Edit tour

Windows Analysis Report
https://cloudfil.es/ly7mR8utBQ5

Overview

General Information

Sample URL:	https://cloudfil.es/ly7mR8utBQ5
Analysis ID:	708252
Infos:

Detection

HTMLPhisher

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected HtmlPhish44

Found inlined nop instructions (likely shell or obfuscated code)

Found iframes

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

No HTML title found

Detected potential crypto function

HTTP GET or POST without a user agent

Creates a process in suspended mode (likely to inject code)

Contains long sleeps (>= 3 min)

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5928 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

chrome.exe (PID: 1572 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1936 --field-trial-handle=1772,i,13935456055298204775,6851687727719502408,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8 MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

unarchiver.exe (PID: 2768 cmdline: C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND.zip MD5: 9DE2E060A2985A232D8B96F9EC847A19)

7za.exe (PID: 5912 cmdline: C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\fsnnqwuj.h1e" "C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND.zip MD5: 77E556CDFDC5C592F5C46DB4127C6F4C)

conhost.exe (PID: 7004 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

chrome.exe (PID: 3560 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3636 --field-trial-handle=1772,i,13935456055298204775,6851687727719502408,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8 MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

chrome.exe (PID: 6268 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6236 --field-trial-handle=1772,i,13935456055298204775,6851687727719502408,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8 MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

unarchiver.exe (PID: 1768 cmdline: C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND (1).zip MD5: 9DE2E060A2985A232D8B96F9EC847A19)

7za.exe (PID: 4852 cmdline: C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\oluilyf2.xu4" "C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND (1).zip MD5: 77E556CDFDC5C592F5C46DB4127C6F4C)

conhost.exe (PID: 6420 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

unarchiver.exe (PID: 4788 cmdline: C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND (2).zip MD5: 9DE2E060A2985A232D8B96F9EC847A19)

7za.exe (PID: 7164 cmdline: C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\evppz250.yan" "C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND (2).zip MD5: 77E556CDFDC5C592F5C46DB4127C6F4C)

conhost.exe (PID: 5772 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

chrome.exe (PID: 760 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" "https://cloudfil.es/ly7mR8utBQ5 MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Users\user\AppData\Local\Temp\oluilyf2.xu4\SARS OUTSTANDING LETTER OF DEMAND.html	JoeSecurity_HtmlPhish_44	Yara detected HtmlPhish_44	Joe Security
C:\Users\user\AppData\Local\Temp\evppz250.yan\SARS OUTSTANDING LETTER OF DEMAND.html	JoeSecurity_HtmlPhish_44	Yara detected HtmlPhish_44	Joe Security
C:\Users\user\AppData\Local\Temp\fsnnqwuj.h1e\SARS OUTSTANDING LETTER OF DEMAND.html	JoeSecurity_HtmlPhish_44	Yara detected HtmlPhish_44	Joe Security

HTTP traffic detected: POST",e,d);else if(g.O("USE_NET_AJAX_FOR_PING_TRANSPORT",!1)||d)Iu(a,b,"GET","",d,void 0,f);else{b:{try{var l=new Dga({url:a});if(l.B&&l.u||l.C){var m=oi(g.qi(5,a));var n=!(!m||!m.endsWith("/aclk")||"1"!==Ai(a,"ri"));break b}}catch(p){}n=!1}n?moa(a)?(b&&b(),h=!0):h=!1:h=!1;h||noa(a,b)}};moa=function(a,b){try{if(window.navigator&&window.navigator.sendBeacon&&window.navigator.sendBeacon(a,void 0===b?"":b))return!0}catch(c){}return!1};noa=function(a,b){var c=new Image,d=""+ooa++;dx[d]=c;c.onload=c.onerror=function(){b&&dx[d]&&b();delete dx[d]};c.src=a};ex=function(){this.j=new Map;this.u=!1};fx=function(){if(!ex.j){var a=g.Ia("yt.networkRequestMonitor.instance")||new ex;g.Ha("yt.networkRequestMonitor.instance",a);ex.j=a}return ex.j};hx=function(){gx||(gx=new Hv("yt.offline"));return gx};poa=function(a){if(g.S("offline_error_handling")){var b=hx().get("errors",!0)||{};b[a.message]={name:a.name,stack:a.stack};a.level&&(b[a.message].level=a.level);hx().set("errors",b,2592E3,!0)}};ix=function(){g.Uf.call(this);var a=this;this.u=!1;this.j=lka();this.j.Ra("networkstatus-online",function(){if(a.u&&g.S("offline_error_handling")){var b=hx().get("errors",!0);if(b){for(var c in b)if(b[c]){var d=new g.Zv(c,"sent via offline_errors");d.name=b[c].name;d.stack=b[c].stack;d.level=b[c].level;g.n

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50065 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50052 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 50029 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 50086 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 49937 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundAccept-Ranges: bytesAccess-Control-Allow-Origin: *Age: 1279030Cache-Control: public, max-age=0, must-revalidateContent-Disposition: inline; filename="404"Content-Length: 48544Content-Type: text/html; charset=utf-8Date: Fri, 23 Sep 2022 06:15:04 GMTEtag: "e906d7243ccfceeeeb28df0cdc4478aa"Server: VercelStrict-Transport-Security: max-age=63072000X-Matched-Path: /404X-Vercel-Cache: HITX-Vercel-Id: fra1:fra1::l9km5-1663913704947-73d98f604576Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundAccept-Ranges: bytesAccess-Control-Allow-Origin: *Age: 1279036Cache-Control: public, max-age=0, must-revalidateContent-Disposition: inline; filename="404"Content-Length: 48544Content-Type: text/html; charset=utf-8Date: Fri, 23 Sep 2022 06:15:10 GMTEtag: "e906d7243ccfceeeeb28df0cdc4478aa"Server: VercelStrict-Transport-Security: max-age=63072000X-Matched-Path: /404X-Vercel-Cache: HITX-Vercel-Id: fra1:fra1::fwplq-1663913710069-dd4a4ea443d3Connection: close

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CONSENT=PENDING+904; AEC=AakniGO7HqlHWlnoY-P22_SwwnNSfVGxlF1NgK5nuj5WLe313NyJi16g7z4; SOCS=CAISHAgCEhJnd3NfMjAyMjA4MDgtMF9SQzEaAmVuIAEaBgiAvOuXBg; NID=511=nUT82hOv6CVwMNqDg-sTtCMJJ6SQ1v_cCpfCpf5nt8EolEbal01GWFyjG01tqWQgh9ciRU880J6nLd2gdbhAJs44PsHAZaVQAFIbrqe2FmFgjrAAK7W9Z8u5LDvwsuZRng98jP6E23SJ4fsPIs326YmnuCwa92dRRCcB6MNeI_o

