Edit tour

Windows Analysis Report
Fatura.Vivo.html

Overview

General Information

Sample Name:	Fatura.Vivo.html
Analysis ID:	679651
MD5:	7e41be563457d6038687186692eb52f8
SHA1:	fd4ade2d432fbd5f0670238cedc3deef7034d364
SHA256:	627dc49bf0bab971d202383338c17f06c7416ebf9d1ac3d602114a6b398a1feb
Tags:	html
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

JA3 SSL client fingerprint seen in connection with other malware

IP address seen in connection with other malware

Classification

Process Tree

System is w10x64

chrome.exe (PID: 1004 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank MD5: C139654B5C1438A95B321BB01AD63EF6)

chrome.exe (PID: 2012 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1564,18120619820808562449,9042696685717106766,131072 --lang=en-GB --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1920 /prefetch:8 MD5: C139654B5C1438A95B321BB01AD63EF6)

chrome.exe (PID: 4112 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" "C:\Users\user\Desktop\Fatura.Vivo.html MD5: C139654B5C1438A95B321BB01AD63EF6)

cleanup

HTTP traffic detected: GET /?hash=%20Fatura%20Vivo%20ZIP HTTP/1.1Host: 24.228.95.34.bc.googleusercontent.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: en-GB,en-US;q=0.9,en;q=0.8

Source: unknown	HTTPS traffic detected: 142.250.184.195:443 -> 192.168.2.4:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.196:443 -> 192.168.2.4:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.196:443 -> 192.168.2.4:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.23.97:443 -> 192.168.2.4:49896 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.239.32.29:443 -> 192.168.2.4:49946 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.239.32.29:443 -> 192.168.2.4:49946 version: TLS 1.2

Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 50029 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50019 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49937 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49917
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 49948 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49959 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 50030 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443

Source: 91e94580-077f-4bd8-b795-0e252a6559eb.tmp.1.dr	String found in binary or memory: https://accounts.google.com
Source: craw_window.js.0.dr	String found in binary or memory: https://accounts.google.com/MergeSession
Source: 91e94580-077f-4bd8-b795-0e252a6559eb.tmp.1.dr	String found in binary or memory: https://apis.google.com
Source: 91e94580-077f-4bd8-b795-0e252a6559eb.tmp.1.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json.0.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 91e94580-077f-4bd8-b795-0e252a6559eb.tmp.1.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: 91e94580-077f-4bd8-b795-0e252a6559eb.tmp.1.dr, 4f9996cb-8173-476b-b672-87104b30f99f.tmp.1.dr, 618cdd77-6a53-4c0d-ab0f-56856969bba6.tmp.1.dr	String found in binary or memory: https://dns.google
Source: 91e94580-077f-4bd8-b795-0e252a6559eb.tmp.1.dr	String found in binary or memory: https://fonts.googleapis.com
Source: 91e94580-077f-4bd8-b795-0e252a6559eb.tmp.1.dr	String found in binary or memory: https://fonts.gstatic.com
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p
Source: 91e94580-077f-4bd8-b795-0e252a6559eb.tmp.1.dr	String found in binary or memory: https://ogs.google.com
Source: craw_window.js.0.dr, manifest.json.0.dr	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: 91e94580-077f-4bd8-b795-0e252a6559eb.tmp.1.dr	String found in binary or memory: https://play.google.com
Source: 91e94580-077f-4bd8-b795-0e252a6559eb.tmp.1.dr	String found in binary or memory: https://r5---sn-h0jeln7l.gvt1.com
Source: 91e94580-077f-4bd8-b795-0e252a6559eb.tmp.1.dr	String found in binary or memory: https://redirector.gvt1.com
Source: craw_window.js.0.dr, manifest.json.0.dr	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: 91e94580-077f-4bd8-b795-0e252a6559eb.tmp.1.dr	String found in binary or memory: https://ssl.gstatic.com
Source: Fatura.Vivo.html	String found in binary or memory: https://storage.googleapis.com/atraso/fatura.html
Source: History Provider Cache.0.dr	String found in binary or memory: https://storage.googleapis.com/atraso/fatura.html2
Source: History Provider Cache.0.dr	String found in binary or memory: https://storage.googleapis.com/atraso/fatura.html2:
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://www-googleapis-staging.sandbox.google.com
Source: 91e94580-077f-4bd8-b795-0e252a6559eb.tmp.1.dr	String found in binary or memory: https://www.google.com
Source: manifest.json.0.dr	String found in binary or memory: https://www.google.com/
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/accounts/OAuthLogin?issueuberauth=1
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/cleardot.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/dot2.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/x2.gif
Source: craw_background.js.0.dr	String found in binary or memory: https://www.google.com/intl/en-US/chrome/blank.html
Source: 91e94580-077f-4bd8-b795-0e252a6559eb.tmp.1.dr, craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://www.googleapis.com
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: 91e94580-077f-4bd8-b795-0e252a6559eb.tmp.1.dr	String found in binary or memory: https://www.gstatic.com

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1564,18120619820808562449,9042696685717106766,131072 --lang=en-GB --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1920 /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" "C:\Users\user\Desktop\Fatura.Vivo.html
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1564,18120619820808562449,9042696685717106766,131072 --lang=en-GB --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1920 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Accept
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Accept

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	2 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	2 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	3 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	1 Ingress Tool Transfer	SIM Card Swap		Carrier Billing Fraud

Source	Detection	Scanner	Link
Fatura.Vivo.html	5%	Virustotal	Browse
Fatura.Vivo.html	6%	Metadefender	Browse
Fatura.Vivo.html	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
https://dns.google	0%	URL Reputation	safe
https://about.google/stories/timelapse-planetary-changes/	0%	Virustotal		Browse

