Edit tour

Windows Analysis Report
Bill of Lading.htm

Overview

General Information

Sample Name:	Bill of Lading.htm
Analysis ID:	656080
MD5:	a6326708064aa448a2f9d842ed8af555
SHA1:	246d098d0a455ed4eba2a96f3c7489685f013345
SHA256:	4c326163765ccce65ac5fe6c707b286f9f7fdffc49d20d68a61df80f7dc72a35
Infos:

Detection

HTMLPhisher

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Yara detected HtmlPhish10

Multi AV Scanner detection for submitted file

Antivirus detection for URL or domain

HTML document with suspicious title

Drops PE files

Found iframes

None HTTPS page querying sensitive user data (password, username or email)

PE file contains sections with non-standard names

No HTML title found

JA3 SSL client fingerprint seen in connection with other malware

IP address seen in connection with other malware

Classification

Process Tree

System is w10x64

chrome.exe (PID: 4952 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "C:\Users\user\Desktop\Bill of Lading.htm MD5: C139654B5C1438A95B321BB01AD63EF6)

chrome.exe (PID: 4756 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1532,10084477516934632773,16157516973983746374,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1904 /prefetch:8 MD5: C139654B5C1438A95B321BB01AD63EF6)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Bill of Lading.htm	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

HTML

Source	Rule	Description	Author	Strings
64316.1.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

HTTP traffic detected: HTTP/1.1 403 ForbiddenAccept-CH: Sec-CH-UA,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Arch,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model,Sec-CH-Device-MemoryAccept-CH: Sec-CH-UA,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Arch,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model,Sec-CH-Device-MemoryCache-Control: max-age=0, private, no-cache, no-store, must-revalidateCharset: utf-8Content-Type: text/html;charset=utf-8Date: Sat, 02 Jul 2022 22:04:41 GMTPragma: no-cacheServer: DataDomeSet-Cookie: datadome=FEY5tb7dPG5UbSTpt-_t5HLx-spNa8mUmaxj2mfn.DuL7~dry7ouR9vL3Qevdgn7Eqn1lLrTo6tnHTMgPmiQp.r~~fotEl~qeRY-4E2C_EyMSxKpTGl7A7t0yO_P1n1; Max-Age=31536000; Domain=.cma-cgm.com; Path=/; Secure; SameSite=LaxX-DataDome: protectedX-DataDome-botfamily: bad_botX-DataDome-botname: Recent proxies suspicious server-side fingerprintX-DataDome-captchapassed: 0X-DataDome-Charset: utf-8X-DataDome-CID: AHrlqAAAAAMArtYQMyDW4e8AVBE0Ug==X-DataDome-headers: X-DataDome Accept-CH Content-Type Charset Cache-Control Pragma Accept-CH X-DataDome-CID Set-CookieX-DataDome-isbot: 1X-DataDome-request-headers: X-DataDome-botname X-DataDome-botfamily X-DataDome-isbot X-DataDome-captchapassed X-DataDome-ruletype X-DataDome-requestidX-DataDome-requestid: dd3257bd-6ce4-921b-fe05-d2086b174fb3X-DataDome-ruletype: AI Threats DetectionX-DataDomeResponse: 403Content-Length: 531Connection: close

Source: widevinecdm.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: widevinecdm.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: widevinecdm.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: widevinecdm.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: widevinecdm.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: widevinecdm.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: widevinecdm.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: widevinecdm.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: widevinecdm.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: widevinecdm.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: widevinecdm.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: pnacl_public_x86_64_pnacl_sz_nexe.0.dr, pnacl_public_x86_64_pnacl_llc_nexe.0.dr	String found in binary or memory: http://llvm.org/):
Source: widevinecdm.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: widevinecdm.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: widevinecdm.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: widevinecdm.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: widevinecdm.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: 2ded6b72-3f6d-4366-9d76-06a94d6df90e.tmp.1.dr, 35e22058-b623-43ef-9d5a-2cf245c30840.tmp.1.dr	String found in binary or memory: https://accounts.google.com
Source: craw_window.js.0.dr	String found in binary or memory: https://accounts.google.com/MergeSession
Source: 2ded6b72-3f6d-4366-9d76-06a94d6df90e.tmp.1.dr, 35e22058-b623-43ef-9d5a-2cf245c30840.tmp.1.dr	String found in binary or memory: https://apis.google.com
Source: Bill of Lading.htm	String found in binary or memory: https://auth-dev.cma-cgm.com:9031/assets/fonts/icons/mustIcons/musticons.woff
Source: Bill of Lading.htm	String found in binary or memory: https://auth.cma-cgm.com/TSbd/08337f9cc5ab200098c9bf786f804c6cd4f8d35ad295482c9b58fcd74625ba236252d0
Source: Bill of Lading.htm	String found in binary or memory: https://auth.cma-cgm.com/assets/images/ecom/favico/cmacgm.png
Source: Bill of Lading.htm	String found in binary or memory: https://auth.cma-cgm.com/ext/pwdreset/Identify?referrer=https%3A%2F%2Fauth.cma-cgm.com%2Fidp%2F4PMLF
Source: pnacl_public_x86_64_libpnacl_irt_shim_dummy_a.0.dr	String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-clang.git
Source: pnacl_public_x86_64_libpnacl_irt_shim_dummy_a.0.dr	String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-llvm.git
Source: 2ded6b72-3f6d-4366-9d76-06a94d6df90e.tmp.1.dr, 35e22058-b623-43ef-9d5a-2cf245c30840.tmp.1.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json1.0.dr, manifest.json.0.dr, manifest.json2.0.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 2ded6b72-3f6d-4366-9d76-06a94d6df90e.tmp.1.dr, 35e22058-b623-43ef-9d5a-2cf245c30840.tmp.1.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: pnacl_public_x86_64_ld_nexe.0.dr	String found in binary or memory: https://code.google.com/p/nativeclient/issues/entry
Source: pnacl_public_x86_64_ld_nexe.0.dr	String found in binary or memory: https://code.google.com/p/nativeclient/issues/entry%s:
Source: 35e22058-b623-43ef-9d5a-2cf245c30840.tmp.1.dr	String found in binary or memory: https://content-autofill.googleapis.com
Source: LICENSE.txt.0.dr	String found in binary or memory: https://creativecommons.org/.
Source: LICENSE.txt.0.dr	String found in binary or memory: https://creativecommons.org/compatiblelicenses
Source: 2ded6b72-3f6d-4366-9d76-06a94d6df90e.tmp.1.dr, ba9fdaff-75ad-40b0-b8fd-e387f5b7b1de.tmp.1.dr, cae02159-572b-45a6-9a0e-fabb434c4db1.tmp.1.dr, 35e22058-b623-43ef-9d5a-2cf245c30840.tmp.1.dr	String found in binary or memory: https://dns.google
Source: Bill of Lading.htm	String found in binary or memory: https://dorothearenault.com/blog/wp-includes/blocks/audio/reportcmacgm.php
Source: LICENSE.txt.0.dr	String found in binary or memory: https://easylist.to/)
Source: 2ded6b72-3f6d-4366-9d76-06a94d6df90e.tmp.1.dr	String found in binary or memory: https://fonts.googleapis.com
Source: 2ded6b72-3f6d-4366-9d76-06a94d6df90e.tmp.1.dr, 35e22058-b623-43ef-9d5a-2cf245c30840.tmp.1.dr	String found in binary or memory: https://fonts.gstatic.com
Source: LICENSE.txt.0.dr	String found in binary or memory: https://github.com/easylist)
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p
Source: 2ded6b72-3f6d-4366-9d76-06a94d6df90e.tmp.1.dr, 35e22058-b623-43ef-9d5a-2cf245c30840.tmp.1.dr	String found in binary or memory: https://ogs.google.com
Source: craw_window.js.0.dr, manifest.json.0.dr	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: 2ded6b72-3f6d-4366-9d76-06a94d6df90e.tmp.1.dr, 35e22058-b623-43ef-9d5a-2cf245c30840.tmp.1.dr	String found in binary or memory: https://play.google.com
Source: 35e22058-b623-43ef-9d5a-2cf245c30840.tmp.1.dr	String found in binary or memory: https://r5---sn-4g5ednde.gvt1.com
Source: 35e22058-b623-43ef-9d5a-2cf245c30840.tmp.1.dr	String found in binary or memory: https://redirector.gvt1.com
Source: craw_window.js.0.dr, manifest.json.0.dr	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: 2ded6b72-3f6d-4366-9d76-06a94d6df90e.tmp.1.dr, 35e22058-b623-43ef-9d5a-2cf245c30840.tmp.1.dr	String found in binary or memory: https://ssl.gstatic.com
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://www-googleapis-staging.sandbox.google.com
Source: Bill of Lading.htm	String found in binary or memory: https://www.cma-cgm.com
Source: Bill of Lading.htm	String found in binary or memory: https://www.cma-cgm.com/Images/signin-cmacgm.jpg
Source: Bill of Lading.htm	String found in binary or memory: https://www.cma-cgm.com/legal-terms
Source: widevinecdm.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: 2ded6b72-3f6d-4366-9d76-06a94d6df90e.tmp.1.dr, 35e22058-b623-43ef-9d5a-2cf245c30840.tmp.1.dr	String found in binary or memory: https://www.google.com
Source: manifest.json.0.dr	String found in binary or memory: https://www.google.com/
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/accounts/OAuthLogin?issueuberauth=1
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/cleardot.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/dot2.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/x2.gif
Source: craw_background.js.0.dr	String found in binary or memory: https://www.google.com/intl/en-US/chrome/blank.html
Source: 2ded6b72-3f6d-4366-9d76-06a94d6df90e.tmp.1.dr, craw_window.js.0.dr, craw_background.js.0.dr, 35e22058-b623-43ef-9d5a-2cf245c30840.tmp.1.dr	String found in binary or memory: https://www.googleapis.com
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: 2ded6b72-3f6d-4366-9d76-06a94d6df90e.tmp.1.dr, 35e22058-b623-43ef-9d5a-2cf245c30840.tmp.1.dr	String found in binary or memory: https://www.gstatic.com