Source: unknown

DNS traffic detected: queries for: clients2.google.com

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=104.0.5112.81&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-104.0.5112.81Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ly7mR8utBQ5 HTTP/1.1Host: cloudfil.esConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/css/761d08517528cd55.css HTTP/1.1Host: cloudfil.esConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://cloudfil.es/ly7mR8utBQ5Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/chunks/webpack-992f997fccc36c29.js HTTP/1.1Host: cloudfil.esConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfil.es/ly7mR8utBQ5Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/chunks/framework-49f1e091cbf6b261.js HTTP/1.1Host: cloudfil.esConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfil.es/ly7mR8utBQ5Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/chunks/main-96fa8ae7c24c9725.js HTTP/1.1Host: cloudfil.esConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfil.es/ly7mR8utBQ5Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/chunks/pages/_app-3b7320b70fab585f.js HTTP/1.1Host: cloudfil.esConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfil.es/ly7mR8utBQ5Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/chunks/469-6d7e72663fcd884a.js HTTP/1.1Host: cloudfil.esConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfil.es/ly7mR8utBQ5Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/chunks/838-e577e7ded876b417.js HTTP/1.1Host: cloudfil.esConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfil.es/ly7mR8utBQ5Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/chunks/pages/%5Bhash%5D-da6732468a64e9d9.js HTTP/1.1Host: cloudfil.esConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfil.es/ly7mR8utBQ5Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/whUZKVJqkE3pK_fzfRN2H/_buildManifest.js HTTP/1.1Host: cloudfil.esConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfil.es/ly7mR8utBQ5Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/inter/v12/UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7W0Q5nw.woff2 HTTP/1.1Host: fonts.gstatic.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Origin: https://cloudfil.essec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CI22yQEIpbbJAQjBtskBCKmdygEIlqHLAQj8qswBCLy8zAEIj73MAQiywcwBCMTBzAEI18HMAQ==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://cloudfil.es/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/whUZKVJqkE3pK_fzfRN2H/_ssgManifest.js HTTP/1.1Host: cloudfil.esConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfil.es/ly7mR8utBQ5Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /all.js HTTP/1.1Host: api.dmcdn.netConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfil.es/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /iframe_api HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CI22yQEIpbbJAQjBtskBCKmdygEIlqHLAQj8qswBCLy8zAEIj73MAQiywcwBCMTBzAEI18HMAQ==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfil.es/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/player/abfb84fe/www-widgetapi.vflset/www-widgetapi.js HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CI22yQEIpbbJAQjBtskBCKmdygEIlqHLAQj8qswBCLy8zAEIj73MAQiywcwBCMTBzAEI18HMAQ==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfil.es/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: YSC=0Gkdp1KDrT4; VISITOR_INFO1_LIVE=SNPwgvJ8Kh8
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: cloudfil.esConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cloudfil.es/ly7mR8utBQ5Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/ly7mR8utBQ5 HTTP/1.1Host: api.cloudfil.esConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: application/json, text/plain, /cf-device-id: 4573b0a3-d086-4d9f-bb85-8dd384048e9dsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://cloudfil.esSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://cloudfil.es/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /locales/en/common.json HTTP/1.1Host: cloudfil.esConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://cloudfil.es/ly7mR8utBQ5Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/ly7mR8utBQ5/files HTTP/1.1Host: api.cloudfil.esConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: application/json, text/plain, /cf-device-id: 4573b0a3-d086-4d9f-bb85-8dd384048e9dsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://cloudfil.esSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://cloudfil.es/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/logoWordmark.svg HTTP/1.1Host: cloudfil.esConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cloudfil.es/ly7mR8utBQ5Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/logoWordmark.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfil.es
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: cloudfiles.ioConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/chunks/webpack-cb7634a8b6194820.js HTTP/1.1Host: cloudfiles.ioConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/chunks/framework-5f4595e5518b5600.js HTTP/1.1Host: cloudfiles.ioConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/chunks/main-fa785b6e775a62c2.js HTTP/1.1Host: cloudfiles.ioConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/chunks/pages/_app-f171edb1f3175855.js HTTP/1.1Host: cloudfiles.ioConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/chunks/0e6451da-b3c1968280f835d2.js HTTP/1.1Host: cloudfiles.ioConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/61cbca8494eb3ac19b8548ecc52b65d8.js HTTP/1.1Host: cdn.cookie-script.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/nunitosans/v12/pe0qMImSLYBIv1o4X1M8cce9I9tAcVwo.woff2 HTTP/1.1Host: fonts.gstatic.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Origin: https://cloudfiles.iosec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CI22yQEIpbbJAQjBtskBCKmdygEIlqHLAQj8qswBCLy8zAEIj73MAQiywcwBCMTBzAEI18HMAQ==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /logos/FullLogo-new.svg HTTP/1.1Host: cloudfiles.ioConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/inter/v12/UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7W0Q5nw.woff2 HTTP/1.1Host: fonts.gstatic.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Origin: https://cloudfiles.iosec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CI22yQEIpbbJAQjBtskBCKmdygEIlqHLAQj8qswBCLy8zAEIj73MAQiywcwBCMTBzAEI18HMAQ==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/chunks/fc20e1c4-9e1761e40e9bca31.js HTTP/1.1Host: cloudfiles.ioConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/chunks/545f34e4-eb701074efab5973.js HTTP/1.1Host: cloudfiles.ioConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/chunks/8edc3fe5-3b2ecbcd66ce8f68.js HTTP/1.1Host: cloudfiles.ioConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/chunks/951-9933cd60a769c984.js HTTP/1.1Host: cloudfiles.ioConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/chunks/28-8667e3219650ddd1.js HTTP/1.1Host: cloudfiles.ioConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/chunks/390-8a0eaf13ec9db927.js HTTP/1.1Host: cloudfiles.ioConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/chunks/976-86b91bf77cab8070.js HTTP/1.1Host: cloudfiles.ioConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/pages/home/hero-image.svg HTTP/1.1Host: cloudfiles.ioConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/chunks/pages/index-54a1471851cf647f.js HTTP/1.1Host: cloudfiles.ioConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/YJeXlCCpqKEI4BNvP_rQi/_buildManifest.js HTTP/1.1Host: cloudfiles.ioConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/YJeXlCCpqKEI4BNvP_rQi/_ssgManifest.js HTTP/1.1Host: cloudfiles.ioConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/pages/home/testimonials/Chris-Moore.png HTTP/1.1Host: cloudfiles.ioConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/pages/home/testimonials/1920px-HubSpot_Logo.svg.png HTTP/1.1Host: cloudfiles.ioConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/pages/home/testimonials/sf-logo.png HTTP/1.1Host: cloudfiles.ioConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/pages/home/testimonials/hs-logo.png HTTP/1.1Host: cloudfiles.ioConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/nunitosans/v12/pe03MImSLYBIv1o4X1M8cc8-BM5tU1ECVZl_.woff2 HTTP/1.1Host: fonts.gstatic.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Origin: https://cloudfiles.iosec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CI22yQEIpbbJAQjBtskBCKmdygEIlqHLAQj8qswBCLy8zAEIj73MAQiywcwBCMTBzAEI18HMAQ==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/nunitosans/v12/pe03MImSLYBIv1o4X1M8cc9iB85tU1ECVZl_.woff2 HTTP/1.1Host: fonts.gstatic.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Origin: https://cloudfiles.iosec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CI22yQEIpbbJAQjBtskBCKmdygEIlqHLAQj8qswBCLy8zAEIj73MAQiywcwBCMTBzAEI18HMAQ==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/nunitosans/v12/pe03MImSLYBIv1o4X1M8cc8aBc5tU1ECVZl_.woff2 HTTP/1.1Host: fonts.gstatic.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Origin: https://cloudfiles.iosec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CI22yQEIpbbJAQjBtskBCKmdygEIlqHLAQj8qswBCLy8zAEIj73MAQiywcwBCMTBzAEI18HMAQ==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /logos/footer-background.png HTTP/1.1Host: cloudfiles.ioConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/ly7mR8utBQ5 HTTP/1.1Host: api.cloudfil.esConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: application/json, text/plain, /cf-session-id: 632d4ec5c3d2310bbf142ae1cf-device-id: 4573b0a3-d086-4d9f-bb85-8dd384048e9dsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://cloudfil.esSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://cloudfil.es/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: W/"23d-5m7x852I5e9PUXYs14wIemXqxlk"
Source: global traffic	HTTP traffic detected: GET /analytics.js/v1/KUs1gEeIVanAKts76f3NenLgmETEQxxr/analytics.min.js HTTP/1.1Host: cdn.segment.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /20182553.js HTTP/1.1Host: js-na1.hs-scripts.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /en_US/fbevents.js HTTP/1.1Host: connect.facebook.netConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /gtag/js?id=UA-188936264-1 HTTP/1.1Host: www.googletagmanager.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /gtm.js?id=GTM-P8KQL93 HTTP/1.1Host: www.googletagmanager.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /gtag/js?id=G-HB9Z4JLXX4 HTTP/1.1Host: www.googletagmanager.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /iframe_api HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CI22yQEIpbbJAQjBtskBCKmdygEIlqHLAQj8qswBCLy8zAEIj73MAQiywcwBCMTBzAEI18HMAQ==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: YSC=0Gkdp1KDrT4; VISITOR_INFO1_LIVE=SNPwgvJ8Kh8
Source: global traffic	HTTP traffic detected: GET /_next/data/YJeXlCCpqKEI4BNvP_rQi/pricing.json?slug=pricing HTTP/1.1Host: cloudfiles.ioConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"purpose: prefetchsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36x-nextjs-data: 1sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/image?url=%2Fimages%2Fpages%2Fhome%2Ftestimonials%2Fhs-logo.png&w=1920&q=75 HTTP/1.1Host: cloudfiles.ioConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v1/projects/KUs1gEeIVanAKts76f3NenLgmETEQxxr/settings HTTP/1.1Host: cdn.segment.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://cloudfiles.ioSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/pages/home/testimonials/5-star-rating.svg HTTP/1.1Host: cloudfiles.ioConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/image?url=%2Fimages%2Fpages%2Fhome%2Ftestimonials%2Fg2-logo.png&w=1920&q=75 HTTP/1.1Host: cloudfiles.ioConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/player/abfb84fe/www-widgetapi.vflset/www-widgetapi.js HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CI22yQEIpbbJAQjBtskBCKmdygEIlqHLAQj8qswBCLy8zAEIj73MAQiywcwBCMTBzAEI18HMAQ==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: YSC=0Gkdp1KDrT4; VISITOR_INFO1_LIVE=SNPwgvJ8Kh8
Source: global traffic	HTTP traffic detected: GET /analytics/1663913400000/20182553.js HTTP/1.1Host: js.hs-analytics.netConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fb.js HTTP/1.1Host: js.hsadspixel.netConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /embed/1rkTwk6PKdY?autoplay=0&mute=0&controls=0&origin=https%3A%2F%2Fcloudfiles.io&playsinline=1&showinfo=0&rel=0&iv_load_policy=3&modestbranding=1&enablejsapi=1&widgetid=1 HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9X-Client-Data: CI22yQEIpbbJAQjBtskBCKmdygEIlqHLAQj8qswBCLy8zAEIj73MAQiywcwBCMTBzAEI18HMAQ==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: YSC=0Gkdp1KDrT4; VISITOR_INFO1_LIVE=SNPwgvJ8Kh8
Source: global traffic	HTTP traffic detected: GET /20182553.js HTTP/1.1Host: js.hs-banner.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /signals/config/749116996109032?v=2.9.83&r=stable HTTP/1.1Host: connect.facebook.netConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /conversations-embed.js HTTP/1.1Host: js.usemessages.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/player/abfb84fe/www-player.css HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1X-Client-Data: CI22yQEIpbbJAQjBtskBCKmdygEIlqHLAQj8qswBCLy8zAEIj73MAQiywcwBCMTBzAEI18HMAQ==Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.youtube.com/embed/1rkTwk6PKdY?autoplay=0&mute=0&controls=0&origin=https%3A%2F%2Fcloudfiles.io&playsinline=1&showinfo=0&rel=0&iv_load_policy=3&modestbranding=1&enablejsapi=1&widgetid=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: YSC=0Gkdp1KDrT4; VISITOR_INFO1_LIVE=SNPwgvJ8Kh8
Source: global traffic	HTTP traffic detected: GET /s/player/abfb84fe/www-embed-player.vflset/www-embed-player.js HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CI22yQEIpbbJAQjBtskBCKmdygEIlqHLAQj8qswBCLy8zAEIj73MAQiywcwBCMTBzAEI18HMAQ==Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.youtube.com/embed/1rkTwk6PKdY?autoplay=0&mute=0&controls=0&origin=https%3A%2F%2Fcloudfiles.io&playsinline=1&showinfo=0&rel=0&iv_load_policy=3&modestbranding=1&enablejsapi=1&widgetid=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: YSC=0Gkdp1KDrT4; VISITOR_INFO1_LIVE=SNPwgvJ8Kh8
Source: global traffic	HTTP traffic detected: GET /livechat-public/v1/message/public?portalId=20182553&conversations-embed=static-1.10824&mobile=false&messagesUtk=e86f3294fabf4298bfb6731338a898f9&traceId=e86f3294fabf4298bfb6731338a898f9 HTTP/1.1Host: api.hubspot.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0X-HubSpot-Messages-Uri: https://cloudfiles.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://cloudfiles.ioSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2 HTTP/1.1Host: fonts.gstatic.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Origin: https://www.youtube.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CI22yQEIpbbJAQjBtskBCKmdygEIlqHLAQj8qswBCLy8zAEIj73MAQiywcwBCMTBzAEI18HMAQ==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://www.youtube.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/player/abfb84fe/player_ias.vflset/en_US/base.js HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CI22yQEIpbbJAQjBtskBCKmdygEIlqHLAQj8qswBCLy8zAEIj73MAQiywcwBCMTBzAEI18HMAQ==Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.youtube.com/embed/1rkTwk6PKdY?autoplay=0&mute=0&controls=0&origin=https%3A%2F%2Fcloudfiles.io&playsinline=1&showinfo=0&rel=0&iv_load_policy=3&modestbranding=1&enablejsapi=1&widgetid=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: YSC=0Gkdp1KDrT4; VISITOR_INFO1_LIVE=SNPwgvJ8Kh8
Source: global traffic	HTTP traffic detected: GET /ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-HB9Z4JLXX4&cid=604035153.1663946092&gtm=2oe9l0&aip=1&z=1923764674 HTTP/1.1Host: www.google.co.ukConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CI22yQEIpbbJAQjBtskBCKmdygEIlqHLAQj8qswBCLy8zAEIj73MAQiywcwBCMTBzAEI18HMAQ==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /hs-script-loader-public/v1/config/pixel/json?portalId=20182553 HTTP/1.1Host: api.hubapi.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://cloudfiles.ioSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /analytics-next/bundles/870.bundle.323974846b6d45afb45e.js HTTP/1.1Host: cdn.segment.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/player/abfb84fe/fetch-polyfill.vflset/fetch-polyfill.js HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CI22yQEIpbbJAQjBtskBCKmdygEIlqHLAQj8qswBCLy8zAEIj73MAQiywcwBCMTBzAEI18HMAQ==Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.youtube.com/embed/1rkTwk6PKdY?autoplay=0&mute=0&controls=0&origin=https%3A%2F%2Fcloudfiles.io&playsinline=1&showinfo=0&rel=0&iv_load_policy=3&modestbranding=1&enablejsapi=1&widgetid=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: YSC=0Gkdp1KDrT4; VISITOR_INFO1_LIVE=SNPwgvJ8Kh8
Source: global traffic	HTTP traffic detected: GET /analytics-next/bundles/ajs-destination.bundle.35a8f6f19959bf2f455f.js HTTP/1.1Host: cdn.segment.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /conversations-visitor/20182553/threads/utk/e86f3294fabf4298bfb6731338a898f9?uuid=9cb37ca1f6ae46778bde47f4ac4692ca&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=cloudfiles.io&inApp53=false&messagesUtk=e86f3294fabf4298bfb6731338a898f9&url=https%3A%2F%2Fcloudfiles.io%2F&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=false&enableWidgetCookieBanner=false&isInCMS=false HTTP/1.1Host: app.hubspot.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tr/?id=749116996109032&ev=PageView&dl=https%3A%2F%2Fcloudfiles.io%2F&rl=&if=false&ts=1663946093096&sw=1280&sh=1024&v=2.9.83&r=stable&ec=0&o=30&fbp=fb.1.1663946093092.1064301508&it=1663946090710&coo=false&rqm=GET HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /gtag/js?id=AW-10783125194 HTTP/1.1Host: www.googletagmanager.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/ly7mR8utBQ5/files/download? HTTP/1.1Host: api.cloudfil.esConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: application/json, text/plain, /cf-session-id: 632d4ec5c3d2310bbf142ae1cf-device-id: 4573b0a3-d086-4d9f-bb85-8dd384048e9dsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://cloudfil.esSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://cloudfil.es/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /gtag/js?id=AW-10783125194&l=dataLayer&cx=c HTTP/1.1Host: www.googletagmanager.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /files/632d42032155f034859123fd/dd22dcbe6c19b15128cab3522986d931/SARS%20OUTSTANDING%20LETTER%20OF%20DEMAND.zip?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAUV34ETFBMAVXCJUY%2F20220923%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20220923T061453Z&X-Amz-Expires=3600&X-Amz-Signature=ef31bc69633694a50c4197ccb18f0a2e470e07b84915298c4e0c409cf0cc9bc1&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3DSARS%20OUTSTANDING%20LETTER%20OF%20DEMAND.zip&origin=cloudfiles-prod-files.s3-accelerate.amazonaws.com&verify=1663913993-x9l3HX2kcl1_WJwGsMZV3xodOWreBRr3OwmLS1529Yo HTTP/1.1Host: cloudfil.esConnection: keep-aliveSec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: emptyReferer: https://cloudfil.es/ly7mR8utBQ5User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /gtag/js?id=AW-10790228306&l=dataLayer&cx=c HTTP/1.1Host: www.googletagmanager.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /gtag/js?id=AW-10790155329&l=dataLayer&cx=c HTTP/1.1Host: www.googletagmanager.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /head-dlb/static-1.233/bundle.production.js HTTP/1.1Host: static.hsappstatic.netConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Origin: https://app.hubspot.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://app.hubspot.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /conversations-visitor-ui/static-1.11843/sass/visitor.css HTTP/1.1Host: static.hsappstatic.netConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://app.hubspot.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /analytics-next/bundles/schemaFilter.bundle.debb169c1abb431faaa6.js HTTP/1.1Host: cdn.segment.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /hubspot-dlb/static-1.318/bundle.production.js HTTP/1.1Host: static.hsappstatic.netConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Origin: https://app.hubspot.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://app.hubspot.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /conversations-visitor-ui/static-1.13284/bundles/visitor.js HTTP/1.1Host: static.hsappstatic.netConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Origin: https://app.hubspot.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://app.hubspot.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j97&tid=UA-188936264-1&cid=604035153.1663946092&jid=1865915276&_u=YADAAUAAAAAAAC~&z=1702222027 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CI22yQEIpbbJAQjBtskBCKmdygEIlqHLAQj8qswBCLy8zAEIj73MAQiywcwBCMTBzAEI18HMAQ==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=nUT82hOv6CVwMNqDg-sTtCMJJ6SQ1v_cCpfCpf5nt8EolEbal01GWFyjG01tqWQgh9ciRU880J6nLd2gdbhAJs44PsHAZaVQAFIbrqe2FmFgjrAAK7W9Z8u5LDvwsuZRng98jP6E23SJ4fsPIs326YmnuCwa92dRRCcB6MNeI_o
Source: global traffic	HTTP traffic detected: GET /_next/static/chunks/cfc6b023-bfbbf3efd654883b.js HTTP/1.1Host: cloudfiles.ioConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: application/signed-exchange;v=b3;q=0.7,/;q=0.8Purpose: prefetchSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _ga_HB9Z4JLXX4=GS1.1.1663946091.1.1.1663946091.60.0.0; ph_phc_T3PTF5hBP3diRM81BaUw8mdzvKytDNdmz6aF4HXbGz2_posthog=%7B%22distinct_id%22%3A%221836aea56e9200-0c663330652bb5-26021d51-140000-1836aea56ea126%22%2C%22%24device_id%22%3A%221836aea56e9200-0c663330652bb5-26021d51-140000-1836aea56ea126%22%2C%22%24initial_referrer%22%3A%22%24direct%22%2C%22%24initial_referring_domain%22%3A%22%24direct%22%2C%22%24referrer%22%3A%22%24direct%22%2C%22%24referring_domain%22%3A%22%24direct%22%2C%22%24session_recording_enabled%22%3Afalse%2C%22%24active_feature_flags%22%3A%5B%5D%2C%22%24enabled_feature_flags%22%3A%7B%7D%7D; _fbp=fb.1.1663946093092.1064301508; _ga=GA1.2.604035153.1663946092; _gid=GA1.2.405113668.1663946093; _gat_gtag_UA_188936264_1=1; _gcl_au=1.1.1471331947.1663946094
Source: global traffic	HTTP traffic detected: GET /_next/static/chunks/43a99af2-6a652ea0e41564d0.js HTTP/1.1Host: cloudfiles.ioConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: application/signed-exchange;v=b3;q=0.7,/;q=0.8Purpose: prefetchSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _ga_HB9Z4JLXX4=GS1.1.1663946091.1.1.1663946091.60.0.0; ph_phc_T3PTF5hBP3diRM81BaUw8mdzvKytDNdmz6aF4HXbGz2_posthog=%7B%22distinct_id%22%3A%221836aea56e9200-0c663330652bb5-26021d51-140000-1836aea56ea126%22%2C%22%24device_id%22%3A%221836aea56e9200-0c663330652bb5-26021d51-140000-1836aea56ea126%22%2C%22%24initial_referrer%22%3A%22%24direct%22%2C%22%24initial_referring_domain%22%3A%22%24direct%22%2C%22%24referrer%22%3A%22%24direct%22%2C%22%24referring_domain%22%3A%22%24direct%22%2C%22%24session_recording_enabled%22%3Afalse%2C%22%24active_feature_flags%22%3A%5B%5D%2C%22%24enabled_feature_flags%22%3A%7B%7D%7D; _fbp=fb.1.1663946093092.1064301508; _ga=GA1.2.604035153.1663946092; _gid=GA1.2.405113668.1663946093; _gat_gtag_UA_188936264_1=1; _gcl_au=1.1.1471331947.1663946094
Source: global traffic	HTTP traffic detected: GET /_next/static/chunks/b16bd182-2fce6d9e40c8c943.js HTTP/1.1Host: cloudfiles.ioConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: application/signed-exchange;v=b3;q=0.7,/;q=0.8Purpose: prefetchSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _ga_HB9Z4JLXX4=GS1.1.1663946091.1.1.1663946091.60.0.0; ph_phc_T3PTF5hBP3diRM81BaUw8mdzvKytDNdmz6aF4HXbGz2_posthog=%7B%22distinct_id%22%3A%221836aea56e9200-0c663330652bb5-26021d51-140000-1836aea56ea126%22%2C%22%24device_id%22%3A%221836aea56e9200-0c663330652bb5-26021d51-140000-1836aea56ea126%22%2C%22%24initial_referrer%22%3A%22%24direct%22%2C%22%24initial_referring_domain%22%3A%22%24direct%22%2C%22%24referrer%22%3A%22%24direct%22%2C%22%24referring_domain%22%3A%22%24direct%22%2C%22%24session_recording_enabled%22%3Afalse%2C%22%24active_feature_flags%22%3A%5B%5D%2C%22%24enabled_feature_flags%22%3A%7B%7D%7D; _fbp=fb.1.1663946093092.1064301508; _ga=GA1.2.604035153.1663946092; _gid=GA1.2.405113668.1663946093; _gat_gtag_UA_188936264_1=1; _gcl_au=1.1.1471331947.1663946094
Source: global traffic	HTTP traffic detected: GET /_next/static/chunks/5ca00d41-f80dcc02233c86a3.js HTTP/1.1Host: cloudfiles.ioConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: application/signed-exchange;v=b3;q=0.7,/;q=0.8Purpose: prefetchSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _ga_HB9Z4JLXX4=GS1.1.1663946091.1.1.1663946091.60.0.0; ph_phc_T3PTF5hBP3diRM81BaUw8mdzvKytDNdmz6aF4HXbGz2_posthog=%7B%22distinct_id%22%3A%221836aea56e9200-0c663330652bb5-26021d51-140000-1836aea56ea126%22%2C%22%24device_id%22%3A%221836aea56e9200-0c663330652bb5-26021d51-140000-1836aea56ea126%22%2C%22%24initial_referrer%22%3A%22%24direct%22%2C%22%24initial_referring_domain%22%3A%22%24direct%22%2C%22%24referrer%22%3A%22%24direct%22%2C%22%24referring_domain%22%3A%22%24direct%22%2C%22%24session_recording_enabled%22%3Afalse%2C%22%24active_feature_flags%22%3A%5B%5D%2C%22%24enabled_feature_flags%22%3A%7B%7D%7D; _fbp=fb.1.1663946093092.1064301508; _ga=GA1.2.604035153.1663946092; _gid=GA1.2.405113668.1663946093; _gat_gtag_UA_188936264_1=1; _gcl_au=1.1.1471331947.1663946094
Source: global traffic	HTTP traffic detected: GET /_next/static/chunks/197-c096a3bf80407be8.js HTTP/1.1Host: cloudfiles.ioConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: application/signed-exchange;v=b3;q=0.7,/;q=0.8Purpose: prefetchSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _ga_HB9Z4JLXX4=GS1.1.1663946091.1.1.1663946091.60.0.0; ph_phc_T3PTF5hBP3diRM81BaUw8mdzvKytDNdmz6aF4HXbGz2_posthog=%7B%22distinct_id%22%3A%221836aea56e9200-0c663330652bb5-26021d51-140000-1836aea56ea126%22%2C%22%24device_id%22%3A%221836aea56e9200-0c663330652bb5-26021d51-140000-1836aea56ea126%22%2C%22%24initial_referrer%22%3A%22%24direct%22%2C%22%24initial_referring_domain%22%3A%22%24direct%22%2C%22%24referrer%22%3A%22%24direct%22%2C%22%24referring_domain%22%3A%22%24direct%22%2C%22%24session_recording_enabled%22%3Afalse%2C%22%24active_feature_flags%22%3A%5B%5D%2C%22%24enabled_feature_flags%22%3A%7B%7D%7D; _fbp=fb.1.1663946093092.1064301508; _ga=GA1.2.604035153.1663946092; _gid=GA1.2.405113668.1663946093; _gat_gtag_UA_188936264_1=1; _gcl_au=1.1.1471331947.1663946094
Source: global traffic	HTTP traffic detected: GET /_next/static/chunks/423-c466c32b0761d1c5.js HTTP/1.1Host: cloudfiles.ioConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: application/signed-exchange;v=b3;q=0.7,/;q=0.8Purpose: prefetchSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _ga_HB9Z4JLXX4=GS1.1.1663946091.1.1.1663946091.60.0.0; ph_phc_T3PTF5hBP3diRM81BaUw8mdzvKytDNdmz6aF4HXbGz2_posthog=%7B%22distinct_id%22%3A%221836aea56e9200-0c663330652bb5-26021d51-140000-1836aea56ea126%22%2C%22%24device_id%22%3A%221836aea56e9200-0c663330652bb5-26021d51-140000-1836aea56ea126%22%2C%22%24initial_referrer%22%3A%22%24direct%22%2C%22%24initial_referring_domain%22%3A%22%24direct%22%2C%22%24referrer%22%3A%22%24direct%22%2C%22%24referring_domain%22%3A%22%24direct%22%2C%22%24session_recording_enabled%22%3Afalse%2C%22%24active_feature_flags%22%3A%5B%5D%2C%22%24enabled_feature_flags%22%3A%7B%7D%7D; _fbp=fb.1.1663946093092.1064301508; _ga=GA1.2.604035153.1663946092; _gid=GA1.2.405113668.1663946093; _gat_gtag_UA_188936264_1=1; _gcl_au=1.1.1471331947.1663946094
Source: global traffic	HTTP traffic detected: GET /tr/?id=749116996109032&ev=Microdata&dl=https%3A%2F%2Fcloudfiles.io%2F&rl=&if=false&ts=1663946095810&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22File%20Sharing%20Platform%20%7C%20Share%20Documents%20Online%20%7C%20CloudFiles%22%2C%22meta%3Adescription%22%3A%22CloudFiles%20is%20a%20modern%20file%20sharing%20platform%20for%20businesses%20designed%20to%20reduce%20mundane%20tasks.%20Sign%20up%20and%20put%20your%20energy%20to%20things%20that%20matter.%22%7D&cd[OpenGraph]=%7B%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1280&sh=1024&v=2.9.83&r=stable&ec=1&o=30&fbp=fb.1.1663946093092.1064301508&it=1663946090710&coo=false&es=automatic&tm=3&rqm=GET HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /conversations-visitor-ui/static-1.13132/i18n-data-data-locales-en-us.js HTTP/1.1Host: static.hsappstatic.netConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Origin: https://app.hubspot.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://app.hubspot.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_next/static/chunks/pages/%5Bslug%5D-987d9e7f5dfae2bd.js HTTP/1.1Host: cloudfiles.ioConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: application/signed-exchange;v=b3;q=0.7,/;q=0.8Purpose: prefetchSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _ga_HB9Z4JLXX4=GS1.1.1663946091.1.1.1663946091.60.0.0; ph_phc_T3PTF5hBP3diRM81BaUw8mdzvKytDNdmz6aF4HXbGz2_posthog=%7B%22distinct_id%22%3A%221836aea56e9200-0c663330652bb5-26021d51-140000-1836aea56ea126%22%2C%22%24device_id%22%3A%221836aea56e9200-0c663330652bb5-26021d51-140000-1836aea56ea126%22%2C%22%24initial_referrer%22%3A%22%24direct%22%2C%22%24initial_referring_domain%22%3A%22%24direct%22%2C%22%24referrer%22%3A%22%24direct%22%2C%22%24referring_domain%22%3A%22%24direct%22%2C%22%24session_recording_enabled%22%3Afalse%2C%22%24active_feature_flags%22%3A%5B%5D%2C%22%24enabled_feature_flags%22%3A%7B%7D%7D; _fbp=fb.1.1663946093092.1064301508; _ga=GA1.2.604035153.1663946092; _gid=GA1.2.405113668.1663946093; _gat_gtag_UA_188936264_1=1; _gcl_au=1.1.1471331947.1663946094
Source: global traffic	HTTP traffic detected: GET /instream/ad_status.js HTTP/1.1Host: static.doubleclick.netConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CI22yQEIpbbJAQjBtskBCKmdygEIlqHLAQj8qswBCLy8zAEIj73MAQiywcwBCMTBzAEI18HMAQ==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.youtube.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: IDE=AHWqTUkzjscYZ52NAY8n0cT95jijV6W0yuM6NwF8WWQoBrDcA-yxPPCjwWHtVTdU
Source: global traffic	HTTP traffic detected: GET /pagead/id HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.youtube.comX-Client-Data: CI22yQEIpbbJAQjBtskBCKmdygEIlqHLAQj8qswBCLy8zAEIj73MAQiywcwBCMTBzAEI18HMAQ==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.youtube.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: IDE=AHWqTUkzjscYZ52NAY8n0cT95jijV6W0yuM6NwF8WWQoBrDcA-yxPPCjwWHtVTdU
Source: global traffic	HTTP traffic detected: GET /js/th/A6NiJ4FpWdYb46YkL14Gb7YSsd_Y0OEDYbyMmxwlYE4.js HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CI22yQEIpbbJAQjBtskBCKmdygEIlqHLAQj8qswBCLy8zAEIj73MAQiywcwBCMTBzAEI18HMAQ==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.youtube.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=nUT82hOv6CVwMNqDg-sTtCMJJ6SQ1v_cCpfCpf5nt8EolEbal01GWFyjG01tqWQgh9ciRU880J6nLd2gdbhAJs44PsHAZaVQAFIbrqe2FmFgjrAAK7W9Z8u5LDvwsuZRng98jP6E23SJ4fsPIs326YmnuCwa92dRRCcB6MNeI_o
Source: global traffic	HTTP traffic detected: GET /ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j97&tid=UA-188936264-1&cid=604035153.1663946092&jid=1865915276&_u=YADAAUAAAAAAAC~&z=1702222027 HTTP/1.1Host: www.google.co.ukConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CI22yQEIpbbJAQjBtskBCKmdygEIlqHLAQj8qswBCLy8zAEIj73MAQiywcwBCMTBzAEI18HMAQ==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /vi_webp/1rkTwk6PKdY/sddefault.webp HTTP/1.1Host: i.ytimg.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CI22yQEIpbbJAQjBtskBCKmdygEIlqHLAQj8qswBCLy8zAEIj73MAQiywcwBCMTBzAEI18HMAQ==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.youtube.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/viewthroughconversion/10790155329/?random=1663946097413&cv=9&fst=1663946097413&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_his=1&u_tz=-420&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa9l0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcloudfiles.io%2F&tiba=File%20Sharing%20Platform%20%7C%20Share%20Documents%20Online%20%7C%20CloudFiles&auid=1471331947.1663946094&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CI22yQEIpbbJAQjBtskBCKmdygEIlqHLAQj8qswBCLy8zAEIj73MAQiywcwBCMTBzAEI18HMAQ==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: IDE=AHWqTUmb4mZiaecYrlYE5v2SQK8Mo0O9wRRPxFD7O9khuIVKtStu9A7CrL_ZTafo
Source: global traffic	HTTP traffic detected: GET /pagead/viewthroughconversion/10783125194/?random=1663946097443&cv=9&fst=1663946097443&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_his=1&u_tz=-420&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa9l0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcloudfiles.io%2F&tiba=File%20Sharing%20Platform%20%7C%20Share%20Documents%20Online%20%7C%20CloudFiles&auid=1471331947.1663946094&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CI22yQEIpbbJAQjBtskBCKmdygEIlqHLAQj8qswBCLy8zAEIj73MAQiywcwBCMTBzAEI18HMAQ==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: IDE=AHWqTUmb4mZiaecYrlYE5v2SQK8Mo0O9wRRPxFD7O9khuIVKtStu9A7CrL_ZTafo
Source: global traffic	HTTP traffic detected: GET /pagead/viewthroughconversion/10790228306/?random=1663946097450&cv=9&fst=1663946097450&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_his=1&u_tz=-420&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa9l0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcloudfiles.io%2F&tiba=File%20Sharing%20Platform%20%7C%20Share%20Documents%20Online%20%7C%20CloudFiles&auid=1471331947.1663946094&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CI22yQEIpbbJAQjBtskBCKmdygEIlqHLAQj8qswBCLy8zAEIj73MAQiywcwBCMTBzAEI18HMAQ==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: IDE=AHWqTUmb4mZiaecYrlYE5v2SQK8Mo0O9wRRPxFD7O9khuIVKtStu9A7CrL_ZTafo
Source: global traffic	HTTP traffic detected: GET /s/player/abfb84fe/player_ias.vflset/en_US/embed.js HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CI22yQEIpbbJAQjBtskBCKmdygEIlqHLAQj8qswBCLy8zAEIj73MAQiywcwBCMTBzAEI18HMAQ==Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.youtube.com/embed/1rkTwk6PKdY?autoplay=0&mute=0&controls=0&origin=https%3A%2F%2Fcloudfiles.io&playsinline=1&showinfo=0&rel=0&iv_load_policy=3&modestbranding=1&enablejsapi=1&widgetid=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: YSC=0Gkdp1KDrT4; VISITOR_INFO1_LIVE=SNPwgvJ8Kh8
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/10790155329/?random=1663946097413&cv=9&fst=1663945200000&num=1&bg=ffffff&guid=ON&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_his=1&u_tz=-420&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa9l0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcloudfiles.io%2F&tiba=File%20Sharing%20Platform%20%7C%20Share%20Documents%20Online%20%7C%20CloudFiles&async=1&fmt=3&is_vtc=1&random=346257282&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CI22yQEIpbbJAQjBtskBCKmdygEIlqHLAQj8qswBCLy8zAEIj73MAQiywcwBCMTBzAEI18HMAQ==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=nUT82hOv6CVwMNqDg-sTtCMJJ6SQ1v_cCpfCpf5nt8EolEbal01GWFyjG01tqWQgh9ciRU880J6nLd2gdbhAJs44PsHAZaVQAFIbrqe2FmFgjrAAK7W9Z8u5LDvwsuZRng98jP6E23SJ4fsPIs326YmnuCwa92dRRCcB6MNeI_o
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/10790155329/?random=1663946097413&cv=9&fst=1663945200000&num=1&bg=ffffff&guid=ON&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_his=1&u_tz=-420&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa9l0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcloudfiles.io%2F&tiba=File%20Sharing%20Platform%20%7C%20Share%20Documents%20Online%20%7C%20CloudFiles&async=1&fmt=3&is_vtc=1&random=346257282&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y HTTP/1.1Host: www.google.co.ukConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CI22yQEIpbbJAQjBtskBCKmdygEIlqHLAQj8qswBCLy8zAEIj73MAQiywcwBCMTBzAEI18HMAQ==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /generate_204?uf-mSA HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CI22yQEIpbbJAQjBtskBCKmdygEIlqHLAQj8qswBCLy8zAEIj73MAQiywcwBCMTBzAEI18HMAQ==Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.youtube.com/embed/1rkTwk6PKdY?autoplay=0&mute=0&controls=0&origin=https%3A%2F%2Fcloudfiles.io&playsinline=1&showinfo=0&rel=0&iv_load_policy=3&modestbranding=1&enablejsapi=1&widgetid=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: YSC=0Gkdp1KDrT4; VISITOR_INFO1_LIVE=SNPwgvJ8Kh8
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/10790228306/?random=1663946097450&cv=9&fst=1663945200000&num=1&bg=ffffff&guid=ON&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_his=1&u_tz=-420&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa9l0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcloudfiles.io%2F&tiba=File%20Sharing%20Platform%20%7C%20Share%20Documents%20Online%20%7C%20CloudFiles&async=1&fmt=3&is_vtc=1&random=1233451760&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y HTTP/1.1Host: www.google.co.ukConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CI22yQEIpbbJAQjBtskBCKmdygEIlqHLAQj8qswBCLy8zAEIj73MAQiywcwBCMTBzAEI18HMAQ==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/10790228306/?random=1663946097450&cv=9&fst=1663945200000&num=1&bg=ffffff&guid=ON&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_his=1&u_tz=-420&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa9l0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcloudfiles.io%2F&tiba=File%20Sharing%20Platform%20%7C%20Share%20Documents%20Online%20%7C%20CloudFiles&async=1&fmt=3&is_vtc=1&random=1233451760&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CI22yQEIpbbJAQjBtskBCKmdygEIlqHLAQj8qswBCLy8zAEIj73MAQiywcwBCMTBzAEI18HMAQ==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=nUT82hOv6CVwMNqDg-sTtCMJJ6SQ1v_cCpfCpf5nt8EolEbal01GWFyjG01tqWQgh9ciRU880J6nLd2gdbhAJs44PsHAZaVQAFIbrqe2FmFgjrAAK7W9Z8u5LDvwsuZRng98jP6E23SJ4fsPIs326YmnuCwa92dRRCcB6MNeI_o
Source: global traffic	HTTP traffic detected: GET /ytc/AMLnZu-FWsVbF8aAR_gls7ecgPiqYZt6-nIMTeclblUc=s68-c-k-c0x00ffffff-no-rj HTTP/1.1Host: yt3.ggpht.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CI22yQEIpbbJAQjBtskBCKmdygEIlqHLAQj8qswBCLy8zAEIj73MAQiywcwBCMTBzAEI18HMAQ==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.youtube.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/10783125194/?random=1663946097443&cv=9&fst=1663945200000&num=1&bg=ffffff&guid=ON&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_his=1&u_tz=-420&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa9l0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcloudfiles.io%2F&tiba=File%20Sharing%20Platform%20%7C%20Share%20Documents%20Online%20%7C%20CloudFiles&async=1&fmt=3&is_vtc=1&random=1027656747&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y HTTP/1.1Host: www.google.co.ukConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CI22yQEIpbbJAQjBtskBCKmdygEIlqHLAQj8qswBCLy8zAEIj73MAQiywcwBCMTBzAEI18HMAQ==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/10783125194/?random=1663946097443&cv=9&fst=1663945200000&num=1&bg=ffffff&guid=ON&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_his=1&u_tz=-420&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa9l0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcloudfiles.io%2F&tiba=File%20Sharing%20Platform%20%7C%20Share%20Documents%20Online%20%7C%20CloudFiles&async=1&fmt=3&is_vtc=1&random=1027656747&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CI22yQEIpbbJAQjBtskBCKmdygEIlqHLAQj8qswBCLy8zAEIj73MAQiywcwBCMTBzAEI18HMAQ==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=nUT82hOv6CVwMNqDg-sTtCMJJ6SQ1v_cCpfCpf5nt8EolEbal01GWFyjG01tqWQgh9ciRU880J6nLd2gdbhAJs44PsHAZaVQAFIbrqe2FmFgjrAAK7W9Z8u5LDvwsuZRng98jP6E23SJ4fsPIs326YmnuCwa92dRRCcB6MNeI_o
Source: global traffic	HTTP traffic detected: GET /logos/CloudFilesLogo.svg HTTP/1.1Host: cloudfiles.ioConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __hstc=218584006.222eafc23c17f2f1f20b9c762dc2bdcf.1663946098461.1663946098461.1663946098461.1; hubspotutk=222eafc23c17f2f1f20b9c762dc2bdcf; __hssrc=1; __hssc=218584006.1.1663946098463
Source: global traffic	HTTP traffic detected: GET /api/ly7mR8utBQ5 HTTP/1.1Host: api.cloudfil.esConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: application/json, text/plain, /cf-session-id: 632d4ec5c3d2310bbf142ae1cf-device-id: 4573b0a3-d086-4d9f-bb85-8dd384048e9dsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://cloudfil.esSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://cloudfil.es/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: W/"23d-5m7x852I5e9PUXYs14wIemXqxlk"
Source: global traffic	HTTP traffic detected: GET /__ptq.gif?k=1&sd=1280x1024&cd=24-bit&cs=UTF-8&ln=en-us&bfp=4285505810&v=1.1&a=20182553&pu=https%3A%2F%2Fcloudfiles.io%2F&t=File+Sharing+Platform+%7C+Share+Documents+Online+%7C+CloudFiles&cts=1663946098472&vi=222eafc23c17f2f1f20b9c762dc2bdcf&nc=true&u=218584006.222eafc23c17f2f1f20b9c762dc2bdcf.1663946098461.1663946098461.1663946098461.1&b=218584006.1.1663946098463&cc=15 HTTP/1.1Host: track.hubspot.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cloudfiles.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=KBeB2x5rqUrxdG9hNMEB40Lk8PAadP80.qhombaISjw-1663913693-0-AcDU+D5wZXtpRYkuUNQbXu6lie4owgpFswTDlMODroNE0+Wv8KtGwsI4RHfUpXPH7lPTDvesEM9gPWctUvKBqwg=
Source: global traffic	HTTP traffic detected: GET /userpreferences/v1/avatar/af37eb0cf85adf85d80f9fda4baa0b45/100 HTTP/1.1Host: api-na1.hubspot.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://app.hubspot.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=KBeB2x5rqUrxdG9hNMEB40Lk8PAadP80.qhombaISjw-1663913693-0-AcDU+D5wZXtpRYkuUNQbXu6lie4owgpFswTDlMODroNE0+Wv8KtGwsI4RHfUpXPH7lPTDvesEM9gPWctUvKBqwg=
Source: global traffic	HTTP traffic detected: GET /userpreferences/v1/avatar/7baf5799201cac38d1c7a19dc11b89b1/100 HTTP/1.1Host: api-na1.hubspot.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://app.hubspot.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=KBeB2x5rqUrxdG9hNMEB40Lk8PAadP80.qhombaISjw-1663913693-0-AcDU+D5wZXtpRYkuUNQbXu6lie4owgpFswTDlMODroNE0+Wv8KtGwsI4RHfUpXPH7lPTDvesEM9gPWctUvKBqwg=
Source: global traffic	HTTP traffic detected: GET /userpreferences/v1/avatar/9da96031556358e4754625e37320e787/100 HTTP/1.1Host: api-na1.hubspot.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://app.hubspot.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=KBeB2x5rqUrxdG9hNMEB40Lk8PAadP80.qhombaISjw-1663913693-0-AcDU+D5wZXtpRYkuUNQbXu6lie4owgpFswTDlMODroNE0+Wv8KtGwsI4RHfUpXPH7lPTDvesEM9gPWctUvKBqwg=
Source: global traffic	HTTP traffic detected: GET /api/ly7mR8utBQ5 HTTP/1.1Host: api.cloudfil.esConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: application/json, text/plain, /cf-session-id: 632d4ec5c3d2310bbf142ae1cf-device-id: 4573b0a3-d086-4d9f-bb85-8dd384048e9dsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://cloudfil.esSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://cloudfil.es/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: W/"23d-5m7x852I5e9PUXYs14wIemXqxlk"
Source: global traffic	HTTP traffic detected: GET /9da96031556358e4754625e37320e787-100 HTTP/1.1Host: avatars.hubspot.netConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://app.hubspot.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /7baf5799201cac38d1c7a19dc11b89b1-100 HTTP/1.1Host: avatars.hubspot.netConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://app.hubspot.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /af37eb0cf85adf85d80f9fda4baa0b45-100 HTTP/1.1Host: avatars.hubspot.netConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://app.hubspot.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /logos/FullLogo-new.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /logos/CloudFilesLogo.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /_next/image?url=%2Fimages%2Fpages%2Fhome%2Ftestimonials%2Fhs-logo.png&w=3840&q=75 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /images/pages/home/hero-image.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /images/pages/home/testimonials/5-star-rating.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /_next/image?url=%2Fimages%2Fpages%2Fhome%2Ftestimonials%2Fg2-logo.png&w=3840&q=75 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /images/pages/home/testimonials/Chris-Moore.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /images/pages/home/testimonials/1920px-HubSpot_Logo.svg.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /ytc/AMLnZu-FWsVbF8aAR_gls7ecgPiqYZt6-nIMTeclblUc=s68-c-k-c0x00ffffff-no-rj HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: yt3.ggpht.com
Source: global traffic	HTTP traffic detected: GET /images/pages/home/testimonials/StephenDrew.jpeg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /vi_webp/1rkTwk6PKdY/sddefault.webp HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: i.ytimg.com
Source: global traffic	HTTP traffic detected: GET /images/pages/home/testimonials/Architecture-Social.jpeg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /images/pages/home/testimonials/goreact-logo.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /userpreferences/v1/avatar/af37eb0cf85adf85d80f9fda4baa0b45/100 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: api-na1.hubspot.com
Source: global traffic	HTTP traffic detected: GET /userpreferences/v1/avatar/7baf5799201cac38d1c7a19dc11b89b1/100 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: api-na1.hubspot.com
Source: global traffic	HTTP traffic detected: GET /images/pages/home/testimonials/Travis-White.jpg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /images/pages/home/testimonials/neighbourhood-logo.jpeg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /userpreferences/v1/avatar/9da96031556358e4754625e37320e787/100 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: api-na1.hubspot.com
Source: global traffic	HTTP traffic detected: GET /images/pages/home/testimonials/avatar-man.jpg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /images/pages/home/testimonials/chemstation-logo.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /images/pages/home/testimonials/sf-logo.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /images/pages/home/testimonials/hs-logo.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /images/pages/home/features/cloud-copy.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /images/pages/home/features/secure-file-sharing.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /images/pages/home/features/file-links.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /images/pages/home/features/detailed-analytics.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /images/pages/home/testimonials/Jordan-Harris.jpeg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /images/pages/home/features/content-marketing.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /images/pages/home/features/ecm-vs-cms.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /images/pages/home/features/email-attachment.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /images/pages/home/buddha-banner.jpg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /logos/cloudfiles-white-logo.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /logos/security/soc2.webp HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /logos/security/gdpr.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /logos/security/iso27001.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /icons/twitter.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /icons/linkedin.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /icons/angellist.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /icons/email.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /logos/footer-background.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /logos/FullLogo-new.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.ioIf-None-Match: "6828bfea39e698db0210a67f79cff32c"
Source: global traffic	HTTP traffic detected: GET /images/pages/home/hero-image.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.ioIf-None-Match: "4e2cb1ad210e58b3c977279210908988"
Source: global traffic	HTTP traffic detected: GET /_next/image?url=%2Fimages%2Fpages%2Fhome%2Ftestimonials%2Fhs-logo.png&w=3840&q=75 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.ioIf-Modified-Since: Thu, 08 Sep 2022 14:38:34 GMT
Source: global traffic	HTTP traffic detected: GET /images/pages/home/testimonials/5-star-rating.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.ioIf-None-Match: "7b3e30bc5aa52d7f1903d1c68ad34818"
Source: global traffic	HTTP traffic detected: GET /_next/image?url=%2Fimages%2Fpages%2Fhome%2Ftestimonials%2Fg2-logo.png&w=3840&q=75 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.ioIf-Modified-Since: Thu, 08 Sep 2022 14:40:07 GMT
Source: global traffic	HTTP traffic detected: GET /images/pages/home/testimonials/Chris-Moore.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.ioIf-None-Match: "8c49ed37fa963fa09037015dd71a680f"
Source: global traffic	HTTP traffic detected: GET /images/pages/home/testimonials/1920px-HubSpot_Logo.svg.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.ioIf-None-Match: "fa23191bc3e76f4448fefdc777132780"
Source: global traffic	HTTP traffic detected: GET /logos/CloudFilesLogo.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.ioIf-None-Match: "042dd544efee9717a3de914b1faecf68"
Source: global traffic	HTTP traffic detected: GET /images/pages/home/testimonials/StephenDrew.jpeg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.ioIf-None-Match: "99ff3bfe76149ad4dea863dfaf56c8b4"
Source: global traffic	HTTP traffic detected: GET /images/pages/home/testimonials/Architecture-Social.jpeg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.ioIf-None-Match: "67e015195ac89bf41c2b8d10bb9b0fc5"
Source: global traffic	HTTP traffic detected: GET /images/pages/home/testimonials/Jordan-Harris.jpeg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /images/pages/home/testimonials/Travis-White.jpg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.ioIf-None-Match: "cd0c74d998d0cfc6d12535267d20afce"
Source: global traffic	HTTP traffic detected: GET /images/pages/home/testimonials/neighbourhood-logo.jpeg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /images/pages/home/testimonials/avatar-man.jpg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.ioIf-None-Match: "3b2a6f64bccf299335d04860b3fc9d2e"
Source: global traffic	HTTP traffic detected: GET /images/pages/home/testimonials/chemstation-logo.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.ioIf-None-Match: "9031f1c63aa192419b8ed5e6a6d74ba9"
Source: global traffic	HTTP traffic detected: GET /images/pages/home/testimonials/goreact-logo.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.ioIf-None-Match: "5b95c58f24c7d78e6752ce122cdc2311"
Source: global traffic	HTTP traffic detected: GET /images/pages/home/testimonials/hs-logo.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.ioIf-None-Match: "ba5562838bd8e6073b4a8996cfedf86c"
Source: global traffic	HTTP traffic detected: GET /images/pages/home/features/cloud-copy.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /images/pages/home/features/secure-file-sharing.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /images/pages/home/features/file-links.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /images/pages/home/features/detailed-analytics.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /images/pages/home/testimonials/sf-logo.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.ioIf-None-Match: "b6bacb4e58fabf87be42b96d1bf9d734"
Source: global traffic	HTTP traffic detected: GET /images/pages/home/features/content-marketing.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /images/pages/home/features/ecm-vs-cms.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /images/pages/home/features/email-attachment.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /images/pages/home/buddha-banner.jpg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /logos/cloudfiles-white-logo.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /logos/security/soc2.webp HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /logos/security/gdpr.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /logos/security/iso27001.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /icons/twitter.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /icons/linkedin.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /icons/angellist.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /icons/email.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /logos/footer-background.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cloudfiles.io
Source: global traffic	HTTP traffic detected: GET /api/ly7mR8utBQ5/files/download? HTTP/1.1Host: api.cloudfil.esConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: application/json, text/plain, /cf-session-id: 632d4ec5c3d2310bbf142ae1cf-device-id: 4573b0a3-d086-4d9f-bb85-8dd384048e9dsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://cloudfil.esSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://cloudfil.es/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: W/"2a2-av0BRQDyDDKF3yCWJDyA6yEo4sY"
Source: global traffic	HTTP traffic detected: GET /files/632d42032155f034859123fd/dd22dcbe6c19b15128cab3522986d931/SARS%20OUTSTANDING%20LETTER%20OF%20DEMAND.zip?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAUV34ETFBMAVXCJUY%2F20220923%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20220923T061532Z&X-Amz-Expires=3600&X-Amz-Signature=d9703dd406f373ce62dbfbedff0f73ad4c0cc885214c07a12134a97a4d5973c2&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3DSARS%20OUTSTANDING%20LETTER%20OF%20DEMAND.zip&origin=cloudfiles-prod-files.s3-accelerate.amazonaws.com&verify=1663914032-Z-BLTuiybx_6ZpFIVuGKAWPkLgtCWto0IUueUfEQXWk HTTP/1.1Host: cloudfil.esConnection: keep-aliveSec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: emptyReferer: https://cloudfil.es/ly7mR8utBQ5User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/ly7mR8utBQ5 HTTP/1.1Host: api.cloudfil.esConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: application/json, text/plain, /cf-session-id: 632d4ec5c3d2310bbf142ae1cf-device-id: 4573b0a3-d086-4d9f-bb85-8dd384048e9dsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://cloudfil.esSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://cloudfil.es/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: W/"23d-5m7x852I5e9PUXYs14wIemXqxlk"
Source: global traffic	HTTP traffic detected: GET /api/ly7mR8utBQ5 HTTP/1.1Host: api.cloudfil.esConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: application/json, text/plain, /cf-session-id: 632d4ec5c3d2310bbf142ae1cf-device-id: 4573b0a3-d086-4d9f-bb85-8dd384048e9dsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://cloudfil.esSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://cloudfil.es/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: W/"23d-5m7x852I5e9PUXYs14wIemXqxlk"
Source: global traffic	HTTP traffic detected: GET /api/ly7mR8utBQ5/files/download? HTTP/1.1Host: api.cloudfil.esConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: application/json, text/plain, /cf-session-id: 632d4ec5c3d2310bbf142ae1cf-device-id: 4573b0a3-d086-4d9f-bb85-8dd384048e9dsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://cloudfil.esSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://cloudfil.es/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: W/"2a2-DkZgQQ8Wvb7ZctiXmyrtrdlE6Hs"
Source: global traffic	HTTP traffic detected: GET /files/632d42032155f034859123fd/dd22dcbe6c19b15128cab3522986d931/SARS%20OUTSTANDING%20LETTER%20OF%20DEMAND.zip?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAUV34ETFBMAVXCJUY%2F20220923%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20220923T061550Z&X-Amz-Expires=3600&X-Amz-Signature=d89721e8204ffad73fdcaefe35c5f8d4b752d2f28420357921dae2e744c3ba05&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3DSARS%20OUTSTANDING%20LETTER%20OF%20DEMAND.zip&origin=cloudfiles-prod-files.s3-accelerate.amazonaws.com&verify=1663914050-dtqk9eTGiOD_uoN_0MvGpFrrQqmRrXkd1wsPPd-VCFM HTTP/1.1Host: cloudfil.esConnection: keep-aliveSec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: emptyReferer: https://cloudfil.es/ly7mR8utBQ5User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/ly7mR8utBQ5 HTTP/1.1Host: api.cloudfil.esConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: application/json, text/plain, /cf-session-id: 632d4ec5c3d2310bbf142ae1cf-device-id: 4573b0a3-d086-4d9f-bb85-8dd384048e9dsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://cloudfil.esSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://cloudfil.es/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: W/"23d-5m7x852I5e9PUXYs14wIemXqxlk"
Source: global traffic	HTTP traffic detected: GET /api/ly7mR8utBQ5/files/download? HTTP/1.1Host: api.cloudfil.esConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Accept: application/json, text/plain, /cf-session-id: 632d4ec5c3d2310bbf142ae1cf-device-id: 4573b0a3-d086-4d9f-bb85-8dd384048e9dsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://cloudfil.esSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://cloudfil.es/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: W/"2a2-ODL6du9cy17E0I+0mLNgTGy9rKM"