Name	IP	Active	Malicious	Reputation
gstaticadssl.l.google.com	142.250.184.195	true	false	high
scone-pa.clients6.google.com	172.217.16.202	true	false	high
www.google.de	172.217.18.3	true	false	high
dart.l.doubleclick.net	142.250.184.230	true	false	high
google.com	172.217.16.206	true	false	high
csp.withgoogle.com	172.217.16.209	true	false	unknown
accounts.google.com	142.250.185.205	true	false	high
plus.l.google.com	216.58.212.142	true	false	high
stats.l.doubleclick.net	66.102.1.155	true	false	high
www-googletagmanager.l.google.com	142.250.186.168	true	false	high
mail.google.com	142.250.186.165	true	false	high
store.google.com	172.217.16.142	true	false	high
adservice.google.com	142.250.185.130	true	false	high
about.google	216.239.32.29	true	false	unknown
youtube-ui.l.google.com	142.250.184.206	true	false	high
googleads.g.doubleclick.net	172.217.18.2	true	false	high
play.google.com	142.250.186.142	true	false	high
24.228.95.34.bc.googleusercontent.com	34.95.228.24	true	false	high
www.google.com	142.250.185.196	true	false	high
clients.l.google.com	142.250.186.110	true	false	high
googlehosted.l.googleusercontent.com	172.217.23.97	true	false	high
kstatic.googleusercontent.com	35.241.11.240	true	false	high
ad.doubleclick.net	unknown	unknown	false	high
time.windows.com	unknown	unknown	false	high
lh3.googleusercontent.com	unknown	unknown	false	high
stats.g.doubleclick.net	unknown	unknown	false	high
clients2.google.com	unknown	unknown	false	high
www.youtube.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high

Name	Malicious	Antivirus Detection	Reputation
https://www.google.com/	false		high
https://about.google/stories/timelapse-planetary-changes/	false	0%, Virustotal, Browse	unknown
https://store.google.com/DE?utm_source=hp_header&utm_medium=google_ooo&utm_campaign=GS100042&hl=de	false		high
http://24.228.95.34.bc.googleusercontent.com/?hash=%20Fatura%20Vivo%20ZIP	false		high
https://www.google.com/intl/de/gmail/about/#	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
216.58.212.142	plus.l.google.com	United States	15169	GOOGLEUS	false
34.95.228.24	24.228.95.34.bc.googleusercontent.com	United States	15169	GOOGLEUS	false
142.250.185.205	accounts.google.com	United States	15169	GOOGLEUS	false
172.217.23.97	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
66.102.1.155	stats.l.doubleclick.net	United States	15169	GOOGLEUS	false
66.102.1.156	unknown	United States	15169	GOOGLEUS	false
142.250.186.110	clients.l.google.com	United States	15169	GOOGLEUS	false
142.250.184.206	youtube-ui.l.google.com	United States	15169	GOOGLEUS	false
35.241.11.240	kstatic.googleusercontent.com	United States	15169	GOOGLEUS	false
172.217.16.142	store.google.com	United States	15169	GOOGLEUS	false
142.250.184.195	gstaticadssl.l.google.com	United States	15169	GOOGLEUS	false
216.239.32.29	about.google	United States	15169	GOOGLEUS	false
142.250.184.230	dart.l.doubleclick.net	United States	15169	GOOGLEUS	false
172.217.16.206	google.com	United States	15169	GOOGLEUS	false
172.217.18.3	www.google.de	United States	15169	GOOGLEUS	false
172.217.16.209	csp.withgoogle.com	United States	15169	GOOGLEUS	false
172.217.18.2	googleads.g.doubleclick.net	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.185.196	www.google.com	United States	15169	GOOGLEUS	false
142.250.185.130	adservice.google.com	United States	15169	GOOGLEUS	false
142.250.186.165	mail.google.com	United States	15169	GOOGLEUS	false
142.250.186.168	www-googletagmanager.l.google.com	United States	15169	GOOGLEUS	false

IP
192.168.2.1
192.168.2.23
127.0.0.1

Joe Sandbox Version:	35.0.0 Citrine
Analysis ID:	679651
Start date and time: 06/08/202208:44:08	2022-08-06 08:44:08 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 5s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	Fatura.Vivo.html
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean1.winHTML@37/117@33/25
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .html Adjust boot time Enable AMSI Browse: https://about.google/?fg=1&utm_source=google-DE&utm_medium=referral&utm_campaign=hp-header Browse: https://store.google.com/DE?utm_source=hp_header&utm_medium=google_ooo&utm_campaign=GS100042&hl=en-DE Browse: https://mail.google.com/mail/&ogbl

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SysEx File -
Category:	dropped
Size (bytes):	94708
Entropy (8bit):	3.7449533126471413
Encrypted:	false
SSDEEP:	384:J7CdlbAeXoffVMSBUNBr6vlv3exL2HXWGC1rQTt1xufTrCrwZmIDQvRtpCO7bFNB:BGC1Vm3iWoeDhrncXrSbKh3Vl1
MD5:	2405ED7F517338F4A03F876037DC1C9A
SHA1:	03E85D9AD5CB79BD611BD2B38A7F9A4C3B1F81E6
SHA-256:	8689BB1FE97627AD06174EA3C3A92C4827BCA491249FFCA49B951320F3D5A16E
SHA-512:	924352F358FC9DB81CDF5CF596D7CE08499C913BFCE7108F5D3C5148DAA6DD6DC767A2E34F0710F1ADBC36A25BABC12374FE21C548CF9908129BAC1624D10C9F
Malicious:	false
Reputation:	low
Preview:	.q.................C.:.\.P.R.O.G.R.A.~.1.\.M.I.C.R.O.S.~.1.\.O.f.f.i.c.e.1.6.\.G.R.O.O.V.E.E.X...D.L.L..P!...[)...%.p.r.o.g.r.a.m.f.i.l.e.s.%.\.m.i.c.r.o.s.o.f.t. .o.f.f.i.c.e.\.o.f.f.i.c.e.1.6.\.......g.r.o.o.v.e.e.x...d.l.l.....M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e. .2.0.1.6......M.i.c.r.o.s.o.f.t. .O.n.e.D.r.i.v.e. .f.o.r. .B.u.s.i.n.e.s.s. .E.x.t.e.n.s.i.o.n.s.....1.6...0...4.7.1.1...1.0.0.0.....*...C.:.\.P.R.O.G.R.A.~.1.\.M.I.C.R.O.S.~.1.\.O.f.f.i.c.e.1.6.\.G.R.O.O.V.E.E.X...D.L.L.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n....d8.D...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.o.m.m.o.n. .F.i.l.e.s.\.M.i.c.r.o.s.o.f.t. .S.h.a.r.e.d.\.O.F.F.I.C.E.1.6.\.m.s.o.s.h.e.x.t...d.l.l..@.....U/...%.c.o.m.m.o.n.p.r.o.g.r.a.m.f.i.l.e.s.%.\.m.i.c.r.o.s.o.f.t. .s.h.a.r.e.d.\.o.f.f.i.c.e.1.6.\.......m.s.o.s.h.e.x.t...d.l.l.....M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e.)...M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e. .S.h.e.l.l. .E.x.t.e.n.s.i.o.n. .H.a.n.d.l.e.r.s.......1.6...0...4.2.6.6...1.0.0.1.....D...C.:.\.P.r.o.g.r.a.m.

