6	0xf6ca	No error (0)	code.jquery.com	cds.s5x3j6q5.hwcdn.net		CNAME (Canonical name)	IN (0x0001)
Jul 1, 2022 20:56:59.632010937 CEST	8.8.8.8	192.168.2.6	0x79bd	No error (0)	aadcdn.msftauth.net	cs1100.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)
Jul 1, 2022 20:56:59.632010937 CEST	8.8.8.8	192.168.2.6	0x79bd	No error (0)	cs1100.wpc.omegacdn.net		152.199.23.37	A (IP address)	IN (0x0001)
Jul 1, 2022 20:56:59.637995958 CEST	8.8.8.8	192.168.2.6	0x8e69	No error (0)	accounts.google.com		172.217.16.205	A (IP address)	IN (0x0001)
Jul 1, 2022 20:56:59.638426065 CEST	8.8.8.8	192.168.2.6	0x59d0	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)
Jul 1, 2022 20:56:59.638426065 CEST	8.8.8.8	192.168.2.6	0x59d0	No error (0)	clients.l.google.com		142.250.185.142	A (IP address)	IN (0x0001)
Jul 1, 2022 20:56:59.652978897 CEST	8.8.8.8	192.168.2.6	0x2fc9	No error (0)	dual.part-0032.t-0009.t-msedge.net	global-entry-afdthirdparty-fallback.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)
Jul 1, 2022 20:56:59.652978897 CEST	8.8.8.8	192.168.2.6	0x2fc9	No error (0)	dual.part-0032.t-0009.fbs1-t-msedge.net	part-0032.t-0009.fbs1-t-msedge.net		CNAME (Canonical name)	IN (0x0001)
Jul 1, 2022 20:56:59.652978897 CEST	8.8.8.8	192.168.2.6	0x2fc9	No error (0)	part-0032.t-0009.fbs1-t-msedge.net		13.107.219.60	A (IP address)	IN (0x0001)
Jul 1, 2022 20:56:59.652978897 CEST	8.8.8.8	192.168.2.6	0x2fc9	No error (0)	part-0032.t-0009.fbs1-t-msedge.net		13.107.227.60	A (IP address)	IN (0x0001)
Jul 1, 2022 20:57:01.542516947 CEST	8.8.8.8	192.168.2.6	0xe482	No error (0)	dual.part-0032.t-0009.t-msedge.net	global-entry-afdthirdparty-fallback.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)
Jul 1, 2022 20:57:01.542516947 CEST	8.8.8.8	192.168.2.6	0xe482	No error (0)	dual.part-0032.t-0009.fbs1-t-msedge.net	part-0032.t-0009.fbs1-t-msedge.net		CNAME (Canonical name)	IN (0x0001)
Jul 1, 2022 20:57:01.542516947 CEST	8.8.8.8	192.168.2.6	0xe482	No error (0)	part-0032.t-0009.fbs1-t-msedge.net		13.107.219.60	A (IP address)	IN (0x0001)
Jul 1, 2022 20:57:01.542516947 CEST	8.8.8.8	192.168.2.6	0xe482	No error (0)	part-0032.t-0009.fbs1-t-msedge.net		13.107.227.60	A (IP address)	IN (0x0001)
Jul 1, 2022 20:57:01.679250002 CEST	8.8.8.8	192.168.2.6	0xa0a4	No error (0)	aadcdn.msftauth.net	cs1100.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)
Jul 1, 2022 20:57:01.679250002 CEST	8.8.8.8	192.168.2.6	0xa0a4	No error (0)	cs1100.wpc.omegacdn.net		152.199.23.37	A (IP address)	IN (0x0001)

Timestamp	kBytes transferred	Direction	Data
2022-07-01 18:57:00 UTC	0	OUT	GET /shared/1.0/content/images/applogos/53_8b36337037cff88c3df203bb73d58e41.png HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-07-01 18:57:00 UTC	3	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding Age: 833388 Cache-Control: public, max-age=31536000 Content-MD5: izYzcDfP+Iw98gO7c9WOQQ== Content-Type: image/png Date: Fri, 01 Jul 2022 18:57:00 GMT Etag: 0x8D7AF695D6C58F2 Last-Modified: Wed, 12 Feb 2020 03:12:17 GMT Server: ECAcc (frc/8FBC) X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 1182cd20-c01e-004f-3ae7-851dc4000000 x-ms-version: 2009-09-19 Content-Length: 5139 Connection: close
2022-07-01 18:57:00 UTC	5	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 56 00 00 00 48 08 06 00 00 00 ad 04 dd dc 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 25 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 38 20 37 39 2e 31 36 34 30 33 36 2c 20 32 30 31 39 2f 30 38 2f 31 33 2d 30 31 3a 30 36 3a 35 37 20 20 Data Ascii: PNGIHDRVHtEXtSoftwareAdobe ImageReadyqe<%iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57