Source: unknown	HTTPS traffic detected: 76.76.21.21:443 -> 192.168.2.3:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 76.76.21.21:443 -> 192.168.2.3:49922 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 76.76.21.21:443 -> 192.168.2.3:49921 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.161:443 -> 192.168.2.3:49934 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.182:443 -> 192.168.2.3:49935 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.19.154.83:443 -> 192.168.2.3:49941 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.19.154.83:443 -> 192.168.2.3:49943 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 76.76.21.21:443 -> 192.168.2.3:49958 version: TLS 1.2

Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 12_2_030202C8	12_2_030202C8
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 12_2_030202B9	12_2_030202B9
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 17_2_012102C8	17_2_012102C8
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 17_2_012102BC	17_2_012102BC
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 20_2_054A02C8	20_2_054A02C8
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 20_2_054A02B9	20_2_054A02B9

Source: C:\Windows\SysWOW64\unarchiver.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1936 --field-trial-handle=1772,i,13935456055298204775,6851687727719502408,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" "https://cloudfil.es/ly7mR8utBQ5
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\unarchiver.exe C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND.zip
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3636 --field-trial-handle=1772,i,13935456055298204775,6851687727719502408,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6236 --field-trial-handle=1772,i,13935456055298204775,6851687727719502408,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\fsnnqwuj.h1e" "C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND.zip
Source: C:\Windows\SysWOW64\7za.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\unarchiver.exe C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND (1).zip
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\oluilyf2.xu4" "C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND (1).zip
Source: C:\Windows\SysWOW64\7za.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\unarchiver.exe C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND (2).zip
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\evppz250.yan" "C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND (2).zip
Source: C:\Windows\SysWOW64\7za.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1936 --field-trial-handle=1772,i,13935456055298204775,6851687727719502408,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\unarchiver.exe C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND.zip	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3636 --field-trial-handle=1772,i,13935456055298204775,6851687727719502408,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6236 --field-trial-handle=1772,i,13935456055298204775,6851687727719502408,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\unarchiver.exe C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND (1).zip	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\unarchiver.exe C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND (2).zip	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\fsnnqwuj.h1e" "C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND.zip	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\oluilyf2.xu4" "C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND (1).zip	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\evppz250.yan" "C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND (2).zip	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6420:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5772:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7004:120:WilError_01

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\GoogleUpdater

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\Downloads\22e8244c-6e16-464c-801c-35bec625d846.tmp

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

File created: C:\Users\user\AppData\Local\Temp\unarchiver.log

Jump to behavior

Source: classification engine

Classification label: mal48.phis.win@53/12@49/38

Source: C:\Windows\SysWOW64\unarchiver.exe	Automated click: OK
Source: C:\Windows\SysWOW64\unarchiver.exe	Automated click: OK
Source: C:\Windows\SysWOW64\unarchiver.exe	Automated click: OK

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\GoogleUpdater

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

Code function: 17_2_01210015 pushfd ; retf

17_2_01210016

Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe TID: 5080	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe TID: 6368	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe TID: 5836	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

Code function: 12_2_0165B1D6 GetSystemInfo,

12_2_0165B1D6

Source: C:\Windows\SysWOW64\unarchiver.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\fsnnqwuj.h1e" "C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND.zip	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\oluilyf2.xu4" "C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND (1).zip	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\evppz250.yan" "C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND (2).zip	Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
1 Drive-by Compromise	Windows Management Instrumentation	Path Interception	11 Process Injection	3 Masquerading	OS Credential Dumping	21 Virtualization/Sandbox Evasion	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	11 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	3 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	4 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	21 Virtualization/Sandbox Evasion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	5 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	11 Process Injection	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	3 Ingress Tool Transfer	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	Remote System Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://cloudfil.es/ly7mR8utBQ5	0%	Virustotal		Browse
https://cloudfil.es/ly7mR8utBQ5	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label
https://js.usemessages.com/conversations-embed.js	0%	URL Reputation	safe
https://js.hsadspixel.net/fb.js	0%	URL Reputation	safe
https://cloudfiles.io/_next/image?url=%2Fimages%2Fpages%2Fhome%2Ftestimonials%2Fhs-logo.png&w=1920&q=75	0%	Avira URL Cloud	safe
https://cloudfiles.io/images/pages/home/testimonials/Jordan-Harris.jpeg	0%	Avira URL Cloud	safe
https://cloudfil.es/_next/static/chunks/main-96fa8ae7c24c9725.js	0%	Avira URL Cloud	safe
https://cloudfiles.io/logos/security/gdpr.png	0%	Avira URL Cloud	safe
https://cloudfiles.io/icons/twitter.png	0%	Avira URL Cloud	safe
https://cloudfiles.io/_next/static/YJeXlCCpqKEI4BNvP_rQi/_buildManifest.js	0%	Avira URL Cloud	safe
https://cloudfiles.io/images/pages/home/testimonials/neighbourhood-logo.jpeg	0%	Avira URL Cloud	safe
https://cloudfiles.io/images/pages/home/testimonials/Architecture-Social.jpeg	0%	Avira URL Cloud	safe
https://cloudfiles.io/icons/linkedin.png	0%	Avira URL Cloud	safe
https://cloudfiles.io/images/pages/home/testimonials/1920px-HubSpot_Logo.svg.png	0%	Avira URL Cloud	safe
https://cloudfiles.io/images/pages/home/testimonials/Chris-Moore.png	0%	Avira URL Cloud	safe
https://www.google.co.uk/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-HB9Z4JLXX4&cid=604035153.1663946092&gtm=2oe9l0&aip=1&z=1923764674	0%	Avira URL Cloud	safe
https://cloudfiles.io/_next/static/YJeXlCCpqKEI4BNvP_rQi/_ssgManifest.js	0%	Avira URL Cloud	safe
https://js.hs-banner.com/20182553.js	0%	Avira URL Cloud	safe
https://cloudfiles.io/_next/static/chunks/pages/%5Bslug%5D-987d9e7f5dfae2bd.js	0%	Avira URL Cloud	safe
https://cloudfiles.io/_next/static/chunks/423-c466c32b0761d1c5.js	0%	Avira URL Cloud	safe
https://api.cloudfil.es/api/views/632d4ec5c3d2310bbf142ae1/download	0%	Avira URL Cloud	safe
https://api.cloudfil.es/api/ly7mR8utBQ5	0%	Avira URL Cloud	safe
https://cloudfiles.io/_next/static/chunks/197-c096a3bf80407be8.js	0%	Avira URL Cloud	safe
https://cloudfiles.io/images/pages/home/features/file-links.svg	0%	Avira URL Cloud	safe
https://cloudfiles.io/images/pages/home/testimonials/goreact-logo.svg	0%	Avira URL Cloud	safe
https://cloudfil.es/favicon.ico	0%	Avira URL Cloud	safe
https://cloudfiles.io/images/pages/home/buddha-banner.jpg	0%	Avira URL Cloud	safe
https://www.google.co.uk/pagead/1p-user-list/10783125194/?random=1663946097443&cv=9&fst=1663945200000&num=1&bg=ffffff&guid=ON&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_his=1&u_tz=-420&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa9l0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcloudfiles.io%2F&tiba=File%20Sharing%20Platform%20%7C%20Share%20Documents%20Online%20%7C%20CloudFiles&async=1&fmt=3&is_vtc=1&random=1027656747&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y	0%	Avira URL Cloud	safe
https://cloudfil.es/_next/static/chunks/pages/%5Bhash%5D-da6732468a64e9d9.js	0%	Avira URL Cloud	safe
https://cloudfiles.io/images/pages/home/features/detailed-analytics.png	0%	Avira URL Cloud	safe
https://cloudfiles.io/_next/static/chunks/pages/_app-f171edb1f3175855.js	0%	Avira URL Cloud	safe
https://cloudfiles.io/logos/FullLogo-new.svg	0%	Avira URL Cloud	safe
https://static.hsappstatic.net/hubspot-dlb/static-1.318/bundle.production.js	0%	Avira URL Cloud	safe
https://cloudfiles.io/_next/image?url=%2Fimages%2Fpages%2Fhome%2Ftestimonials%2Fg2-logo.png&w=3840&q=75	0%	Avira URL Cloud	safe
https://cloudfiles.io/icons/angellist.png	0%	Avira URL Cloud	safe
https://cloudfiles.io/_next/static/chunks/390-8a0eaf13ec9db927.js	0%	Avira URL Cloud	safe
https://www.google.co.uk/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j97&tid=UA-188936264-1&cid=604035153.1663946092&jid=1865915276&_u=YADAAUAAAAAAAC~&z=1702222027	0%	Avira URL Cloud	safe
https://cloudfiles.io/_next/static/chunks/545f34e4-eb701074efab5973.js	0%	Avira URL Cloud	safe
https://cloudfiles.io/hog/decide?v=2&ip=1&_=1663946086126	0%	Avira URL Cloud	safe
https://cloudfiles.io/_next/data/YJeXlCCpqKEI4BNvP_rQi/pricing.json?slug=pricing	0%	Avira URL Cloud	safe
https://www.google.co.uk/pagead/1p-user-list/10790155329/?random=1663946097413&cv=9&fst=1663945200000&num=1&bg=ffffff&guid=ON&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_his=1&u_tz=-420&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa9l0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcloudfiles.io%2F&tiba=File%20Sharing%20Platform%20%7C%20Share%20Documents%20Online%20%7C%20CloudFiles&async=1&fmt=3&is_vtc=1&random=346257282&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y	0%	Avira URL Cloud	safe
https://api.cloudfil.es/api/ly7mR8utBQ5/files	0%	Avira URL Cloud	safe
https://cloudfil.es/_next/static/css/761d08517528cd55.css	0%	Avira URL Cloud	safe
https://cloudfiles.io/images/pages/home/features/secure-file-sharing.svg	0%	Avira URL Cloud	safe
https://cloudfiles.io/logos/security/soc2.webp	0%	Avira URL Cloud	safe
https://cloudfiles.io/_next/static/chunks/5ca00d41-f80dcc02233c86a3.js	0%	Avira URL Cloud	safe
https://cloudfiles.io/_next/static/chunks/framework-5f4595e5518b5600.js	0%	Avira URL Cloud	safe
https://cloudfiles.io/_next/static/chunks/pages/index-54a1471851cf647f.js	0%	Avira URL Cloud	safe
https://cloudfiles.io/_next/static/chunks/fc20e1c4-9e1761e40e9bca31.js	0%	Avira URL Cloud	safe
https://cloudfiles.io/hog/e?ip=1&_=1663946086204	0%	Avira URL Cloud	safe
https://cloudfiles.io/images/pages/home/testimonials/Travis-White.jpg	0%	Avira URL Cloud	safe
https://cloudfiles.io/images/pages/home/testimonials/5-star-rating.svg	0%	Avira URL Cloud	safe
https://cloudfiles.io/_next/static/chunks/28-8667e3219650ddd1.js	0%	Avira URL Cloud	safe
https://cloudfiles.io/images/pages/home/features/cloud-copy.svg	0%	Avira URL Cloud	safe
https://cloudfiles.io/_next/static/chunks/951-9933cd60a769c984.js	0%	Avira URL Cloud	safe
https://cloudfiles.io/_next/static/chunks/43a99af2-6a652ea0e41564d0.js	0%	Avira URL Cloud	safe
https://static.hsappstatic.net/head-dlb/static-1.233/bundle.production.js	0%	Avira URL Cloud	safe
https://cloudfiles.io/images/pages/home/hero-image.svg	0%	Avira URL Cloud	safe
https://cloudfil.es/_next/static/chunks/838-e577e7ded876b417.js	0%	Avira URL Cloud	safe
https://cloudfiles.io/_next/static/chunks/b16bd182-2fce6d9e40c8c943.js	0%	Avira URL Cloud	safe
https://cloudfil.es/images/logoWordmark.svg	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
gstaticadssl.l.google.com	172.217.16.195	true	false	high
i.ytimg.com	142.250.186.182	true	false	high
js.hs-analytics.net	104.17.69.176	true	false	unknown
cloudfil.es	76.76.21.21	true	false	unknown
d296je7bbdd650.cloudfront.net	108.138.32.174	true	false	high
scontent.xx.fbcdn.net	157.240.17.15	true	false	high
track.hubspot.com	104.19.154.83	true	false	high
avatars.hubspot.net	104.17.240.204	true	false	high
dmotion.s.llnwi.net	95.140.230.217	true	false	unknown
photos-ugc.l.googleusercontent.com	142.250.186.161	true	false	high
www.google.com	142.250.185.164	true	false	high
js.usemessages.com	104.17.239.204	true	false	unknown
api.cloudfil.es	172.67.199.56	true	false	unknown
js.hs-banner.com	104.18.33.171	true	false	unknown
star-mini.c10r.facebook.com	157.240.17.35	true	false	high
a.nel.cloudflare.com	35.190.80.1	true	false	high
static.hsappstatic.net	104.17.6.210	true	false	unknown
accounts.google.com	216.58.212.173	true	false	high
stats.l.doubleclick.net	108.177.15.156	true	false	high
app.hubspot.com	104.19.155.83	true	false	high
www-googletagmanager.l.google.com	172.217.18.8	true	false	high
js.hsadspixel.net	104.17.112.176	true	false	unknown
region1.analytics.google.com	216.239.32.36	true	false	high
static-doubleclick-net.l.google.com	142.250.185.166	true	false	high
youtube-ui.l.google.com	172.217.23.110	true	false	high
js-na1.hs-scripts.com	104.17.213.204	true	false	high
api.hubspot.com	104.19.154.83	true	false	high
googleads.g.doubleclick.net	142.250.184.226	true	false	high
play.google.com	142.250.185.110	true	false	high
api-na1.hubspot.com	104.19.154.83	true	false	high
api.hubapi.com	104.17.202.204	true	false	high
www.google.co.uk	172.217.18.3	true	false	unknown
cloudfiles.io	76.76.21.21	true	false	unknown
clients.l.google.com	142.250.186.46	true	false	high
cdn.cookie-script.com	116.203.90.127	true	false	high
yt3.ggpht.com	unknown	unknown	false	high
stats.g.doubleclick.net	unknown	unknown	false	high
cdn.segment.com	unknown	unknown	false	high
clients2.google.com	unknown	unknown	false	high
api.dmcdn.net	unknown	unknown	false	high
www.youtube.com	unknown	unknown	false	high
bam-cell.nr-data.net	unknown	unknown	false	unknown
www.facebook.com	unknown	unknown	false	high
www.linkedin.com	unknown	unknown	false	high
js-agent.newrelic.com	unknown	unknown	false	high
connect.facebook.net	unknown	unknown	false	high
px.ads.linkedin.com	unknown	unknown	false	high
static.doubleclick.net	unknown	unknown	false	high
snap.licdn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://cloudfiles.io/_next/image?url=%2Fimages%2Fpages%2Fhome%2Ftestimonials%2Fhs-logo.png&w=1920&q=75	false	Avira URL Cloud: safe	unknown
https://cloudfiles.io/logos/security/gdpr.png	false	Avira URL Cloud: safe	unknown
https://www.youtube.com/s/player/abfb84fe/player_ias.vflset/en_US/base.js	false		high
https://region1.analytics.google.com/g/collect?v=2&tid=G-HB9Z4JLXX4&gtm=2oe9l0&_p=932923266&cid=604035153.1663946092&ul=en-us&sr=1280x1024&_z=ccd.v9B&_s=2&sid=1663946091&sct=1&seg=1&dl=https%3A%2F%2Fcloudfiles.io%2F&dt=File%20Sharing%20Platform%20%7C%20Share%20Documents%20Online%20%7C%20CloudFiles&en=page_view&_ee=1	false		high
https://api-na1.hubspot.com/userpreferences/v1/avatar/9da96031556358e4754625e37320e787/100	false		high
https://www.google.com/pagead/1p-user-list/10790155329/?random=1663946097413&cv=9&fst=1663945200000&num=1&bg=ffffff&guid=ON&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_his=1&u_tz=-420&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa9l0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcloudfiles.io%2F&tiba=File%20Sharing%20Platform%20%7C%20Share%20Documents%20Online%20%7C%20CloudFiles&async=1&fmt=3&is_vtc=1&random=346257282&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y	false		high
https://cloudfiles.io/images/pages/home/testimonials/Jordan-Harris.jpeg	false	Avira URL Cloud: safe	unknown
https://cloudfil.es/_next/static/chunks/main-96fa8ae7c24c9725.js	false	Avira URL Cloud: safe	unknown
https://js.usemessages.com/conversations-embed.js	false	URL Reputation: safe	unknown
https://cloudfiles.io/icons/twitter.png	false	Avira URL Cloud: safe	unknown
https://cloudfiles.io/_next/static/YJeXlCCpqKEI4BNvP_rQi/_buildManifest.js	false	Avira URL Cloud: safe	unknown
https://cloudfiles.io/images/pages/home/testimonials/neighbourhood-logo.jpeg	false	Avira URL Cloud: safe	unknown
https://cdn.segment.com/analytics-next/bundles/870.bundle.323974846b6d45afb45e.js	false		high
https://www.youtube.com/s/player/abfb84fe/player_ias.vflset/en_US/embed.js	false		high
https://avatars.hubspot.net/9da96031556358e4754625e37320e787-100	false		high
https://www.youtube.com/iframe_api	false		high
https://cloudfiles.io/images/pages/home/testimonials/Architecture-Social.jpeg	false	Avira URL Cloud: safe	unknown
https://cdn.segment.com/v1/projects/KUs1gEeIVanAKts76f3NenLgmETEQxxr/settings	false		high
https://www.youtube.com/youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8	false		high
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j97&tid=UA-188936264-1&cid=604035153.1663946092&jid=1865915276&gjid=1491550274&_gid=405113668.1663946093&_u=YADAAUAAAAAAAC~&z=1482416094	false		high
https://cloudfiles.io/images/pages/home/testimonials/Chris-Moore.png	false	Avira URL Cloud: safe	unknown
https://connect.facebook.net/en_US/fbevents.js	false		high
https://cloudfiles.io/icons/linkedin.png	false	Avira URL Cloud: safe	unknown
https://cloudfiles.io/images/pages/home/testimonials/1920px-HubSpot_Logo.svg.png	false	Avira URL Cloud: safe	unknown
https://www.google.co.uk/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-HB9Z4JLXX4&cid=604035153.1663946092&gtm=2oe9l0&aip=1&z=1923764674	false	Avira URL Cloud: safe	unknown
https://cloudfiles.io/_next/static/YJeXlCCpqKEI4BNvP_rQi/_ssgManifest.js	false	Avira URL Cloud: safe	unknown
https://cloudfiles.io/_next/static/chunks/pages/%5Bslug%5D-987d9e7f5dfae2bd.js	false	Avira URL Cloud: safe	unknown
https://js.hs-banner.com/20182553.js	false	Avira URL Cloud: safe	unknown
https://cloudfiles.io/_next/static/chunks/197-c096a3bf80407be8.js	false	Avira URL Cloud: safe	unknown
https://cloudfiles.io/_next/static/chunks/423-c466c32b0761d1c5.js	false	Avira URL Cloud: safe	unknown
https://app.hubspot.com/conversations-visitor/20182553/threads/utk/e86f3294fabf4298bfb6731338a898f9?uuid=9cb37ca1f6ae46778bde47f4ac4692ca&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=cloudfiles.io&inApp53=false&messagesUtk=e86f3294fabf4298bfb6731338a898f9&url=https%3A%2F%2Fcloudfiles.io%2F&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=false&enableWidgetCookieBanner=false&isInCMS=false	false		high
https://api.cloudfil.es/api/ly7mR8utBQ5	false	Avira URL Cloud: safe	unknown
https://cloudfiles.io/images/pages/home/features/file-links.svg	false	Avira URL Cloud: safe	unknown
https://api.cloudfil.es/api/views/632d4ec5c3d2310bbf142ae1/download	false	Avira URL Cloud: safe	unknown
https://i.ytimg.com/vi_webp/1rkTwk6PKdY/sddefault.webp	false		high
https://cloudfiles.io/images/pages/home/testimonials/goreact-logo.svg	false	Avira URL Cloud: safe	unknown
https://cloudfil.es/favicon.ico	false	Avira URL Cloud: safe	unknown
https://cloudfiles.io/images/pages/home/buddha-banner.jpg	false	Avira URL Cloud: safe	unknown
https://www.google.co.uk/pagead/1p-user-list/10783125194/?random=1663946097443&cv=9&fst=1663945200000&num=1&bg=ffffff&guid=ON&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_his=1&u_tz=-420&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa9l0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcloudfiles.io%2F&tiba=File%20Sharing%20Platform%20%7C%20Share%20Documents%20Online%20%7C%20CloudFiles&async=1&fmt=3&is_vtc=1&random=1027656747&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y	false	Avira URL Cloud: safe	unknown
https://app.hubspot.com/conversations-visitor/20182553/threads/utk/e86f3294fabf4298bfb6731338a898f9?uuid=9cb37ca1f6ae46778bde47f4ac4692ca&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=cloudfiles.io&inApp53=false&messagesUtk=e86f3294fabf4298bfb6731338a898f9&url=https%3A%2F%2Fcloudfiles.io%2F&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=false&enableWidgetCookieBanner=false&isInCMS=false&hubspotUtk=222eafc23c17f2f1f20b9c762dc2bdcf	false		high
https://static.hsappstatic.net/hubspot-dlb/static-1.318/bundle.production.js	false	Avira URL Cloud: safe	unknown
https://cloudfiles.io/images/pages/home/features/detailed-analytics.png	false	Avira URL Cloud: safe	unknown
https://static.doubleclick.net/instream/ad_status.js	false		high
https://cloudfil.es/_next/static/chunks/pages/%5Bhash%5D-da6732468a64e9d9.js	false	Avira URL Cloud: safe	unknown
https://cloudfiles.io/_next/static/chunks/pages/_app-f171edb1f3175855.js	false	Avira URL Cloud: safe	unknown
https://js.hsadspixel.net/fb.js	false	URL Reputation: safe	unknown
https://googleads.g.doubleclick.net/pagead/id	false		high
https://cdn.segment.com/analytics.js/v1/KUs1gEeIVanAKts76f3NenLgmETEQxxr/analytics.min.js	false		high
https://api.hubapi.com/hs-script-loader-public/v1/config/pixel/json?portalId=20182553	false		high
https://www.facebook.com/tr/?id=749116996109032&ev=Microdata&dl=https%3A%2F%2Fcloudfiles.io%2F&rl=&if=false&ts=1663946095810&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22File%20Sharing%20Platform%20%7C%20Share%20Documents%20Online%20%7C%20CloudFiles%22%2C%22meta%3Adescription%22%3A%22CloudFiles%20is%20a%20modern%20file%20sharing%20platform%20for%20businesses%20designed%20to%20reduce%20mundane%20tasks.%20Sign%20up%20and%20put%20your%20energy%20to%20things%20that%20matter.%22%7D&cd[OpenGraph]=%7B%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1280&sh=1024&v=2.9.83&r=stable&ec=1&o=30&fbp=fb.1.1663946093092.1064301508&it=1663946090710&coo=false&es=automatic&tm=3&rqm=GET	false		high
https://cloudfiles.io/logos/FullLogo-new.svg	false	Avira URL Cloud: safe	unknown
https://cloudfiles.io/icons/angellist.png	false	Avira URL Cloud: safe	unknown
https://cloudfiles.io/_next/image?url=%2Fimages%2Fpages%2Fhome%2Ftestimonials%2Fg2-logo.png&w=3840&q=75	false	Avira URL Cloud: safe	unknown
https://cloudfiles.io/_next/static/chunks/390-8a0eaf13ec9db927.js	false	Avira URL Cloud: safe	unknown
https://www.google.co.uk/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j97&tid=UA-188936264-1&cid=604035153.1663946092&jid=1865915276&_u=YADAAUAAAAAAAC~&z=1702222027	false	Avira URL Cloud: safe	unknown
https://www.google.com/pagead/1p-user-list/10783125194/?random=1663946097443&cv=9&fst=1663945200000&num=1&bg=ffffff&guid=ON&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_his=1&u_tz=-420&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa9l0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcloudfiles.io%2F&tiba=File%20Sharing%20Platform%20%7C%20Share%20Documents%20Online%20%7C%20CloudFiles&async=1&fmt=3&is_vtc=1&random=1027656747&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y	false		high
https://api-na1.hubspot.com/userpreferences/v1/avatar/af37eb0cf85adf85d80f9fda4baa0b45/100	false		high
https://cloudfiles.io/_next/static/chunks/545f34e4-eb701074efab5973.js	false	Avira URL Cloud: safe	unknown
https://cdn.cookie-script.com/s/61cbca8494eb3ac19b8548ecc52b65d8.js	false		high
https://cloudfiles.io/hog/decide?v=2&ip=1&_=1663946086126	false	Avira URL Cloud: safe	unknown
https://cloudfiles.io/_next/data/YJeXlCCpqKEI4BNvP_rQi/pricing.json?slug=pricing	false	Avira URL Cloud: safe	unknown
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j97&tid=UA-188936264-1&cid=604035153.1663946092&jid=1865915276&_u=YADAAUAAAAAAAC~&z=1702222027	false		high
https://api.dmcdn.net/all.js	false		high
https://www.google.co.uk/pagead/1p-user-list/10790155329/?random=1663946097413&cv=9&fst=1663945200000&num=1&bg=ffffff&guid=ON&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_his=1&u_tz=-420&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa9l0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcloudfiles.io%2F&tiba=File%20Sharing%20Platform%20%7C%20Share%20Documents%20Online%20%7C%20CloudFiles&async=1&fmt=3&is_vtc=1&random=346257282&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y	false	Avira URL Cloud: safe	unknown
https://api.cloudfil.es/api/ly7mR8utBQ5/files	false	Avira URL Cloud: safe	unknown
https://www.youtube.com/s/player/abfb84fe/fetch-polyfill.vflset/fetch-polyfill.js	false		high
https://www.youtube.com/generate_204?uf-mSA	false		high
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=104.0.5112.81&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1	false		high
https://cloudfil.es/_next/static/css/761d08517528cd55.css	false	Avira URL Cloud: safe	unknown
https://cloudfiles.io/images/pages/home/features/secure-file-sharing.svg	false	Avira URL Cloud: safe	unknown
https://cdn.segment.com/analytics-next/bundles/schemaFilter.bundle.debb169c1abb431faaa6.js	false		high
https://www.youtube.com/embed/1rkTwk6PKdY?autoplay=0&mute=0&controls=0&origin=https%3A%2F%2Fcloudfiles.io&playsinline=1&showinfo=0&rel=0&iv_load_policy=3&modestbranding=1&enablejsapi=1&widgetid=1	false		high
https://connect.facebook.net/signals/config/749116996109032?v=2.9.83&r=stable	false		high
https://app.hubspot.com/api/cartographer/v1/rhumb?hs_static_app=conversations-visitor-ui&hs_static_app_version=1.13284	false		high
https://cloudfiles.io/_next/static/chunks/5ca00d41-f80dcc02233c86a3.js	false	Avira URL Cloud: safe	unknown
https://cloudfiles.io/logos/security/soc2.webp	false	Avira URL Cloud: safe	unknown
https://cloudfiles.io/	false		unknown
https://cloudfiles.io/_next/static/chunks/framework-5f4595e5518b5600.js	false	Avira URL Cloud: safe	unknown
https://cloudfiles.io/_next/static/chunks/pages/index-54a1471851cf647f.js	false	Avira URL Cloud: safe	unknown
https://cloudfiles.io/_next/static/chunks/fc20e1c4-9e1761e40e9bca31.js	false	Avira URL Cloud: safe	unknown
https://www.youtube.com/s/player/abfb84fe/www-embed-player.vflset/www-embed-player.js	false		high
https://app.hubspot.com/api/cartographer/v1/performance?hs_static_app=conversations-visitor-ui&hs_static_app_version=1.13284	false		high
https://cloudfiles.io/hog/e?ip=1&_=1663946086204	false	Avira URL Cloud: safe	unknown
https://cloudfiles.io/images/pages/home/testimonials/Travis-White.jpg	false	Avira URL Cloud: safe	unknown
https://www.google.com/js/th/A6NiJ4FpWdYb46YkL14Gb7YSsd_Y0OEDYbyMmxwlYE4.js	false		high
https://yt3.ggpht.com/ytc/AMLnZu-FWsVbF8aAR_gls7ecgPiqYZt6-nIMTeclblUc=s68-c-k-c0x00ffffff-no-rj	false		high
https://avatars.hubspot.net/7baf5799201cac38d1c7a19dc11b89b1-100	false		high
https://cloudfiles.io/_next/static/chunks/28-8667e3219650ddd1.js	false	Avira URL Cloud: safe	unknown
https://track.hubspot.com/__ptq.gif?k=1&sd=1280x1024&cd=24-bit&cs=UTF-8&ln=en-us&bfp=4285505810&v=1.1&a=20182553&pu=https%3A%2F%2Fcloudfiles.io%2F&t=File+Sharing+Platform+%7C+Share+Documents+Online+%7C+CloudFiles&cts=1663946098472&vi=222eafc23c17f2f1f20b9c762dc2bdcf&nc=true&u=218584006.222eafc23c17f2f1f20b9c762dc2bdcf.1663946098461.1663946098461.1663946098461.1&b=218584006.1.1663946098463&cc=15	false		high
https://cloudfiles.io/images/pages/home/testimonials/5-star-rating.svg	false	Avira URL Cloud: safe	unknown
https://cloudfiles.io/images/pages/home/features/cloud-copy.svg	false	Avira URL Cloud: safe	unknown
https://cloudfiles.io/_next/static/chunks/951-9933cd60a769c984.js	false	Avira URL Cloud: safe	unknown
https://cloudfiles.io/_next/static/chunks/43a99af2-6a652ea0e41564d0.js	false	Avira URL Cloud: safe	unknown
https://cloudfil.es/ly7mR8utBQ5	false		unknown
https://cloudfiles.io/images/pages/home/hero-image.svg	false	Avira URL Cloud: safe	unknown
https://static.hsappstatic.net/head-dlb/static-1.233/bundle.production.js	false	Avira URL Cloud: safe	unknown
https://cloudfiles.io/	false		unknown
https://cloudfil.es/_next/static/chunks/838-e577e7ded876b417.js	false	Avira URL Cloud: safe	unknown
https://cloudfiles.io/_next/static/chunks/b16bd182-2fce6d9e40c8c943.js	false	Avira URL Cloud: safe	unknown
https://cloudfil.es/images/logoWordmark.svg	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.19.155.83	app.hubspot.com	United States	13335	CLOUDFLARENETUS	false
108.177.15.156	stats.l.doubleclick.net	United States	15169	GOOGLEUS	false
95.140.230.217	dmotion.s.llnwi.net	United Kingdom	22822	LLNWUS	false
104.18.33.171	js.hs-banner.com	United States	13335	CLOUDFLARENETUS	false
104.17.213.204	js-na1.hs-scripts.com	United States	13335	CLOUDFLARENETUS	false
157.240.17.35	star-mini.c10r.facebook.com	United States	32934	FACEBOOKUS	false
104.17.239.204	js.usemessages.com	United States	13335	CLOUDFLARENETUS	false
142.250.184.226	googleads.g.doubleclick.net	United States	15169	GOOGLEUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
104.17.6.210	static.hsappstatic.net	United States	13335	CLOUDFLARENETUS	false
76.76.21.21	cloudfil.es	United States	16509	AMAZON-02US	false
104.17.240.204	avatars.hubspot.net	United States	13335	CLOUDFLARENETUS	false
104.21.52.125	unknown	United States	13335	CLOUDFLARENETUS	false
104.19.154.83	track.hubspot.com	United States	13335	CLOUDFLARENETUS	false
172.217.18.8	www-googletagmanager.l.google.com	United States	15169	GOOGLEUS	false
142.250.186.182	i.ytimg.com	United States	15169	GOOGLEUS	false
172.217.18.3	www.google.co.uk	United States	15169	GOOGLEUS	false
142.250.185.110	play.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
104.17.112.176	js.hsadspixel.net	United States	13335	CLOUDFLARENETUS	false
172.217.16.195	gstaticadssl.l.google.com	United States	15169	GOOGLEUS	false
142.250.186.46	clients.l.google.com	United States	15169	GOOGLEUS	false
108.138.32.174	d296je7bbdd650.cloudfront.net	United States	16509	AMAZON-02US	false
142.250.185.166	static-doubleclick-net.l.google.com	United States	15169	GOOGLEUS	false
216.239.32.36	region1.analytics.google.com	United States	15169	GOOGLEUS	false
172.217.23.110	youtube-ui.l.google.com	United States	15169	GOOGLEUS	false
157.240.17.15	scontent.xx.fbcdn.net	United States	32934	FACEBOOKUS	false
142.250.185.164	www.google.com	United States	15169	GOOGLEUS	false
216.58.212.173	accounts.google.com	United States	15169	GOOGLEUS	false
142.250.186.161	photos-ugc.l.googleusercontent.com	United States	15169	GOOGLEUS	false
104.17.202.204	api.hubapi.com	United States	13335	CLOUDFLARENETUS	false
116.203.90.127	cdn.cookie-script.com	Germany	24940	HETZNER-ASDE	false
172.67.199.56	api.cloudfil.es	United States	13335	CLOUDFLARENETUS	false
104.17.69.176	js.hs-analytics.net	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.1
192.168.2.4
192.168.2.5
127.0.0.1