Name	Source	Malicious	Antivirus Detection	Reputation
https://dns.google	91e94580-077f-4bd8-b795-0e252a6559eb.tmp.1.dr, 4f9996cb-8173-476b-b672-87104b30f99f.tmp.1.dr, 618cdd77-6a53-4c0d-ab0f-56856969bba6.tmp.1.dr	false	URL Reputation: safe	unknown
https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p	craw_window.js.0.dr, craw_background.js.0.dr	false		high
https://www.google.com/intl/en-US/chrome/blank.html	craw_background.js.0.dr	false		high
https://ogs.google.com	91e94580-077f-4bd8-b795-0e252a6559eb.tmp.1.dr	false		high
https://www.google.com/images/cleardot.gif	craw_window.js.0.dr	false		high
https://play.google.com	91e94580-077f-4bd8-b795-0e252a6559eb.tmp.1.dr	false		high
https://payments.google.com/payments/v4/js/integrator.js	craw_window.js.0.dr, manifest.json.0.dr	false		high
https://sandbox.google.com/payments/v4/js/integrator.js	craw_window.js.0.dr, manifest.json.0.dr	false		high
https://www.google.com/images/x2.gif	craw_window.js.0.dr	false		high
https://accounts.google.com/MergeSession	craw_window.js.0.dr	false		high
https://www.google.com	91e94580-077f-4bd8-b795-0e252a6559eb.tmp.1.dr	false		high
https://www.google.com/images/dot2.gif	craw_window.js.0.dr	false		high
https://accounts.google.com	91e94580-077f-4bd8-b795-0e252a6559eb.tmp.1.dr	false		high
https://clients2.googleusercontent.com	91e94580-077f-4bd8-b795-0e252a6559eb.tmp.1.dr	false		high
https://apis.google.com	91e94580-077f-4bd8-b795-0e252a6559eb.tmp.1.dr	false		high
https://www.google.com/accounts/OAuthLogin?issueuberauth=1	craw_window.js.0.dr	false		high
https://www.google.com/	manifest.json.0.dr	false		high
https://www-googleapis-staging.sandbox.google.com	craw_window.js.0.dr, craw_background.js.0.dr	false		high
https://clients2.google.com	91e94580-077f-4bd8-b795-0e252a6559eb.tmp.1.dr	false		high
https://clients2.google.com/service/update2/crx	manifest.json.0.dr	false		high

File type:	ASCII text, with CRLF line terminators
Entropy (8bit):	4.605535342239748
TrID:
File name:	Fatura.Vivo.html
File size:	96
MD5:	7e41be563457d6038687186692eb52f8
SHA1:	fd4ade2d432fbd5f0670238cedc3deef7034d364
SHA256:	627dc49bf0bab971d202383338c17f06c7416ebf9d1ac3d602114a6b398a1feb
SHA512:	a42a7be4d37f3c255c2597e32a5ac350916a36acf96ef3b5634449a9e83828a0f424d6e18b49596b3e6c1a17c51a1f38deda3fc0984e0e30ea9d1264f4f81db4
SSDEEP:	3:TAREHjJMzVJu+1zWNVYkMECYKKhmHTCW/Xekn:LMRJVCNOkMLZHTCWfFn
TLSH:	70B012A31408953B462157A460913023A23106006D0D41B0C21024CD1869F10C682372
File Content Preview:	..<meta http-equiv="refresh" content="0; url=https://storage.googleapis.com/atraso/fatura.html">