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: Yara match	File source: Bill of Lading.htm, type: SAMPLE
Source: Yara match	File source: 64316.1.pages.csv, type: HTML

Source: file:///C:/Users/user/Desktop/Bill%20of%20Lading.htm	HTTP Parser: Iframe src: https://www.cma-cgm.com/Images/signin-cmacgm.jpg
Source: file:///C:/Users/user/Desktop/Bill%20of%20Lading.htm	HTTP Parser: Iframe src: https://www.cma-cgm.com/Images/signin-cmacgm.jpg

Source: file:///C:/Users/user/Desktop/Bill%20of%20Lading.htm	HTTP Parser: Has password / email / username input fields
Source: file:///C:/Users/user/Desktop/Bill%20of%20Lading.htm	HTTP Parser: Has password / email / username input fields

Source: file:///C:/Users/user/Desktop/Bill%20of%20Lading.htm	HTTP Parser: HTML title missing
Source: file:///C:/Users/user/Desktop/Bill%20of%20Lading.htm	HTTP Parser: HTML title missing

Source: file:///C:/Users/user/Desktop/Bill%20of%20Lading.htm	HTTP Parser: No <meta name="author".. found
Source: file:///C:/Users/user/Desktop/Bill%20of%20Lading.htm	HTTP Parser: No <meta name="author".. found

Source: file:///C:/Users/user/Desktop/Bill%20of%20Lading.htm	HTTP Parser: No <meta name="copyright".. found
Source: file:///C:/Users/user/Desktop/Bill%20of%20Lading.htm	HTTP Parser: No <meta name="copyright".. found

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic			Jump to behavior

Source: unknown	HTTPS traffic detected: 152.199.21.98:443 -> 192.168.2.3:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.109.119.57:443 -> 192.168.2.3:49764 version: TLS 1.2

Source:	Binary string: widevinecdm.dll.pdb source: widevinecdm.dll.0.dr
Source:	Binary string: widevinecdm.dll.pdb@ source: widevinecdm.dll.0.dr

Source: Joe Sandbox View	IP Address: 13.224.103.115 13.224.103.115
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250

Source: Ruleset Data.0.dr	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: Filtering Rules.0.dr, Ruleset Data.0.dr	String found in binary or memory: www.facebook.com/ajax/ads/ equals www.facebook.com (Facebook)
Source: Filtering Rules.0.dr	String found in binary or memory: www.facebook.com0 equals www.facebook.com (Facebook)