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	708252
Start date and time:	2022-09-23 08:13:19 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://cloudfil.es/ly7mR8utBQ5
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal48.phis.win@53/12@49/38
EGA Information:	Successful, ratio: 100%
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 143 Number of non-executed functions: 3
Cookbook Comments:	Browse: https://cloudfiles.io/

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.163, 34.104.35.123, 142.250.185.234, 80.67.82.235, 80.67.82.240, 13.107.42.14, 216.239.32.178, 216.239.38.178, 216.239.36.178, 216.239.34.178, 142.250.74.194, 142.250.184.202, 142.250.184.234, 172.217.18.10, 172.217.16.138, 172.217.23.106, 172.217.18.106, 142.250.185.74, 142.250.185.106, 142.250.185.138, 142.250.185.170, 142.250.185.202, 142.250.181.234, 172.217.16.202, 216.58.212.170, 142.250.74.202, 151.101.2.137, 151.101.66.137, 151.101.130.137, 151.101.194.137, 162.247.241.2, 142.250.186.131
Excluded domains from analysis (whitelisted): www-linkedin-com.l-0005.l-msedge.net, fonts.googleapis.com, fs.microsoft.com, www.googleadservices.com, fonts.gstatic.com, tls12.newrelic.com.cdn.cloudflare.net, www-alv.google-analytics.com, clientservices.googleapis.com, od.linkedin.edgesuite.net, jnn-pa.googleapis.com, k.sni.global.fastly.net, l-0005.l-msedge.net, edgedl.me.gvt1.com, www.googletagmanager.com, update.googleapis.com, a1916.dscg2.akamai.net, www.google-analytics.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	HTML document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	607486
Entropy (8bit):	5.2236882570919505
Encrypted:	false
SSDEEP:	6144:IgudndlMFDNrPmbRo0oGPmgE+fgx5b1ZugL6kVxV7HX756inXK4C3ambG0OUy5j9:JAWeXE+AIgmmxWina4C3DJOUmzDa7y
MD5:	6C7C272ABC28BF1E856F0B55908EFDF8
SHA1:	C59D77633692929D62CE37C7C505B6B16D93F1DC
SHA-256:	95C9619234E4C0FEB72CD913280552B2DFA9CE6B1B8422FB31696917B880F4ED
SHA-512:	8C31B996DA89C2F5396A9D8EABDDEBF239771B51D5B17E350B9BE9B9EA8EA6C2FF99FF0499F5A5C098AA59BA5CF8740983D27B8F4AE8413C14674736702FD6EA
Malicious:	true
Yara Hits:	Rule: JoeSecurity_HtmlPhish_44, Description: Yara detected HtmlPhish_44, Source: C:\Users\user\AppData\Local\Temp\evppz250.yan\SARS OUTSTANDING LETTER OF DEMAND.html, Author: Joe Security
Reputation:	low
Preview:	<script language=javascript>document.write(unescape('%3Cscript%20language%3Djavascript%3Edocument.write%28unescape%28%27%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%253Chtml%2520xmlns%253D%2522http%253A//www.w3.org/1999/xhtml%2522%253E%250A%253Chead%253E%250A%253Cscript%2520type%253D%2522text/javascript%2522%253Efunction%2520showDiv%2528%2529%2520%257B%2520%2520%2520document.getElementById%2528%2527welcomeDiv%2527%2529.style.display%2520%253D%2520%2522block%2522%253B%2520%2520%2520document.getElementById%2528

C:\Users\user\AppData\Local\Temp\fsnnqwuj.h1e\SARS OUTSTANDING LETTER OF DEMAND.html

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	HTML document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	607486
Entropy (8bit):	5.2236882570919505
Encrypted:	false
SSDEEP:	6144:IgudndlMFDNrPmbRo0oGPmgE+fgx5b1ZugL6kVxV7HX756inXK4C3ambG0OUy5j9:JAWeXE+AIgmmxWina4C3DJOUmzDa7y
MD5:	6C7C272ABC28BF1E856F0B55908EFDF8
SHA1:	C59D77633692929D62CE37C7C505B6B16D93F1DC
SHA-256:	95C9619234E4C0FEB72CD913280552B2DFA9CE6B1B8422FB31696917B880F4ED
SHA-512:	8C31B996DA89C2F5396A9D8EABDDEBF239771B51D5B17E350B9BE9B9EA8EA6C2FF99FF0499F5A5C098AA59BA5CF8740983D27B8F4AE8413C14674736702FD6EA
Malicious:	true
Yara Hits:	Rule: JoeSecurity_HtmlPhish_44, Description: Yara detected HtmlPhish_44, Source: C:\Users\user\AppData\Local\Temp\fsnnqwuj.h1e\SARS OUTSTANDING LETTER OF DEMAND.html, Author: Joe Security
Reputation:	low
Preview:	<script language=javascript>document.write(unescape('%3Cscript%20language%3Djavascript%3Edocument.write%28unescape%28%27%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%253Chtml%2520xmlns%253D%2522http%253A//www.w3.org/1999/xhtml%2522%253E%250A%253Chead%253E%250A%253Cscript%2520type%253D%2522text/javascript%2522%253Efunction%2520showDiv%2528%2529%2520%257B%2520%2520%2520document.getElementById%2528%2527welcomeDiv%2527%2529.style.display%2520%253D%2520%2522block%2522%253B%2520%2520%2520document.getElementById%2528

C:\Users\user\AppData\Local\Temp\oluilyf2.xu4\SARS OUTSTANDING LETTER OF DEMAND.html

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	HTML document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	607486
Entropy (8bit):	5.2236882570919505
Encrypted:	false
SSDEEP:	6144:IgudndlMFDNrPmbRo0oGPmgE+fgx5b1ZugL6kVxV7HX756inXK4C3ambG0OUy5j9:JAWeXE+AIgmmxWina4C3DJOUmzDa7y
MD5:	6C7C272ABC28BF1E856F0B55908EFDF8
SHA1:	C59D77633692929D62CE37C7C505B6B16D93F1DC
SHA-256:	95C9619234E4C0FEB72CD913280552B2DFA9CE6B1B8422FB31696917B880F4ED
SHA-512:	8C31B996DA89C2F5396A9D8EABDDEBF239771B51D5B17E350B9BE9B9EA8EA6C2FF99FF0499F5A5C098AA59BA5CF8740983D27B8F4AE8413C14674736702FD6EA
Malicious:	true
Yara Hits:	Rule: JoeSecurity_HtmlPhish_44, Description: Yara detected HtmlPhish_44, Source: C:\Users\user\AppData\Local\Temp\oluilyf2.xu4\SARS OUTSTANDING LETTER OF DEMAND.html, Author: Joe Security
Reputation:	low
Preview:	<script language=javascript>document.write(unescape('%3Cscript%20language%3Djavascript%3Edocument.write%28unescape%28%27%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%250A%253Chtml%2520xmlns%253D%2522http%253A//www.w3.org/1999/xhtml%2522%253E%250A%253Chead%253E%250A%253Cscript%2520type%253D%2522text/javascript%2522%253Efunction%2520showDiv%2528%2529%2520%257B%2520%2520%2520document.getElementById%2528%2527welcomeDiv%2527%2529.style.display%2520%253D%2520%2522block%2522%253B%2520%2520%2520document.getElementById%2528

C:\Users\user\AppData\Local\Temp\unarchiver.log

Download File

Process:	C:\Windows\SysWOW64\unarchiver.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	4236
Entropy (8bit):	5.232726440512009
Encrypted:	false
SSDEEP:	48:vuvFGTGbTGTGpJGYGTGpvnGbFGGnG7GVGTGOGTGTG0lywbWGTGbTGTGpJGYGTGpz:vQMFsUw4w9FwlUh/F0v
MD5:	4EE4F7492444E8A277AFD31BE256EA59
SHA1:	7DB4767426AA4F6F058339526DD8CE377CB0F586
SHA-256:	92EA0D6D6903C7F8880CDEC5A3B795400381D8F2A5DDDBE88757EAEB88B94472
SHA-512:	0F3C1FAA7124E44A1B9C415A725219398F939C13DCB6FB8AF00B45F47477CFC354F1894C9C25428587C1E18E51FA8DE8CA2AF267C73517F29636728224198ED9
Malicious:	false
Reputation:	low
Preview:	09/23/2022 8:14 AM: Unpack: C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND.zip..09/23/2022 8:15 AM: Tmp dir: C:\Users\user\AppData\Local\Temp\fsnnqwuj.h1e..09/23/2022 8:15 AM: Received from standard out: ..09/23/2022 8:15 AM: Received from standard out: 7-Zip 18.05 (x86) : Copyright (c) 1999-2018 Igor Pavlov : 2018-04-30..09/23/2022 8:15 AM: Received from standard out: ..09/23/2022 8:15 AM: Received from standard out: Scanning the drive for archives:..09/23/2022 8:15 AM: Received from standard out: 1 file, 218624 bytes (214 KiB)..09/23/2022 8:15 AM: Received from standard out: ..09/23/2022 8:15 AM: Received from standard out: Extracting archive: C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND.zip..09/23/2022 8:15 AM: Received from standard out: --..09/23/2022 8:15 AM: Received from standard out: Path = C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND.zip..09/23/2022 8:15 AM: Received from standard out: Type = zip..09/23/2022 8:15 AM: Received from stan

C:\Users\user\Downloads\22e8244c-6e16-464c-801c-35bec625d846.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	7.992671078684705
Encrypted:	true
SSDEEP:	768:U4HB+ZeuYtS2pfJN/DXcT/k1J1/WzzYaHxKA695tdZP+Q9bgJ:U4H2euORdX4/sJ1/8zYaHxKA67BP+RJ
MD5:	F4CDDC3CA6224D9613C1309A94F05FE4
SHA1:	6024DF7345E7A805DDF0D83A2E766B8C8F96F4C1
SHA-256:	00384D0BEC2D3E1BDE76849383B8016C4748D114EE2A2D7E66C97B4D0CF3E16D
SHA-512:	C67DABE92C8E4043E43CF16F8CC6301A8FC499653438C915984C447B1FB300A8C598B428B6F86AF19786A9CCE0171E85D5694378636B321518317AEF32F0FAC5
Malicious:	false
Reputation:	low
Preview:	PK.........Z6U./..RU...D..&...SARS OUTSTANDING LETTER OF DEMAND.html.:Y..Z..e^:.0,v....@....E.e...Mv...b.[-.]}..<.z8.9.yr'3.....O.....-t...^...b...(..R?..UDvf......L. ?`....B.P. .#...xC................xy.t.0X.A.....W..........^.%N]."I...p.3.sG....7.....+....:....J.)"3.........L......\|....\..s&...fj]1....8._..=..,o....$.7b..{........o_.......g.sg.G.......WU.k8.s..=[lh..^.W-O.(.../..I.y....x......}.)rgH..'.r?.z.2........N.l+.K..........9.,.j...._......z?..PO]?....sL..`R..s....k..w...0.<..O`..<.i\D...8......7X.~.d.[...I,.3...C?hnt.........vP.o.L..af..s.'...}#......[..n...a.G.'....Z........D^=..@.g....../....N....e......'N..9..8x q........D./.o...f...Z...g?.\|g.w..nY~../..5..X.y...\|..../......P.S..8.;..D..8....2.C;.G.S...zU_....a.4.........W..V.q.............%?..?.r....F....xr...x.../x../\|.4O...?....,....................).'.....\.....9.!_..?..=.?...^....Id....%2#.......G}.....i>k.>E.....WO.).r..\|...t...z.wV4...@>N.^W...D7.2R...8]9..`..B.

C:\Users\user\Downloads\97f61521-b3dd-4003-bb1c-5ea026c9e45a.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	7.992671078684705
Encrypted:	true
SSDEEP:	768:U4HB+ZeuYtS2pfJN/DXcT/k1J1/WzzYaHxKA695tdZP+Q9bgJ:U4H2euORdX4/sJ1/8zYaHxKA67BP+RJ
MD5:	F4CDDC3CA6224D9613C1309A94F05FE4
SHA1:	6024DF7345E7A805DDF0D83A2E766B8C8F96F4C1
SHA-256:	00384D0BEC2D3E1BDE76849383B8016C4748D114EE2A2D7E66C97B4D0CF3E16D
SHA-512:	C67DABE92C8E4043E43CF16F8CC6301A8FC499653438C915984C447B1FB300A8C598B428B6F86AF19786A9CCE0171E85D5694378636B321518317AEF32F0FAC5
Malicious:	false
Reputation:	low
Preview:	PK.........Z6U./..RU...D..&...SARS OUTSTANDING LETTER OF DEMAND.html.:Y..Z..e^:.0,v....@....E.e...Mv...b.[-.]}..<.z8.9.yr'3.....O.....-t...^...b...(..R?..UDvf......L. ?`....B.P. .#...xC................xy.t.0X.A.....W..........^.%N]."I...p.3.sG....7.....+....:....J.)"3.........L......\|....\..s&...fj]1....8._..=..,o....$.7b..{........o_.......g.sg.G.......WU.k8.s..=[lh..^.W-O.(.../..I.y....x......}.)rgH..'.r?.z.2........N.l+.K..........9.,.j...._......z?..PO]?....sL..`R..s....k..w...0.<..O`..<.i\D...8......7X.~.d.[...I,.3...C?hnt.........vP.o.L..af..s.'...}#......[..n...a.G.'....Z........D^=..@.g....../....N....e......'N..9..8x q........D./.o...f...Z...g?.\|g.w..nY~../..5..X.y...\|..../......P.S..8.;..D..8....2.C;.G.S...zU_....a.4.........W..V.q.............%?..?.r....F....xr...x.../x../\|.4O...?....,....................).'.....\.....9.!_..?..=.?...^....Id....%2#.......G}.....i>k.>E.....WO.).r..\|...t...z.wV4...@>N.^W...D7.2R...8]9..`..B.

C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND (1).zip (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract
Category:	dropped
Size (bytes):	218624
Entropy (8bit):	7.997633897441664
Encrypted:	true
SSDEEP:	6144:Uir/w6o2bJbeM8N39ricj/EkZe1cGDRyKkcWT0n0v:5Do2NbeM8NhiM/EkmTZX0v
MD5:	768A4E2E3787C533A467D3FB433F9BEB
SHA1:	E3EB38314319F27BCA5F17DA7CEB96CA64030894
SHA-256:	3CB16DBD2D8C4D037FB5A6BA58D24CBDC6E82A23021FC0666FE0CAB25AA47E3E
SHA-512:	768740724AADDD9BEF9C4EF0F0CE57CC5316BEC60AE3C956ACAE3E62BF9F99983EC0231C9F487593A8CE4B4BD10927F1F66608F3B24987895E449F8403818CC4
Malicious:	false
Reputation:	low
Preview:	PK.........Z6U./..RU...D..&...SARS OUTSTANDING LETTER OF DEMAND.html.:Y..Z..e^:.0,v....@....E.e...Mv...b.[-.]}..<.z8.9.yr'3.....O.....-t...^...b...(..R?..UDvf......L. ?`....B.P. .#...xC................xy.t.0X.A.....W..........^.%N]."I...p.3.sG....7.....+....:....J.)"3.........L......\|....\..s&...fj]1....8._..=..,o....$.7b..{........o_.......g.sg.G.......WU.k8.s..=[lh..^.W-O.(.../..I.y....x......}.)rgH..'.r?.z.2........N.l+.K..........9.,.j...._......z?..PO]?....sL..`R..s....k..w...0.<..O`..<.i\D...8......7X.~.d.[...I,.3...C?hnt.........vP.o.L..af..s.'...}#......[..n...a.G.'....Z........D^=..@.g....../....N....e......'N..9..8x q........D./.o...f...Z...g?.\|g.w..nY~../..5..X.y...\|..../......P.S..8.;..D..8....2.C;.G.S...zU_....a.4.........W..V.q.............%?..?.r....F....xr...x.../x../\|.4O...?....,....................).'.....\.....9.!_..?..=.?...^....Id....%2#.......G}.....i>k.>E.....WO.).r..\|...t...z.wV4...@>N.^W...D7.2R...8]9..`..B.

C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND (1).zip.crdownload

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract
Category:	dropped
Size (bytes):	218624
Entropy (8bit):	7.997633897441664
Encrypted:	true
SSDEEP:	6144:Uir/w6o2bJbeM8N39ricj/EkZe1cGDRyKkcWT0n0v:5Do2NbeM8NhiM/EkmTZX0v
MD5:	768A4E2E3787C533A467D3FB433F9BEB
SHA1:	E3EB38314319F27BCA5F17DA7CEB96CA64030894
SHA-256:	3CB16DBD2D8C4D037FB5A6BA58D24CBDC6E82A23021FC0666FE0CAB25AA47E3E
SHA-512:	768740724AADDD9BEF9C4EF0F0CE57CC5316BEC60AE3C956ACAE3E62BF9F99983EC0231C9F487593A8CE4B4BD10927F1F66608F3B24987895E449F8403818CC4
Malicious:	false
Reputation:	low
Preview:	PK.........Z6U./..RU...D..&...SARS OUTSTANDING LETTER OF DEMAND.html.:Y..Z..e^:.0,v....@....E.e...Mv...b.[-.]}..<.z8.9.yr'3.....O.....-t...^...b...(..R?..UDvf......L. ?`....B.P. .#...xC................xy.t.0X.A.....W..........^.%N]."I...p.3.sG....7.....+....:....J.)"3.........L......\|....\..s&...fj]1....8._..=..,o....$.7b..{........o_.......g.sg.G.......WU.k8.s..=[lh..^.W-O.(.../..I.y....x......}.)rgH..'.r?.z.2........N.l+.K..........9.,.j...._......z?..PO]?....sL..`R..s....k..w...0.<..O`..<.i\D...8......7X.~.d.[...I,.3...C?hnt.........vP.o.L..af..s.'...}#......[..n...a.G.'....Z........D^=..@.g....../....N....e......'N..9..8x q........D./.o...f...Z...g?.\|g.w..nY~../..5..X.y...\|..../......P.S..8.;..D..8....2.C;.G.S...zU_....a.4.........W..V.q.............%?..?.r....F....xr...x.../x../\|.4O...?....,....................).'.....\.....9.!_..?..=.?...^....Id....%2#.......G}.....i>k.>E.....WO.).r..\|...t...z.wV4...@>N.^W...D7.2R...8]9..`..B.

C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND (2).zip (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract
Category:	dropped
Size (bytes):	218624
Entropy (8bit):	7.997633897441664
Encrypted:	true
SSDEEP:	6144:Uir/w6o2bJbeM8N39ricj/EkZe1cGDRyKkcWT0n0v:5Do2NbeM8NhiM/EkmTZX0v
MD5:	768A4E2E3787C533A467D3FB433F9BEB
SHA1:	E3EB38314319F27BCA5F17DA7CEB96CA64030894
SHA-256:	3CB16DBD2D8C4D037FB5A6BA58D24CBDC6E82A23021FC0666FE0CAB25AA47E3E
SHA-512:	768740724AADDD9BEF9C4EF0F0CE57CC5316BEC60AE3C956ACAE3E62BF9F99983EC0231C9F487593A8CE4B4BD10927F1F66608F3B24987895E449F8403818CC4
Malicious:	false
Reputation:	low
Preview:	PK.........Z6U./..RU...D..&...SARS OUTSTANDING LETTER OF DEMAND.html.:Y..Z..e^:.0,v....@....E.e...Mv...b.[-.]}..<.z8.9.yr'3.....O.....-t...^...b...(..R?..UDvf......L. ?`....B.P. .#...xC................xy.t.0X.A.....W..........^.%N]."I...p.3.sG....7.....+....:....J.)"3.........L......\|....\..s&...fj]1....8._..=..,o....$.7b..{........o_.......g.sg.G.......WU.k8.s..=[lh..^.W-O.(.../..I.y....x......}.)rgH..'.r?.z.2........N.l+.K..........9.,.j...._......z?..PO]?....sL..`R..s....k..w...0.<..O`..<.i\D...8......7X.~.d.[...I,.3...C?hnt.........vP.o.L..af..s.'...}#......[..n...a.G.'....Z........D^=..@.g....../....N....e......'N..9..8x q........D./.o...f...Z...g?.\|g.w..nY~../..5..X.y...\|..../......P.S..8.;..D..8....2.C;.G.S...zU_....a.4.........W..V.q.............%?..?.r....F....xr...x.../x../\|.4O...?....,....................).'.....\.....9.!_..?..=.?...^....Id....%2#.......G}.....i>k.>E.....WO.).r..\|...t...z.wV4...@>N.^W...D7.2R...8]9..`..B.

C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND (2).zip.crdownload

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract
Category:	dropped
Size (bytes):	218624
Entropy (8bit):	7.997633897441664
Encrypted:	true
SSDEEP:	6144:Uir/w6o2bJbeM8N39ricj/EkZe1cGDRyKkcWT0n0v:5Do2NbeM8NhiM/EkmTZX0v
MD5:	768A4E2E3787C533A467D3FB433F9BEB
SHA1:	E3EB38314319F27BCA5F17DA7CEB96CA64030894
SHA-256:	3CB16DBD2D8C4D037FB5A6BA58D24CBDC6E82A23021FC0666FE0CAB25AA47E3E
SHA-512:	768740724AADDD9BEF9C4EF0F0CE57CC5316BEC60AE3C956ACAE3E62BF9F99983EC0231C9F487593A8CE4B4BD10927F1F66608F3B24987895E449F8403818CC4
Malicious:	false
Reputation:	low
Preview:	PK.........Z6U./..RU...D..&...SARS OUTSTANDING LETTER OF DEMAND.html.:Y..Z..e^:.0,v....@....E.e...Mv...b.[-.]}..<.z8.9.yr'3.....O.....-t...^...b...(..R?..UDvf......L. ?`....B.P. .#...xC................xy.t.0X.A.....W..........^.%N]."I...p.3.sG....7.....+....:....J.)"3.........L......\|....\..s&...fj]1....8._..=..,o....$.7b..{........o_.......g.sg.G.......WU.k8.s..=[lh..^.W-O.(.../..I.y....x......}.)rgH..'.r?.z.2........N.l+.K..........9.,.j...._......z?..PO]?....sL..`R..s....k..w...0.<..O`..<.i\D...8......7X.~.d.[...I,.3...C?hnt.........vP.o.L..af..s.'...}#......[..n...a.G.'....Z........D^=..@.g....../....N....e......'N..9..8x q........D./.o...f...Z...g?.\|g.w..nY~../..5..X.y...\|..../......P.S..8.;..D..8....2.C;.G.S...zU_....a.4.........W..V.q.............%?..?.r....F....xr...x.../x../\|.4O...?....,....................).'.....\.....9.!_..?..=.?...^....Id....%2#.......G}.....i>k.>E.....WO.).r..\|...t...z.wV4...@>N.^W...D7.2R...8]9..`..B.

C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND.zip (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract
Category:	dropped
Size (bytes):	218624
Entropy (8bit):	7.997633897441664
Encrypted:	true
SSDEEP:	6144:Uir/w6o2bJbeM8N39ricj/EkZe1cGDRyKkcWT0n0v:5Do2NbeM8NhiM/EkmTZX0v
MD5:	768A4E2E3787C533A467D3FB433F9BEB
SHA1:	E3EB38314319F27BCA5F17DA7CEB96CA64030894
SHA-256:	3CB16DBD2D8C4D037FB5A6BA58D24CBDC6E82A23021FC0666FE0CAB25AA47E3E
SHA-512:	768740724AADDD9BEF9C4EF0F0CE57CC5316BEC60AE3C956ACAE3E62BF9F99983EC0231C9F487593A8CE4B4BD10927F1F66608F3B24987895E449F8403818CC4
Malicious:	false
Reputation:	low
Preview:	PK.........Z6U./..RU...D..&...SARS OUTSTANDING LETTER OF DEMAND.html.:Y..Z..e^:.0,v....@....E.e...Mv...b.[-.]}..<.z8.9.yr'3.....O.....-t...^...b...(..R?..UDvf......L. ?`....B.P. .#...xC................xy.t.0X.A.....W..........^.%N]."I...p.3.sG....7.....+....:....J.)"3.........L......\|....\..s&...fj]1....8._..=..,o....$.7b..{........o_.......g.sg.G.......WU.k8.s..=[lh..^.W-O.(.../..I.y....x......}.)rgH..'.r?.z.2........N.l+.K..........9.,.j...._......z?..PO]?....sL..`R..s....k..w...0.<..O`..<.i\D...8......7X.~.d.[...I,.3...C?hnt.........vP.o.L..af..s.'...}#......[..n...a.G.'....Z........D^=..@.g....../....N....e......'N..9..8x q........D./.o...f...Z...g?.\|g.w..nY~../..5..X.y...\|..../......P.S..8.;..D..8....2.C;.G.S...zU_....a.4.........W..V.q.............%?..?.r....F....xr...x.../x../\|.4O...?....,....................).'.....\.....9.!_..?..=.?...^....Id....%2#.......G}.....i>k.>E.....WO.).r..\|...t...z.wV4...@>N.^W...D7.2R...8]9..`..B.

C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND.zip.crdownload

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract
Category:	dropped
Size (bytes):	218624
Entropy (8bit):	7.997633897441664
Encrypted:	true
SSDEEP:	6144:Uir/w6o2bJbeM8N39ricj/EkZe1cGDRyKkcWT0n0v:5Do2NbeM8NhiM/EkmTZX0v
MD5:	768A4E2E3787C533A467D3FB433F9BEB
SHA1:	E3EB38314319F27BCA5F17DA7CEB96CA64030894
SHA-256:	3CB16DBD2D8C4D037FB5A6BA58D24CBDC6E82A23021FC0666FE0CAB25AA47E3E
SHA-512:	768740724AADDD9BEF9C4EF0F0CE57CC5316BEC60AE3C956ACAE3E62BF9F99983EC0231C9F487593A8CE4B4BD10927F1F66608F3B24987895E449F8403818CC4
Malicious:	false
Reputation:	low
Preview:	PK.........Z6U./..RU...D..&...SARS OUTSTANDING LETTER OF DEMAND.html.:Y..Z..e^:.0,v....@....E.e...Mv...b.[-.]}..<.z8.9.yr'3.....O.....-t...^...b...(..R?..UDvf......L. ?`....B.P. .#...xC................xy.t.0X.A.....W..........^.%N]."I...p.3.sG....7.....+....:....J.)"3.........L......\|....\..s&...fj]1....8._..=..,o....$.7b..{........o_.......g.sg.G.......WU.k8.s..=[lh..^.W-O.(.../..I.y....x......}.)rgH..'.r?.z.2........N.l+.K..........9.,.j...._......z?..PO]?....sL..`R..s....k..w...0.<..O`..<.i\D...8......7X.~.d.[...I,.3...C?hnt.........vP.o.L..af..s.'...}#......[..n...a.G.'....Z........D^=..@.g....../....N....e......'N..9..8x q........D./.o...f...Z...g?.\|g.w..nY~../..5..X.y...\|..../......P.S..8.;..D..8....2.C;.G.S...zU_....a.4.........W..V.q.............%?..?.r....F....xr...x.../x../\|.4O...?....,....................).'.....\.....9.!_..?..=.?...^....Id....%2#.......G}.....i>k.>E.....WO.).r..\|...t...z.wV4...@>N.^W...D7.2R...8]9..`..B.