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 6, 2022 08:45:14.889241934 CEST	49748	443	192.168.2.4	142.250.185.205
Aug 6, 2022 08:45:14.889291048 CEST	443	49748	142.250.185.205	192.168.2.4
Aug 6, 2022 08:45:14.889379025 CEST	49748	443	192.168.2.4	142.250.185.205
Aug 6, 2022 08:45:14.889636993 CEST	49749	443	192.168.2.4	142.250.186.110
Aug 6, 2022 08:45:14.889693022 CEST	443	49749	142.250.186.110	192.168.2.4
Aug 6, 2022 08:45:14.889775038 CEST	49749	443	192.168.2.4	142.250.186.110
Aug 6, 2022 08:45:14.891032934 CEST	49748	443	192.168.2.4	142.250.185.205
Aug 6, 2022 08:45:14.891052961 CEST	443	49748	142.250.185.205	192.168.2.4
Aug 6, 2022 08:45:14.892117023 CEST	49749	443	192.168.2.4	142.250.186.110
Aug 6, 2022 08:45:14.892142057 CEST	443	49749	142.250.186.110	192.168.2.4
Aug 6, 2022 08:45:14.953001022 CEST	443	49749	142.250.186.110	192.168.2.4
Aug 6, 2022 08:45:14.957562923 CEST	443	49748	142.250.185.205	192.168.2.4
Aug 6, 2022 08:45:14.958559990 CEST	49749	443	192.168.2.4	142.250.186.110
Aug 6, 2022 08:45:14.958592892 CEST	443	49749	142.250.186.110	192.168.2.4
Aug 6, 2022 08:45:14.958766937 CEST	49748	443	192.168.2.4	142.250.185.205
Aug 6, 2022 08:45:14.958801031 CEST	443	49748	142.250.185.205	192.168.2.4
Aug 6, 2022 08:45:14.958992958 CEST	443	49749	142.250.186.110	192.168.2.4
Aug 6, 2022 08:45:14.959070921 CEST	49749	443	192.168.2.4	142.250.186.110
Aug 6, 2022 08:45:14.959891081 CEST	443	49749	142.250.186.110	192.168.2.4
Aug 6, 2022 08:45:14.959968090 CEST	49749	443	192.168.2.4	142.250.186.110
Aug 6, 2022 08:45:14.960020065 CEST	443	49748	142.250.185.205	192.168.2.4
Aug 6, 2022 08:45:14.960176945 CEST	49748	443	192.168.2.4	142.250.185.205
Aug 6, 2022 08:45:15.148358107 CEST	49748	443	192.168.2.4	142.250.185.205
Aug 6, 2022 08:45:15.148655891 CEST	443	49748	142.250.185.205	192.168.2.4
Aug 6, 2022 08:45:15.148807049 CEST	49749	443	192.168.2.4	142.250.186.110
Aug 6, 2022 08:45:15.149120092 CEST	443	49749	142.250.186.110	192.168.2.4
Aug 6, 2022 08:45:15.149293900 CEST	49748	443	192.168.2.4	142.250.185.205
Aug 6, 2022 08:45:15.149321079 CEST	443	49748	142.250.185.205	192.168.2.4
Aug 6, 2022 08:45:15.149981022 CEST	49749	443	192.168.2.4	142.250.186.110
Aug 6, 2022 08:45:15.150017023 CEST	443	49749	142.250.186.110	192.168.2.4
Aug 6, 2022 08:45:15.178740978 CEST	443	49749	142.250.186.110	192.168.2.4
Aug 6, 2022 08:45:15.178883076 CEST	443	49749	142.250.186.110	192.168.2.4
Aug 6, 2022 08:45:15.179060936 CEST	49749	443	192.168.2.4	142.250.186.110
Aug 6, 2022 08:45:15.179086924 CEST	49749	443	192.168.2.4	142.250.186.110
Aug 6, 2022 08:45:15.182379961 CEST	49749	443	192.168.2.4	142.250.186.110
Aug 6, 2022 08:45:15.182421923 CEST	443	49749	142.250.186.110	192.168.2.4
Aug 6, 2022 08:45:15.200931072 CEST	443	49748	142.250.185.205	192.168.2.4
Aug 6, 2022 08:45:15.201133966 CEST	443	49748	142.250.185.205	192.168.2.4
Aug 6, 2022 08:45:15.201225042 CEST	49748	443	192.168.2.4	142.250.185.205
Aug 6, 2022 08:45:15.201258898 CEST	49748	443	192.168.2.4	142.250.185.205
Aug 6, 2022 08:45:15.204303026 CEST	49748	443	192.168.2.4	142.250.185.205
Aug 6, 2022 08:45:15.204339027 CEST	443	49748	142.250.185.205	192.168.2.4
Aug 6, 2022 08:45:15.666130066 CEST	49760	443	192.168.2.4	142.250.185.196
Aug 6, 2022 08:45:15.666181087 CEST	443	49760	142.250.185.196	192.168.2.4
Aug 6, 2022 08:45:15.666304111 CEST	49760	443	192.168.2.4	142.250.185.196
Aug 6, 2022 08:45:15.666506052 CEST	49760	443	192.168.2.4	142.250.185.196
Aug 6, 2022 08:45:15.666531086 CEST	443	49760	142.250.185.196	192.168.2.4
Aug 6, 2022 08:45:15.719945908 CEST	443	49760	142.250.185.196	192.168.2.4
Aug 6, 2022 08:45:15.720412016 CEST	49760	443	192.168.2.4	142.250.185.196
Aug 6, 2022 08:45:15.720465899 CEST	443	49760	142.250.185.196	192.168.2.4
Aug 6, 2022 08:45:15.721822977 CEST	443	49760	142.250.185.196	192.168.2.4
Aug 6, 2022 08:45:15.721930027 CEST	49760	443	192.168.2.4	142.250.185.196
Aug 6, 2022 08:45:15.727437973 CEST	49760	443	192.168.2.4	142.250.185.196
Aug 6, 2022 08:45:15.727644920 CEST	49760	443	192.168.2.4	142.250.185.196
Aug 6, 2022 08:45:15.727652073 CEST	443	49760	142.250.185.196	192.168.2.4
Aug 6, 2022 08:45:15.764260054 CEST	443	49760	142.250.185.196	192.168.2.4
Aug 6, 2022 08:45:15.764370918 CEST	49760	443	192.168.2.4	142.250.185.196
Aug 6, 2022 08:45:15.764374971 CEST	443	49760	142.250.185.196	192.168.2.4
Aug 6, 2022 08:45:15.764467955 CEST	49760	443	192.168.2.4	142.250.185.196
Aug 6, 2022 08:45:15.845268965 CEST	49760	443	192.168.2.4	142.250.185.196
Aug 6, 2022 08:45:15.845323086 CEST	443	49760	142.250.185.196	192.168.2.4
Aug 6, 2022 08:45:16.524955988 CEST	49762	80	192.168.2.4	34.95.228.24
Aug 6, 2022 08:45:16.525671005 CEST	49763	80	192.168.2.4	34.95.228.24
Aug 6, 2022 08:45:16.737191916 CEST	49765	80	192.168.2.4	34.95.228.24
Aug 6, 2022 08:45:16.777789116 CEST	80	49763	34.95.228.24	192.168.2.4
Aug 6, 2022 08:45:16.777904034 CEST	49763	80	192.168.2.4	34.95.228.24
Aug 6, 2022 08:45:16.778167009 CEST	49763	80	192.168.2.4	34.95.228.24
Aug 6, 2022 08:45:16.778496981 CEST	80	49762	34.95.228.24	192.168.2.4
Aug 6, 2022 08:45:16.778594017 CEST	49762	80	192.168.2.4	34.95.228.24
Aug 6, 2022 08:45:16.988986015 CEST	80	49765	34.95.228.24	192.168.2.4
Aug 6, 2022 08:45:16.989104033 CEST	49765	80	192.168.2.4	34.95.228.24
Aug 6, 2022 08:45:17.029136896 CEST	80	49763	34.95.228.24	192.168.2.4
Aug 6, 2022 08:45:17.634411097 CEST	80	49763	34.95.228.24	192.168.2.4
Aug 6, 2022 08:45:17.688622952 CEST	49763	80	192.168.2.4	34.95.228.24
Aug 6, 2022 08:45:17.688977003 CEST	49770	443	192.168.2.4	172.217.16.206
Aug 6, 2022 08:45:17.689009905 CEST	443	49770	172.217.16.206	192.168.2.4
Aug 6, 2022 08:45:17.689080000 CEST	49770	443	192.168.2.4	172.217.16.206
Aug 6, 2022 08:45:17.689362049 CEST	49770	443	192.168.2.4	172.217.16.206
Aug 6, 2022 08:45:17.689372063 CEST	443	49770	172.217.16.206	192.168.2.4
Aug 6, 2022 08:45:17.734078884 CEST	443	49770	172.217.16.206	192.168.2.4
Aug 6, 2022 08:45:17.750489950 CEST	49770	443	192.168.2.4	172.217.16.206
Aug 6, 2022 08:45:17.750538111 CEST	443	49770	172.217.16.206	192.168.2.4
Aug 6, 2022 08:45:17.751386881 CEST	443	49770	172.217.16.206	192.168.2.4
Aug 6, 2022 08:45:17.751475096 CEST	49770	443	192.168.2.4	172.217.16.206
Aug 6, 2022 08:45:17.752820969 CEST	443	49770	172.217.16.206	192.168.2.4
Aug 6, 2022 08:45:17.752908945 CEST	49770	443	192.168.2.4	172.217.16.206
Aug 6, 2022 08:45:17.755328894 CEST	49770	443	192.168.2.4	172.217.16.206
Aug 6, 2022 08:45:17.755542040 CEST	443	49770	172.217.16.206	192.168.2.4
Aug 6, 2022 08:45:17.755851030 CEST	49770	443	192.168.2.4	172.217.16.206
Aug 6, 2022 08:45:17.755877972 CEST	443	49770	172.217.16.206	192.168.2.4
Aug 6, 2022 08:45:17.784610033 CEST	443	49770	172.217.16.206	192.168.2.4
Aug 6, 2022 08:45:17.784764051 CEST	49770	443	192.168.2.4	172.217.16.206
Aug 6, 2022 08:45:17.785744905 CEST	49770	443	192.168.2.4	172.217.16.206
Aug 6, 2022 08:45:17.785763025 CEST	443	49770	172.217.16.206	192.168.2.4
Aug 6, 2022 08:45:18.213798046 CEST	49771	443	192.168.2.4	142.250.184.195
Aug 6, 2022 08:45:18.213826895 CEST	443	49771	142.250.184.195	192.168.2.4
Aug 6, 2022 08:45:18.213906050 CEST	49771	443	192.168.2.4	142.250.184.195
Aug 6, 2022 08:45:18.214138031 CEST	49771	443	192.168.2.4	142.250.184.195
Aug 6, 2022 08:45:18.214145899 CEST	443	49771	142.250.184.195	192.168.2.4
Aug 6, 2022 08:45:18.266845942 CEST	443	49771	142.250.184.195	192.168.2.4