Timestamp	kBytes transferred	Direction	Data
2022-07-01 18:57:00 UTC	0	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-07-01 18:57:00 UTC	0	OUT	Data Raw: 20 Data Ascii:
2022-07-01 18:57:00 UTC	18	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 01 Jul 2022 18:57:00 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-tqYaZrQ1VOt65Xt1We3JxQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'nonce-tqYaZrQ1VOt65Xt1We3JxQ' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Report-To: {"group":"IdentityListAccountsHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/IdentityListAccountsHttp/external"}]} Cross-Origin-Opener-Policy: same-origin; report-to="IdentityListAccountsHttp" Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-07-01 18:57:00 UTC	20	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2022-07-01 18:57:00 UTC	20	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-07-01 18:57:01 UTC	57	OUT	GET /shared/1.0/content/images/applogos/53_8b36337037cff88c3df203bb73d58e41.png HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36 Host: aadcdn.msftauth.net
2022-07-01 18:57:01 UTC	63	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding Age: 833389 Cache-Control: public, max-age=31536000 Content-MD5: izYzcDfP+Iw98gO7c9WOQQ== Content-Type: image/png Date: Fri, 01 Jul 2022 18:57:01 GMT Etag: 0x8D7AF695D6C58F2 Last-Modified: Wed, 12 Feb 2020 03:12:17 GMT Server: ECAcc (frc/8FBC) X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 1182cd20-c01e-004f-3ae7-851dc4000000 x-ms-version: 2009-09-19 Content-Length: 5139 Connection: close
2022-07-01 18:57:01 UTC	63	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 56 00 00 00 48 08 06 00 00 00 ad 04 dd dc 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 25 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 38 20 37 39 2e 31 36 34 30 33 36 2c 20 32 30 31 39 2f 30 38 2f 31 33 2d 30 31 3a 30 36 3a 35 37 20 20 Data Ascii: PNGIHDRVHtEXtSoftwareAdobe ImageReadyqe<%iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57

Timestamp	kBytes transferred	Direction	Data
2022-07-01 18:57:01 UTC	68	OUT	GET /shared/1.0/content/images/signin-options_4e48046ce74f4b89d45037c90576bfac.svg HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36 Host: aadcdn.msftauth.net
2022-07-01 18:57:01 UTC	69	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 29356739 Cache-Control: public, max-age=31536000 Content-MD5: R2FAVxfpONfnQAuxVxXbHg== Content-Type: image/svg+xml Date: Fri, 01 Jul 2022 18:57:01 GMT Etag: 0x8D8852A740F01B9 Last-Modified: Tue, 10 Nov 2020 03:41:05 GMT Server: ECAcc (frc/8FFC) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: a3f9aa36-901e-008e-257c-82e72e000000 x-ms-version: 2009-09-19 Content-Length: 1592 Connection: close
2022-07-01 18:57:01 UTC	69	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 34 38 22 20 68 65 69 67 68 74 3d 22 34 38 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 34 38 20 34 38 22 3e 3c 64 65 66 73 3e 3c 73 74 79 6c 65 3e 2e 61 7b 66 69 6c 6c 3a 6e 6f 6e 65 3b 7d 2e 62 7b 66 69 6c 6c 3a 23 34 30 34 30 34 30 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 64 65 66 73 3e 3c 72 65 63 74 20 63 6c 61 73 73 3d 22 61 22 20 77 69 64 74 68 3d 22 34 38 22 20 68 65 69 67 68 74 3d 22 34 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 62 22 20 64 3d 22 4d 34 30 2c 33 32 2e 35 37 38 56 34 30 48 33 32 56 33 36 48 32 38 56 33 32 48 32 34 56 32 38 2e 37 36 36 41 31 30 2e 36 38 39 2c 31 30 2e 36 38 39 2c 30 2c 30 2c Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 48 48"><defs><style>.a{fill:none;}.b{fill:#404040;}</style></defs><rect class="a" width="48" height="48"/><path class="b" d="M40,32.578V40H32V36H28V32H24V28.766A10.689,10.689,0,0,

Timestamp	kBytes transferred	Direction	Data
2022-07-01 18:57:00 UTC	0	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfm X-Goog-Update-Updater: chromecrx-85.0.4183.121 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-07-01 18:57:00 UTC	17	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-5WbciJbOhTqrTfkTtvz0kQ' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 01 Jul 2022 18:57:00 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 5660 X-Daystart: 43020 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-07-01 18:57:00 UTC	17	IN	Data Raw: 33 31 62 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 35 36 36 30 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 34 33 30 32 30 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 31b<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="5660" elapsed_seconds="43020"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2022-07-01 18:57:00 UTC	18	IN	Data Raw: 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 2e 63 72 78 22 20 66 70 3d 22 31 2e 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 61 Data Ascii: mmhkkegccagdldgiimedpiccmgmieda.crx" fp="1.81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app><a
2022-07-01 18:57:00 UTC	18	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-07-01 18:57:00 UTC	1	OUT	GET /shared/1.0/content/images/appbackgrounds/49-small_e58aafc980614a9cd7796bea7b5ea8f0.jpg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-07-01 18:57:00 UTC	3	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=31536000 Content-Length: 987 Content-Type: image/jpeg Content-MD5: 5YqvyYBhSpzXeWvqe16o8A== Last-Modified: Fri, 27 Mar 2020 19:41:47 GMT ETag: 0x8D7D286E322A911 X-Cache: TCP_HIT Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 72e47f8d-001e-002f-6c58-8a2f5f000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * X-Azure-Ref: 0fEO/YgAAAAAmIhdG0C7zQa4kezh5MM7FRlJBMjMxMDUwNDE3MDI3ADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng== Date: Fri, 01 Jul 2022 18:57:00 GMT Connection: close
2022-07-01 18:57:00 UTC	4	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 66 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 04 01 1a 00 05 00 00 00 01 00 00 00 3e 01 1b 00 05 00 00 00 01 00 00 00 46 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 10 00 00 00 4e 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 70 61 69 6e 74 2e 6e 65 74 20 34 2e 32 2e 39 00 ff db 00 43 00 02 01 01 01 01 01 02 01 01 01 02 02 02 02 02 04 03 02 02 02 02 05 04 04 03 04 06 05 06 06 06 05 06 06 06 07 09 08 06 07 09 07 06 06 08 0b 08 09 0a 0a 0a 0a 0a 06 08 0b 0c 0b 0a 0c 09 0a 0a 0a ff db 00 43 01 02 02 02 02 02 02 05 03 03 05 0a 07 06 07 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a Data Ascii: JFIFHHfExifMM*>F(1NHHpaint.net 4.2.9CC