Target ID:	0
Start time:	08:14:15
Start date:	23/09/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Imagebase:	0x7ff614650000
File size:	2851656 bytes
MD5 hash:	0FEC2748F363150DC54C1CAFFB1A9408
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Target ID:	1
Start time:	08:14:17
Start date:	23/09/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1936 --field-trial-handle=1772,i,13935456055298204775,6851687727719502408,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff614650000
File size:	2851656 bytes
MD5 hash:	0FEC2748F363150DC54C1CAFFB1A9408
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Target ID:	2
Start time:	08:14:18
Start date:	23/09/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" "https://cloudfil.es/ly7mR8utBQ5
Imagebase:	0x7ff614650000
File size:	2851656 bytes
MD5 hash:	0FEC2748F363150DC54C1CAFFB1A9408
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Target ID:	12
Start time:	08:14:55
Start date:	23/09/2022
Path:	C:\Windows\SysWOW64\unarchiver.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND.zip
Imagebase:	0xd60000
File size:	13312 bytes
MD5 hash:	9DE2E060A2985A232D8B96F9EC847A19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low

Show Windows behavior

Target ID:	13
Start time:	08:14:57
Start date:	23/09/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3636 --field-trial-handle=1772,i,13935456055298204775,6851687727719502408,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff614650000
File size:	2851656 bytes
MD5 hash:	0FEC2748F363150DC54C1CAFFB1A9408
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Target ID:	14
Start time:	08:14:58
Start date:	23/09/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6236 --field-trial-handle=1772,i,13935456055298204775,6851687727719502408,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff614650000
File size:	2851656 bytes
MD5 hash:	0FEC2748F363150DC54C1CAFFB1A9408
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Target ID:	15
Start time:	08:15:03
Start date:	23/09/2022
Path:	C:\Windows\SysWOW64\7za.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\fsnnqwuj.h1e" "C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND.zip
Imagebase:	0x830000
File size:	289792 bytes
MD5 hash:	77E556CDFDC5C592F5C46DB4127C6F4C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Target ID:	16
Start time:	08:15:04
Start date:	23/09/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Target ID:	17
Start time:	08:15:33
Start date:	23/09/2022
Path:	C:\Windows\SysWOW64\unarchiver.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND (1).zip
Imagebase:	0x620000
File size:	13312 bytes
MD5 hash:	9DE2E060A2985A232D8B96F9EC847A19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low

Show Windows behavior

Target ID:	18
Start time:	08:15:34
Start date:	23/09/2022
Path:	C:\Windows\SysWOW64\7za.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\oluilyf2.xu4" "C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND (1).zip
Imagebase:	0x830000
File size:	289792 bytes
MD5 hash:	77E556CDFDC5C592F5C46DB4127C6F4C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Target ID:	19
Start time:	08:15:36
Start date:	23/09/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Target ID:	20
Start time:	08:15:51
Start date:	23/09/2022
Path:	C:\Windows\SysWOW64\unarchiver.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND (2).zip
Imagebase:	0xbb0000
File size:	13312 bytes
MD5 hash:	9DE2E060A2985A232D8B96F9EC847A19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low

Show Windows behavior

Target ID:	23
Start time:	08:15:53
Start date:	23/09/2022
Path:	C:\Windows\SysWOW64\7za.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\evppz250.yan" "C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND (2).zip
Imagebase:	0x830000
File size:	289792 bytes
MD5 hash:	77E556CDFDC5C592F5C46DB4127C6F4C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Target ID:	24
Start time:	08:15:55
Start date:	23/09/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Execution Graph

Execution Coverage:	16.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	4.8%
Total number of Nodes:	83
Total number of Limit Nodes:	5

Executed Functions

Function 030202C8 Relevance: 4.6, Strings: 3, Instructions: 892
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0ryq, xrefs: 030208F6
0ryq, xrefs: 030208E0
m]-q^, xrefs: 03020387, 0302038C

Memory Dump Source

Source File: 0000000C.00000002.421231526.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3020000_unarchiver.jbxd

Similarity

API ID:
String ID: 0ryq$0ryq$m]-q^
API String ID: 0-3117093105
Opcode ID: 020f0a47b73e86a0aefd5ff576b738d8af97f9fc425584a2edcb2f9a2a3b065b
Instruction ID: 51dc7ca6331531b8c691381668f1dc4b9e8b3b1a00f497bf88737aa7714b85ac
Opcode Fuzzy Hash: 020f0a47b73e86a0aefd5ff576b738d8af97f9fc425584a2edcb2f9a2a3b065b
Instruction Fuzzy Hash: 3092F274A01228CFDB64CF64C848BAEBBB6FB89305F1095E9D509AB354CB359E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0165B1D6 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(?), ref: 0165B208

Memory Dump Source

Source File: 0000000C.00000002.420941116.000000000165A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0165A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_165a000_unarchiver.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: db1249e31e5bda946df6843c33dd1c384f084c3c9a599cbfefd06b1a33f6f0de
Instruction ID: 04275c745ec39a5a75978ffe727332834e5aa5286ac17db7271fa4f8d0e853a2
Opcode Fuzzy Hash: db1249e31e5bda946df6843c33dd1c384f084c3c9a599cbfefd06b1a33f6f0de
Instruction Fuzzy Hash: C501AD308042409FDB50CF19EC8576AFBA4EF04220F18C4ABDD488F206D279A408CB72

Uniqueness

Uniqueness Score: -1.00%

Function 0165B246 Relevance: 1.6, APIs: 1, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E2C), ref: 0165B2F3

Memory Dump Source

Source File: 0000000C.00000002.420941116.000000000165A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0165A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_165a000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: a2429d41c26c2e8ae4b8b5a77ff7f1db37ddebf2b453832c3200690b56bd3e61
Instruction ID: efbdd20f7758d502e7509953ef1c23cec7990d1125496b3b246de03c765f404e
Opcode Fuzzy Hash: a2429d41c26c2e8ae4b8b5a77ff7f1db37ddebf2b453832c3200690b56bd3e61
Instruction Fuzzy Hash: 0E31C471404344AFEB128B65DC44FA7BFACEF06310F0888AAED85DB162D375A919CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0165AD04 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E2C), ref: 0165ADA7

Memory Dump Source

Source File: 0000000C.00000002.420941116.000000000165A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0165A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_165a000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: e0937cbbbcd28bf6b9859d23b80f9511a614ad14173bfc8c5c06401b6323fb50
Instruction ID: 2a5253e590f3bffa027fca10f1446c7236c3650dbc4153459f9cec38f048bc40
Opcode Fuzzy Hash: e0937cbbbcd28bf6b9859d23b80f9511a614ad14173bfc8c5c06401b6323fb50
Instruction Fuzzy Hash: FF31B3721443846FEB228B65DC44FA7BFACEF05310F0889AEED85DB152D224A519CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0165AB76 Relevance: 1.6, APIs: 1, Instructions: 93
pipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreatePipe.KERNELBASE(?,00000E2C,?,?), ref: 0165AC36

Memory Dump Source

Source File: 0000000C.00000002.420941116.000000000165A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0165A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_165a000_unarchiver.jbxd

Similarity

API ID: CreatePipe
String ID:
API String ID: 2719314638-0
Opcode ID: 6078093f0fec2ebb6228a559518a86b6df6d6dd2e7be6e7349fc940d31ef022f
Instruction ID: 77c103930a28aca6bd2fef93be137efdc057a1b4d59b7f177213b075cc60b660
Opcode Fuzzy Hash: 6078093f0fec2ebb6228a559518a86b6df6d6dd2e7be6e7349fc940d31ef022f
Instruction Fuzzy Hash: 6B318C6250E7C06FD3138B758C61AA2BFB4AF47610F1D84DBD8C48F1A3D268A919C776

Uniqueness

Uniqueness Score: -1.00%

Function 0165A4E8 Relevance: 1.6, APIs: 1, Instructions: 90
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 0165A589

Memory Dump Source

Source File: 0000000C.00000002.420941116.000000000165A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0165A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_165a000_unarchiver.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: a213c20252b9432011c9f0c90166b80c2b708e5dd8b2ba5678d4f8033bebe107
Instruction ID: 0eb8d181ab3061f35ac8f9d47a75e760459f97bbd6bd0c439d8af30af5df4894
Opcode Fuzzy Hash: a213c20252b9432011c9f0c90166b80c2b708e5dd8b2ba5678d4f8033bebe107
Instruction Fuzzy Hash: 7B318971504380AFE722CB69CC44F66BFE8EF05220F0885AEED858B252D375E908CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0165A120 Relevance: 1.6, APIs: 1, Instructions: 84
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindNextFileW.KERNELBASE(?,00000E2C,?,?), ref: 0165A1C2

Memory Dump Source

Source File: 0000000C.00000002.420941116.000000000165A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0165A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_165a000_unarchiver.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: bc26b5df28327714c5aa122575cda0c112c1a9f813d7efa2583f3325ff2ee8b6
Instruction ID: 1bcb03b71a0244262aa961e155d0325646e2791209245442a497901e5dd8d950
Opcode Fuzzy Hash: bc26b5df28327714c5aa122575cda0c112c1a9f813d7efa2583f3325ff2ee8b6
Instruction Fuzzy Hash: 9131A07140D7C06FD3128B758C51B62BFB4EF47620F1985DBDD848F293D225A919CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0165A9EC Relevance: 1.6, APIs: 1, Instructions: 82
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E2C,06F765DF,00000000,00000000,00000000,00000000), ref: 0165AA8C

Memory Dump Source

Source File: 0000000C.00000002.420941116.000000000165A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0165A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_165a000_unarchiver.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: fa7108291c3ec4a01e2d6a44073cbd9741adf861a6b4c12326bb80839dbdcfce
Instruction ID: d4a7d9e0cbb9fb2b52abde52efb5425ede9f3d1dccadbb04121269d37d0acf4a
Opcode Fuzzy Hash: fa7108291c3ec4a01e2d6a44073cbd9741adf861a6b4c12326bb80839dbdcfce
Instruction Fuzzy Hash: 7A217E72504744AFE721CB69DC44FA3BBB8EF05710F08859AED85DB252D364E948CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0165B276 Relevance: 1.6, APIs: 1, Instructions: 80
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E2C), ref: 0165B2F3

Memory Dump Source

Source File: 0000000C.00000002.420941116.000000000165A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0165A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_165a000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: e9833b921abf5fd3357b64810d9cbdfe22621dd3987d8a94d7194dcd779c5959
Instruction ID: dc272cba1230e0d9179feb21a4cb445cbf5da6648cde00ca60dbbea51753f05d
Opcode Fuzzy Hash: e9833b921abf5fd3357b64810d9cbdfe22621dd3987d8a94d7194dcd779c5959
Instruction Fuzzy Hash: C921D671500204AFEB218F65DC45F6BFBACEF04310F04896AED85DB251D671E5088BB1

Uniqueness

Uniqueness Score: -1.00%

Function 0165AD2A Relevance: 1.6, APIs: 1, Instructions: 80
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E2C), ref: 0165ADA7

Memory Dump Source

Source File: 0000000C.00000002.420941116.000000000165A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0165A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_165a000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 7bd05e4c06f79da39b56e4cec585151b3fb4cb3e22fb4c12dffece92d128b75f
Instruction ID: cda426a714767e0da9b1473c40210728e9e760815cc97ed48779a51dd8ff8f7b
Opcode Fuzzy Hash: 7bd05e4c06f79da39b56e4cec585151b3fb4cb3e22fb4c12dffece92d128b75f
Instruction Fuzzy Hash: 3F21D372500204AFEB219F69DC44FABFBACEF04324F18896AED45DB251D670E548CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 0165A75C Relevance: 1.6, APIs: 1, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNELBASE(?,00000E2C,06F765DF,00000000,00000000,00000000,00000000), ref: 0165A7EA

Memory Dump Source

Source File: 0000000C.00000002.420941116.000000000165A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0165A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_165a000_unarchiver.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 896c50cc54e03d4205870d6e7979ca8580f59cf6d4e5514df5283dc74b3ad08e
Instruction ID: b44eb006ea441161f798a06ee63a0fdebfe88544e9fd4e2d8cb333afe66ba36a
Opcode Fuzzy Hash: 896c50cc54e03d4205870d6e7979ca8580f59cf6d4e5514df5283dc74b3ad08e
Instruction Fuzzy Hash: 502192714083806FE7128B64DC40F66BFA8EF46714F0984AAED849F253D264A909C772

Uniqueness

Uniqueness Score: -1.00%

Function 0165A83F Relevance: 1.6, APIs: 1, Instructions: 77
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000E2C,06F765DF,00000000,00000000,00000000,00000000), ref: 0165A8CD

Memory Dump Source

Source File: 0000000C.00000002.420941116.000000000165A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0165A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_165a000_unarchiver.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: d357ae8560300ad9981b5e370cff4378abc486f02ad78c8d04f6ce569c025f9d
Instruction ID: 37f0a5650939906c3c912f341043b4e9316e44da41041f7350929f0c8e7237fb
Opcode Fuzzy Hash: d357ae8560300ad9981b5e370cff4378abc486f02ad78c8d04f6ce569c025f9d
Instruction Fuzzy Hash: 2821AE71009380AFDB228F65DC54F96BFB8EF46310F08889BE9849F252C265A508CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0165A50A Relevance: 1.6, APIs: 1, Instructions: 76
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 0165A589

Memory Dump Source

Source File: 0000000C.00000002.420941116.000000000165A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0165A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_165a000_unarchiver.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 3388ef21b63890011977b137ad4f8149247248b8320e671153b2a69ace8fa1f1
Instruction ID: 61f3769220a8617369d59b56aa525f3857bc83181bd0b02d2a742fc567137ffb
Opcode Fuzzy Hash: 3388ef21b63890011977b137ad4f8149247248b8320e671153b2a69ace8fa1f1
Instruction Fuzzy Hash: BC219C71500240AFEB21CF69CD44F66FBE8EF04314F18856AED858B252D771E504CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0165B737 Relevance: 1.6, APIs: 1, Instructions: 74
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnumThreadWindows.USER32(?,00000E2C,?,?), ref: 0165B7D6

Memory Dump Source

Source File: 0000000C.00000002.420941116.000000000165A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0165A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_165a000_unarchiver.jbxd

Similarity

API ID: EnumThreadWindows
String ID:
API String ID: 2941952884-0
Opcode ID: 10fc81135ed56e0b42b34406c34bfd320be80859863df4ae30418f18ebce7221
Instruction ID: d5a317ac451fbe9fcdeec6fee65583cdaf07192c9f7e5ac90fb1a3811cfb5bbb
Opcode Fuzzy Hash: 10fc81135ed56e0b42b34406c34bfd320be80859863df4ae30418f18ebce7221
Instruction Fuzzy Hash: F121627154E7C06FD3138B258C55A22BFB4EF47610F0A81DFD8848B5A3D228A919C7B2

Uniqueness

Uniqueness Score: -1.00%

Function 0165A69B Relevance: 1.6, APIs: 1, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNELBASE(?,00000E2C,06F765DF,00000000,00000000,00000000,00000000), ref: 0165A721

Memory Dump Source

Source File: 0000000C.00000002.420941116.000000000165A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0165A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_165a000_unarchiver.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: d8104130350c38c529300f869f27334550a88c85ece1ed5fb09b042c6b793666
Instruction ID: b64a9837d916225afe502bb33d8226b658acbcf410e606ad4dcbaa5ebf6578d4
Opcode Fuzzy Hash: d8104130350c38c529300f869f27334550a88c85ece1ed5fb09b042c6b793666
Instruction Fuzzy Hash: 7321D5B54087806FE7128B65DC51BA2BFBCDF47724F1880DBED849B293D264A909C772

Uniqueness

Uniqueness Score: -1.00%

Function 0165A917 Relevance: 1.6, APIs: 1, Instructions: 70
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(?,?), ref: 0165A997

Memory Dump Source

Source File: 0000000C.00000002.420941116.000000000165A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0165A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_165a000_unarchiver.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: b8c18a4b1aaf01e504ad04ac407d07c4ce41aa7a1a27f9290a7e81d3b7548799
Instruction ID: 6925fe5cb61eef201d9fa9e9579ab0ae469e1dc70bc5557eb6c41e6170773cb3
Opcode Fuzzy Hash: b8c18a4b1aaf01e504ad04ac407d07c4ce41aa7a1a27f9290a7e81d3b7548799
Instruction Fuzzy Hash: 7321AF765083C45FE712CB69DC55B92BFE8AF06214F0980EADD84CF253D324D949CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0165B5BD Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0165B63E

Memory Dump Source

Source File: 0000000C.00000002.420941116.000000000165A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0165A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_165a000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 9d89d18dfbed891dcc9410e04dd599e9a0b63149c84ad83e170c227bf7a847ff
Instruction ID: dd66979adb838cf02a4f378536e8df97ac911c0b25205b5d591251bccc008dd1
Opcode Fuzzy Hash: 9d89d18dfbed891dcc9410e04dd599e9a0b63149c84ad83e170c227bf7a847ff
Instruction Fuzzy Hash: 9121A1724093C0AFDB138F64DC50A52BFB5EF46210F0C84DAED848B163D2759518CB72

Uniqueness

Uniqueness Score: -1.00%

Function 0165AA12 Relevance: 1.6, APIs: 1, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E2C,06F765DF,00000000,00000000,00000000,00000000), ref: 0165AA8C

Memory Dump Source

Source File: 0000000C.00000002.420941116.000000000165A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0165A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_165a000_unarchiver.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 87ffdcc15c69653a87c60dd788dc9227da98bcdde7e530cdba658f98e91fc539
Instruction ID: 0b462944863542a5ab3bd2d350ccbfaa5cc9b3aa63d4b239d50a6081b4e7fb81
Opcode Fuzzy Hash: 87ffdcc15c69653a87c60dd788dc9227da98bcdde7e530cdba658f98e91fc539
Instruction Fuzzy Hash: FE218E71600604AFE761CF59CD84FA7BBECEF04710F08856AEE459B351D760E908CA72

Uniqueness

Uniqueness Score: -1.00%

Function 0165A5E0 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 0165A654

Memory Dump Source

Source File: 0000000C.00000002.420941116.000000000165A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0165A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_165a000_unarchiver.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 38635129387175df30336ef6a7de063c969f3c4814b7dd93183459b6b75b5b04
Instruction ID: 78fec1228d492cbb37045274d6843ca76ba6019be5498466d721593446ab1b52
Opcode Fuzzy Hash: 38635129387175df30336ef6a7de063c969f3c4814b7dd93183459b6b75b5b04
Instruction Fuzzy Hash: 0321C2758097C05FD7138B29DC95752BFB4AF43220F0980DBDC858F6A3D2649908C7B2

Uniqueness

Uniqueness Score: -1.00%

Function 0165A86E Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,00000E2C,06F765DF,00000000,00000000,00000000,00000000), ref: 0165A8CD

Memory Dump Source

Source File: 0000000C.00000002.420941116.000000000165A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0165A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_165a000_unarchiver.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: cbdd2c106ece499dc3c1083d1956bb17dc12c0ef5cb4788b963aee2515e9e187
Instruction ID: 27179543c7368edbbe830482452bdb61d0481336cb2e200afa9c5b56c8d166a2
Opcode Fuzzy Hash: cbdd2c106ece499dc3c1083d1956bb17dc12c0ef5cb4788b963aee2515e9e187
Instruction Fuzzy Hash: 9C11C471400600EFEB21CF59DC40FA6FBA8EF04714F18856BED459B251D675A509CB72

Uniqueness

Uniqueness Score: -1.00%

Function 0165B800 Relevance: 1.6, APIs: 1, Instructions: 59windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(?,?,?,?), ref: 0165B86D

Memory Dump Source

Source File: 0000000C.00000002.420941116.000000000165A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0165A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_165a000_unarchiver.jbxd

Similarity

API ID: Message
String ID:
API String ID: 2030045667-0
Opcode ID: 410ff33172115b7a3e7f8bd4a47b7b3869d50194946aadded06a46bdcf7e61bf
Instruction ID: 80579522c26d2e591ecc3481cf54e8a346c9984cf3cf62ab14a4306dc4b5c25d
Opcode Fuzzy Hash: 410ff33172115b7a3e7f8bd4a47b7b3869d50194946aadded06a46bdcf7e61bf
Instruction Fuzzy Hash: 0D119DB1504380AFEB228F19DC45B22FFB8EF45624F09849EED859B253D361E908CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0165A78E Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,00000E2C,06F765DF,00000000,00000000,00000000,00000000), ref: 0165A7EA

Memory Dump Source

Source File: 0000000C.00000002.420941116.000000000165A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0165A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_165a000_unarchiver.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 8e7ae633ec8b175e6041c3f89469bf442fdbd841d55a4f87484b305cc1aeb6ca
Instruction ID: e47b9d2aa3ed926ad4e4194da021409e60a902bad2638850cea0f95732e466dd
Opcode Fuzzy Hash: 8e7ae633ec8b175e6041c3f89469bf442fdbd841d55a4f87484b305cc1aeb6ca
Instruction Fuzzy Hash: E011E371400200AFEB21CF59DC80FA6FBA8EF44724F18856BED459B241D674A409CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 0165A2AE Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 0165A30C

Memory Dump Source

Source File: 0000000C.00000002.420941116.000000000165A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0165A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_165a000_unarchiver.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: c684c2bb14b368f6816757df6e0bd7d468234b8816065aa066e7ca1d97ef1a3d
Instruction ID: 60207e6c5ee1f7a1708c7d7ffc566e274b6f1eea256e33344dbe271736cd5c93
Opcode Fuzzy Hash: c684c2bb14b368f6816757df6e0bd7d468234b8816065aa066e7ca1d97ef1a3d
Instruction Fuzzy Hash: E611A0754093C09FD7238B25DC95A52BFB4DF07224F0D81DBDD848F263D265A948CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0165A6CE Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E2C,06F765DF,00000000,00000000,00000000,00000000), ref: 0165A721

Memory Dump Source

Source File: 0000000C.00000002.420941116.000000000165A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0165A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_165a000_unarchiver.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: a851f52bbd4449689949adc6219efcde691c07d66b13b4acde8deb752fddf553
Instruction ID: 52de06f4769d78ae469c10d5863b2f4beb50db9438d69f45f92447a23eceb93c
Opcode Fuzzy Hash: a851f52bbd4449689949adc6219efcde691c07d66b13b4acde8deb752fddf553
Instruction Fuzzy Hash: 6701D275500200AFE720CB59DC85FB6FBACDF44724F1881ABEE459B346D674A5088AB2

Uniqueness

Uniqueness Score: -1.00%

Function 0165A952 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,?), ref: 0165A997

Memory Dump Source

Source File: 0000000C.00000002.420941116.000000000165A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0165A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_165a000_unarchiver.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 07d6b3b3aa0d38b9867e53a455daf93e7c31ca60ceed17bebcd7ad234e0d31ba
Instruction ID: f89105b76d529a6e30be9e915c096066e12c9584db73debbcd319c8caaf383d5
Opcode Fuzzy Hash: 07d6b3b3aa0d38b9867e53a455daf93e7c31ca60ceed17bebcd7ad234e0d31ba
Instruction Fuzzy Hash: 67118E796042449FEB50CF69DC84766FBE8EF04220F08C5AADD49CB246D774E444CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0165B1B4 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(?), ref: 0165B208

Memory Dump Source

Source File: 0000000C.00000002.420941116.000000000165A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0165A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_165a000_unarchiver.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 7e059c0c4bf2aa3c6a7e6fe452085036be7daad26d08aa3fe96d883bb25840b3
Instruction ID: 6210c9a3d31ab812967c03c3b9a46c1f1c16f365cb3edecbe33eb4bb8e58d635
Opcode Fuzzy Hash: 7e059c0c4bf2aa3c6a7e6fe452085036be7daad26d08aa3fe96d883bb25840b3
Instruction Fuzzy Hash: 8F117071409380AFD7128F25DC85B56FFB4DF46220F1884EBED849F253D275A948CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0165AF8B Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(?), ref: 0165AFE4

Memory Dump Source

Source File: 0000000C.00000002.420941116.000000000165A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0165A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_165a000_unarchiver.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: a34acb3a0e117eb3ce96b3090834a0076391d8c8c84cbbc77a5a78f65570e5a3
Instruction ID: b730498b0de260dc32880d19be8dab9ce297cdd7e9d333cc926f076554f1f1ce
Opcode Fuzzy Hash: a34acb3a0e117eb3ce96b3090834a0076391d8c8c84cbbc77a5a78f65570e5a3
Instruction Fuzzy Hash: 3E119E755093809FD7128B29DC85B52BFB4EF06220F0D84EBED858B263D365A848DB62

Uniqueness

Uniqueness Score: -1.00%

Function 0165ABE6 Relevance: 1.5, APIs: 1, Instructions: 47pipeCOMMON

Download Yara Rule

APIs

CreatePipe.KERNELBASE(?,00000E2C,?,?), ref: 0165AC36

Memory Dump Source

Source File: 0000000C.00000002.420941116.000000000165A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0165A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_165a000_unarchiver.jbxd

Similarity

API ID: CreatePipe
String ID:
API String ID: 2719314638-0
Opcode ID: 12d983419c76077ab440c1d002f48b854e8d89616fa2edb1f35196b0d872b274
Instruction ID: 05747abc35e22342367d3594617524acb5e66b80ece07e115402fda53a439164
Opcode Fuzzy Hash: 12d983419c76077ab440c1d002f48b854e8d89616fa2edb1f35196b0d872b274
Instruction Fuzzy Hash: 5201D471540600ABD310DF1ADC82B26FBA8FB88B20F14812AED088B745D335F915CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 0165A172 Relevance: 1.5, APIs: 1, Instructions: 47fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNELBASE(?,00000E2C,?,?), ref: 0165A1C2

Memory Dump Source

Source File: 0000000C.00000002.420941116.000000000165A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0165A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_165a000_unarchiver.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: e9f54456e9723e1526c4e870652641a68ce93ce2be5b926535c0683d54f63594
Instruction ID: 57a51a3b9bce2fee266ef5329fbd880c32d9bda08f7266c38ff04294bef38b01
Opcode Fuzzy Hash: e9f54456e9723e1526c4e870652641a68ce93ce2be5b926535c0683d54f63594
Instruction Fuzzy Hash: 5501D471540600ABD710DF1ADC82B26FBA8FB88B20F14816AED088B745D335F915CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 0165B822 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(?,?,?,?), ref: 0165B86D

Memory Dump Source

Source File: 0000000C.00000002.420941116.000000000165A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0165A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_165a000_unarchiver.jbxd

Similarity

API ID: Message
String ID:
API String ID: 2030045667-0
Opcode ID: 0af4e6c33ac9edb837ea0b6602e20be0444274e4f15b6e0c543ad11847feb5f5
Instruction ID: 45feae68fe2c84dc19c11ace1f8a2a7ba329839aa18704859e291155a5a4ba97
Opcode Fuzzy Hash: 0af4e6c33ac9edb837ea0b6602e20be0444274e4f15b6e0c543ad11847feb5f5
Instruction Fuzzy Hash: 0C018C75A006009FEB60CF1ADC85B22FBA8EF04620F08949ADD458B356D371E408CA72

Uniqueness

Uniqueness Score: -1.00%

Function 0165B5FA Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0165B63E

Memory Dump Source

Source File: 0000000C.00000002.420941116.000000000165A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0165A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_165a000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 64e59c01d3d5d3527992a23aec1f883160be95b6b3f2edc4c92e5590f0619771
Instruction ID: 143e6de7bcfcd57de53eaf9060c3bca3aeae2bb535d3220b6a88cc7129da7b8e
Opcode Fuzzy Hash: 64e59c01d3d5d3527992a23aec1f883160be95b6b3f2edc4c92e5590f0619771
Instruction Fuzzy Hash: C6015B31400600DFDB618F59D844B66FBE5EF48720F0889AADD894B656C376A418DF72

Uniqueness

Uniqueness Score: -1.00%

Function 0165A622 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 0165A654

Memory Dump Source

Source File: 0000000C.00000002.420941116.000000000165A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0165A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_165a000_unarchiver.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: fb49e4551c68de2bdee1736dbcb1cb2e87fc5148f4589653ede1a157ed68df03
Instruction ID: be9ae8beccb62532a0422dda6814790a13bfba896251f990583c62452ba0ad54
Opcode Fuzzy Hash: fb49e4551c68de2bdee1736dbcb1cb2e87fc5148f4589653ede1a157ed68df03
Instruction Fuzzy Hash: 4201DF315002009FDB508F69DC85766FBA4EF40220F08C4ABDD498F246D678E408CB72

Uniqueness

Uniqueness Score: -1.00%

Function 0165B786 Relevance: 1.5, APIs: 1, Instructions: 43threadCOMMON

Download Yara Rule

APIs

EnumThreadWindows.USER32(?,00000E2C,?,?), ref: 0165B7D6

Memory Dump Source

Source File: 0000000C.00000002.420941116.000000000165A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0165A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_165a000_unarchiver.jbxd

Similarity

API ID: EnumThreadWindows
String ID:
API String ID: 2941952884-0
Opcode ID: 7571f6a68e876b8b9c51238031e91c2942c3364136fe533c6fd3ca01218e2844
Instruction ID: ddca8d6439e2c42150ce9706939a2b9102e48493ad5b0c69561fd10fb8cab2b8
Opcode Fuzzy Hash: 7571f6a68e876b8b9c51238031e91c2942c3364136fe533c6fd3ca01218e2844
Instruction Fuzzy Hash: 3401A271540600ABD250DF1ADC82B26FBA8FB88B20F14811AED084B745D371F915CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 0165AFB2 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(?), ref: 0165AFE4

Memory Dump Source

Source File: 0000000C.00000002.420941116.000000000165A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0165A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_165a000_unarchiver.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: fe7a8800780f3075044aa2fd7fc0efee77abe13a70c47063923c988565233839
Instruction ID: 1ae0242e26405fbd5fee974e8baa5b5e5ee86148f59c26b3feb7e5d9833d6ed6
Opcode Fuzzy Hash: fe7a8800780f3075044aa2fd7fc0efee77abe13a70c47063923c988565233839
Instruction Fuzzy Hash: CC01DC756002409FDB508F19DC85766FBA4EF04324F0CC0ABDD498B796D6B5E848DAA2