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Aug 6, 2022 08:45:14.856436014 CEST	192.168.2.4	8.8.8.8	0x1688	Standard query (0)	accounts.google.com	A (IP address)	IN (0x0001)
Aug 6, 2022 08:45:14.857635021 CEST	192.168.2.4	8.8.8.8	0x7887	Standard query (0)	clients2.google.com	A (IP address)	IN (0x0001)
Aug 6, 2022 08:45:15.626429081 CEST	192.168.2.4	8.8.8.8	0xc5e8	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Aug 6, 2022 08:45:16.481993914 CEST	192.168.2.4	8.8.8.8	0x54b4	Standard query (0)	24.228.95.34.bc.googleusercontent.com	A (IP address)	IN (0x0001)
Aug 6, 2022 08:45:17.660495996 CEST	192.168.2.4	8.8.8.8	0xda01	Standard query (0)	google.com	A (IP address)	IN (0x0001)
Aug 6, 2022 08:45:18.711534023 CEST	192.168.2.4	8.8.8.8	0xa516	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)
Aug 6, 2022 08:45:28.679311037 CEST	192.168.2.4	8.8.8.8	0x9309	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Aug 6, 2022 08:45:36.973202944 CEST	192.168.2.4	8.8.8.8	0xd3cb	Standard query (0)	about.google	A (IP address)	IN (0x0001)
Aug 6, 2022 08:45:37.386713982 CEST	192.168.2.4	8.8.8.8	0xe7c3	Standard query (0)	csp.withgoogle.com	A (IP address)	IN (0x0001)
Aug 6, 2022 08:45:39.084192038 CEST	192.168.2.4	8.8.8.8	0x63f0	Standard query (0)	lh3.googleusercontent.com	A (IP address)	IN (0x0001)
Aug 6, 2022 08:45:40.218261957 CEST	192.168.2.4	8.8.8.8	0x9ad6	Standard query (0)	scone-pa.clients6.google.com	A (IP address)	IN (0x0001)
Aug 6, 2022 08:45:40.218698025 CEST	192.168.2.4	8.8.8.8	0x81a8	Standard query (0)	stats.g.doubleclick.net	A (IP address)	IN (0x0001)
Aug 6, 2022 08:45:40.482333899 CEST	192.168.2.4	8.8.8.8	0x853	Standard query (0)	kstatic.googleusercontent.com	A (IP address)	IN (0x0001)
Aug 6, 2022 08:45:42.748759031 CEST	192.168.2.4	8.8.8.8	0x5b72	Standard query (0)	store.google.com	A (IP address)	IN (0x0001)
Aug 6, 2022 08:45:52.230139017 CEST	192.168.2.4	8.8.8.8	0xd0eb	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)
Aug 6, 2022 08:45:53.971224070 CEST	192.168.2.4	8.8.8.8	0x993	Standard query (0)	www.google.de	A (IP address)	IN (0x0001)
Aug 6, 2022 08:45:53.971527100 CEST	192.168.2.4	8.8.8.8	0xffc0	Standard query (0)	googleads.g.doubleclick.net	A (IP address)	IN (0x0001)
Aug 6, 2022 08:45:54.602967978 CEST	192.168.2.4	8.8.8.8	0xbf0	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)
Aug 6, 2022 08:45:57.776505947 CEST	192.168.2.4	8.8.8.8	0x53e3	Standard query (0)	mail.google.com	A (IP address)	IN (0x0001)
Aug 6, 2022 08:46:27.734975100 CEST	192.168.2.4	8.8.8.8	0x81ea	Standard query (0)	lh3.googleusercontent.com	A (IP address)	IN (0x0001)
Aug 6, 2022 08:46:42.607086897 CEST	192.168.2.4	8.8.8.8	0x7eef	Standard query (0)	stats.g.doubleclick.net	A (IP address)	IN (0x0001)
Aug 6, 2022 08:47:10.337965012 CEST	192.168.2.4	8.8.8.8	0x9bdf	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)
Aug 6, 2022 08:47:10.554195881 CEST	192.168.2.4	8.8.8.8	0x31e6	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Aug 6, 2022 08:47:10.557296038 CEST	192.168.2.4	8.8.8.8	0xcbd1	Standard query (0)	www.google.de	A (IP address)	IN (0x0001)
Aug 6, 2022 08:47:10.722578049 CEST	192.168.2.4	8.8.8.8	0xd8e7	Standard query (0)	ad.doubleclick.net	A (IP address)	IN (0x0001)
Aug 6, 2022 08:47:10.810060978 CEST	192.168.2.4	8.8.8.8	0x6998	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)
Aug 6, 2022 08:47:10.830508947 CEST	192.168.2.4	8.8.8.8	0xc731	Standard query (0)	about.google	A (IP address)	IN (0x0001)
Aug 6, 2022 08:47:13.399775982 CEST	192.168.2.4	8.8.8.8	0xa832	Standard query (0)	adservice.google.com	A (IP address)	IN (0x0001)
Aug 6, 2022 08:47:31.649302959 CEST	192.168.2.4	8.8.8.8	0xe	Standard query (0)	about.google	A (IP address)	IN (0x0001)
Aug 6, 2022 08:48:03.901590109 CEST	192.168.2.4	8.8.8.8	0xa24f	Standard query (0)	stats.g.doubleclick.net	A (IP address)	IN (0x0001)
Aug 6, 2022 08:48:15.936501026 CEST	192.168.2.4	8.8.8.8	0xa068	Standard query (0)	scone-pa.clients6.google.com	A (IP address)	IN (0x0001)
Aug 6, 2022 08:48:38.982630014 CEST	192.168.2.4	8.8.8.8	0x5d29	Standard query (0)	time.windows.com	A (IP address)	IN (0x0001)
Aug 6, 2022 08:48:40.536242008 CEST	192.168.2.4	8.8.8.8	0x6263	Standard query (0)	time.windows.com	A (IP address)	IN (0x0001)