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789

Source: global traffic	HTTP traffic detected: GET /TSbd/08337f9cc5ab200098c9bf786f804c6cd4f8d35ad295482c9b58fcd74625ba236252d06005b7c679?type=2 HTTP/1.1Host: auth.cma-cgm.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfmX-Goog-Update-Updater: chromecrx-85.0.4183.121Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Images/signin-cmacgm.jpg HTTP/1.1Host: www.cma-cgm.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/images/ecom/favico/cmacgm.png HTTP/1.1Host: auth.cma-cgm.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Images/signin-cmacgm.jpg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: www.cma-cgm.com
Source: global traffic	HTTP traffic detected: GET /assets/images/ecom/favico/cmacgm.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: auth.cma-cgm.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.cma-cgm.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /c.js HTTP/1.1Host: ct.captcha-delivery.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.cma-cgm.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /captcha/?initialCid=AHrlqAAAAAMArtYQMyDW4e8AVBE0Ug%3D%3D&hash=490A8A2485BA28921F861A802754DD&cid=FEY5tb7dPG5UbSTpt-_t5HLx-spNa8mUmaxj2mfn.DuL7~dry7ouR9vL3Qevdgn7Eqn1lLrTo6tnHTMgPmiQp.r~~fotEl~qeRY-4E2C_EyMSxKpTGl7A7t0yO_P1n1&t=fe&referer=https%3A%2F%2Fwww.cma-cgm.com%2F&s=39232&e=780f21e70762d08ade6338357e438d98c48990f440d7390dde3eecf1a92ad3d5 HTTP/1.1Host: geo.captcha-delivery.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.cma-cgm.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /captcha/assets/tpl/6dc485c0c428c35b53577b146dc6f9179f55ef9ad41b327a2a179998839364bf/index.css HTTP/1.1Host: static.captcha-delivery.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,/;q=0.1Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://geo.captcha-delivery.com/captcha/?initialCid=AHrlqAAAAAMArtYQMyDW4e8AVBE0Ug%3D%3D&hash=490A8A2485BA28921F861A802754DD&cid=FEY5tb7dPG5UbSTpt-_t5HLx-spNa8mUmaxj2mfn.DuL7~dry7ouR9vL3Qevdgn7Eqn1lLrTo6tnHTMgPmiQp.r~~fotEl~qeRY-4E2C_EyMSxKpTGl7A7t0yO_P1n1&t=fe&referer=https%3A%2F%2Fwww.cma-cgm.com%2F&s=39232&e=780f21e70762d08ade6338357e438d98c48990f440d7390dde3eecf1a92ad3d5Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /common/fonts/roboto/font-face.css HTTP/1.1Host: static.captcha-delivery.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,/;q=0.1Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://geo.captcha-delivery.com/captcha/?initialCid=AHrlqAAAAAMArtYQMyDW4e8AVBE0Ug%3D%3D&hash=490A8A2485BA28921F861A802754DD&cid=FEY5tb7dPG5UbSTpt-_t5HLx-spNa8mUmaxj2mfn.DuL7~dry7ouR9vL3Qevdgn7Eqn1lLrTo6tnHTMgPmiQp.r~~fotEl~qeRY-4E2C_EyMSxKpTGl7A7t0yO_P1n1&t=fe&referer=https%3A%2F%2Fwww.cma-cgm.com%2F&s=39232&e=780f21e70762d08ade6338357e438d98c48990f440d7390dde3eecf1a92ad3d5Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /captcha/assets/set/45d788cda3c3698f9b00f48b6b6f6dfb843702dd/logo.png?update_cache=-8246815016896654048 HTTP/1.1Host: static.captcha-delivery.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://geo.captcha-delivery.com/captcha/?initialCid=AHrlqAAAAAMArtYQMyDW4e8AVBE0Ug%3D%3D&hash=490A8A2485BA28921F861A802754DD&cid=FEY5tb7dPG5UbSTpt-_t5HLx-spNa8mUmaxj2mfn.DuL7~dry7ouR9vL3Qevdgn7Eqn1lLrTo6tnHTMgPmiQp.r~~fotEl~qeRY-4E2C_EyMSxKpTGl7A7t0yO_P1n1&t=fe&referer=https%3A%2F%2Fwww.cma-cgm.com%2F&s=39232&e=780f21e70762d08ade6338357e438d98c48990f440d7390dde3eecf1a92ad3d5Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /captcha/assets/tpl/6dc485c0c428c35b53577b146dc6f9179f55ef9ad41b327a2a179998839364bf/loading_spinner.gif HTTP/1.1Host: static.captcha-delivery.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://geo.captcha-delivery.com/captcha/?initialCid=AHrlqAAAAAMArtYQMyDW4e8AVBE0Ug%3D%3D&hash=490A8A2485BA28921F861A802754DD&cid=FEY5tb7dPG5UbSTpt-_t5HLx-spNa8mUmaxj2mfn.DuL7~dry7ouR9vL3Qevdgn7Eqn1lLrTo6tnHTMgPmiQp.r~~fotEl~qeRY-4E2C_EyMSxKpTGl7A7t0yO_P1n1&t=fe&referer=https%3A%2F%2Fwww.cma-cgm.com%2F&s=39232&e=780f21e70762d08ade6338357e438d98c48990f440d7390dde3eecf1a92ad3d5Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tags.js HTTP/1.1Host: js.datadome.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://geo.captcha-delivery.com/captcha/?initialCid=AHrlqAAAAAMArtYQMyDW4e8AVBE0Ug%3D%3D&hash=490A8A2485BA28921F861A802754DD&cid=FEY5tb7dPG5UbSTpt-_t5HLx-spNa8mUmaxj2mfn.DuL7~dry7ouR9vL3Qevdgn7Eqn1lLrTo6tnHTMgPmiQp.r~~fotEl~qeRY-4E2C_EyMSxKpTGl7A7t0yO_P1n1&t=fe&referer=https%3A%2F%2Fwww.cma-cgm.com%2F&s=39232&e=780f21e70762d08ade6338357e438d98c48990f440d7390dde3eecf1a92ad3d5Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /common/fonts/roboto/roboto.woff2 HTTP/1.1Host: static.captcha-delivery.comConnection: keep-aliveOrigin: https://geo.captcha-delivery.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://static.captcha-delivery.com/common/fonts/roboto/font-face.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /gettype.php?gt=1e505deed3832c02c96ca5abe70df9ab&callback=geetest_1656831883419 HTTP/1.1Host: api-na.geetest.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://geo.captcha-delivery.com/captcha/?initialCid=AHrlqAAAAAMArtYQMyDW4e8AVBE0Ug%3D%3D&hash=490A8A2485BA28921F861A802754DD&cid=FEY5tb7dPG5UbSTpt-_t5HLx-spNa8mUmaxj2mfn.DuL7~dry7ouR9vL3Qevdgn7Eqn1lLrTo6tnHTMgPmiQp.r~~fotEl~qeRY-4E2C_EyMSxKpTGl7A7t0yO_P1n1&t=fe&referer=https%3A%2F%2Fwww.cma-cgm.com%2F&s=39232&e=780f21e70762d08ade6338357e438d98c48990f440d7390dde3eecf1a92ad3d5Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/js/fullpage.9.1.0.js HTTP/1.1Host: static.geetest.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://geo.captcha-delivery.com/captcha/?initialCid=AHrlqAAAAAMArtYQMyDW4e8AVBE0Ug%3D%3D&hash=490A8A2485BA28921F861A802754DD&cid=FEY5tb7dPG5UbSTpt-_t5HLx-spNa8mUmaxj2mfn.DuL7~dry7ouR9vL3Qevdgn7Eqn1lLrTo6tnHTMgPmiQp.r~~fotEl~qeRY-4E2C_EyMSxKpTGl7A7t0yO_P1n1&t=fe&referer=https%3A%2F%2Fwww.cma-cgm.com%2F&s=39232&e=780f21e70762d08ade6338357e438d98c48990f440d7390dde3eecf1a92ad3d5Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.cma-cgm.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.cma-cgm.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: datadome=FEY5tb7dPG5UbSTpt-_t5HLx-spNa8mUmaxj2mfn.DuL7~dry7ouR9vL3Qevdgn7Eqn1lLrTo6tnHTMgPmiQp.r~~fotEl~qeRY-4E2C_EyMSxKpTGl7A7t0yO_P1n1
Source: global traffic	HTTP traffic detected: GET /get.php?gt=1e505deed3832c02c96ca5abe70df9ab&challenge=bef8fb076d83726e66825df64615ae36&lang=en&pt=0&client_type=web&w=biKyO)VG0UrLmUQybnxWdc6wK4T8Ykrn5wGyY3O1g)y3MaPd2uihg1QxMw54hDKBBxeH7esrJWe3AhAAzZolka2PgVxh7HhCFdbiHcmOl7ksTrSKlLXnpMl5XPEg1(euAxcm8KL14VrArboqEQyi2PAkqVlmJmVG0(fcRng0WRoaiG)mlZ23W2JfoAFVjOGMckwwZMLSS3tvBeZOYbM1sZjEhZ2lLTsCh9v1S8xdcnQdXjA0k6lybEIVvLzc5ghX0blgz7u(9hyyZ3SpqLuAloaNk1EtHcWjeiyOPG4TXOZVt1MOdOHngrYTd3vnH4R(X18PxlBXlqRSEB(0(kbdpJOs2gfGqOErw(GKRJFetMPQAhmgIvh)la1TlsVx1JpWhcxnYxDy4FBjANYoL))xKzSBgIUY161q(UU)dYCyApX37MpLf6pP7SlwH6CswnkoiFr)Z7K3t6OI0ZEd5BBc0Z8FnyG2hjBBhVVZNZp48Asia9yFX2PlR)UySnNG8RwJ2WwxOYvHIhUlepc0F1QolDBpb1vkOR5hEjU(8VewKklH5F)sC0JdjS2B0Dfk7tuTaHUSsJrX(HaU6jcu2ZCpxfIR1M)A1KwIJMCZ1yrcfGx0I5ZqZY33KQvwZcdDrqQskti(dPvPafOf25hqYtbCiq70p0Gh7jzBU56wxxKmIKIzQhhn4nKqFARd0IfoAKpy9Y72xg)e8N3q(bHTUTDA09id2JPxr3saBJMzVDips9B6j)kDL)rVAJPivXBt(IBK5EDM0bzRLcgSsrCd9gCX64R6rh4UZ6tOQJWz)(JLuXjYgHXfYe2rKURc5GkZcJjYbxvQ7Rw810B1fnq51Lpcaa)Ea4leOK8kU3av2VJNI7pdg(jwERV4zyWjXiqHiOXxTwo0LkjLyFl5QRZto34GeLI5QoWnQzplH(i)mUMlleKj78aSW7fxV0)8RyvsHkLr1O247hsg9JDy78h8PFHzbKJSIphyBbSBk0UCU8ml(GSGZ3sOkYzr)6XV00g7)B1(wc1I)8188Qvrus5M9inI)tDmOi6f30)CH5socYCakcHC5ekAlhxhROIBMcZH7ZRixZX8zDEqTH)0nDIQXTvVR5g8is44bkLZLPKtPglHcRK8uTiB)0vM3wEttwgvN52vMILXFscUrW6sd(ryzkvqi8qq7kvtC4gZrec2D)Th7RR)Hb(oQmZo2llQ0egBAr5ol0hHeWlkh4VbcrsU6HfkNQStjAydj6QfdlPCF3LhYvy4)SJrU0dY(vDqRCjc7iXBfiyPvbMTOEi2CErr23YDlvMHVxP3eNDAHvxp0eGI(eMbGPxAZtXjVnnOVyGiBsnQXU5BB4(YIXQcIQDAGOu5kMxKQuVZMEVUjnDdvFdWJGKz5jLk6C402EZs0xxvO3egIthrhWM)fe5vEQYPrlmAi2wh3sv98nCqHDnPYwX3(NiyIfLHJKky0MIBWdswyhLrWawMyyTGSXRxHTqcda2PZO0OqMa8cK6UdA3SdyS6QajmC26NDRWBwUTdT4R1Cvu8vQFd6EEY4)NcKuYV9fGR2Xwcz0AU76)x)DvQPvNbUwYJKLAlXTpQk(DNmLIuHBDK((cXa2xQ7FtEbb(OsB)eo4t1E917Xt1OS8qna59K9hxMr)pnKOx3RY(N5gNCAEajGYMMS2CoeSa(aDERlHjypqDK8nIx64dxfSZiVSRmUXkWzxJYkJMmqUx8HKWYVLRgGvMdm2Gvzd59F)QDLUmlb8zYxTtPjcViIA(tidUed0(uJq55udutJMYIjxtOWtFGQOYQRWzBy((f0WhGqcEOMkRrjjcsyyAqIeP6naXARul1gj6ca6BIGOxboh4cjXlFR01P2LZFSebCJTKGncl4ALICmRmTfXys96YPKRaMsm3aXx4bIA)o)pSdYssyUMdBhicxapd5cVmohM5r6o0FfffxlW2nI84RCbl(UlRn964a)Nvt8QB(T3xcXBApkyWAO)4FYZXI4BjAF9v76PZIQEqeARNIh(StbLn2Cdk4iJWHW2urtK)WENDRLhMDO(EwvrGrPmRvaJvXU52KlFGDX0XwZI0Dpz6Nfbn0Z5Pv6uqIKqz5niph6440PEGYkGUVha8EWIFsV80YI0ZksgD0(wTL8VJ7v0we9ULB4S1NY(BifsSh1FIymv1O70IoPxkYXzewKaYJfIGV87wn29v322bNG6gQvvrsucNtQ4L2WIZRiNHqBTndRDcyvmUVAv9VI85E7fPHChZGgce8Ecjaz)PLwj0WrG4r1kc3U9GTipQ.6999822004dcfc5396dbdf0d2924447731928cbe64b2009907e0fd4fa834edf8ea729c12b1d2d3e73c938fb2384ab3d4c49f10ab76a0356597ef5ac7c23c4410b3de21638e1420367f9fcb46b58c76af055a0f43eef30032fbd2b9d39000c70b510e2ba04d0c5b373d1c4527f63703a4e3f2479324beb79fe7dc0b49116884cc&callback=geetest_1656831892905 HTTP/1.1Host: api-na.geetest.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://geo.captc
Source: global traffic	HTTP traffic detected: GET /static/wind/style_https.1.5.8.css HTTP/1.1Host: static.geetest.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://geo.captcha-delivery.com/captcha/?initialCid=AHrlqAAAAAMArtYQMyDW4e8AVBE0Ug%3D%3D&hash=490A8A2485BA28921F861A802754DD&cid=FEY5tb7dPG5UbSTpt-_t5HLx-spNa8mUmaxj2mfn.DuL7~dry7ouR9vL3Qevdgn7Eqn1lLrTo6tnHTMgPmiQp.r~~fotEl~qeRY-4E2C_EyMSxKpTGl7A7t0yO_P1n1&t=fe&referer=https%3A%2F%2Fwww.cma-cgm.com%2F&s=39232&e=780f21e70762d08ade6338357e438d98c48990f440d7390dde3eecf1a92ad3d5Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/wind/sprite.1.5.8.png HTTP/1.1Host: static.geetest.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://static.geetest.com/static/wind/style_https.1.5.8.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "C:\Users\user\Desktop\Bill of Lading.htm
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1532,10084477516934632773,16157516973983746374,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1904 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1532,10084477516934632773,16157516973983746374,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1904 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: widevinecdm.dll.0.dr	Static PE information: section name: .00cfg
Source: widevinecdm.dll.0.dr	Static PE information: section name: .rodata
Source: widevinecdm.dll.0.dr	Static PE information: section name: _RDATA