Uniqueness

Uniqueness Score: -1.00%

Function 0165A2DA Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 0165A30C

Memory Dump Source

Source File: 0000000C.00000002.420941116.000000000165A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0165A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_165a000_unarchiver.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 0fe3b40c4bef585ad5d34c2ca7bc05dfd9a68c84613d07c94cb431ab90af47eb
Instruction ID: 2c8e89cd8e2bc8f1cb65711c6ab89e2f2e10ea72e7eed0ca10f206f26447686b
Opcode Fuzzy Hash: 0fe3b40c4bef585ad5d34c2ca7bc05dfd9a68c84613d07c94cb431ab90af47eb
Instruction Fuzzy Hash: 34F0AF34504240DFDB608F4ADC85766FBA4EF04724F18C1ABDD498B357D3B5A448CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 03021419 Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

M]-q^, xrefs: 0302158A, 0302158F

Memory Dump Source

Source File: 0000000C.00000002.421231526.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3020000_unarchiver.jbxd

Similarity

API ID:
String ID: M]-q^
API String ID: 0-1558019382
Opcode ID: 50e5dd2af68db0f248b43263c84612713e3ceab6e4b42781bf46206b1d043e65
Instruction ID: bcc218f04974180f582ae9e4c42ffb39a8a4868d73b1b2af63bdd78b5bdf07b8
Opcode Fuzzy Hash: 50e5dd2af68db0f248b43263c84612713e3ceab6e4b42781bf46206b1d043e65
Instruction Fuzzy Hash: DB510870E02209DFCB18DFB5D884AAEBBB6FF8A300F205569D405B7350DB359942CB54

Uniqueness

Uniqueness Score: -1.00%

Function 02F1025D Relevance: .5, Instructions: 463COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.421204768.0000000002F10000.00000040.00000020.00020000.00000000.sdmp, Offset: 02F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a074810b196c3e39798feae3d73fa718f5511be1e45f2e19fb059645ea0286d6
Instruction ID: c70b13c2810dbd7f9db139bf49a636d91e270b5de30bfdbde87cbfb19897bbed
Opcode Fuzzy Hash: a074810b196c3e39798feae3d73fa718f5511be1e45f2e19fb059645ea0286d6
Instruction Fuzzy Hash: 3731ECA254E3C04FC7038B359C655A1BFB49E53224B5E84EBD8C5CF5A3E219984ACB22

Uniqueness

Uniqueness Score: -1.00%

Function 02F105CF Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.421204768.0000000002F10000.00000040.00000020.00020000.00000000.sdmp, Offset: 02F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05492dcd7eb255866af346a74569bf8364bcb87a5dc30c7446b0b30e698ff0aa
Instruction ID: ce5f1bdea0151b7a4197bd1d334f1797edb4a15839b8430e188fcc9fb60f5048
Opcode Fuzzy Hash: 05492dcd7eb255866af346a74569bf8364bcb87a5dc30c7446b0b30e698ff0aa
Instruction Fuzzy Hash: EB1191B654D3C05FC3538B25AC51892BFF8EE4723031A84EBD884CB163D124AE49CB72

Uniqueness

Uniqueness Score: -1.00%

Function 030212F8 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.421231526.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3020000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75314e99240b3e7cdee0321254333f389083dc597b292ec781b2244742340062
Instruction ID: 6364a977e02e8ccc9d77ec32b19b872cdcd89cc5308e8cef4b40a55cdcad3d1e
Opcode Fuzzy Hash: 75314e99240b3e7cdee0321254333f389083dc597b292ec781b2244742340062
Instruction Fuzzy Hash: CE110A31D11118DBCB05DFA4E844AEEBBB6FB89310F101529DA04B3354DA316D46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02F107F8 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.421204768.0000000002F10000.00000040.00000020.00020000.00000000.sdmp, Offset: 02F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad2b0d466e1f1773df679dc2b844d9a22cc47b90217f2e76f2e926419aa8ea41
Instruction ID: f326f5e4bfaad5c5f0f6daad6d91fb302bf5b6b0938e5dc13e80f7117304a036
Opcode Fuzzy Hash: ad2b0d466e1f1773df679dc2b844d9a22cc47b90217f2e76f2e926419aa8ea41
Instruction Fuzzy Hash: 560184B24497946FD701CB19EC41D57BBE8DF86620B09C46BEC488B216D275B9188BB2

Uniqueness

Uniqueness Score: -1.00%

Function 03021620 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.421231526.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3020000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea23ba2c020f1ec16a20990b4c3dab3d443cb6272c69b7e1a5527bb598b10e86
Instruction ID: 424de2a3e156e7c381cc3ea9ec04b02620e5e931613a9b78aa2ba4ad6018665e
Opcode Fuzzy Hash: ea23ba2c020f1ec16a20990b4c3dab3d443cb6272c69b7e1a5527bb598b10e86
Instruction Fuzzy Hash: BB1113B0C06219DFCB08DFB4C8496AEBBB0AF41301F2495AAC415A7290C7799A88CB95

Uniqueness

Uniqueness Score: -1.00%

Function 03021630 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.421231526.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3020000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c85a995c618a899ba6f074c8a7676c352d20a51ae11a40dc3c034b79728b3670
Instruction ID: 85772b86ea6b8888fb142614b265498d545660b33c4765337397d90aacd4ee2a
Opcode Fuzzy Hash: c85a995c618a899ba6f074c8a7676c352d20a51ae11a40dc3c034b79728b3670
Instruction Fuzzy Hash: C50124B0C02219DFCB08EFB4C4887AEBBB0AB44301F2059A9C02173380C7749A84CF80

Uniqueness

Uniqueness Score: -1.00%

Function 030213A8 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.421231526.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3020000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8126033cb009fba415f6a294343d85fd4d505ea881c30dd1afa4d8fef89e5ae1
Instruction ID: 18cbaa85458786cb8572d02820d262cac5bceac29643c80b0d5ca867df96020b
Opcode Fuzzy Hash: 8126033cb009fba415f6a294343d85fd4d505ea881c30dd1afa4d8fef89e5ae1
Instruction Fuzzy Hash: 31F03CB4D0520DEBCB58DFA9C944AAEBBF5FB44300F1095A9D804B3300D6316A04DB95

Uniqueness

Uniqueness Score: -1.00%

Function 02F1081E Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.421204768.0000000002F10000.00000040.00000020.00020000.00000000.sdmp, Offset: 02F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f686276079a2ffc4f6cf0eba471689ade21894a0c62cb6b46de2c7e52f51ccd7
Instruction ID: aa5f04917e6ba6e23c60cfe4337a1898fa14b64b87ea396d5b45e3fc6bdcb79d
Opcode Fuzzy Hash: f686276079a2ffc4f6cf0eba471689ade21894a0c62cb6b46de2c7e52f51ccd7
Instruction Fuzzy Hash: A1F082B29456046FD240DF09ED41856F7ECDF84621B18C52FEC088B705E276AA144AE2

Uniqueness

Uniqueness Score: -1.00%

Function 02F105F6 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.421204768.0000000002F10000.00000040.00000020.00020000.00000000.sdmp, Offset: 02F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24661b89de7b449703fbdf4fbb3f1fef96a6e8175da1887f4c5f2742e5ec6ead
Instruction ID: 1151cfaf8c4e97d2d3888fbb401767b97814c315511de60e33981160e7473a65
Opcode Fuzzy Hash: 24661b89de7b449703fbdf4fbb3f1fef96a6e8175da1887f4c5f2742e5ec6ead
Instruction Fuzzy Hash: 5DE06D766446004B9650CF0BEC81452F798EB88630718C07BDC0D8B705E675F5058EA6

Uniqueness

Uniqueness Score: -1.00%

Function 02F105AF Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.421204768.0000000002F10000.00000040.00000020.00020000.00000000.sdmp, Offset: 02F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2f10000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c98cf33c9251e8440c9dcbdc96e1d3486c6089c7defdf9ac512de1ea6045d9d
Instruction ID: 89eb6156e6a74ee9f1bdd32f23f5f5b1d6a074064bbf66f77ac0a535d045cd34
Opcode Fuzzy Hash: 3c98cf33c9251e8440c9dcbdc96e1d3486c6089c7defdf9ac512de1ea6045d9d
Instruction Fuzzy Hash: F9E0C272A046408BDA50CA0AFD55061F7D0EBC1330B6880BFCC09CBB00E127A648CA92

Uniqueness

Uniqueness Score: -1.00%

Function 016523F4 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.420936013.0000000001652000.00000040.00000800.00020000.00000000.sdmp, Offset: 01652000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1652000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3780a5cef4974f0d6ea074babab7df3b36bc23832f2d76eb26c6cfad7a199ad7
Instruction ID: c79969ef8a72393300ee90cde3430fe93d4bc9101727d690e2635209279fa5f2
Opcode Fuzzy Hash: 3780a5cef4974f0d6ea074babab7df3b36bc23832f2d76eb26c6cfad7a199ad7
Instruction Fuzzy Hash: 68D05E79216A818FE3268A1CC5B8B953FE4AB51B04F4A44FDEC408B763C368D9D1D200

Uniqueness

Uniqueness Score: -1.00%

Function 016523BC Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.420936013.0000000001652000.00000040.00000800.00020000.00000000.sdmp, Offset: 01652000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1652000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c9fb342b72fe96afb1e4e1ec52f99218a3148abb08503191b802523b43cd0ad
Instruction ID: d29fb7008344a28be14510f0cd7eff8064d4505f40bb400ad96851292348c73d
Opcode Fuzzy Hash: 9c9fb342b72fe96afb1e4e1ec52f99218a3148abb08503191b802523b43cd0ad
Instruction Fuzzy Hash: B0D05E343002818BDB15DB0CC9A4F593BD4AB41B04F0644FCAC008B762C3A4D881C600

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 030202B9 Relevance: 1.6, Strings: 1, Instructions: 352COMMON

Download Yara Rule

Strings

m]-q^, xrefs: 03020387, 0302038C

Memory Dump Source

Source File: 0000000C.00000002.421231526.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3020000_unarchiver.jbxd

Similarity

API ID:
String ID: m]-q^
API String ID: 0-2635878962
Opcode ID: 29e3f06a6a3c15e8b30ab8969c11f1fc12319a2688f3126587390884422a42f1
Instruction ID: 87830b10612180b2c78c4d987d92f34c83c0eac1d363a67f4900440c823513ac
Opcode Fuzzy Hash: 29e3f06a6a3c15e8b30ab8969c11f1fc12319a2688f3126587390884422a42f1
Instruction Fuzzy Hash: 32F1F534902629CFDB28CF65DD48BAABBB6FF8A301F0092E9D6096B254C7355D84CF50

Uniqueness

Uniqueness Score: -1.00%

Function 03020AB7 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.421231526.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3020000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81938b8a79f1ad2f4934ef2a89e34d9f4cac89bf0c213dc6edc7972e0aa6e51b
Instruction ID: cc25566da17686121084e3f69c153bb8a5fa00b7bffa13f51abc45c8d74cfe70
Opcode Fuzzy Hash: 81938b8a79f1ad2f4934ef2a89e34d9f4cac89bf0c213dc6edc7972e0aa6e51b
Instruction Fuzzy Hash: A6F0F831E4A228CFCB10CE94D4806FCFBB9FB4A356F60A655C50A67205C335D989CB84

Uniqueness

Uniqueness Score: -1.00%

Function 03020A7C Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.421231526.0000000003020000.00000040.00000800.00020000.00000000.sdmp, Offset: 03020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3020000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2d68a709fcd3340f027d9bd07a3199098a6d636be1390861897504f2e7680ee
Instruction ID: b22bd0e53284b405b48cfe3fb4bfe5e0a1376508fb5a93a325159241b6865bc0
Opcode Fuzzy Hash: b2d68a709fcd3340f027d9bd07a3199098a6d636be1390861897504f2e7680ee
Instruction Fuzzy Hash: 24F03931E46128CFCB10CE94D4806FCF7B9FB4A31AF60A6A1C50AA7205C336D949CB84

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: unarchiver.exePID: 1768, Parent PID: 5928COMMON

Execution Graph

Execution Coverage:	16.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	83
Total number of Limit Nodes:	5

Executed Functions

Function 012102C8 Relevance: 3.4, Strings: 2, Instructions: 892
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0ryq, xrefs: 012108F6
0ryq, xrefs: 012108E0

Memory Dump Source

Source File: 00000011.00000002.444203657.0000000001210000.00000040.00000800.00020000.00000000.sdmp, Offset: 01210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1210000_unarchiver.jbxd

Similarity

API ID:
String ID: 0ryq$0ryq
API String ID: 0-3575859011
Opcode ID: 495b54c72db90acdb3c44a369095952cf283f3b13689d7c00fd0e99df56d7c88
Instruction ID: 705e8d3d8c5b2427a635586d22bbb800456425d04af036f6ddccb41f15c331e3
Opcode Fuzzy Hash: 495b54c72db90acdb3c44a369095952cf283f3b13689d7c00fd0e99df56d7c88
Instruction Fuzzy Hash: C1921778911268CFDB28DF64C854B9DBBB2BF99301F1085A9E509AB358DB709EC1CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00C2B246 Relevance: 1.6, APIs: 1, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E2C), ref: 00C2B2F3

Memory Dump Source

Source File: 00000011.00000002.443896701.0000000000C2A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C2A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_c2a000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: dcbdee2feb18ba1dbbc7e3aff5deb80cd6b2fba7eb9a0c73d7c95f9b9e61e633
Instruction ID: 93473e86ec35023a4c02ac941c18aa7853eddece8ffbd3500854cf5beb0a23f6
Opcode Fuzzy Hash: dcbdee2feb18ba1dbbc7e3aff5deb80cd6b2fba7eb9a0c73d7c95f9b9e61e633
Instruction Fuzzy Hash: 1731C6714043446FE7228B65DC44FA7BFBCEF05310F08849AE985CF162D275A919CB71

Uniqueness

Uniqueness Score: -1.00%

Function 00C2AD04 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E2C), ref: 00C2ADA7

Memory Dump Source

Source File: 00000011.00000002.443896701.0000000000C2A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C2A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_c2a000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: c84aa5706cdaa68ddfdc538521afdf89458e0f65a10a916a6cfa8ac30d05aef1
Instruction ID: cf38559fc321832d68a4e193c003894d603b623f1f07fc02e7581c7814af6a01
Opcode Fuzzy Hash: c84aa5706cdaa68ddfdc538521afdf89458e0f65a10a916a6cfa8ac30d05aef1
Instruction Fuzzy Hash: 7E31C7710043847FEB228B65DC44FA7BFACEF05310F0888AAF985DB552D234A559CB71

Uniqueness

Uniqueness Score: -1.00%

Function 00C2AB76 Relevance: 1.6, APIs: 1, Instructions: 93
pipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreatePipe.KERNELBASE(?,00000E2C,?,?), ref: 00C2AC36

Memory Dump Source

Source File: 00000011.00000002.443896701.0000000000C2A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C2A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_c2a000_unarchiver.jbxd

Similarity

API ID: CreatePipe
String ID:
API String ID: 2719314638-0
Opcode ID: ea2dea9d4d2e9419297a706ba1fdbd1b9be7cbae870a6ce385b52975e1cdd417
Instruction ID: 1634bab8052787271f1db1dae5716593d60ddeb785e89dbe0d5bece59c00388f
Opcode Fuzzy Hash: ea2dea9d4d2e9419297a706ba1fdbd1b9be7cbae870a6ce385b52975e1cdd417
Instruction Fuzzy Hash: 1B319A6240E3C06FD3138B758C61AA2BFB4AF47610F1D84CBD8C48F1A3D2696919C766

Uniqueness

Uniqueness Score: -1.00%

Function 00C2A4E8 Relevance: 1.6, APIs: 1, Instructions: 90
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 00C2A589

Memory Dump Source

Source File: 00000011.00000002.443896701.0000000000C2A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C2A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_c2a000_unarchiver.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: afca1c4e6f9b3268f0c9dc0177bf1f05efa854b3e58d11627eb9b9a554a14c6b
Instruction ID: 1df7880842748c7de283448c14cbc9d03fa705101cf393a9895200ca46074c85
Opcode Fuzzy Hash: afca1c4e6f9b3268f0c9dc0177bf1f05efa854b3e58d11627eb9b9a554a14c6b
Instruction Fuzzy Hash: E4318971504780AFE722CF25DC44B66BFE8EF05220F0884AEE9858B652D335E908CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00C2A120 Relevance: 1.6, APIs: 1, Instructions: 85
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindNextFileW.KERNELBASE(?,00000E2C,?,?), ref: 00C2A1C2

Memory Dump Source

Source File: 00000011.00000002.443896701.0000000000C2A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C2A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_c2a000_unarchiver.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: ee127da33adb5bf408f3a1a3032d061fe18b3841ddbe11c50891f18c5c7a2218
Instruction ID: 1f9d7c815d3bee75df5882217faee71d9d93db6c0a3cbd82ca547679300857c3
Opcode Fuzzy Hash: ee127da33adb5bf408f3a1a3032d061fe18b3841ddbe11c50891f18c5c7a2218
Instruction Fuzzy Hash: F031D07140D3C06FD7128B358C51BA2BFB4EF47620F1981CBD9848F293D225A919C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 00C2A9EC Relevance: 1.6, APIs: 1, Instructions: 82
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E2C,6DF723F4,00000000,00000000,00000000,00000000), ref: 00C2AA8C

Memory Dump Source

Source File: 00000011.00000002.443896701.0000000000C2A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C2A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_c2a000_unarchiver.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 1f2e71b7268d1f4ea0fc432eca1aacee98a081995cfca1b91c104f0843c8b4b0
Instruction ID: a53c92a3d0a871a756922612790d93e81e44b17c11b1ad436df2d310aa124ca9
Opcode Fuzzy Hash: 1f2e71b7268d1f4ea0fc432eca1aacee98a081995cfca1b91c104f0843c8b4b0
Instruction Fuzzy Hash: CA217C72504740AFE721CB25DC44FA3BBB8EF05710F08849AE985DB252D224EA48CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00C2B276 Relevance: 1.6, APIs: 1, Instructions: 80
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E2C), ref: 00C2B2F3

Memory Dump Source

Source File: 00000011.00000002.443896701.0000000000C2A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C2A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_c2a000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: f97500b94418e4d4d66e30c64fd43ff655be7d9fc3f2da1dc86efe5d8110ca4f
Instruction ID: b489adb2af9e0cd56d5a9116ce492c1cc847c5ff883be8d251d31deb2e25cc05
Opcode Fuzzy Hash: f97500b94418e4d4d66e30c64fd43ff655be7d9fc3f2da1dc86efe5d8110ca4f
Instruction Fuzzy Hash: ED21D372500204AFEB21CF65DC44FABFBACEF04310F14896AED45DB651D771A9088BB1

Uniqueness

Uniqueness Score: -1.00%

Function 00C2AD2A Relevance: 1.6, APIs: 1, Instructions: 80
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E2C), ref: 00C2ADA7

Memory Dump Source

Source File: 00000011.00000002.443896701.0000000000C2A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C2A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_c2a000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 7c6210210d3c8d217bd0a0db2dfb7b95115d8141d1809bc49282117e30f05eda
Instruction ID: f7f900288623d82f80e62ba59e4761e6f193e0d043948e43520f3901a24e53d4
Opcode Fuzzy Hash: 7c6210210d3c8d217bd0a0db2dfb7b95115d8141d1809bc49282117e30f05eda
Instruction Fuzzy Hash: 9321B372500204AFEB218F69DC44FABFBACEF04324F14886AED45DB651D675A548CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 00C2A75C Relevance: 1.6, APIs: 1, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNELBASE(?,00000E2C,6DF723F4,00000000,00000000,00000000,00000000), ref: 00C2A7EA

Memory Dump Source

Source File: 00000011.00000002.443896701.0000000000C2A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C2A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_c2a000_unarchiver.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 162f1e993e4dd3a9bb2c9e603f91fd697b1ae32b6e9769afb547b621c21795b1
Instruction ID: 2c6756c969480ac6ad5aa0cfbb6373843466bffa536d492039bd085281ac75ce
Opcode Fuzzy Hash: 162f1e993e4dd3a9bb2c9e603f91fd697b1ae32b6e9769afb547b621c21795b1
Instruction Fuzzy Hash: 7321B6714083806FE7228B24DC40FA6BFB8EF46714F0884EBED849F153D265A909C772

Uniqueness

Uniqueness Score: -1.00%

Function 00C2A83F Relevance: 1.6, APIs: 1, Instructions: 77
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000E2C,6DF723F4,00000000,00000000,00000000,00000000), ref: 00C2A8CD

Memory Dump Source

Source File: 00000011.00000002.443896701.0000000000C2A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C2A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_c2a000_unarchiver.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 603b508c12ee6ddf5a1f36276ee59a1fae831c3d24ae5172fa5d775085048670
Instruction ID: 91d660cb7977aea9fdbeeb6c2bfc2aacca6208d0050a368c45cc32dc86bac1aa
Opcode Fuzzy Hash: 603b508c12ee6ddf5a1f36276ee59a1fae831c3d24ae5172fa5d775085048670
Instruction Fuzzy Hash: BF21A171009380AFDB228F65DC54F96BFB8EF46314F08849BE9849F152C265A548CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00C2A50A Relevance: 1.6, APIs: 1, Instructions: 76
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 00C2A589

Memory Dump Source

Source File: 00000011.00000002.443896701.0000000000C2A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C2A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_c2a000_unarchiver.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 797f587366721ecaf6fd83e02915f438ce457e19c7e280421a84b7292e47c41b
Instruction ID: 58b31ca5a431bf366676f39986868850b2b2403f52baa05a5b7cbafe8c5eccde
Opcode Fuzzy Hash: 797f587366721ecaf6fd83e02915f438ce457e19c7e280421a84b7292e47c41b
Instruction Fuzzy Hash: 7121AE71500640AFEB21CF65DD44B67FBE8EF04310F18846EE9858B652D771E904CB72

Uniqueness

Uniqueness Score: -1.00%

Function 00C2B737 Relevance: 1.6, APIs: 1, Instructions: 74
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnumThreadWindows.USER32(?,00000E2C,?,?), ref: 00C2B7D6

Memory Dump Source

Source File: 00000011.00000002.443896701.0000000000C2A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C2A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_c2a000_unarchiver.jbxd

Similarity

API ID: EnumThreadWindows
String ID:
API String ID: 2941952884-0
Opcode ID: 00fb48240ce3f22ffaaa5d98e8fb593824c970e71304b106425ff67a048814f9
Instruction ID: f7ba31a140128850f67fb4d29585d70e80744dae43e3fe8176a7a35751194a83
Opcode Fuzzy Hash: 00fb48240ce3f22ffaaa5d98e8fb593824c970e71304b106425ff67a048814f9
Instruction Fuzzy Hash: 7C21747150E7C06FD3138B258C55A22BFB4EF47610F0A81DFD9848F5A3D228A919C7B2

Uniqueness

Uniqueness Score: -1.00%

Function 00C2A69B Relevance: 1.6, APIs: 1, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNELBASE(?,00000E2C,6DF723F4,00000000,00000000,00000000,00000000), ref: 00C2A721

Memory Dump Source

Source File: 00000011.00000002.443896701.0000000000C2A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C2A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_c2a000_unarchiver.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 721b806d9314587164b29140aa5e07cac8209dd1917188dc0207e4ecb0f0a4e9
Instruction ID: 0be059e0fc018d4b50478beae6d0c251ed04b7edbd5358e5fd96eee7fc41c9cb
Opcode Fuzzy Hash: 721b806d9314587164b29140aa5e07cac8209dd1917188dc0207e4ecb0f0a4e9
Instruction Fuzzy Hash: 4E21C3B54087806FE7128B25DC50BA2BFB8DF46724F1880DBED849B293D264A909C772

Uniqueness

Uniqueness Score: -1.00%

Function 00C2A917 Relevance: 1.6, APIs: 1, Instructions: 70
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(?,?), ref: 00C2A997

Memory Dump Source

Source File: 00000011.00000002.443896701.0000000000C2A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C2A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_c2a000_unarchiver.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: f005c4c95337e474d488d03e233433cdd11b470d91790a118be37c5e0b13927c
Instruction ID: 96d26d624d9407725438705f074d500a8cf8329a20923741a57538a181f2dc33
Opcode Fuzzy Hash: f005c4c95337e474d488d03e233433cdd11b470d91790a118be37c5e0b13927c
Instruction Fuzzy Hash: 1D21B0765083C45FDB12CB29EC55B92BFE8AF06314F0980EAD984CF153D225D949CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00C2AA12 Relevance: 1.6, APIs: 1, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E2C,6DF723F4,00000000,00000000,00000000,00000000), ref: 00C2AA8C

Memory Dump Source

Source File: 00000011.00000002.443896701.0000000000C2A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C2A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_c2a000_unarchiver.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: b5979b083d2d6ef56e7f326765f074b03302af21cf7ea7e516d73d54e481bdcd
Instruction ID: 0a5e2d78988aefd685b6c884a0dbd6b91d2697509e24014639673f206fe8c957
Opcode Fuzzy Hash: b5979b083d2d6ef56e7f326765f074b03302af21cf7ea7e516d73d54e481bdcd
Instruction Fuzzy Hash: 9A218C71600600EFEB20CF19ED84FA7FBECEF04714F18846AEA459B651D660E948DE72

Uniqueness

Uniqueness Score: -1.00%

Function 00C2B5BD Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00C2B63E

Memory Dump Source

Source File: 00000011.00000002.443896701.0000000000C2A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C2A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_c2a000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: ac45e93e8bafe0a1cd36b9c2ffa7682cbe397c13f8c99b28e95616e5d5fd6858
Instruction ID: c98293c607f38783307b91242c868fbe1feb74c58721301f64c71b7085ba86f6
Opcode Fuzzy Hash: ac45e93e8bafe0a1cd36b9c2ffa7682cbe397c13f8c99b28e95616e5d5fd6858
Instruction Fuzzy Hash: EF216072409380AFDB238F60DC54A62BFB4EF46214F0884DAED858B563D2759918DB61

Uniqueness

Uniqueness Score: -1.00%

Function 00C2A5E0 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 00C2A654

Memory Dump Source

Source File: 00000011.00000002.443896701.0000000000C2A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C2A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_c2a000_unarchiver.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: dde82c7fdf74c988b7c8f44d0d31101d6d94d1b51a27a2efa49ca5160c1a16b9
Instruction ID: be179d2c0b5addd18ff65392fea3e678db2e26929586a4e4c632bae70450812d
Opcode Fuzzy Hash: dde82c7fdf74c988b7c8f44d0d31101d6d94d1b51a27a2efa49ca5160c1a16b9
Instruction Fuzzy Hash: 7621B0758093C05FD7138B25DC94692BFB4AF12220F0980DBDC858F5A3D2259948C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 00C2A86E Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,00000E2C,6DF723F4,00000000,00000000,00000000,00000000), ref: 00C2A8CD

Memory Dump Source

Source File: 00000011.00000002.443896701.0000000000C2A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C2A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_c2a000_unarchiver.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 294b7e5278d3c9500781b0ec3e496175c06a72af9f15d8a8a312d3f9b3c6415e
Instruction ID: df427509665b494d3717a62257a1248670c16c98b6e6c4242f7d075a6f4d52f4
Opcode Fuzzy Hash: 294b7e5278d3c9500781b0ec3e496175c06a72af9f15d8a8a312d3f9b3c6415e
Instruction Fuzzy Hash: 7C11C171400200EFEB21DF56EC40FA6FBA8EF04324F18886BEE459B651D675A548CB72

Uniqueness

Uniqueness Score: -1.00%

Function 00C2B800 Relevance: 1.6, APIs: 1, Instructions: 59windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(?,?,?,?), ref: 00C2B86D

Memory Dump Source

Source File: 00000011.00000002.443896701.0000000000C2A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C2A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_c2a000_unarchiver.jbxd

Similarity

API ID: Message
String ID:
API String ID: 2030045667-0
Opcode ID: 1d2645584bfae02b32769f606705cd5aed51b05b3053acf99fe766db368c9a1f
Instruction ID: 6dbff79c34853ecb49722142dbd388c4e8d44625c160c07d7df15251a91bfe3e
Opcode Fuzzy Hash: 1d2645584bfae02b32769f606705cd5aed51b05b3053acf99fe766db368c9a1f
Instruction Fuzzy Hash: 9E1190B1504780AFEB21CF15DC45B62FFB8EF55314F09849EED889B652D361E908CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00C2A78E Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,00000E2C,6DF723F4,00000000,00000000,00000000,00000000), ref: 00C2A7EA

Memory Dump Source

Source File: 00000011.00000002.443896701.0000000000C2A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C2A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_c2a000_unarchiver.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 4f7d6ea22e799e30b1dc63f0f718738bba105b0953f8cfa6a1fb6e3921fe110d
Instruction ID: 39ad572fe22aad8ce4c5934b7984f513f2817210148351d1a894fabef496023f
Opcode Fuzzy Hash: 4f7d6ea22e799e30b1dc63f0f718738bba105b0953f8cfa6a1fb6e3921fe110d
Instruction Fuzzy Hash: 5511A371400200AFEB21CF55ED44FA6FBA8EF44724F18846BEE459B641D675A508CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 00C2A2AE Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 00C2A30C

Memory Dump Source

Source File: 00000011.00000002.443896701.0000000000C2A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C2A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_c2a000_unarchiver.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 0d32b15c6adfa615be0f60085c47c674265a3cbb9caea5a41908ea3a74ded7f0
Instruction ID: cd098a733cfed9c149610c7d39fa5c3182b779462716f088b78a6fa4f4ff1a4a
Opcode Fuzzy Hash: 0d32b15c6adfa615be0f60085c47c674265a3cbb9caea5a41908ea3a74ded7f0
Instruction Fuzzy Hash: 2411A0754093C09FD7228B25EC54B52BFB4DF17220F0980DBDD848F263D265A948CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00C2A6CE Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E2C,6DF723F4,00000000,00000000,00000000,00000000), ref: 00C2A721

Memory Dump Source

Source File: 00000011.00000002.443896701.0000000000C2A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C2A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_c2a000_unarchiver.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: c1a468a86d6b61bd9202941efb64a844fe94a3186305a4aa1e2e9c07d2cbe814
Instruction ID: 35855aaa10dee8c7ba60316fbacfa1e874efe27a67499bbc358094064de45059
Opcode Fuzzy Hash: c1a468a86d6b61bd9202941efb64a844fe94a3186305a4aa1e2e9c07d2cbe814
Instruction Fuzzy Hash: 9801D271500200AFE720CB19EC85FA7FBACDF44724F1880ABEE049B241D674A5488AB7

Uniqueness

Uniqueness Score: -1.00%

Function 00C2A952 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,?), ref: 00C2A997

Memory Dump Source

Source File: 00000011.00000002.443896701.0000000000C2A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C2A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_c2a000_unarchiver.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 8b1a852e1ae57d05429e5402f6408d507ca1e7eb770f9b5da4a3cc2066a0bc68
Instruction ID: d56363978323fd7f6c80957d553d97e435e632496f4ac70c14d58440f2e6ed07
Opcode Fuzzy Hash: 8b1a852e1ae57d05429e5402f6408d507ca1e7eb770f9b5da4a3cc2066a0bc68
Instruction Fuzzy Hash: CA11C8755002409FDB10DF2AE884766FBD8EF04310F18C4ABDD45CF642D675D584CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00C2AF8B Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(?), ref: 00C2AFE4

Memory Dump Source

Source File: 00000011.00000002.443896701.0000000000C2A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C2A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_c2a000_unarchiver.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 14849b7a41db0b9e83fc545aaac19c62d0163a89f421ff8ca8ca0c8270d0c43b
Instruction ID: 8f2910dab422428c82e976be6068b714cbcd3124ec869258aa1e4cf1732a4419
Opcode Fuzzy Hash: 14849b7a41db0b9e83fc545aaac19c62d0163a89f421ff8ca8ca0c8270d0c43b
Instruction Fuzzy Hash: 59119E755093809FD7128B29DC45B52BFB4EF06220F0984DBED858B262D265A948DB62

Uniqueness

Uniqueness Score: -1.00%

Function 00C2B1B4 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(?), ref: 00C2B208

Memory Dump Source

Source File: 00000011.00000002.443896701.0000000000C2A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C2A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_c2a000_unarchiver.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: b5ed541443c2b459af720a58e234512d7d6500dd9978e2ecff91d2b939d3a427
Instruction ID: 907475386e0247428bf5102c2bb9d2f5dc756017f2bbce0d92daa3ec1a026b88
Opcode Fuzzy Hash: b5ed541443c2b459af720a58e234512d7d6500dd9978e2ecff91d2b939d3a427
Instruction Fuzzy Hash: ED117071409380AFD712CF25EC44B56FFB4DF56220F1884EBED849F252D275A948CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00C2ABE6 Relevance: 1.5, APIs: 1, Instructions: 47pipeCOMMON

Download Yara Rule

APIs

CreatePipe.KERNELBASE(?,00000E2C,?,?), ref: 00C2AC36

Memory Dump Source

Source File: 00000011.00000002.443896701.0000000000C2A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C2A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_c2a000_unarchiver.jbxd

Similarity

API ID: CreatePipe
String ID:
API String ID: 2719314638-0
Opcode ID: fe4d28607dca4f7017513a88d72b82320834aa25951522f26f4477a969365e11
Instruction ID: 0443f265298a636a005f642fc27580403bf11e949bbedba57d1c86388931f9b6
Opcode Fuzzy Hash: fe4d28607dca4f7017513a88d72b82320834aa25951522f26f4477a969365e11
Instruction Fuzzy Hash: 5201D471540600ABD310DF1ADC81F36FBA8FB88B20F14812AED088B741D235F515CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 00C2A172 Relevance: 1.5, APIs: 1, Instructions: 47fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNELBASE(?,00000E2C,?,?), ref: 00C2A1C2

Memory Dump Source

Source File: 00000011.00000002.443896701.0000000000C2A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C2A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_c2a000_unarchiver.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: c9882f420e625e3c2e695214dc3bf04b1bd8a21240b86209fd557a4498088c9b
Instruction ID: 055f39f4af6dc2846c4b07f3a6be12319de9858076b01e48754936950cadf0d8
Opcode Fuzzy Hash: c9882f420e625e3c2e695214dc3bf04b1bd8a21240b86209fd557a4498088c9b
Instruction Fuzzy Hash: 5501D471540600ABD710DF1ADC81B36FBA8FB88B20F14816AED088B741D235F515CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 00C2B822 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(?,?,?,?), ref: 00C2B86D

Memory Dump Source

Source File: 00000011.00000002.443896701.0000000000C2A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C2A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_c2a000_unarchiver.jbxd

Similarity

API ID: Message
String ID:
API String ID: 2030045667-0
Opcode ID: 4e5c504811100eac3f27b325682d98592eeb3afb0955f26119768df2005fc356
Instruction ID: 2620231fec8863b338a3b99444f4a2cb3c9259245c64eba8fbc01894884fa6bf
Opcode Fuzzy Hash: 4e5c504811100eac3f27b325682d98592eeb3afb0955f26119768df2005fc356
Instruction Fuzzy Hash: 40019275900600DFEB20CF16E845B22FBE8EF14324F18C45ADD498B752D371E948CA72

Uniqueness

Uniqueness Score: -1.00%

Function 00C2B5FA Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00C2B63E

Memory Dump Source

Source File: 00000011.00000002.443896701.0000000000C2A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C2A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_c2a000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: a7be5635970375564ab271e3aa1fba5fa054928add5ef762554b11ec3c4508fa
Instruction ID: 9c07fca9e00392da899a879dd8a1b160ac7ac346557d40ffd34a604d94957ef6
Opcode Fuzzy Hash: a7be5635970375564ab271e3aa1fba5fa054928add5ef762554b11ec3c4508fa
Instruction Fuzzy Hash: B9018031400700DFDB218F55E844B66FFE4EF48720F18C9AAEE894B612C376A918DF62

Uniqueness

Uniqueness Score: -1.00%

Function 00C2B786 Relevance: 1.5, APIs: 1, Instructions: 43threadCOMMON

Download Yara Rule

APIs

EnumThreadWindows.USER32(?,00000E2C,?,?), ref: 00C2B7D6

Memory Dump Source

Source File: 00000011.00000002.443896701.0000000000C2A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C2A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_c2a000_unarchiver.jbxd

Similarity

API ID: EnumThreadWindows
String ID:
API String ID: 2941952884-0
Opcode ID: d07f59b61675bfb39a60c8aec00eead2856f4887ae6e0e9c4f78fa212a69cce5
Instruction ID: 1323babedc78f39fc153ba984bf67dc71cec5fc69b05349d6948d18b51207f17
Opcode Fuzzy Hash: d07f59b61675bfb39a60c8aec00eead2856f4887ae6e0e9c4f78fa212a69cce5
Instruction Fuzzy Hash: 3401AD71540600ABD360DF1ADC82F36FBA8FB88B20F14811AED084BB41E231F915CBE6

Uniqueness

Uniqueness Score: -1.00%

Function 00C2A622 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 00C2A654

Memory Dump Source

Source File: 00000011.00000002.443896701.0000000000C2A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C2A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_c2a000_unarchiver.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 7a5f2fea037736655837951bb0e8fd95d67436ed6790424812130f7a97a689f7
Instruction ID: 7eb7fadedccfebacc7b9bd740523451597a230a81789da20b3bf047d4d672a64
Opcode Fuzzy Hash: 7a5f2fea037736655837951bb0e8fd95d67436ed6790424812130f7a97a689f7
Instruction Fuzzy Hash: 0F018F755042409FDB20CF29E8857A6FBA4EF04320F1CC4ABED498F642D679A548CF62

Uniqueness

Uniqueness Score: -1.00%

Function 00C2B1D6 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(?), ref: 00C2B208

Memory Dump Source

Source File: 00000011.00000002.443896701.0000000000C2A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C2A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_c2a000_unarchiver.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 4b92070ac7750ad7d5022ea7af6fd2a024341edabc6f804a6db17187ff8e4b42
Instruction ID: 767d91644fa18f2e6a914af15325c8bb9b556229f5b9fa9a1c9b3ccfab4026b0
Opcode Fuzzy Hash: 4b92070ac7750ad7d5022ea7af6fd2a024341edabc6f804a6db17187ff8e4b42
Instruction Fuzzy Hash: 5C01D130804340DFDB20CF19E88476AFBA4EF04320F18C4ABDD488F606D779A948CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00C2AFB2 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(?), ref: 00C2AFE4

Memory Dump Source

Source File: 00000011.00000002.443896701.0000000000C2A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C2A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_c2a000_unarchiver.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 869ff01de1e6557c90d76e6035524506bbaf0d72fd0fb1e3b882797ef1fbbb17
Instruction ID: 788e0bf1391e784824294c1fd8ef2f9f341b7f87dfe2eae8e5d3df012656d23d
Opcode Fuzzy Hash: 869ff01de1e6557c90d76e6035524506bbaf0d72fd0fb1e3b882797ef1fbbb17
Instruction Fuzzy Hash: E801F475500240DFDB208F1AE884766FBA4EF04320F18C0ABDD5A8B752D679E948DE62

Uniqueness

Uniqueness Score: -1.00%

Function 00C2A2DA Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 00C2A30C

Memory Dump Source

Source File: 00000011.00000002.443896701.0000000000C2A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C2A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_c2a000_unarchiver.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 6452d76008fbff045e789aa1566a67104f6f37ab7780871b40b0dd7cf46d051f
Instruction ID: 7e325974f6d45441a792edeb0971e89d6808de8bce6c8f086267c522136db38f
Opcode Fuzzy Hash: 6452d76008fbff045e789aa1566a67104f6f37ab7780871b40b0dd7cf46d051f
Instruction Fuzzy Hash: 02F0AF34404240DFDB20CF0AE884766FBA4EF04724F18C09BDE494F626D7B5E948CAA3

Uniqueness

Uniqueness Score: -1.00%

Function 01211419 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.444203657.0000000001210000.00000040.00000800.00020000.00000000.sdmp, Offset: 01210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1210000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f755fb44e20ee8c736799a3745a5f4e20e7b7101b2c76dc23d5fba6df80fa92e
Instruction ID: 2c380cc76abc5ec76d86a85257d24c7b8b8e14677a2c523c496dfa696a938e99
Opcode Fuzzy Hash: f755fb44e20ee8c736799a3745a5f4e20e7b7101b2c76dc23d5fba6df80fa92e
Instruction Fuzzy Hash: 40512574E02209EFDB18DFB5D4909AEBBB2FF8A300F209469E405B7350DB399942CB54

Uniqueness

Uniqueness Score: -1.00%

Function 012112E8 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.444203657.0000000001210000.00000040.00000800.00020000.00000000.sdmp, Offset: 01210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1210000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffe98c3b336c197eb160ec570053ef293780cab25e225e4cd46eae93084a2bce
Instruction ID: d883d0059f0d3541d584eeee2de4de2db6b5bc5b1c6067cc3ab3a48a79c12fa1
Opcode Fuzzy Hash: ffe98c3b336c197eb160ec570053ef293780cab25e225e4cd46eae93084a2bce
Instruction Fuzzy Hash: 0E114C35D15148AFCB05DFA4E8509EEBFB2FF86310F101429E901B3265DB716916CF80

Uniqueness

Uniqueness Score: -1.00%

Function 012112F8 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.444203657.0000000001210000.00000040.00000800.00020000.00000000.sdmp, Offset: 01210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1210000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb3ead20ab94b7d6704afacc666dfd3f347694060e5d8ff4bfdd77812f56276a
Instruction ID: e9478049c5f865054c080776ed432e8d0a804b2ce387c68205fca25d7c8e171e
Opcode Fuzzy Hash: bb3ead20ab94b7d6704afacc666dfd3f347694060e5d8ff4bfdd77812f56276a
Instruction Fuzzy Hash: B2111C35D1110CEBCB04DFA4E8509EEBBB6FF95310F101429EA04B3358DB31A956CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02AF07F8 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.444280314.0000000002AF0000.00000040.00000020.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2af0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e08a8ff50f10114dcddbcf25322066a5c247a6e1198b2af8b85b0b02fbbfa032
Instruction ID: 11b0d1021e55b4ff6c146cef7c93af0e287eee0e96c95eb9a5c043e8505ff732
Opcode Fuzzy Hash: e08a8ff50f10114dcddbcf25322066a5c247a6e1198b2af8b85b0b02fbbfa032
Instruction Fuzzy Hash: 1301B1B24092506FD701DF15AC41C97BBE8DF85624B09C46AEC489B202D232B9188BA2

Uniqueness

Uniqueness Score: -1.00%

Function 02AF05CF Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.444280314.0000000002AF0000.00000040.00000020.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2af0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b4accb81e6cbdf08c6fea4a19c9c6778952b39db66f2c56b427f6b379b7ad4b
Instruction ID: 45ea0d44ee061526d46245134d16ec16f57489b82bdd41bf7b91e61b5cec234f
Opcode Fuzzy Hash: 2b4accb81e6cbdf08c6fea4a19c9c6778952b39db66f2c56b427f6b379b7ad4b
Instruction Fuzzy Hash: 9501FE755093805FD7128F16EC40863FFB8DE8662070CC19FED498B612D1256504CB72

Uniqueness

Uniqueness Score: -1.00%

Function 01211620 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.444203657.0000000001210000.00000040.00000800.00020000.00000000.sdmp, Offset: 01210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1210000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5ff464e91bcf5ae2a727555259e9ba1a7bcd5e1ca33bb2ba477cfa8cc69223c
Instruction ID: e56091b78c23ee32b0841e887520aa8f60a65555dec6e9786d89abc62f331c08
Opcode Fuzzy Hash: a5ff464e91bcf5ae2a727555259e9ba1a7bcd5e1ca33bb2ba477cfa8cc69223c
Instruction Fuzzy Hash: C50125B4C0524ADFCB04EFB4C48ABAEBFB0AF45301F2499ADC11567291C7758A94CF85

Uniqueness

Uniqueness Score: -1.00%

Function 01211630 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.444203657.0000000001210000.00000040.00000800.00020000.00000000.sdmp, Offset: 01210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1210000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 543085dbdfb6261520556194858d7ac49d40343b1e7beddf37b92efcdfcc0f7b
Instruction ID: 36128ead879962dbfdfb935be95a6409e1d5ad4a5fd4f73f2b0cba26fc597bde
Opcode Fuzzy Hash: 543085dbdfb6261520556194858d7ac49d40343b1e7beddf37b92efcdfcc0f7b
Instruction Fuzzy Hash: AE01EFB0C0121ADFCB08EFB8C4857AEBBB0AB45301F6099A9C525A3280D7759A94CF95

Uniqueness

Uniqueness Score: -1.00%

Function 012113A8 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.444203657.0000000001210000.00000040.00000800.00020000.00000000.sdmp, Offset: 01210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1210000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfa02914d7ebff1c506110da0545ace1a9e7a3e54f6c5c72283a6bb5b5b12134
Instruction ID: 3cec6b63a961e02a3e58aa17458d5483edd1820dacabbecbfc9770b2ff0025c9
Opcode Fuzzy Hash: cfa02914d7ebff1c506110da0545ace1a9e7a3e54f6c5c72283a6bb5b5b12134
Instruction Fuzzy Hash: BB0119B8D05209EFCB44DFB9D545AEEBFF1AF89300F1091AAC454A3315D6301A15DF51

Uniqueness

Uniqueness Score: -1.00%

Function 02AF081E Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.444280314.0000000002AF0000.00000040.00000020.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2af0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a240f2a7f06bdabf1f6d63cc5f74a47192d945b2c6231f1a8645ca365bc127f8
Instruction ID: e92eb23dab83eecca7cd540bb01950499fe9b0c5ebb24c338baa31a476e3119b
Opcode Fuzzy Hash: a240f2a7f06bdabf1f6d63cc5f74a47192d945b2c6231f1a8645ca365bc127f8
Instruction Fuzzy Hash: DBF082B28452046FD240DF09ED418A6F7ECDF84621B14C52FED088B305E276AA144AE2

Uniqueness

Uniqueness Score: -1.00%

Function 02AF05F6 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.444280314.0000000002AF0000.00000040.00000020.00020000.00000000.sdmp, Offset: 02AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2af0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c91d289ae60e22f36cb35ae76fa4dc6bca412025018757daaeee3fc8e64fd953
Instruction ID: a8ea57fcfaddbd8388c10c09fbf4d4b303c5054fb2ce99413beb089fccb8f5a9
Opcode Fuzzy Hash: c91d289ae60e22f36cb35ae76fa4dc6bca412025018757daaeee3fc8e64fd953
Instruction Fuzzy Hash: 55E092766046004BD650CF0BFC41462F7D8EB88630718C07FDD0D8B701E536B505CEA6

Uniqueness

Uniqueness Score: -1.00%

Function 00C223F4 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.443890096.0000000000C22000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C22000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_c22000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8693b0516cf77e1780efa9b2738cdee4537b79218fd5083493f91b3a0383bf9d
Instruction ID: 7d75f0558133456c8daaa5a4c757c39f14fd537643736e14d9fe57807a13c344
Opcode Fuzzy Hash: 8693b0516cf77e1780efa9b2738cdee4537b79218fd5083493f91b3a0383bf9d
Instruction Fuzzy Hash: 66D05E79215A915FD3269A1CD1A8B953BD4AB51B04F4A44FAE8408BA63C368DA81E610

Uniqueness

Uniqueness Score: -1.00%

Function 00C223BC Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.443890096.0000000000C22000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C22000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_c22000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7f69f08647005d63086bbd9714db1dedd05b3682336be17f94399be595f8ee6
Instruction ID: 5b29f4255556aa7f588a59e360185a121894dd5ee9685ad10fba4f6aeb484f4f
Opcode Fuzzy Hash: c7f69f08647005d63086bbd9714db1dedd05b3682336be17f94399be595f8ee6
Instruction Fuzzy Hash: 0ED05E383002814BCB19DB0CD594F5937D8AF41B04F0644E8AC108BA72C3A8DD81C600

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: unarchiver.exePID: 4788, Parent PID: 5928COMMON

Execution Graph

Execution Coverage:	16.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	86
Total number of Limit Nodes:	5

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 054A02C8 Relevance: 3.4, Strings: 2, Instructions: 892
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0ryq, xrefs: 054A08F6
0ryq, xrefs: 054A08E0

Memory Dump Source

Source File: 00000014.00000002.484628823.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_54a0000_unarchiver.jbxd

Similarity

API ID:
String ID: 0ryq$0ryq
API String ID: 0-3575859011
Opcode ID: a1d6cb5f599d732fdcd75cd98eca0a8dc3c8742e223fa429541e55ca238ba77d
Instruction ID: 6824b2b00d22b68fc83b31eb47029d32fdfc0efeeeb5b4375f73defc3404608e
Opcode Fuzzy Hash: a1d6cb5f599d732fdcd75cd98eca0a8dc3c8742e223fa429541e55ca238ba77d
Instruction Fuzzy Hash: 2E92DF74E01228CFDB64CF64D848BADBBB2BB99301F1085EAD409AB354CB749E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 015CB246 Relevance: 1.6, APIs: 1, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E2C), ref: 015CB2F3

Memory Dump Source

Source File: 00000014.00000002.484127246.00000000015CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 015CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_15ca000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 0e8c2d9e1edccd05f823686430ee4609b8349107e9b0d661a287d01f28bff0d6
Instruction ID: 87bdf2c749a737336d8a0f9a033b4388bc0882ab2b26fee81a5244dae79380bb
Opcode Fuzzy Hash: 0e8c2d9e1edccd05f823686430ee4609b8349107e9b0d661a287d01f28bff0d6
Instruction Fuzzy Hash: AC31B4714043446FE7128F65DC45FABBFACEF45710F08889AE985DF152D224A919CB71

Uniqueness

Uniqueness Score: -1.00%

Function 015CAD04 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E2C), ref: 015CADA7

Memory Dump Source

Source File: 00000014.00000002.484127246.00000000015CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 015CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_15ca000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: c5e77b8b5ed93edc6e358bf50421f9f6a23933fe9bea4ad7dbe9ceb0f27c5dad
Instruction ID: 9ac36075ec9c16d59b041f6043e3bf6884365516747e0456ef2d09bd5f56131e
Opcode Fuzzy Hash: c5e77b8b5ed93edc6e358bf50421f9f6a23933fe9bea4ad7dbe9ceb0f27c5dad
Instruction Fuzzy Hash: D031D3720043846FEB228F65CC44FA7BFACEF05310F0888AEF985DB152D224A409CB71

Uniqueness

Uniqueness Score: -1.00%

Function 015CAB76 Relevance: 1.6, APIs: 1, Instructions: 93
pipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreatePipe.KERNELBASE(?,00000E2C,?,?), ref: 015CAC36

Memory Dump Source

Source File: 00000014.00000002.484127246.00000000015CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 015CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_15ca000_unarchiver.jbxd

Similarity

API ID: CreatePipe
String ID:
API String ID: 2719314638-0
Opcode ID: c18c35b90037385d640f6cf6e9848aca9d7a33eda4cf0c3c920bb4ec9e4b6b6a
Instruction ID: a5ff1647690cf6d0485e9a287a57d29f8b49420354eae0162d6e88f42afaeebd
Opcode Fuzzy Hash: c18c35b90037385d640f6cf6e9848aca9d7a33eda4cf0c3c920bb4ec9e4b6b6a
Instruction Fuzzy Hash: B6317A6250E7C46FD3138B718C61A92BFB4AF47610F1D84CBE8C48F1A3D2696919C776

Uniqueness

Uniqueness Score: -1.00%

Function 015CA4E8 Relevance: 1.6, APIs: 1, Instructions: 90
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 015CA589

Memory Dump Source

Source File: 00000014.00000002.484127246.00000000015CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 015CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_15ca000_unarchiver.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 062b13291c6895cf6d661e8e1802d9d4c435d584d91001dbefc31c627a86f45d
Instruction ID: 542c352fd1dbb2c547037acc6376d9f83b9ecce313d744fd392b5c8485331270
Opcode Fuzzy Hash: 062b13291c6895cf6d661e8e1802d9d4c435d584d91001dbefc31c627a86f45d
Instruction Fuzzy Hash: C4318F71504384AFE722CF65CD44F66BFE8EF45610F08849EE9859B252D375E408CB71

Uniqueness

Uniqueness Score: -1.00%

Function 015CA120 Relevance: 1.6, APIs: 1, Instructions: 85
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindNextFileW.KERNELBASE(?,00000E2C,?,?), ref: 015CA1C2

Memory Dump Source

Source File: 00000014.00000002.484127246.00000000015CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 015CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_15ca000_unarchiver.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 90a0daf710122aefc6635cf7be31e4075880116ae49601a2fc9345bd311b4a7f
Instruction ID: 7dee8153c9d5d65869b16db72a1f32c6d6834a5397392ef276b9acc9f90032ca
Opcode Fuzzy Hash: 90a0daf710122aefc6635cf7be31e4075880116ae49601a2fc9345bd311b4a7f
Instruction Fuzzy Hash: 2C31C17140D3C06FD7128B768C51B66BFB4EF87620F1981CBD9848F193D225A809C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 015CA9EC Relevance: 1.6, APIs: 1, Instructions: 82
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E2C,3B9D78EC,00000000,00000000,00000000,00000000), ref: 015CAA8C

Memory Dump Source

Source File: 00000014.00000002.484127246.00000000015CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 015CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_15ca000_unarchiver.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: c07d67d8e0b740eb9f98301bc02f76684d30e7146dbf31cb23ece6c364f8cba0
Instruction ID: d6ff77a2596567a66d23d1b0987bcc98306feeba776c5843a3dc61500ba4ec1f
Opcode Fuzzy Hash: c07d67d8e0b740eb9f98301bc02f76684d30e7146dbf31cb23ece6c364f8cba0
Instruction Fuzzy Hash: E2218D72504744AFE722CF59DC44FA7BFA8AF45710F08849AE9858B252E264E908CB61

Uniqueness

Uniqueness Score: -1.00%

Function 015CB276 Relevance: 1.6, APIs: 1, Instructions: 80
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E2C), ref: 015CB2F3

Memory Dump Source

Source File: 00000014.00000002.484127246.00000000015CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 015CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_15ca000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 561c8c69e8f9e4d9583c17a8151f08addba3b19db315a812f7c937a8706b985b
Instruction ID: afef5af86f077880e969af6ac56a2d96c83019109ff2537b6b057d9902dfa496
Opcode Fuzzy Hash: 561c8c69e8f9e4d9583c17a8151f08addba3b19db315a812f7c937a8706b985b
Instruction Fuzzy Hash: 6821C172500204AFEB218F65DC85FABFBACFF04710F04896EED459B251D675A508CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 015CA41B Relevance: 1.6, APIs: 1, Instructions: 80
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNELBASE(?,00000E2C,?,?), ref: 015CA4C2

Memory Dump Source

Source File: 00000014.00000002.484127246.00000000015CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 015CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_15ca000_unarchiver.jbxd

Similarity

API ID: PathTemp
String ID:
API String ID: 2920410445-0
Opcode ID: 1cfc8e8b82432a99b751ab701745f2817ab267714f83a128a66c89c363ac39d7
Instruction ID: 92f9d1454273b5f10c5ad5af814dea5d9f1ba2c86ba1af19b4bf136ec98297d8
Opcode Fuzzy Hash: 1cfc8e8b82432a99b751ab701745f2817ab267714f83a128a66c89c363ac39d7
Instruction Fuzzy Hash: 592191714097806FD7138B25CC51B62BFB8EF87714F0A81DBE8848B593D224A919C7B2

Uniqueness

Uniqueness Score: -1.00%

Function 015CAD2A Relevance: 1.6, APIs: 1, Instructions: 80
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E2C), ref: 015CADA7

Memory Dump Source

Source File: 00000014.00000002.484127246.00000000015CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 015CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_15ca000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: a5a7092f5cc951aae293b5eaeaf90cb34555b9e13b97ebb30870a94f87794b38
Instruction ID: d91a623249cd100dbeffe907b98ff6f36b081bb00e15e238e68ddfaacc1d0b61
Opcode Fuzzy Hash: a5a7092f5cc951aae293b5eaeaf90cb34555b9e13b97ebb30870a94f87794b38
Instruction Fuzzy Hash: BA21C472500208AFEB218F69DC44FABFBACEF04714F14886EED459B251D634A548CB71

Uniqueness

Uniqueness Score: -1.00%

Function 015CA75C Relevance: 1.6, APIs: 1, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNELBASE(?,00000E2C,3B9D78EC,00000000,00000000,00000000,00000000), ref: 015CA7EA

Memory Dump Source

Source File: 00000014.00000002.484127246.00000000015CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 015CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_15ca000_unarchiver.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 5c62f0cdca4285381ad60a104c23b1066b203d546fa22bab3fd587de0ea5ed22
Instruction ID: 7604bae4d1de06d4dba22c0c5a634415b4eff8bc9a6224c24e3bc696a81a2bf7
Opcode Fuzzy Hash: 5c62f0cdca4285381ad60a104c23b1066b203d546fa22bab3fd587de0ea5ed22
Instruction Fuzzy Hash: B22192714083806FE7128B65DC40FA6BFA8EF46714F0884EAE9849F153D265A809C772

Uniqueness

Uniqueness Score: -1.00%

Function 015CA83F Relevance: 1.6, APIs: 1, Instructions: 77
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000E2C,3B9D78EC,00000000,00000000,00000000,00000000), ref: 015CA8CD

Memory Dump Source

Source File: 00000014.00000002.484127246.00000000015CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 015CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_15ca000_unarchiver.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 66d72f1bb6c3f1437eb3697b872c85dbd414d259f90ebb4e3fe91398bcd91924
Instruction ID: 707451c26435f568ca72abd69bc7435fb7bc2d7a6313a88d6e4e2eb130689ccd
Opcode Fuzzy Hash: 66d72f1bb6c3f1437eb3697b872c85dbd414d259f90ebb4e3fe91398bcd91924
Instruction Fuzzy Hash: 5521A171409380AFDB228F65DC55F97BFB8EF46310F08849BE9849F152D265A408CB72

Uniqueness

Uniqueness Score: -1.00%

Function 015CA50A Relevance: 1.6, APIs: 1, Instructions: 76
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 015CA589

Memory Dump Source

Source File: 00000014.00000002.484127246.00000000015CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 015CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_15ca000_unarchiver.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 44b3a3cf336189f190844c1406e7236e2a675d6f70b5f5cc1f3bbf954cd27333
Instruction ID: 611c194d91cf193feaf0059b90135697c6dcfd5d5f821143abbc70b294181d91
Opcode Fuzzy Hash: 44b3a3cf336189f190844c1406e7236e2a675d6f70b5f5cc1f3bbf954cd27333
Instruction Fuzzy Hash: F4218B71500244AFEB21DFA9CD84B6AFFE8EF14710F08886EE9858B252E775E404CA61

Uniqueness

Uniqueness Score: -1.00%

Function 015CB737 Relevance: 1.6, APIs: 1, Instructions: 74
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnumThreadWindows.USER32(?,00000E2C,?,?), ref: 015CB7D6

Memory Dump Source

Source File: 00000014.00000002.484127246.00000000015CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 015CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_15ca000_unarchiver.jbxd

Similarity

API ID: EnumThreadWindows
String ID:
API String ID: 2941952884-0
Opcode ID: e1653243c7173516cbdae8eb3b13eccc4d4d645e5444f3e4ae1709a6de3ca357
Instruction ID: 850b168cbec87fd10b605c91fd8513a6fe53988bc0ad8073bbf8b886ba39e7a4
Opcode Fuzzy Hash: e1653243c7173516cbdae8eb3b13eccc4d4d645e5444f3e4ae1709a6de3ca357
Instruction Fuzzy Hash: 7E21627150E7C06FD3139B258C55B22BFB4EF47610F0A81DFD8848B5A3D228A919C7B2

Uniqueness

Uniqueness Score: -1.00%

Function 015CA69B Relevance: 1.6, APIs: 1, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNELBASE(?,00000E2C,3B9D78EC,00000000,00000000,00000000,00000000), ref: 015CA721

Memory Dump Source

Source File: 00000014.00000002.484127246.00000000015CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 015CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_15ca000_unarchiver.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 6ca8471f1ac195e6268d4ed1f436f524e0c6d540ca663c63245efe2386f2a5b6
Instruction ID: ba71177b61be9dd2f6c71cddcb78b2cb41d69ae1174efc8745e0229c72a34e5c
Opcode Fuzzy Hash: 6ca8471f1ac195e6268d4ed1f436f524e0c6d540ca663c63245efe2386f2a5b6
Instruction Fuzzy Hash: F121C6754083846FE7128B65DC50BA6BFBCEF46714F1880DBE9849F253D264A909C772

Uniqueness

Uniqueness Score: -1.00%

Function 015CA917 Relevance: 1.6, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,?), ref: 015CA997

Memory Dump Source

Source File: 00000014.00000002.484127246.00000000015CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 015CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_15ca000_unarchiver.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 537395b52b72ef8805f2e7dfb3acfc861e7eb64a140518b2b684ea51113e5276
Instruction ID: 66138f773730e537f991c755b1c135dc4f3161ed10247075aaf956f748f95af6
Opcode Fuzzy Hash: 537395b52b72ef8805f2e7dfb3acfc861e7eb64a140518b2b684ea51113e5276
Instruction Fuzzy Hash: AA21AF765083C45FE712CB69DC55B96BFE8AF06214F0980EAD984CF153E3249949CB61

Uniqueness

Uniqueness Score: -1.00%

Function 015CAA12 Relevance: 1.6, APIs: 1, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E2C,3B9D78EC,00000000,00000000,00000000,00000000), ref: 015CAA8C

Memory Dump Source

Source File: 00000014.00000002.484127246.00000000015CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 015CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_15ca000_unarchiver.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 8a6fc01a6d710774125ecc10f1fdc2ed3a1faba1889db954a198121b65450255
Instruction ID: 1c16f3df0ce9c1ad474c74e40918591c0445d74c16cca11273a0659b2ac0092e
Opcode Fuzzy Hash: 8a6fc01a6d710774125ecc10f1fdc2ed3a1faba1889db954a198121b65450255
Instruction Fuzzy Hash: 6B218171600604AFE721CF59DD84FA7BBECEF04714F08846AE9459B251E6A4E508CA71

Uniqueness

Uniqueness Score: -1.00%

Function 015CB5BD Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 015CB63E

Memory Dump Source

Source File: 00000014.00000002.484127246.00000000015CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 015CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_15ca000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 1cf615af9c84ab3c98f7c2a1560240a9b627002adc38ec95ee1fb461385c3624
Instruction ID: 97a502d9a8253261acf0b75a57c3e76c9080b7a7e0316bfb8f494d0b01dc11d7
Opcode Fuzzy Hash: 1cf615af9c84ab3c98f7c2a1560240a9b627002adc38ec95ee1fb461385c3624
Instruction Fuzzy Hash: 2C216072409380AFDB138F65DC54A52BFB4EF46214F0884DEED858F163D2759518DB61

Uniqueness

Uniqueness Score: -1.00%

Function 015CA5E0 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 015CA654

Memory Dump Source

Source File: 00000014.00000002.484127246.00000000015CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 015CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_15ca000_unarchiver.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 95fb8b9648b9b498b253f5b9e75fd89f92adbda40f5e3ebef32e0acf4c2b3507
Instruction ID: 5a2c94ae11aba6f0ebb3fc7589d86e0bdc574b43841bf0aefe4eccacf29d9cbe
Opcode Fuzzy Hash: 95fb8b9648b9b498b253f5b9e75fd89f92adbda40f5e3ebef32e0acf4c2b3507
Instruction Fuzzy Hash: FD21B0758093C05FD7138B25DC94752BFB8AF42220F0980DFDC858F1A3D2289948C7B2

Uniqueness

Uniqueness Score: -1.00%

Function 015CA86E Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,00000E2C,3B9D78EC,00000000,00000000,00000000,00000000), ref: 015CA8CD

Memory Dump Source

Source File: 00000014.00000002.484127246.00000000015CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 015CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_15ca000_unarchiver.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: cd22051bc7937959e4001ea98f35d9610421a85caec4aa4531dc62283c94863d
Instruction ID: a5f230854082f04f0e2938ef25c98929b5d2d11eb639d5635757e2812bfa4c22
Opcode Fuzzy Hash: cd22051bc7937959e4001ea98f35d9610421a85caec4aa4531dc62283c94863d
Instruction Fuzzy Hash: 9411B271400204AFEB218F95DC41BABFFA8EF44714F18886BEE459F252D275A408CB72

Uniqueness

Uniqueness Score: -1.00%

Function 015CA78E Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,00000E2C,3B9D78EC,00000000,00000000,00000000,00000000), ref: 015CA7EA

Memory Dump Source

Source File: 00000014.00000002.484127246.00000000015CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 015CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_15ca000_unarchiver.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: c36a6eb8cab276ae540aa37ca12d3f6a81138aa36740b226caf91bbcee01331b
Instruction ID: 9026038998268bd3774459f23e0d55d2fb41e61f8db5c05dd87790738c3bb367
Opcode Fuzzy Hash: c36a6eb8cab276ae540aa37ca12d3f6a81138aa36740b226caf91bbcee01331b
Instruction Fuzzy Hash: F1118271500204AFEB219F55DC44BA7FFA8EF44724F18846BED459F241D675A408CB72

Uniqueness

Uniqueness Score: -1.00%

Function 015CB800 Relevance: 1.6, APIs: 1, Instructions: 59windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(?,?,?,?), ref: 015CB86D

Memory Dump Source

Source File: 00000014.00000002.484127246.00000000015CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 015CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_15ca000_unarchiver.jbxd

Similarity

API ID: Message
String ID:
API String ID: 2030045667-0
Opcode ID: babe9141b55416eb74ac0c869a8275075a4fc276c9ab0c33eb5da856fa762bd0
Instruction ID: f19ef4696bf0dc5c5d2e4303c4631fdcf7fdc06a8538c2643765efab58852489
Opcode Fuzzy Hash: babe9141b55416eb74ac0c869a8275075a4fc276c9ab0c33eb5da856fa762bd0
Instruction Fuzzy Hash: 891181B1904340AFEB218F19DC45B27FFA8EF45650F08849EED849B253D265E508CB71

Uniqueness

Uniqueness Score: -1.00%

Function 015CA2AE Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 015CA30C

Memory Dump Source

Source File: 00000014.00000002.484127246.00000000015CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 015CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_15ca000_unarchiver.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 46a64c899f2e99cdcef14951748a54835c36b0ce5860afc0b27396b3ae7cca27
Instruction ID: 35852d8e43e59878de50e2b8dff0beb90b53479f83116d23cb27852f9650c160
Opcode Fuzzy Hash: 46a64c899f2e99cdcef14951748a54835c36b0ce5860afc0b27396b3ae7cca27
Instruction Fuzzy Hash: AF11BC758093C49FD7238B25DC94A52BFB4EF07620F0980DFDD848F263D269A808CB62

Uniqueness

Uniqueness Score: -1.00%

Function 015CA952 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,?), ref: 015CA997

Memory Dump Source

Source File: 00000014.00000002.484127246.00000000015CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 015CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_15ca000_unarchiver.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: a58c9ada1f7d9b1e05929bc55ae7c2767791ad1d0c044965b16376ac9b846e68
Instruction ID: c5dc6833105ccb2ec87f717481ccf265991a565f4bdfea26288e416806526a25
Opcode Fuzzy Hash: a58c9ada1f7d9b1e05929bc55ae7c2767791ad1d0c044965b16376ac9b846e68
Instruction Fuzzy Hash: 7B113075A042449FDB11CF69D8857AAFFE8AB04610F18C4AEDD49CF242E774D444CB61

Uniqueness

Uniqueness Score: -1.00%

Function 015CA6CE Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E2C,3B9D78EC,00000000,00000000,00000000,00000000), ref: 015CA721

Memory Dump Source

Source File: 00000014.00000002.484127246.00000000015CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 015CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_15ca000_unarchiver.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 92ad4f0a695f281685688a5d149cbba095995ccb9e52b8e11fe67e58573b889e
Instruction ID: 72b9ac372ecb9b5ba381a5cb231e621f4a952dc487a147025829fc718bb6ba25
Opcode Fuzzy Hash: 92ad4f0a695f281685688a5d149cbba095995ccb9e52b8e11fe67e58573b889e
Instruction Fuzzy Hash: 9B01C471500204AEE7118F59DC85BA6FFECEF44724F18C4ABEE059F241E664A4088AB2

Uniqueness

Uniqueness Score: -1.00%

Function 015CAF8B Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(?), ref: 015CAFE4

Memory Dump Source

Source File: 00000014.00000002.484127246.00000000015CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 015CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_15ca000_unarchiver.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: ae674388818d4478917e83057d532adbe5c37f51b45711d73bf9e84d26fac3ca
Instruction ID: 7e8830c74581fe2d58337c7b30e2aae8fc1713ab440b3d18ab23c5470efb4b28
Opcode Fuzzy Hash: ae674388818d4478917e83057d532adbe5c37f51b45711d73bf9e84d26fac3ca
Instruction Fuzzy Hash: 1311C1715093809FD7128B25DC45B52BFB8EF06220F0884DFDD858F263C225A848DB61

Uniqueness

Uniqueness Score: -1.00%

Function 015CB1B4 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(?), ref: 015CB208

Memory Dump Source

Source File: 00000014.00000002.484127246.00000000015CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 015CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_15ca000_unarchiver.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: dcad84f49ec7fe890682e19a0ad33ff05b5a27bba4902afaba4eb57e3e47dc3e
Instruction ID: 0a8a8cce62447da2cbd137e8ef8f955f8c8b0f7c6d3e440bd2a46d256a3726d5
Opcode Fuzzy Hash: dcad84f49ec7fe890682e19a0ad33ff05b5a27bba4902afaba4eb57e3e47dc3e
Instruction Fuzzy Hash: BC1173714093809FD7128F25DC45B56FFB8DF46220F1884EBDD849F253D275A548CB62

Uniqueness

Uniqueness Score: -1.00%

Function 015CA172 Relevance: 1.5, APIs: 1, Instructions: 47fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNELBASE(?,00000E2C,?,?), ref: 015CA1C2

Memory Dump Source

Source File: 00000014.00000002.484127246.00000000015CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 015CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_15ca000_unarchiver.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 24e3d8b62be19e5b819a86038f74ee59c8b5043d31d669a57527b9c65fc7b3c7
Instruction ID: 1f2edd57ca422611d853dd28484d7777531db622f4bc95dc805a91972ecfcdac
Opcode Fuzzy Hash: 24e3d8b62be19e5b819a86038f74ee59c8b5043d31d669a57527b9c65fc7b3c7
Instruction Fuzzy Hash: ED01D471940600ABD710DF16DC81B26FBA8FB88B20F14816AED088B741D335F515CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 015CABE6 Relevance: 1.5, APIs: 1, Instructions: 47pipeCOMMON

Download Yara Rule

APIs

CreatePipe.KERNELBASE(?,00000E2C,?,?), ref: 015CAC36

Memory Dump Source

Source File: 00000014.00000002.484127246.00000000015CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 015CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_15ca000_unarchiver.jbxd

Similarity

API ID: CreatePipe
String ID:
API String ID: 2719314638-0
Opcode ID: 7604a5a56aa9e60e825812bb2ddbbaf3b2edf17fb1e98f8339acff5bcfb9985a
Instruction ID: a9072cdd64895bcaf3eef337cfd4071fb05265fed27606d7d38e2b6fc3617ca2
Opcode Fuzzy Hash: 7604a5a56aa9e60e825812bb2ddbbaf3b2edf17fb1e98f8339acff5bcfb9985a
Instruction Fuzzy Hash: 0101D471940600ABD310DF16DC81B26FBA8FB88B20F14C16AED088B741D335F515CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 015CB822 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(?,?,?,?), ref: 015CB86D

Memory Dump Source

Source File: 00000014.00000002.484127246.00000000015CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 015CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_15ca000_unarchiver.jbxd

Similarity

API ID: Message
String ID:
API String ID: 2030045667-0
Opcode ID: b62eaa0faba0f11656d6278fc6a94be8af6fda1dd324f235de9cdd01d1675b19
Instruction ID: b451b8e46eba2c6796e89ab2e5a8733d86fc36ebcf3abdeed46fac0c135b3fe3
Opcode Fuzzy Hash: b62eaa0faba0f11656d6278fc6a94be8af6fda1dd324f235de9cdd01d1675b19
Instruction Fuzzy Hash: 8E0129759006009FEB208F5AD886B27FBE8FB14B60F08C49EDD459B252D265E448CAB2

Uniqueness

Uniqueness Score: -1.00%

Function 015CB5FA Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 015CB63E

Memory Dump Source

Source File: 00000014.00000002.484127246.00000000015CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 015CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_15ca000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 02852359f5f34b2e9ee91e1cd5a448eef6f42d027c20169b6ce7f095c65be64f
Instruction ID: 7270455453ef45187489d13434d877dee13c4a5cae1cd932281c2927d89b847d
Opcode Fuzzy Hash: 02852359f5f34b2e9ee91e1cd5a448eef6f42d027c20169b6ce7f095c65be64f
Instruction Fuzzy Hash: A7015B31400600DFDB218F95D845B66FFE4EF48720F0889AEDE894A612C276A458DF62

Uniqueness

Uniqueness Score: -1.00%

Function 015CA472 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetTempPathW.KERNELBASE(?,00000E2C,?,?), ref: 015CA4C2

Memory Dump Source

Source File: 00000014.00000002.484127246.00000000015CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 015CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_15ca000_unarchiver.jbxd

Similarity

API ID: PathTemp
String ID:
API String ID: 2920410445-0
Opcode ID: 98876ce555516e14bd9e2fa3c68022b42994f1e08726a72e874c565231ea24f9
Instruction ID: c146685b58993b5899b99dc14062c86211c1b122bc5bf111c45b7be674359a0a
Opcode Fuzzy Hash: 98876ce555516e14bd9e2fa3c68022b42994f1e08726a72e874c565231ea24f9
Instruction Fuzzy Hash: 0D01A271540600ABD210DF1ADC82B26FBA8FB88B20F14815AED084B741D335F515CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 015CB786 Relevance: 1.5, APIs: 1, Instructions: 43threadCOMMON

Download Yara Rule

APIs

EnumThreadWindows.USER32(?,00000E2C,?,?), ref: 015CB7D6

Memory Dump Source

Source File: 00000014.00000002.484127246.00000000015CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 015CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_15ca000_unarchiver.jbxd

Similarity

API ID: EnumThreadWindows
String ID:
API String ID: 2941952884-0
Opcode ID: aaff399cce1767c1a5a52132c72988112adcb878bb77dc6bc09b3d10217beb3a
Instruction ID: b095527e6d2e6e9ebf2ba233db7397514e319f922131a3e40a39ff62b625e37c
Opcode Fuzzy Hash: aaff399cce1767c1a5a52132c72988112adcb878bb77dc6bc09b3d10217beb3a
Instruction Fuzzy Hash: 0001A271540600ABD210DF1ADC82B26FBA8FB88B20F14C15AED084B741D335F515CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 015CA622 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 015CA654

Memory Dump Source

Source File: 00000014.00000002.484127246.00000000015CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 015CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_15ca000_unarchiver.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: e62efbb72a17f9778166f8fca273ad4f6acf45d011883df116d229f52e154a13
Instruction ID: 41fea7bbf939d42dc6c48930a229a389c64c0f4e1303e9f7efc859abf0ead88d
Opcode Fuzzy Hash: e62efbb72a17f9778166f8fca273ad4f6acf45d011883df116d229f52e154a13
Instruction Fuzzy Hash: 0701BC319002049FDB118F69D884766FFA8EF40620F08C4AFDD498F202E679A448CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 015CB1D6 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(?), ref: 015CB208

Memory Dump Source

Source File: 00000014.00000002.484127246.00000000015CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 015CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_15ca000_unarchiver.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 8af0d89980cd6d8858c3e1b32be8f525fdb78cc28ec1d882db7c0c6e9fce1865
Instruction ID: f74e535375da4225e8009341356b3071bef16aeb3543d19075a016a625810433
Opcode Fuzzy Hash: 8af0d89980cd6d8858c3e1b32be8f525fdb78cc28ec1d882db7c0c6e9fce1865
Instruction Fuzzy Hash: 5401AD708042409FDB10CF59E88576AFBE8EF44720F18C4AFDD498F206D279A408CB62

Uniqueness

Uniqueness Score: -1.00%

Function 015CAFB2 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(?), ref: 015CAFE4

Memory Dump Source

Source File: 00000014.00000002.484127246.00000000015CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 015CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_15ca000_unarchiver.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 60b2e0248bb85639a38a5978424110f91c050c22e4afef9802dee45a102f1deb
Instruction ID: db6ad56e3672d8d3aee73edc837f969e905fe19a4e35123cd00f12f194aa21fa
Opcode Fuzzy Hash: 60b2e0248bb85639a38a5978424110f91c050c22e4afef9802dee45a102f1deb
Instruction Fuzzy Hash: 4301AD799002449FDB118F19D885766FFA4EF04720F08C4AFDD459F252E679A448DA62

Uniqueness

Uniqueness Score: -1.00%

Function 015CA2DA Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 015CA30C

Memory Dump Source

Source File: 00000014.00000002.484127246.00000000015CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 015CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_15ca000_unarchiver.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 94432608840ec96b78ec80fb71a0fea9608869ae5c9212641f66e00b5d1036be
Instruction ID: c20ffca933b26e3aa6f5f0be088f0e087b0bd9302723923e4afd91b49cd34edc
Opcode Fuzzy Hash: 94432608840ec96b78ec80fb71a0fea9608869ae5c9212641f66e00b5d1036be
Instruction Fuzzy Hash: 94F0AF34904244DFDB208F4AD884766FFA4EF04B20F18C4AFDD494F216E3B9A448CE62

Uniqueness

Uniqueness Score: -1.00%

Function 054A1419 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.484628823.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_54a0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a78eff105b129860ba53d452f06eabb83e9d48696532d11b40597449d79d0964
Instruction ID: 8f11c797be3abf7730f9c7fcf268c1d9d9b0de84086b0bd9c6e6f09ea6039169
Opcode Fuzzy Hash: a78eff105b129860ba53d452f06eabb83e9d48696532d11b40597449d79d0964
Instruction Fuzzy Hash: 6151E570E42219DFDB18DFB5D880AEEBBB6FF8A600F209469D405B7390DB359942CB54

Uniqueness

Uniqueness Score: -1.00%

Function 054A12F8 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.484628823.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_54a0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd2d6b07702474defa3aee991dd0f0c501632f6d4de2913fedb4b6e26dd704e1
Instruction ID: 3845e71d48c7ceed1ceea4838a965b9f1e70f0509b831a9e8fda34674c765fa9
Opcode Fuzzy Hash: bd2d6b07702474defa3aee991dd0f0c501632f6d4de2913fedb4b6e26dd704e1
Instruction Fuzzy Hash: F5111871E11208DFCB44DFA8E8849EEBBB6FB8A310F10142AE905B7350DB716D06CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02E707FA Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.484339783.0000000002E70000.00000040.00000020.00020000.00000000.sdmp, Offset: 02E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_2e70000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5634e756ad103875855b421ad665fad24d3d75e04d0a060bfa199dd19b9223bd
Instruction ID: fcef9a0fb9d90ea404b361d0c858ea383cf78e0f4e4b6c44f6e9c609785ab048
Opcode Fuzzy Hash: 5634e756ad103875855b421ad665fad24d3d75e04d0a060bfa199dd19b9223bd
Instruction Fuzzy Hash: 1E0152724093946FD702DF15DC41957BFF8DF86620B08C5AFE8898B216D2656918CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 054A1620 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.484628823.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_54a0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb80b4c1175a8ce31c5c43eee86a4028f6aab5a1a93ec4b4465e0a82429669cf
Instruction ID: 707e8d287b58725465a53bfd9fc77b997c25cedc47247968278f027a8a4d3ef8
Opcode Fuzzy Hash: fb80b4c1175a8ce31c5c43eee86a4028f6aab5a1a93ec4b4465e0a82429669cf
Instruction Fuzzy Hash: 72111371C05309DFCB48EFB4C4456AEBBB0AB41301F64A5AAC415A3381D7789A84CB95

Uniqueness

Uniqueness Score: -1.00%

Function 02E705CF Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.484339783.0000000002E70000.00000040.00000020.00020000.00000000.sdmp, Offset: 02E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_2e70000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74939409958394a76a64475b9011c16789d8206129c0ac6fd14260be2c5fffe3
Instruction ID: 93489ba77a3d30b2b6d638996e8d649a0d60b856336e704b715c90eee34dadfd
Opcode Fuzzy Hash: 74939409958394a76a64475b9011c16789d8206129c0ac6fd14260be2c5fffe3
Instruction Fuzzy Hash: B601A77150D7805FD712CB16EC40963FFB8EF86620708C5DFEC898B652D225A808CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 054A1630 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.484628823.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_54a0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 429ee71fba69786fc34c23ab4cc8dc3d32fff41c18e4b19eca70a8101326a438
Instruction ID: d7b60d521b7fc988227b08c1aef86d96626c2020e7638975c7a1638e75ca86ba
Opcode Fuzzy Hash: 429ee71fba69786fc34c23ab4cc8dc3d32fff41c18e4b19eca70a8101326a438
Instruction Fuzzy Hash: A101E4B1D01209DFCB48EFB4C4857AEBBB1BB45301F6069AAC415B3380D7749A94CF95

Uniqueness

Uniqueness Score: -1.00%

Function 054A13A8 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.484628823.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_54a0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05917105aaff88f864f073236301fdfffbcd1429a1cf94a12f8c8fc86b556baa
Instruction ID: 37d1646d629b906eed31dcde2baee69859475484ac4b4b38dfb6b32196dbe5f7
Opcode Fuzzy Hash: 05917105aaff88f864f073236301fdfffbcd1429a1cf94a12f8c8fc86b556baa
Instruction Fuzzy Hash: 89F03CB5D04609EBCB44DFA9C9816EEBBF1FF84301F2095A9C404A7300D7315A00DB91

Uniqueness

Uniqueness Score: -1.00%

Function 02E7081E Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.484339783.0000000002E70000.00000040.00000020.00020000.00000000.sdmp, Offset: 02E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_2e70000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee6c01d8c0f6ae2d7a05586edba5dbfba323be43cdc54d238468803730b73cf4
Instruction ID: 51b121110e26c672fe59d1430af00c6c25c37707f927fa57e4c65538055931fb
Opcode Fuzzy Hash: ee6c01d8c0f6ae2d7a05586edba5dbfba323be43cdc54d238468803730b73cf4
Instruction Fuzzy Hash: 1AF082B29452046FD240DF0AED41857F7ECDF84621B14C56FEC088B305E276A9148EF2

Uniqueness

Uniqueness Score: -1.00%

Function 02E705F6 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.484339783.0000000002E70000.00000040.00000020.00020000.00000000.sdmp, Offset: 02E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_2e70000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ca334f2e26122b78ecca2dfbbd0659c20146dc837c50674a0925cef793d1fb8
Instruction ID: 38ce135e9a8c54966384639196dcd731f5c7b7645ae88754a6861b8c94dc5e8e
Opcode Fuzzy Hash: 6ca334f2e26122b78ecca2dfbbd0659c20146dc837c50674a0925cef793d1fb8
Instruction Fuzzy Hash: F8E06D76A046004BD650DF0BEC81452FB98EB88630718C07FDC0D8B701E23AB505CEA6

Uniqueness

Uniqueness Score: -1.00%

Function 015C23F4 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.484122236.00000000015C2000.00000040.00000800.00020000.00000000.sdmp, Offset: 015C2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_15c2000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 651bc7935164ea3d35f9388076aa201f977997622a2f825c02343700db09d552
Instruction ID: 4d3c03f0d89a42d093bbe7b36b60c2de5049ba03ba056b937f840c46a26cea0a
Opcode Fuzzy Hash: 651bc7935164ea3d35f9388076aa201f977997622a2f825c02343700db09d552
Instruction Fuzzy Hash: 31D05E79215A814FE3268E1CC1E8B997FE4BB51B04F4A44FDE8408F663C368D981D200

Uniqueness

Uniqueness Score: -1.00%

Function 015C23BC Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.484122236.00000000015C2000.00000040.00000800.00020000.00000000.sdmp, Offset: 015C2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_15c2000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5793fe31b2558d142b805a24e30504e018126dffd9fc3d83007e8372b08dfaf6
Instruction ID: 6f6991d4506c8e9a1f6c186c763852d6e2bd0a0369f27af184848cbfb7ace55b
Opcode Fuzzy Hash: 5793fe31b2558d142b805a24e30504e018126dffd9fc3d83007e8372b08dfaf6
Instruction Fuzzy Hash: 5AD05E343002814FDB15DF0CC594F5D3BD4BB41F04F0644ECAC008F662C3A8D881C600

Uniqueness

Uniqueness Score: -1.00%

Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\oluilyf2.xu4\SARS OUTSTANDING LETTER OF DEMAND.html, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\evppz250.yan\SARS OUTSTANDING LETTER OF DEMAND.html, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\fsnnqwuj.h1e\SARS OUTSTANDING LETTER OF DEMAND.html, type: DROPPED

Source: https://cloudfiles.io/	HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-P8KQL93
Source: https://cloudfiles.io/	HTTP Parser: Iframe src: https://www.youtube.com/embed/1rkTwk6PKdY?autoplay=0&mute=0&controls=0&origin=https%3A%2F%2Fcloudfiles.io&playsinline=1&showinfo=0&rel=0&iv_load_policy=3&modestbranding=1&enablejsapi=1&widgetid=1
Source: https://cloudfiles.io/	HTTP Parser: Iframe src: https://app.hubspot.com/conversations-visitor/20182553/threads/utk/e86f3294fabf4298bfb6731338a898f9?uuid=9cb37ca1f6ae46778bde47f4ac4692ca&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=cloudfiles.io&inApp53=false&messagesUtk=e86f3294fabf4298bfb6731338a898f9&url=https%3A%2F%2Fcloudfiles.io%2F&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=false&enableWidgetCookieBanner=false&isInCMS=false
Source: https://cloudfiles.io/	HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-P8KQL93
Source: https://cloudfiles.io/	HTTP Parser: Iframe src: https://www.youtube.com/embed/1rkTwk6PKdY?autoplay=0&mute=0&controls=0&origin=https%3A%2F%2Fcloudfiles.io&playsinline=1&showinfo=0&rel=0&iv_load_policy=3&modestbranding=1&enablejsapi=1&widgetid=1
Source: https://cloudfiles.io/	HTTP Parser: Iframe src: https://app.hubspot.com/conversations-visitor/20182553/threads/utk/e86f3294fabf4298bfb6731338a898f9?uuid=9cb37ca1f6ae46778bde47f4ac4692ca&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=cloudfiles.io&inApp53=false&messagesUtk=e86f3294fabf4298bfb6731338a898f9&url=https%3A%2F%2Fcloudfiles.io%2F&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=false&enableWidgetCookieBanner=false&isInCMS=false
Source: https://cloudfiles.io/	HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-P8KQL93
Source: https://cloudfiles.io/	HTTP Parser: Iframe src: https://www.youtube.com/embed/1rkTwk6PKdY?autoplay=0&mute=0&controls=0&origin=https%3A%2F%2Fcloudfiles.io&playsinline=1&showinfo=0&rel=0&iv_load_policy=3&modestbranding=1&enablejsapi=1&widgetid=1
Source: https://cloudfiles.io/	HTTP Parser: Iframe src: https://app.hubspot.com/conversations-visitor/20182553/threads/utk/e86f3294fabf4298bfb6731338a898f9?uuid=9cb37ca1f6ae46778bde47f4ac4692ca&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=cloudfiles.io&inApp53=false&messagesUtk=e86f3294fabf4298bfb6731338a898f9&url=https%3A%2F%2Fcloudfiles.io%2F&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=false&enableWidgetCookieBanner=false&isInCMS=false

Source: https://cloudfiles.io/	HTTP Parser: HTML title missing
Source: https://cloudfiles.io/	HTTP Parser: HTML title missing
Source: https://cloudfiles.io/	HTTP Parser: HTML title missing

Source: https://cloudfiles.io/	HTTP Parser: No <meta name="author".. found
Source: https://cloudfiles.io/	HTTP Parser: No <meta name="author".. found
Source: https://cloudfiles.io/	HTTP Parser: No <meta name="author".. found

Source: https://cloudfiles.io/	HTTP Parser: No <meta name="copyright".. found
Source: https://cloudfiles.io/	HTTP Parser: No <meta name="copyright".. found
Source: https://cloudfiles.io/	HTTP Parser: No <meta name="copyright".. found

Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 4x nop then jmp 03020B1Ch	12_2_030202C8
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 4x nop then jmp 030211B7h	12_2_030202C8
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 4x nop then jmp 03020B1Ch	12_2_03020AB7
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 4x nop then jmp 03020B1Ch	12_2_030202B9
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 4x nop then jmp 03020B1Ch	12_2_03020A7C
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 4x nop then jmp 01210B1Ch	17_2_012102C8
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 4x nop then jmp 012111B7h	17_2_012102C8
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 4x nop then jmp 01210B1Ch	17_2_01210AB7
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 4x nop then jmp 01210B1Ch	17_2_012102BC
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 4x nop then jmp 01210B1Ch	17_2_01210A7C
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 4x nop then jmp 054A0B1Ch	20_2_054A02C8
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 4x nop then jmp 054A11B7h	20_2_054A02C8
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 4x nop then jmp 054A0B1Ch	20_2_054A02B9
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 4x nop then jmp 054A0B1Ch	20_2_054A0A7C
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 4x nop then jmp 054A0B1Ch	20_2_054A0AB7

Description:	Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation, but adversaries may also use compromised websites for non-exploitation behavior such as acquiring Application Access Token .
Tactics:	Initial Access
Data Sources:	Network device logs, Network intrusion detection system, Packet capture, Process use of network, SSL/TLS inspection, Web proxy
Platforms:	Linux, macOS, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://cloudfil.es/ly7mR8utBQ5

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\evppz250.yan\SARS OUTSTANDING LETTER OF DEMAND.html

C:\Users\user\AppData\Local\Temp\fsnnqwuj.h1e\SARS OUTSTANDING LETTER OF DEMAND.html

C:\Users\user\AppData\Local\Temp\oluilyf2.xu4\SARS OUTSTANDING LETTER OF DEMAND.html

C:\Users\user\AppData\Local\Temp\unarchiver.log

C:\Users\user\Downloads\22e8244c-6e16-464c-801c-35bec625d846.tmp

C:\Users\user\Downloads\97f61521-b3dd-4003-bb1c-5ea026c9e45a.tmp

C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND (1).zip (copy)

C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND (1).zip.crdownload

C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND (2).zip (copy)

C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND (2).zip.crdownload

C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND.zip (copy)

C:\Users\user\Downloads\SARS OUTSTANDING LETTER OF DEMAND.zip.crdownload

Static File Info

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: chrome.exePID: 5928, Parent PID: 3128

Windows Analysis Report
https://cloudfil.es/ly7mR8utBQ5

Function 030202C8 Relevance: 4.6, Strings: 3, Instructions: 892
COMMON

Function 0165B246 Relevance: 1.6, APIs: 1, Instructions: 101
COMMON

Function 0165AD04 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 0165AB76 Relevance: 1.6, APIs: 1, Instructions: 93
pipeCOMMON

Function 0165A4E8 Relevance: 1.6, APIs: 1, Instructions: 90
fileCOMMON

Function 0165A120 Relevance: 1.6, APIs: 1, Instructions: 84
fileCOMMON

Function 0165A9EC Relevance: 1.6, APIs: 1, Instructions: 82
registryCOMMON

Function 0165B276 Relevance: 1.6, APIs: 1, Instructions: 80
COMMON

Function 0165AD2A Relevance: 1.6, APIs: 1, Instructions: 80
COMMON

Function 0165A75C Relevance: 1.6, APIs: 1, Instructions: 78
COMMON

Function 0165A83F Relevance: 1.6, APIs: 1, Instructions: 77
fileCOMMON

Function 0165A50A Relevance: 1.6, APIs: 1, Instructions: 76
fileCOMMON