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Aug 6, 2022 08:45:14.883111000 CEST	8.8.8.8	192.168.2.4	0x7887	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)
Aug 6, 2022 08:45:14.883111000 CEST	8.8.8.8	192.168.2.4	0x7887	No error (0)	clients.l.google.com		142.250.186.110	A (IP address)	IN (0x0001)
Aug 6, 2022 08:45:14.884349108 CEST	8.8.8.8	192.168.2.4	0x1688	No error (0)	accounts.google.com		142.250.185.205	A (IP address)	IN (0x0001)
Aug 6, 2022 08:45:15.643650055 CEST	8.8.8.8	192.168.2.4	0xc5e8	No error (0)	www.google.com		142.250.185.196	A (IP address)	IN (0x0001)
Aug 6, 2022 08:45:16.522155046 CEST	8.8.8.8	192.168.2.4	0x54b4	No error (0)	24.228.95.34.bc.googleusercontent.com		34.95.228.24	A (IP address)	IN (0x0001)
Aug 6, 2022 08:45:17.687499046 CEST	8.8.8.8	192.168.2.4	0xda01	No error (0)	google.com		172.217.16.206	A (IP address)	IN (0x0001)
Aug 6, 2022 08:45:18.192985058 CEST	8.8.8.8	192.168.2.4	0xc67c	No error (0)	gstaticadssl.l.google.com		142.250.184.195	A (IP address)	IN (0x0001)
Aug 6, 2022 08:45:18.731264114 CEST	8.8.8.8	192.168.2.4	0xa516	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)
Aug 6, 2022 08:45:18.731264114 CEST	8.8.8.8	192.168.2.4	0xa516	No error (0)	plus.l.google.com		216.58.212.142	A (IP address)	IN (0x0001)
Aug 6, 2022 08:45:28.698975086 CEST	8.8.8.8	192.168.2.4	0x9309	No error (0)	www.google.com		142.250.185.196	A (IP address)	IN (0x0001)
Aug 6, 2022 08:45:28.723391056 CEST	8.8.8.8	192.168.2.4	0x56a4	No error (0)	gstaticadssl.l.google.com		142.250.184.195	A (IP address)	IN (0x0001)
Aug 6, 2022 08:45:36.992446899 CEST	8.8.8.8	192.168.2.4	0xd3cb	No error (0)	about.google		216.239.32.29	A (IP address)	IN (0x0001)
Aug 6, 2022 08:45:37.414719105 CEST	8.8.8.8	192.168.2.4	0xe7c3	No error (0)	csp.withgoogle.com		172.217.16.209	A (IP address)	IN (0x0001)
Aug 6, 2022 08:45:37.985435963 CEST	8.8.8.8	192.168.2.4	0xc1ec	No error (0)	www-googletagmanager.l.google.com		142.250.186.168	A (IP address)	IN (0x0001)
Aug 6, 2022 08:45:39.112802029 CEST	8.8.8.8	192.168.2.4	0x63f0	No error (0)	lh3.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)
Aug 6, 2022 08:45:39.112802029 CEST	8.8.8.8	192.168.2.4	0x63f0	No error (0)	googlehosted.l.googleusercontent.com		172.217.23.97	A (IP address)	IN (0x0001)
Aug 6, 2022 08:45:40.243963957 CEST	8.8.8.8	192.168.2.4	0x9ad6	No error (0)	scone-pa.clients6.google.com		172.217.16.202	A (IP address)	IN (0x0001)
Aug 6, 2022 08:45:40.246249914 CEST	8.8.8.8	192.168.2.4	0x81a8	No error (0)	stats.g.doubleclick.net	stats.l.doubleclick.net		CNAME (Canonical name)	IN (0x0001)
Aug 6, 2022 08:45:40.246249914 CEST	8.8.8.8	192.168.2.4	0x81a8	No error (0)	stats.l.doubleclick.net		66.102.1.155	A (IP address)	IN (0x0001)
Aug 6, 2022 08:45:40.246249914 CEST	8.8.8.8	192.168.2.4	0x81a8	No error (0)	stats.l.doubleclick.net		66.102.1.154	A (IP address)	IN (0x0001)
Aug 6, 2022 08:45:40.246249914 CEST	8.8.8.8	192.168.2.4	0x81a8	No error (0)	stats.l.doubleclick.net		66.102.1.157	A (IP address)	IN (0x0001)
Aug 6, 2022 08:45:40.246249914 CEST	8.8.8.8	192.168.2.4	0x81a8	No error (0)	stats.l.doubleclick.net		66.102.1.156	A (IP address)	IN (0x0001)
Aug 6, 2022 08:45:40.510123014 CEST	8.8.8.8	192.168.2.4	0x853	No error (0)	kstatic.googleusercontent.com		35.241.11.240	A (IP address)	IN (0x0001)
Aug 6, 2022 08:45:42.776614904 CEST	8.8.8.8	192.168.2.4	0x5b72	No error (0)	store.google.com		172.217.16.142	A (IP address)	IN (0x0001)
Aug 6, 2022 08:45:52.250792980 CEST	8.8.8.8	192.168.2.4	0xd0eb	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)
Aug 6, 2022 08:45:52.250792980 CEST	8.8.8.8	192.168.2.4	0xd0eb	No error (0)	youtube-ui.l.google.com		142.250.184.206	A (IP address)	IN (0x0001)
Aug 6, 2022 08:45:52.250792980 CEST	8.8.8.8	192.168.2.4	0xd0eb	No error (0)	youtube-ui.l.google.com		142.250.186.78	A (IP address)	IN (0x0001)
Aug 6, 2022 08:45:52.250792980 CEST	8.8.8.8	192.168.2.4	0xd0eb	No error (0)	youtube-ui.l.google.com		172.217.18.14	A (IP address)	IN (0x0001)
Aug 6, 2022 08:45:52.250792980 CEST	8.8.8.8	192.168.2.4	0xd0eb	No error (0)	youtube-ui.l.google.com		142.250.186.174	A (IP address)	IN (0x0001)
Aug 6, 2022 08:45:52.250792980 CEST	8.8.8.8	192.168.2.4	0xd0eb	No error (0)	youtube-ui.l.google.com		172.217.16.206	A (IP address)	IN (0x0001)
Aug 6, 2022 08:45:52.250792980 CEST	8.8.8.8	192.168.2.4	0xd0eb	No error (0)	youtube-ui.l.google.com		216.58.212.174	A (IP address)	IN (0x0001)
Aug 6, 2022 08:45:52.250792980 CEST	8.8.8.8	192.168.2.4	0xd0eb	No error (0)	youtube-ui.l.google.com		172.217.18.110	A (IP address)	IN (0x0001)
Aug 6, 2022 08:45:52.250792980 CEST	8.8.8.8	192.168.2.4	0xd0eb	No error (0)	youtube-ui.l.google.com		142.250.74.206	A (IP address)	IN (0x0001)
Aug 6, 2022 08:45:52.250792980 CEST	8.8.8.8	192.168.2.4	0xd0eb	No error (0)	youtube-ui.l.google.com		172.217.23.110	A (IP address)	IN (0x0001)
Aug 6, 2022 08:45:52.250792980 CEST	8.8.8.8	192.168.2.4	0xd0eb	No error (0)	youtube-ui.l.google.com		216.58.212.142	A (IP address)	IN (0x0001)