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
1 Drive-by Compromise	Windows Management Instrumentation	Path Interception	1 Process Injection	3 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	4 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	5 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	3 Ingress Tool Transfer	SIM Card Swap		Carrier Billing Fraud

Source	Detection	Scanner	Label	Link
Bill of Lading.htm	38%	Virustotal		Browse
Bill of Lading.htm	100%	Avira	HTML/Infected.WebPage.Gen2

Source	Detection	Scanner	Link
C:\Users\user\AppData\Local\Temp\4952_1479674249\_platform_specific\x86_64\pnacl_public_x86_64_ld_nexe	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\4952_1479674249\_platform_specific\x86_64\pnacl_public_x86_64_ld_nexe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\4952_1479674249\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_llc_nexe	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\4952_1479674249\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_llc_nexe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\4952_1479674249\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_sz_nexe	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\4952_1479674249\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_sz_nexe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\4952_40632354\_platform_specific\win_x64\widevinecdm.dll	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\4952_40632354\_platform_specific\win_x64\widevinecdm.dll	0%	ReversingLabs

Source	Detection	Scanner	Link
cs314.wpc.zetacdn.net	0%	Virustotal	Browse
ct.captcha-delivery.com	0%	Virustotal	Browse
static.captcha-delivery.com	0%	Virustotal	Browse

Source	Detection	Scanner	Label
https://static.captcha-delivery.com/captcha/assets/tpl/6dc485c0c428c35b53577b146dc6f9179f55ef9ad41b327a2a179998839364bf/index.css	0%	Avira URL Cloud	safe
https://ct.captcha-delivery.com/c.js	0%	Avira URL Cloud	safe
https://static.captcha-delivery.com/common/fonts/roboto/font-face.css	0%	Avira URL Cloud	safe
https://static.captcha-delivery.com/common/fonts/roboto/roboto.woff2	0%	Avira URL Cloud	safe
https://static.captcha-delivery.com/captcha/assets/tpl/6dc485c0c428c35b53577b146dc6f9179f55ef9ad41b327a2a179998839364bf/loading_spinner.gif	0%	Avira URL Cloud	safe
https://dns.google	0%	URL Reputation	safe
https://static.captcha-delivery.com/captcha/assets/set/45d788cda3c3698f9b00f48b6b6f6dfb843702dd/logo.png?update_cache=-8246815016896654048	0%	Avira URL Cloud	safe
https://dorothearenault.com/blog/wp-includes/blocks/audio/reportcmacgm.php	100%	Avira URL Cloud	phishing

Name	IP	Active	Malicious	Antivirus Detection	Reputation
cs314.wpc.zetacdn.net	152.199.21.98	true	false	0%, Virustotal, Browse	unknown
ct.captcha-delivery.com	13.224.103.115	true	false	0%, Virustotal, Browse	unknown
api-alb-eu-south-1.datadome.co	15.160.254.125	true	false		high
d2lhhyweudwf3e.cloudfront.net	13.224.103.109	true	false		high
accounts.google.com	172.217.16.205	true	false		high
auth-orig.cma-cgm.com	193.109.119.57	true	false		high
api-na.geetest.com	99.83.174.33	true	false		high
js.datadome.co	13.224.103.23	true	false		high
d3ta1auemfotoc.cloudfront.net	13.224.103.36	true	false		high
clients.l.google.com	142.250.185.174	true	false		high
api-eu-south-1.captcha-delivery.com	15.161.117.65	true	false		unknown
clients2.google.com	unknown	unknown	false		high
www.cma-cgm.com	unknown	unknown	false		high
static.captcha-delivery.com	unknown	unknown	false	0%, Virustotal, Browse	unknown
geo.captcha-delivery.com	unknown	unknown	false		unknown
api-js.datadome.co	unknown	unknown	false		high
auth.cma-cgm.com	unknown	unknown	false		high
static.geetest.com	unknown	unknown	false		high

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Bill of Lading.htm

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

HTML

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic

C:\Users\user\AppData\Local\Google\Chrome\User Data\0a59d1ec-8b5a-484f-8eff-6aac9a2d8071.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\1a664eb5-6fc1-4ae5-8e7b-1df07524a077.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\372daf0e-3df1-4e65-8359-29d80431197d.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\474d4889-d9cc-45cb-90aa-fce8bbfb0aeb.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\4c5c2639-63f2-4366-844d-3924a94824e5.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\4d00034b-8517-44e6-a260-44e1692c46f7.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\6d3b4dd5-ad88-4764-8ac1-3d963b1b4ebf.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\71f11f5a-0c76-4247-8f47-3b58418ef40b.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\726a2ceb-a123-46e5-8c39-20bade439cce.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\91dfb4ce-8994-4378-b5ab-544f4167f44c.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\087ce3fe-8b5b-4de4-b21f-debea7d8d75f.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\2ded6b72-3f6d-4366-9d76-06a94d6df90e.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\35e22058-b623-43ef-9d5a-2cf245c30840.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\4fe87a75-1a4d-420e-8a06-9fa9ccd0554a.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\6adfb932-d1f4-4948-9bb2-5b287e7a625d.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\7fb2ddda-f0a9-4c5b-b7c9-226a44edb9b6.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata\computed_hashes.json

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\000003.log

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG.old (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Provider Cache

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network Persistent State (copy)

Windows Analysis Report
Bill of Lading.htm

Name	Malicious	Antivirus Detection	Reputation
https://geo.captcha-delivery.com/captcha/?initialCid=AHrlqAAAAAMArtYQMyDW4e8AVBE0Ug%3D%3D&hash=490A8A2485BA28921F861A802754DD&cid=FEY5tb7dPG5UbSTpt-_t5HLx-spNa8mUmaxj2mfn.DuL7~dry7ouR9vL3Qevdgn7Eqn1lLrTo6tnHTMgPmiQp.r~~fotEl~qeRY-4E2C_EyMSxKpTGl7A7t0yO_P1n1&t=fe&referer=https%3A%2F%2Fwww.cma-cgm.com%2F&s=39232&e=780f21e70762d08ade6338357e438d98c48990f440d7390dde3eecf1a92ad3d5	false		unknown
https://api-js.datadome.co/js/	false		high
https://static.geetest.com/static/js/fullpage.9.1.0.js	false		high
https://static.captcha-delivery.com/captcha/assets/tpl/6dc485c0c428c35b53577b146dc6f9179f55ef9ad41b327a2a179998839364bf/index.css	false	Avira URL Cloud: safe	unknown
https://ct.captcha-delivery.com/c.js	false	Avira URL Cloud: safe	unknown
file:///C:/Users/user/Desktop/Bill%20of%20Lading.htm	true		low
https://static.geetest.com/static/wind/style_https.1.5.8.css	false		high
https://www.cma-cgm.com/	false		high
https://static.captcha-delivery.com/common/fonts/roboto/font-face.css	false	Avira URL Cloud: safe	unknown
https://static.captcha-delivery.com/common/fonts/roboto/roboto.woff2	false	Avira URL Cloud: safe	unknown
https://api-na.geetest.com/gettype.php?gt=1e505deed3832c02c96ca5abe70df9ab&callback=geetest_1656831883419	false		high
https://auth.cma-cgm.com/TSbd/08337f9cc5ab200098c9bf786f804c6cd4f8d35ad295482c9b58fcd74625ba236252d06005b7c679?type=2	false		high
https://js.datadome.co/tags.js	false		high
https://static.captcha-delivery.com/captcha/assets/tpl/6dc485c0c428c35b53577b146dc6f9179f55ef9ad41b327a2a179998839364bf/loading_spinner.gif	false	Avira URL Cloud: safe	unknown
https://auth.cma-cgm.com/assets/images/ecom/favico/cmacgm.png	false		high
https://static.geetest.com/static/wind/sprite.1.5.8.png	false		high
https://www.cma-cgm.com/	false		high
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1	false		high
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false		high
https://www.cma-cgm.com/favicon.ico	false		high
https://geo.captcha-delivery.com/captcha/?initialCid=AHrlqAAAAAMArtYQMyDW4e8AVBE0Ug%3D%3D&hash=490A8A2485BA28921F861A802754DD&cid=FEY5tb7dPG5UbSTpt-_t5HLx-spNa8mUmaxj2mfn.DuL7~dry7ouR9vL3Qevdgn7Eqn1lLrTo6tnHTMgPmiQp.r~~fotEl~qeRY-4E2C_EyMSxKpTGl7A7t0yO_P1n1&t=fe&referer=https%3A%2F%2Fwww.cma-cgm.com%2F&s=39232&e=780f21e70762d08ade6338357e438d98c48990f440d7390dde3eecf1a92ad3d5	true		unknown
https://www.cma-cgm.com/Images/signin-cmacgm.jpg	false		high
https://static.captcha-delivery.com/captcha/assets/set/45d788cda3c3698f9b00f48b6b6f6dfb843702dd/logo.png?update_cache=-8246815016896654048	false	Avira URL Cloud: safe	unknown
https://www.cma-cgm.com/Images/signin-cmacgm.jpg	false		high

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.google.com/images/cleardot.gif	craw_window.js.0.dr	false		high
https://auth-dev.cma-cgm.com:9031/assets/fonts/icons/mustIcons/musticons.woff	Bill of Lading.htm	false		high
https://play.google.com	2ded6b72-3f6d-4366-9d76-06a94d6df90e.tmp.1.dr, 35e22058-b623-43ef-9d5a-2cf245c30840.tmp.1.dr	false		high
https://easylist.to/)	LICENSE.txt.0.dr	false		high
https://sandbox.google.com/payments/v4/js/integrator.js	craw_window.js.0.dr, manifest.json.0.dr	false		high
https://accounts.google.com/MergeSession	craw_window.js.0.dr	false		high
https://creativecommons.org/compatiblelicenses	LICENSE.txt.0.dr	false		high
https://www.google.com	2ded6b72-3f6d-4366-9d76-06a94d6df90e.tmp.1.dr, 35e22058-b623-43ef-9d5a-2cf245c30840.tmp.1.dr	false		high
https://github.com/easylist)	LICENSE.txt.0.dr	false		high
https://creativecommons.org/.	LICENSE.txt.0.dr	false		high
https://accounts.google.com	2ded6b72-3f6d-4366-9d76-06a94d6df90e.tmp.1.dr, 35e22058-b623-43ef-9d5a-2cf245c30840.tmp.1.dr	false		high
https://apis.google.com	2ded6b72-3f6d-4366-9d76-06a94d6df90e.tmp.1.dr, 35e22058-b623-43ef-9d5a-2cf245c30840.tmp.1.dr	false		high
https://www.google.com/accounts/OAuthLogin?issueuberauth=1	craw_window.js.0.dr	false		high
https://www-googleapis-staging.sandbox.google.com	craw_window.js.0.dr, craw_background.js.0.dr	false		high
https://clients2.google.com	2ded6b72-3f6d-4366-9d76-06a94d6df90e.tmp.1.dr, 35e22058-b623-43ef-9d5a-2cf245c30840.tmp.1.dr	false		high
https://www.cma-cgm.com/legal-terms	Bill of Lading.htm	false		high
https://dns.google	2ded6b72-3f6d-4366-9d76-06a94d6df90e.tmp.1.dr, ba9fdaff-75ad-40b0-b8fd-e387f5b7b1de.tmp.1.dr, cae02159-572b-45a6-9a0e-fabb434c4db1.tmp.1.dr, 35e22058-b623-43ef-9d5a-2cf245c30840.tmp.1.dr	false	URL Reputation: safe	unknown
https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p	craw_window.js.0.dr, craw_background.js.0.dr	false		high
https://www.google.com/intl/en-US/chrome/blank.html	craw_background.js.0.dr	false		high
https://ogs.google.com	2ded6b72-3f6d-4366-9d76-06a94d6df90e.tmp.1.dr, 35e22058-b623-43ef-9d5a-2cf245c30840.tmp.1.dr	false		high
https://auth.cma-cgm.com/ext/pwdreset/Identify?referrer=https%3A%2F%2Fauth.cma-cgm.com%2Fidp%2F4PMLF	Bill of Lading.htm	false		high
https://payments.google.com/payments/v4/js/integrator.js	craw_window.js.0.dr, manifest.json.0.dr	false		high
https://chromium.googlesource.com/a/native_client/pnacl-llvm.git	pnacl_public_x86_64_libpnacl_irt_shim_dummy_a.0.dr	false		high
https://auth.cma-cgm.com/TSbd/08337f9cc5ab200098c9bf786f804c6cd4f8d35ad295482c9b58fcd74625ba236252d0	Bill of Lading.htm	false		high
https://www.google.com/images/x2.gif	craw_window.js.0.dr	false		high
http://llvm.org/):	pnacl_public_x86_64_pnacl_sz_nexe.0.dr, pnacl_public_x86_64_pnacl_llc_nexe.0.dr	false		high
https://www.google.com/images/dot2.gif	craw_window.js.0.dr	false		high
https://code.google.com/p/nativeclient/issues/entry%s:	pnacl_public_x86_64_ld_nexe.0.dr	false		high
https://code.google.com/p/nativeclient/issues/entry	pnacl_public_x86_64_ld_nexe.0.dr	false		high
https://www.cma-cgm.com	Bill of Lading.htm	false		high
https://dorothearenault.com/blog/wp-includes/blocks/audio/reportcmacgm.php	Bill of Lading.htm	true	Avira URL Cloud: phishing	unknown
https://clients2.googleusercontent.com	2ded6b72-3f6d-4366-9d76-06a94d6df90e.tmp.1.dr, 35e22058-b623-43ef-9d5a-2cf245c30840.tmp.1.dr	false		high
https://www.google.com/	manifest.json.0.dr	false		high
https://chromium.googlesource.com/a/native_client/pnacl-clang.git	pnacl_public_x86_64_libpnacl_irt_shim_dummy_a.0.dr	false		high
https://clients2.google.com/service/update2/crx	manifest.json1.0.dr, manifest.json.0.dr, manifest.json2.0.dr	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
13.224.103.115	ct.captcha-delivery.com	United States	16509	AMAZON-02US	false
15.160.254.125	api-alb-eu-south-1.datadome.co	United States	71	HP-INTERNET-ASUS	false
193.109.119.57	auth-orig.cma-cgm.com	France	21203	FR-CMA-CGMFranceFR	false
172.217.16.205	accounts.google.com	United States	15169	GOOGLEUS	false
13.224.103.109	d2lhhyweudwf3e.cloudfront.net	United States	16509	AMAZON-02US	false
15.161.117.65	api-eu-south-1.captcha-delivery.com	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.185.174	clients.l.google.com	United States	15169	GOOGLEUS	false
13.224.103.36	d3ta1auemfotoc.cloudfront.net	United States	16509	AMAZON-02US	false
13.224.103.23	js.datadome.co	United States	16509	AMAZON-02US	false
99.83.174.33	api-na.geetest.com	United States	16509	AMAZON-02US	false
152.199.21.98	cs314.wpc.zetacdn.net	United States	15133	EDGECASTUS	false

Joe Sandbox Version:	35.0.0 Citrine
Analysis ID:	656080
Start date and time: 03/07/202200:03:18	2022-07-03 00:03:18 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Bill of Lading.htm
Cookbook file name:	defaultwindowshtmlcookbook.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	27
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal76.phis.winHTM@33/131@14/14
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .htm Adjust boot time Enable AMSI Browse: https://www.cma-cgm.com/

Match	Associated Sample Name / URL	SHA 256	Detection	Link
13.224.103.115	snai.apk	Get hash	malicious	Browse
	https://almanac.io/docs/michelle-plumbing-almanac-onboarding-Ie2TRiMeVIEd744ryefSRjppwHMri4NT	Get hash	malicious	Browse
	https://app.pandadoc.com/document/147bd6920f1a81f0ef9bacb8624f0088ce2f4553?	Get hash	malicious	Browse
	https://katrina-v.company.com	Get hash	malicious	Browse
	https://form.jotform.com/221323445206041	Get hash	malicious	Browse
	https://form.jotform.com/221323445206041	Get hash	malicious	Browse
	https://app.waiverforever.com/pending/zNeOAD1uhV1651855897	Get hash	malicious	Browse
239.255.255.250	Priority Payment Advice 935760631.Htm	Get hash	malicious	Browse
	https://pay.cogencyglobal.com/singleinvoicepayment	Get hash	malicious	Browse
	http://Southside.thetraveljunkie.com.pk/1/ZGVuaXMubW9yZWlyYUBzb3V0aHNpZGUuY29t	Get hash	malicious	Browse
	https://wwwnewscnn4kus.hs-sites-eu1.com/#0.4K6	Get hash	malicious	Browse
	ClosingDoc.html	Get hash	malicious	Browse
	http://d0edsbfmqucaulbq5ew3tn6o.greathem.ws/ozljha.php/1A0u168m9jilc04y9rn61gx1wd90ta330v/skk/017g2	Get hash	malicious	Browse
	https://yielding-cliff-weather.glitch.me/JHindex.html	Get hash	malicious	Browse
	https://mso.vm-service.xyz	Get hash	malicious	Browse
	https://u27457241.ct.sendgrid.net/ls/click?upn=gU5vgDjVhsr8xBWi9KbyhCmRGj-2Bhghe49Z0FiLcWjrB3-2BHjpRZrJUn0d0SGBkXrx6oN6ZDJ2BS4RqE-2FwX06Vp6CNzr5fnG8rLhZtVfnefSs-3DAxs4_-2BYPg4XG7CFcrtVeqe-2FEiJSrJo19pXwJ6tXzH5pmmxxnbXO272-2BI29kN-2BvjWAIpglbQXOPOiRaJAAdguTnhglHj-2BjiZuY-2Bl2yPjdcSrK-2F9ezebjhFVSInURAAh0NL7wSvgIxrQfzCizFzhR7FuzvZGAC9IXJiD5MvT-2BM-2Bord7nJExCKq3jFy6KjuvaLIUZjyvy957XsqnMttci2nlXO0KBQ-3D-3D	Get hash	malicious	Browse
	https://magothy.alphabuildr.com/	Get hash	malicious	Browse
	http://jornetfac.eastasia.cloudapp.azure.com/EMKT_CURSO_775-5693/47940.024663/	Get hash	malicious	Browse
	https://u27733051.ct.sendgrid.net/ls/click?upn=HCGWKV8XHxZ4j6JAvUqU85qmUstX9ujQf79frd5sn49jV1VgryMAoVIQf2IGsGbr8mb3MByyFDCK-2FozDw04RRQwUpt-2FUJFUNFyKRmHqeuCo-3D8613_YQqOrPDtXbRfXaWHaKXmxS8MuXPUoYgcqzaTYWlixJ1Mkt8ZA0IO1wM-2BzFjRFZv00QAhDMzXHC6LEePuTaRud-2Bu6mRjrWo4y8Ajd68Q059d2B3W4naosfLFT-2Fpsxoz9-2FtpNjsUVHpTBnFulHSKYgj239U8BSndlVFfop-2BNco07si36w-2BeJXVxQPlZlzyE-2Fz7Vg2YTziEIHtyVwtt4AGajw-3D-3D	Get hash	malicious	Browse
	https://lostbussiness.com/add2.exe	Get hash	malicious	Browse
	Invoice#0036473 .xlsx	Get hash	malicious	Browse
	Invoice#0036473 .xlsx	Get hash	malicious	Browse
	https://access-payment-request.com	Get hash	malicious	Browse
	https://2caxbnk.me/PSD2/clients/	Get hash	malicious	Browse
	http://rdpolo.xyz/xLXTqRmT?	Get hash	malicious	Browse
	https://officesharepoint-microsoft.nimbusweb.me/share/7180759/nrwc6k8nkclqdtv309ot	Get hash	malicious	Browse
	http://185.220.101.42	Get hash	malicious	Browse
193.109.119.57	Bill of Lading.htm	Get hash	malicious	Browse
	CMA-CGM Online Receipt.html	Get hash	malicious	Browse
	Bill of Lading.htm	Get hash	malicious	Browse
13.224.103.109	https://juanperezu.com/Log%20in/	Get hash	malicious	Browse
13.224.103.109	https://click.smartsheet.com/f/a/FM1AG-y6GySZep-2sm6riw~~/AARF7wA~/RgRkXZU0P0QtaHR0cHM6Ly9leHByZXNzLmFkb2JlLmNvbS9wYWdlL0doMUdkaVFUcUNxdVQvVwNzcGNCCmJxNBB7Yntk0tpSFXB1cmNoYXNpbmdAbXJsLmNvbS5hdVgEAAAAAA~~	Get hash	malicious	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
37f463bf4616ecd445d4a1937da06e19	LxlidaGjzt.exe	Get hash	malicious	Browse	193.109.119.57 152.199.21.98
	lqBlMZgka5.exe	Get hash	malicious	Browse	193.109.119.57 152.199.21.98
	lqBlMZgka5.exe	Get hash	malicious	Browse	193.109.119.57 152.199.21.98
	nsBqQ8GYb9.exe	Get hash	malicious	Browse	193.109.119.57 152.199.21.98
	SecuriteInfo.com.Trojan.GenericKD.39915333.14561.exe	Get hash	malicious	Browse	193.109.119.57 152.199.21.98
	nsBqQ8GYb9.exe	Get hash	malicious	Browse	193.109.119.57 152.199.21.98
	SecuriteInfo.com.Variant.Zusy.428082.19221.exe	Get hash	malicious	Browse	193.109.119.57 152.199.21.98
	FPGG8PCYvE.exe	Get hash	malicious	Browse	193.109.119.57 152.199.21.98
	FPGG8PCYvE.exe	Get hash	malicious	Browse	193.109.119.57 152.199.21.98
	jk42Zw8kFn.exe	Get hash	malicious	Browse	193.109.119.57 152.199.21.98
	M5vHIt7slV.exe	Get hash	malicious	Browse	193.109.119.57 152.199.21.98
	jk42Zw8kFn.exe	Get hash	malicious	Browse	193.109.119.57 152.199.21.98
	M5vHIt7slV.exe	Get hash	malicious	Browse	193.109.119.57 152.199.21.98
	cs.exe	Get hash	malicious	Browse	193.109.119.57 152.199.21.98
	Edge.js	Get hash	malicious	Browse	193.109.119.57 152.199.21.98
	Edge.js	Get hash	malicious	Browse	193.109.119.57 152.199.21.98
	H9mSYpAxqa.exe	Get hash	malicious	Browse	193.109.119.57 152.199.21.98
	ClosingDoc.html	Get hash	malicious	Browse	193.109.119.57 152.199.21.98
	http://d0edsbfmqucaulbq5ew3tn6o.greathem.ws/ozljha.php/1A0u168m9jilc04y9rn61gx1wd90ta330v/skk/017g2	Get hash	malicious	Browse	193.109.119.57 152.199.21.98
	https://yielding-cliff-weather.glitch.me/JHindex.html	Get hash	malicious	Browse	193.109.119.57 152.199.21.98

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	451603
Entropy (8bit):	5.009711072558331
Encrypted:	false
SSDEEP:	12288:ZHfRTyGZ6lup8Cfrvq4JBPKh+FBlESBw4p6:NfOCzvRKhGvwJ
MD5:	A78AD14E77147E7DE3647E61964C0335
SHA1:	CECC3DD41F4CEA0192B24300C71E1911BD4FCE45
SHA-256:	0D6803758FF8F87081FAFD62E90F0950DFB2DD7991E9607FE76A8F92D0E893FA
SHA-512:	DDE24D5AD50D68FC91E9E325D31E66EF8F624B6BB3A07D14FFED1104D3AB5F4EF1D7969A5CDE0DFBB19CB31C506F7DE97AF67C2F244F7E7E8E10648EA8321101
Malicious:	false
Reputation:	high, very likely benign file
Preview:	BDic.... ....6...."..Z..4g....6.2...{/...3...5....AF 1363.AF nm.AF pt.AF n1.AF p.AF tc.AF SM.AF M.AF S.AF MS.AF MNR.AF GDS.AF MNT.AF MH.AF MR.AF SZMR.AF MJ.AF MT.AF MY.AF MRZ.AF MN.AF MG.AF RM.AF N.AF MV.AF XM.AF DSM.AF SD.AF G.AF R.AF MNX.AF MRS.AF MD.AF MNRB.AF B.AF ZSMR.AF PM.AF SMNGJ.AF SMN.AF ZMR.AF SMGB.AF MZR.AF GM.AF SMR.AF SMDG.AF RMZ.AF ZM.AF MDG.AF MDT.AF SMNXT.AF SDY.AF LSDG.AF LGDS.AF GLDS.AF UY.AF U.AF DSGNX.AF GNDSX.AF DSG.AF Y.AF GS.AF IEMS.AF YP.AF ZGDRS.AF XGNVDS.AF UT.AF GNDS.AF GVDS.AF MYPS.AF XGNDS.AF TPRY.AF MDSG.AF ZGSDR.AF DYSG.AF PMYTNS.AF AGDS.AF DRZGS.AF PY.AF GSPMDY.AF EGVDS.AF SL.AF GNXDS.AF DSBG.AF IM.AF I.AF MDGS.AF SMY.AF DSGN.AF DSLG.AF GMDS.AF MDSBG.AF SGD.AF IY.AF P.AF DSMG.AF BLZGDRS.AF TR.AF AGSD.AF ZGBDRSL.AF PTRY.AF ASDGV.AF ASM.AF ICANGSD.AF ICAM.AF IKY.AF AMS.AF PMYTRS.AF BZGVDRS.AF SDRBZG.AF GVMDS.AF PSM.AF DGLS.AF GNVXDS.AF AGDSL.AF DGS.AF XDSGNV.AF BZGDRS.AF AM.AF AS.AF A.AF LDSG.AF AGVDS.AF SDG.AF LDSMG.AF EDSMG.AF EY.AF DRSMZG.AF PRYT.AF LZ

File type:	HTML document, ISO-8859 text, with very long lines, with CRLF line terminators
Entropy (8bit):	5.251662587822124
TrID:	HyperText Markup Language (13003/1) 100.00%
File name:	Bill of Lading.htm
File size:	47325
MD5:	a6326708064aa448a2f9d842ed8af555
SHA1:	246d098d0a455ed4eba2a96f3c7489685f013345
SHA256:	4c326163765ccce65ac5fe6c707b286f9f7fdffc49d20d68a61df80f7dc72a35
SHA512:	815cb7a4260c793b2d9afb9d651f8bd049a05037833bdf868d7241fbae0888c68ade02a0e6809143af32956de6107dc7d1ae6a2ced12fa1fcb0c5799b143dae9
SSDEEP:	768:9FpKME1qhxQrLsxkPEP4xxK53OPe6dAF4zMOdvg5ginOzQ5Z7U8O8+oM84aGEk7y:97VE1qUrLsxeEQxxK53OPe6dAF4zMOd8
TLSH:	3F23CA89274201098DBA1F207BF12F4DFB279273D742C0567AFD94648FBA564CAA0F9D
File Content Preview:	.. html.form.login.ecom.html -->........................<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN".."http://www.w3.org/TR/html4/strict.dtd">..<html>..<head>...<meta http-equiv="x-ua-compatible" content="IE=edge">...<meta http-equiv="Content-Typ

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 3, 2022 00:04:25.826983929 CEST	57723	53	192.168.2.3	8.8.8.8
Jul 3, 2022 00:04:25.833067894 CEST	58116	53	192.168.2.3	8.8.8.8
Jul 3, 2022 00:04:25.841593981 CEST	57421	53	192.168.2.3	8.8.8.8
Jul 3, 2022 00:04:25.855298042 CEST	53	57723	8.8.8.8	192.168.2.3
Jul 3, 2022 00:04:25.859306097 CEST	53	58116	8.8.8.8	192.168.2.3
Jul 3, 2022 00:04:26.346318007 CEST	49873	53	192.168.2.3	8.8.8.8
Jul 3, 2022 00:04:28.396368980 CEST	49327	53	192.168.2.3	8.8.8.8
Jul 3, 2022 00:04:28.672698975 CEST	58981	53	192.168.2.3	8.8.8.8
Jul 3, 2022 00:04:31.484847069 CEST	63148	443	192.168.2.3	142.250.185.174
Jul 3, 2022 00:04:31.509376049 CEST	443	63148	142.250.185.174	192.168.2.3
Jul 3, 2022 00:04:31.510006905 CEST	63148	443	192.168.2.3	142.250.185.174
Jul 3, 2022 00:04:31.533967018 CEST	443	63148	142.250.185.174	192.168.2.3
Jul 3, 2022 00:04:31.534086943 CEST	443	63148	142.250.185.174	192.168.2.3
Jul 3, 2022 00:04:31.534105062 CEST	443	63148	142.250.185.174	192.168.2.3
Jul 3, 2022 00:04:31.534121037 CEST	443	63148	142.250.185.174	192.168.2.3
Jul 3, 2022 00:04:31.590636969 CEST	63148	443	192.168.2.3	142.250.185.174
Jul 3, 2022 00:04:31.591753006 CEST	63148	443	192.168.2.3	142.250.185.174
Jul 3, 2022 00:04:31.595854998 CEST	443	63148	142.250.185.174	192.168.2.3
Jul 3, 2022 00:04:31.595904112 CEST	443	63148	142.250.185.174	192.168.2.3
Jul 3, 2022 00:04:31.595942020 CEST	443	63148	142.250.185.174	192.168.2.3
Jul 3, 2022 00:04:31.595980883 CEST	443	63148	142.250.185.174	192.168.2.3
Jul 3, 2022 00:04:31.597456932 CEST	63148	443	192.168.2.3	142.250.185.174
Jul 3, 2022 00:04:31.597527981 CEST	63148	443	192.168.2.3	142.250.185.174
Jul 3, 2022 00:04:31.890767097 CEST	63148	443	192.168.2.3	142.250.185.174
Jul 3, 2022 00:04:31.891258955 CEST	63148	443	192.168.2.3	142.250.185.174
Jul 3, 2022 00:04:31.918452978 CEST	443	63148	142.250.185.174	192.168.2.3
Jul 3, 2022 00:04:31.928993940 CEST	443	63148	142.250.185.174	192.168.2.3
Jul 3, 2022 00:04:31.929292917 CEST	443	63148	142.250.185.174	192.168.2.3
Jul 3, 2022 00:04:31.929308891 CEST	443	63148	142.250.185.174	192.168.2.3
Jul 3, 2022 00:04:31.960855007 CEST	63148	443	192.168.2.3	142.250.185.174
Jul 3, 2022 00:04:31.961168051 CEST	63148	443	192.168.2.3	142.250.185.174
Jul 3, 2022 00:04:31.961843967 CEST	443	63148	142.250.185.174	192.168.2.3
Jul 3, 2022 00:04:31.962563038 CEST	63148	443	192.168.2.3	142.250.185.174
Jul 3, 2022 00:04:41.345163107 CEST	50778	53	192.168.2.3	8.8.8.8
Jul 3, 2022 00:04:41.370161057 CEST	53	50778	8.8.8.8	192.168.2.3
Jul 3, 2022 00:04:41.559425116 CEST	55151	53	192.168.2.3	8.8.8.8
Jul 3, 2022 00:04:41.587502003 CEST	53	55151	8.8.8.8	192.168.2.3
Jul 3, 2022 00:04:42.133047104 CEST	59795	53	192.168.2.3	8.8.8.8
Jul 3, 2022 00:04:42.136867046 CEST	59390	53	192.168.2.3	8.8.8.8
Jul 3, 2022 00:04:42.142055988 CEST	64816	53	192.168.2.3	8.8.8.8
Jul 3, 2022 00:04:42.155472994 CEST	53	59795	8.8.8.8	192.168.2.3
Jul 3, 2022 00:04:42.158720016 CEST	64996	53	192.168.2.3	8.8.8.8
Jul 3, 2022 00:04:42.159595966 CEST	53	59390	8.8.8.8	192.168.2.3
Jul 3, 2022 00:04:42.169177055 CEST	53	64816	8.8.8.8	192.168.2.3
Jul 3, 2022 00:04:42.183041096 CEST	53	64996	8.8.8.8	192.168.2.3
Jul 3, 2022 00:04:42.314883947 CEST	53816	53	192.168.2.3	8.8.8.8
Jul 3, 2022 00:04:42.338175058 CEST	53	53816	8.8.8.8	192.168.2.3
Jul 3, 2022 00:04:45.878479958 CEST	60640	53	192.168.2.3	8.8.8.8
Jul 3, 2022 00:04:45.902331114 CEST	53	60640	8.8.8.8	192.168.2.3

Timestamp	kBytes transferred	Direction	Data
2022-07-02 22:04:26 UTC	0	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfm X-Goog-Update-Updater: chromecrx-85.0.4183.121 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-07-02 22:04:26 UTC	1	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-F2BKjApzfkPCuUGkJ4bZqw' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 02 Jul 2022 22:04:26 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 5661 X-Daystart: 54266 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-07-02 22:04:26 UTC	2	IN	Data Raw: 33 31 62 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 35 36 36 31 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 35 34 32 36 36 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 31b<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="5661" elapsed_seconds="54266"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2022-07-02 22:04:26 UTC	3	IN	Data Raw: 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 2e 63 72 78 22 20 66 70 3d 22 31 2e 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 61 Data Ascii: mmhkkegccagdldgiimedpiccmgmieda.crx" fp="1.81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app><a
2022-07-02 22:04:26 UTC	3	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0