Aug 6, 2022 08:45:52.250792980 CEST	8.8.8.8	192.168.2.4	0xd0eb	No error (0)	youtube-ui.l.google.com		142.250.185.78	A (IP address)	IN (0x0001)
Aug 6, 2022 08:45:52.250792980 CEST	8.8.8.8	192.168.2.4	0xd0eb	No error (0)	youtube-ui.l.google.com		142.250.185.110	A (IP address)	IN (0x0001)
Aug 6, 2022 08:45:52.250792980 CEST	8.8.8.8	192.168.2.4	0xd0eb	No error (0)	youtube-ui.l.google.com		142.250.185.142	A (IP address)	IN (0x0001)
Aug 6, 2022 08:45:52.250792980 CEST	8.8.8.8	192.168.2.4	0xd0eb	No error (0)	youtube-ui.l.google.com		142.250.184.238	A (IP address)	IN (0x0001)
Aug 6, 2022 08:45:52.250792980 CEST	8.8.8.8	192.168.2.4	0xd0eb	No error (0)	youtube-ui.l.google.com		142.250.185.174	A (IP address)	IN (0x0001)
Aug 6, 2022 08:45:52.250792980 CEST	8.8.8.8	192.168.2.4	0xd0eb	No error (0)	youtube-ui.l.google.com		142.250.185.206	A (IP address)	IN (0x0001)
Aug 6, 2022 08:45:53.998888016 CEST	8.8.8.8	192.168.2.4	0x993	No error (0)	www.google.de		172.217.18.3	A (IP address)	IN (0x0001)
Aug 6, 2022 08:45:53.998944998 CEST	8.8.8.8	192.168.2.4	0xffc0	No error (0)	googleads.g.doubleclick.net		172.217.18.2	A (IP address)	IN (0x0001)
Aug 6, 2022 08:45:54.628952980 CEST	8.8.8.8	192.168.2.4	0xbf0	No error (0)	play.google.com		142.250.186.142	A (IP address)	IN (0x0001)
Aug 6, 2022 08:45:57.804127932 CEST	8.8.8.8	192.168.2.4	0x53e3	No error (0)	mail.google.com		142.250.186.165	A (IP address)	IN (0x0001)
Aug 6, 2022 08:46:27.760839939 CEST	8.8.8.8	192.168.2.4	0x81ea	No error (0)	lh3.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)
Aug 6, 2022 08:46:27.760839939 CEST	8.8.8.8	192.168.2.4	0x81ea	No error (0)	googlehosted.l.googleusercontent.com		172.217.23.97	A (IP address)	IN (0x0001)
Aug 6, 2022 08:46:42.647278070 CEST	8.8.8.8	192.168.2.4	0x7eef	No error (0)	stats.g.doubleclick.net	stats.l.doubleclick.net		CNAME (Canonical name)	IN (0x0001)
Aug 6, 2022 08:46:42.647278070 CEST	8.8.8.8	192.168.2.4	0x7eef	No error (0)	stats.l.doubleclick.net		66.102.1.155	A (IP address)	IN (0x0001)
Aug 6, 2022 08:46:42.647278070 CEST	8.8.8.8	192.168.2.4	0x7eef	No error (0)	stats.l.doubleclick.net		66.102.1.157	A (IP address)	IN (0x0001)
Aug 6, 2022 08:46:42.647278070 CEST	8.8.8.8	192.168.2.4	0x7eef	No error (0)	stats.l.doubleclick.net		66.102.1.154	A (IP address)	IN (0x0001)
Aug 6, 2022 08:46:42.647278070 CEST	8.8.8.8	192.168.2.4	0x7eef	No error (0)	stats.l.doubleclick.net		66.102.1.156	A (IP address)	IN (0x0001)
Aug 6, 2022 08:47:10.364969969 CEST	8.8.8.8	192.168.2.4	0x9bdf	No error (0)	play.google.com		142.250.186.142	A (IP address)	IN (0x0001)
Aug 6, 2022 08:47:10.582315922 CEST	8.8.8.8	192.168.2.4	0x31e6	No error (0)	www.google.com		142.250.185.196	A (IP address)	IN (0x0001)
Aug 6, 2022 08:47:10.584455967 CEST	8.8.8.8	192.168.2.4	0xcbd1	No error (0)	www.google.de		172.217.18.3	A (IP address)	IN (0x0001)
Aug 6, 2022 08:47:10.749816895 CEST	8.8.8.8	192.168.2.4	0xd8e7	No error (0)	ad.doubleclick.net	dart.l.doubleclick.net		CNAME (Canonical name)	IN (0x0001)
Aug 6, 2022 08:47:10.749816895 CEST	8.8.8.8	192.168.2.4	0xd8e7	No error (0)	dart.l.doubleclick.net		142.250.184.230	A (IP address)	IN (0x0001)
Aug 6, 2022 08:47:10.829689026 CEST	8.8.8.8	192.168.2.4	0x6998	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)
Aug 6, 2022 08:47:10.829689026 CEST	8.8.8.8	192.168.2.4	0x6998	No error (0)	plus.l.google.com		216.58.212.142	A (IP address)	IN (0x0001)
Aug 6, 2022 08:47:10.849807024 CEST	8.8.8.8	192.168.2.4	0xc731	No error (0)	about.google		216.239.32.29	A (IP address)	IN (0x0001)
Aug 6, 2022 08:47:13.426660061 CEST	8.8.8.8	192.168.2.4	0xa832	No error (0)	adservice.google.com		142.250.185.130	A (IP address)	IN (0x0001)
Aug 6, 2022 08:47:31.666654110 CEST	8.8.8.8	192.168.2.4	0xe	No error (0)	about.google		216.239.32.29	A (IP address)	IN (0x0001)
Aug 6, 2022 08:48:03.928639889 CEST	8.8.8.8	192.168.2.4	0xa24f	No error (0)	stats.g.doubleclick.net	stats.l.doubleclick.net		CNAME (Canonical name)	IN (0x0001)
Aug 6, 2022 08:48:03.928639889 CEST	8.8.8.8	192.168.2.4	0xa24f	No error (0)	stats.l.doubleclick.net		66.102.1.156	A (IP address)	IN (0x0001)
Aug 6, 2022 08:48:03.928639889 CEST	8.8.8.8	192.168.2.4	0xa24f	No error (0)	stats.l.doubleclick.net		66.102.1.155	A (IP address)	IN (0x0001)
Aug 6, 2022 08:48:03.928639889 CEST	8.8.8.8	192.168.2.4	0xa24f	No error (0)	stats.l.doubleclick.net		66.102.1.154	A (IP address)	IN (0x0001)
Aug 6, 2022 08:48:03.928639889 CEST	8.8.8.8	192.168.2.4	0xa24f	No error (0)	stats.l.doubleclick.net		66.102.1.157	A (IP address)	IN (0x0001)
Aug 6, 2022 08:48:15.953888893 CEST	8.8.8.8	192.168.2.4	0xa068	No error (0)	scone-pa.clients6.google.com		172.217.16.202	A (IP address)	IN (0x0001)
Aug 6, 2022 08:48:39.003541946 CEST	8.8.8.8	192.168.2.4	0x5d29	No error (0)	time.windows.com	twc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)
Aug 6, 2022 08:48:40.558027983 CEST	8.8.8.8	192.168.2.4	0x6263	No error (0)	time.windows.com	twc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)

Target ID:	0
Start time:	08:45:09
Start date:	06/08/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Imagebase:	0x7ff7964c0000
File size:	2150896 bytes
MD5 hash:	C139654B5C1438A95B321BB01AD63EF6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Target ID:	1
Start time:	08:45:11
Start date:	06/08/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1564,18120619820808562449,9042696685717106766,131072 --lang=en-GB --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1920 /prefetch:8
Imagebase:	0x7ff7964c0000
File size:	2150896 bytes
MD5 hash:	C139654B5C1438A95B321BB01AD63EF6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Target ID:	2
Start time:	08:45:12
Start date:	06/08/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" "C:\Users\user\Desktop\Fatura.Vivo.html
Imagebase:	0x7ff7964c0000
File size:	2150896 bytes
MD5 hash:	C139654B5C1438A95B321BB01AD63EF6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Fatura.Vivo.html

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Google\Chrome\User Data\080ba7f6-6ff7-494a-b362-ade637a94d8f.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\0bb7433b-f880-48ef-8864-d4cf7860f276.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\25c8a09f-dd60-4ece-913a-8a86fe30fdde.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\3ff94aa3-9bcc-4222-a1c2-2730b1c32775.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\5a12c651-a52a-4597-b037-aa501ae66d72.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\621aa5a3-76fa-4127-bd83-ad1183b2667c.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\643c1118-a2e8-4aa4-b28f-9aa0aa0209e3.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\7950492e-bd56-45b6-9c97-5890bfd5fa81.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\96cf249a-e499-4319-8b31-814377d54162.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\9baa8bf4-ccca-4b5b-bcfe-7f8aa0bc7f7e.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\1c86301c-5d2a-4c0c-b697-523dbdbbe525.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\30b9e8c0-3153-4a23-a4b0-8e30b63517a4.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\5ac695c3-fcd4-4763-b1ef-c9294ecef4fe.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\5d91f73d-0658-4a8e-b48f-5762f170f14d.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\618a8ab7-9cee-4fbf-94f8-118a6f921609.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\63dc9ee7-c639-4983-a076-89d7195d0c43.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\64a70a77-c17a-43ab-b7f3-d1d1bc801c06.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\6edb7a1e-0601-4505-8250-d1aca5078288.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\8067c521-f575-4e28-a7ee-d9b9cf43fd73.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\8f1d0ee2-b246-49ef-930b-5372e39ec5dc.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\91e94580-077f-4bd8-b795-0e252a6559eb.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\926634f9-1309-4378-a2c7-6b72dcd8b25a.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\9268208e-af50-4c3c-b51f-71f51922abc9.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata\computed_hashes.json

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\000003.log

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG.old (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Provider Cache

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network Persistent State (copy)

Windows Analysis Report
Fatura.Vivo.html

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre