Edit tour

Windows Analysis Report
https://usdtmen.com

Overview

General Information

Sample URL:	https://usdtmen.com
Analysis ID:	756095
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

No HTML title found

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 3188 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://usdtmen.com/ MD5: 7BC7B4AEDC055BB02BCB52710132E9E1)

chrome.exe (PID: 6160 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1768,i,5818765958052219750,8192306715576805166,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8 MD5: 7BC7B4AEDC055BB02BCB52710132E9E1)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: https://usdtmen.com/index/passport/login.html	HTTP Parser: HTML title missing
Source: https://usdtmen.com/index/passport/login.html	HTTP Parser: HTML title missing

Source: https://usdtmen.com/index/passport/login.html	HTTP Parser: No <meta name="author".. found
Source: https://usdtmen.com/index/passport/login.html	HTTP Parser: No <meta name="author".. found

Source: https://usdtmen.com/index/passport/login.html	HTTP Parser: No <meta name="copyright".. found
Source: https://usdtmen.com/index/passport/login.html	HTTP Parser: No <meta name="copyright".. found

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\GoogleUpdater

Jump to behavior

Source: unknown	HTTPS traffic detected: 154.211.96.136:443 -> 192.168.2.3:49889 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 154.211.96.136:443 -> 192.168.2.3:49888 version: TLS 1.2

Source: unknown

DNS traffic detected: queries for: clients2.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 49695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49696
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49695
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49694
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 49694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 49696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49900
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 443

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=104.0.5112.102&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-104.0.5112.102Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: usdtmen.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /index/passport/logout.html HTTP/1.1Host: usdtmen.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_var=en-us; PHPSESSID=vg2hurq6g2m72it0ujr3nddhg4
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: usdtmen.comConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_var=en-us; PHPSESSID=vg2hurq6g2m72it0ujr3nddhg4
Source: global traffic	HTTP traffic detected: GET /index/passport/logout.html HTTP/1.1Host: usdtmen.comConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_var=en-us; PHPSESSID=vg2hurq6g2m72it0ujr3nddhg4
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=u&oit=1&cp=1&gs_rn=42&psi=qRYiebaDLQ80oWIb&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CLC1yQEIkrbJAQiitskBCMS2yQEIqZ3KAQiqj8sBCJahywEIi6vMAQj7u8wBCI+9zAEI6sDMAQidycwBCOPLzAEImNHMAQiZ0swBSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=us&oit=1&cp=2&gs_rn=42&psi=qRYiebaDLQ80oWIb&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CLC1yQEIkrbJAQiitskBCMS2yQEIqZ3KAQiqj8sBCJahywEIi6vMAQj7u8wBCI+9zAEI6sDMAQidycwBCOPLzAEImNHMAQiZ0swBSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=usd&oit=1&cp=3&gs_rn=42&psi=qRYiebaDLQ80oWIb&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CLC1yQEIkrbJAQiitskBCMS2yQEIqZ3KAQiqj8sBCJahywEIi6vMAQj7u8wBCI+9zAEI6sDMAQidycwBCOPLzAEImNHMAQiZ0swBSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=usdt&oit=1&cp=4&gs_rn=42&psi=qRYiebaDLQ80oWIb&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CLC1yQEIkrbJAQiitskBCMS2yQEIqZ3KAQiqj8sBCJahywEIi6vMAQj7u8wBCI+9zAEI6sDMAQidycwBCOPLzAEImNHMAQiZ0swBSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=usdtm&oit=1&cp=5&gs_rn=42&psi=qRYiebaDLQ80oWIb&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CLC1yQEIkrbJAQiitskBCMS2yQEIqZ3KAQiqj8sBCJahywEIi6vMAQj7u8wBCI+9zAEI6sDMAQidycwBCOPLzAEImNHMAQiZ0swBSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=usdtme&oit=1&cp=6&gs_rn=42&psi=qRYiebaDLQ80oWIb&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CLC1yQEIkrbJAQiitskBCMS2yQEIqZ3KAQiqj8sBCJahywEIi6vMAQj7u8wBCI+9zAEI6sDMAQidycwBCOPLzAEImNHMAQiZ0swBSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=usdtmen&oit=1&cp=7&gs_rn=42&psi=qRYiebaDLQ80oWIb&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CLC1yQEIkrbJAQiitskBCMS2yQEIqZ3KAQiqj8sBCJahywEIi6vMAQj7u8wBCI+9zAEI6sDMAQidycwBCOPLzAEImNHMAQiZ0swBSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=usdtmen%3E&oit=4&cp=8&gs_rn=42&psi=qRYiebaDLQ80oWIb&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CLC1yQEIkrbJAQiitskBCMS2yQEIqZ3KAQiqj8sBCJahywEIi6vMAQj7u8wBCI+9zAEI6sDMAQidycwBCOPLzAEImNHMAQiZ0swBSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=usdtmen%3EC&oit=4&cp=9&gs_rn=42&psi=qRYiebaDLQ80oWIb&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CLC1yQEIkrbJAQiitskBCMS2yQEIqZ3KAQiqj8sBCJahywEIi6vMAQj7u8wBCI+9zAEI6sDMAQidycwBCOPLzAEImNHMAQiZ0swBSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=usdtmen%3ECO&oit=4&cp=10&gs_rn=42&psi=qRYiebaDLQ80oWIb&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CLC1yQEIkrbJAQiitskBCMS2yQEIqZ3KAQiqj8sBCJahywEIi6vMAQj7u8wBCI+9zAEI6sDMAQidycwBCOPLzAEImNHMAQiZ0swBSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=usdtmen%3ECOM&oit=4&cp=11&gs_rn=42&psi=qRYiebaDLQ80oWIb&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CLC1yQEIkrbJAQiitskBCMS2yQEIqZ3KAQiqj8sBCJahywEIi6vMAQj7u8wBCI+9zAEI6sDMAQidycwBCOPLzAEImNHMAQiZ0swBSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=usdtmen%3ECO&oit=4&cp=10&gs_rn=42&psi=qRYiebaDLQ80oWIb&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CLC1yQEIkrbJAQiitskBCMS2yQEIqZ3KAQiqj8sBCJahywEIi6vMAQj7u8wBCI+9zAEI6sDMAQidycwBCOPLzAEImNHMAQiZ0swBSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=usdtmen%3EC&oit=4&cp=9&gs_rn=42&psi=qRYiebaDLQ80oWIb&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CLC1yQEIkrbJAQiitskBCMS2yQEIqZ3KAQiqj8sBCJahywEIi6vMAQj7u8wBCI+9zAEI6sDMAQidycwBCOPLzAEImNHMAQiZ0swBSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=usdtmen%3E&oit=4&cp=8&gs_rn=42&psi=qRYiebaDLQ80oWIb&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CLC1yQEIkrbJAQiitskBCMS2yQEIqZ3KAQiqj8sBCJahywEIi6vMAQj7u8wBCI+9zAEI6sDMAQidycwBCOPLzAEImNHMAQiZ0swBSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=usdtmen&oit=1&cp=7&gs_rn=42&psi=qRYiebaDLQ80oWIb&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CLC1yQEIkrbJAQiitskBCMS2yQEIqZ3KAQiqj8sBCJahywEIi6vMAQj7u8wBCI+9zAEI6sDMAQidycwBCOPLzAEImNHMAQiZ0swBSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=usdtmen&oit=1&cp=7&gs_rn=42&psi=qRYiebaDLQ80oWIb&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CLC1yQEIkrbJAQiitskBCMS2yQEIqZ3KAQiqj8sBCJahywEIi6vMAQj7u8wBCI+9zAEI6sDMAQidycwBCOPLzAEImNHMAQiZ0swBSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=usdtme&oit=1&cp=6&gs_rn=42&psi=qRYiebaDLQ80oWIb&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CLC1yQEIkrbJAQiitskBCMS2yQEIqZ3KAQiqj8sBCJahywEIi6vMAQj7u8wBCI+9zAEI6sDMAQidycwBCOPLzAEImNHMAQiZ0swBSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=usdtme%3C&oit=4&cp=7&gs_rn=42&psi=qRYiebaDLQ80oWIb&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CLC1yQEIkrbJAQiitskBCMS2yQEIqZ3KAQiqj8sBCJahywEIi6vMAQj7u8wBCI+9zAEI6sDMAQidycwBCOPLzAEImNHMAQiZ0swBSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=usdtme&oit=1&cp=6&gs_rn=42&psi=qRYiebaDLQ80oWIb&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CLC1yQEIkrbJAQiitskBCMS2yQEIqZ3KAQiqj8sBCJahywEIi6vMAQj7u8wBCI+9zAEI6sDMAQidycwBCOPLzAEImNHMAQiZ0swBSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=usdtmeN&oit=1&cp=7&gs_rn=42&psi=qRYiebaDLQ80oWIb&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CLC1yQEIkrbJAQiitskBCMS2yQEIqZ3KAQiqj8sBCJahywEIi6vMAQj7u8wBCI+9zAEI6sDMAQidycwBCOPLzAEImNHMAQiZ0swBSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CLC1yQEIkrbJAQiitskBCMS2yQEIqZ3KAQiqj8sBCJahywEIi6vMAQj7u8wBCI+9zAEI6sDMAQidycwBCOPLzAEImNHMAQiZ0swBSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CLC1yQEIkrbJAQiitskBCMS2yQEIqZ3KAQiqj8sBCJahywEIi6vMAQj7u8wBCI+9zAEI6sDMAQidycwBCOPLzAEImNHMAQiZ0swBSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=U&oit=1&cp=1&gs_rn=42&psi=qRYiebaDLQ80oWIb&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CLC1yQEIkrbJAQiitskBCMS2yQEIqZ3KAQiqj8sBCJahywEIi6vMAQj7u8wBCI+9zAEI6sDMAQidycwBCOPLzAEImNHMAQiZ0swBSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=US&oit=1&cp=2&gs_rn=42&psi=qRYiebaDLQ80oWIb&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CLC1yQEIkrbJAQiitskBCMS2yQEIqZ3KAQiqj8sBCJahywEIi6vMAQj7u8wBCI+9zAEI6sDMAQidycwBCOPLzAEImNHMAQiZ0swBSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=USD&oit=1&cp=3&gs_rn=42&psi=qRYiebaDLQ80oWIb&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CLC1yQEIkrbJAQiitskBCMS2yQEIqZ3KAQiqj8sBCJahywEIi6vMAQj7u8wBCI+9zAEI6sDMAQidycwBCOPLzAEImNHMAQiZ0swBSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=USDT&oit=1&cp=4&gs_rn=42&psi=qRYiebaDLQ80oWIb&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CLC1yQEIkrbJAQiitskBCMS2yQEIqZ3KAQiqj8sBCJahywEIi6vMAQj7u8wBCI+9zAEI6sDMAQidycwBCOPLzAEImNHMAQiZ0swBSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=USDTM&oit=1&cp=5&gs_rn=42&psi=qRYiebaDLQ80oWIb&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CLC1yQEIkrbJAQiitskBCMS2yQEIqZ3KAQiqj8sBCJahywEIi6vMAQj7u8wBCI+9zAEI6sDMAQidycwBCOPLzAEImNHMAQiZ0swBSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=USDTME&oit=1&cp=6&gs_rn=42&psi=qRYiebaDLQ80oWIb&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CLC1yQEIkrbJAQiitskBCMS2yQEIqZ3KAQiqj8sBCJahywEIi6vMAQj7u8wBCI+9zAEI6sDMAQidycwBCOPLzAEImNHMAQiZ0swBSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=USDTMEN&oit=1&cp=7&gs_rn=42&psi=qRYiebaDLQ80oWIb&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CLC1yQEIkrbJAQiitskBCMS2yQEIqZ3KAQiqj8sBCJahywEIi6vMAQj7u8wBCI+9zAEI6sDMAQidycwBCOPLzAEImNHMAQiZ0swBSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CLC1yQEIkrbJAQiitskBCMS2yQEIqZ3KAQiqj8sBCJahywEIi6vMAQj7u8wBCI+9zAEI6sDMAQidycwBCOPLzAEImNHMAQiZ0swBSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=wwusdtmen.com&oit=3&cp=2&gs_rn=42&psi=qRYiebaDLQ80oWIb&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CLC1yQEIkrbJAQiitskBCMS2yQEIqZ3KAQiqj8sBCJahywEIi6vMAQj7u8wBCI+9zAEI6sDMAQidycwBCOPLzAEImNHMAQiZ0swBSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=wusdtmen.com&oit=3&cp=1&gs_rn=42&psi=qRYiebaDLQ80oWIb&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CLC1yQEIkrbJAQiitskBCMS2yQEIqZ3KAQiqj8sBCJahywEIi6vMAQj7u8wBCI+9zAEI6sDMAQidycwBCOPLzAEImNHMAQiZ0swBSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=usdtmen.com&oit=3&cp=0&gs_rn=42&psi=qRYiebaDLQ80oWIb&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CLC1yQEIkrbJAQiitskBCMS2yQEIqZ3KAQiqj8sBCJahywEIi6vMAQj7u8wBCI+9zAEI6sDMAQidycwBCOPLzAEImNHMAQiZ0swBSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: usdtmen.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_var=en-us; PHPSESSID=vg2hurq6g2m72it0ujr3nddhg4
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: usdtmen.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_var=en-us; PHPSESSID=vg2hurq6g2m72it0ujr3nddhg4
Source: global traffic	HTTP traffic detected: GET /index/passport/logout.html HTTP/1.1Host: usdtmen.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_var=en-us; PHPSESSID=vg2hurq6g2m72it0ujr3nddhg4
Source: global traffic	HTTP traffic detected: GET /index/passport/login.html HTTP/1.1Host: usdtmen.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_var=en-us; PHPSESSID=vg2hurq6g2m72it0ujr3nddhg4
Source: global traffic	HTTP traffic detected: GET /image/weui.css HTTP/1.1Host: usdtmen.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://usdtmen.com/index/passport/login.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_var=en-us; PHPSESSID=vg2hurq6g2m72it0ujr3nddhg4
Source: global traffic	HTTP traffic detected: GET /image/bootstrap.min.css HTTP/1.1Host: usdtmen.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://usdtmen.com/index/passport/login.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_var=en-us; PHPSESSID=vg2hurq6g2m72it0ujr3nddhg4
Source: global traffic	HTTP traffic detected: GET /image/iconfont.css HTTP/1.1Host: usdtmen.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://usdtmen.com/index/passport/login.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_var=en-us; PHPSESSID=vg2hurq6g2m72it0ujr3nddhg4
Source: global traffic	HTTP traffic detected: GET /image/common.css HTTP/1.1Host: usdtmen.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://usdtmen.com/index/passport/login.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_var=en-us; PHPSESSID=vg2hurq6g2m72it0ujr3nddhg4
Source: global traffic	HTTP traffic detected: GET /image/zepto.min.js HTTP/1.1Host: usdtmen.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://usdtmen.com/index/passport/login.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_var=en-us; PHPSESSID=vg2hurq6g2m72it0ujr3nddhg4
Source: global traffic	HTTP traffic detected: GET /image/jquery.min.js HTTP/1.1Host: usdtmen.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://usdtmen.com/index/passport/login.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_var=en-us; PHPSESSID=vg2hurq6g2m72it0ujr3nddhg4
Source: global traffic	HTTP traffic detected: GET /image/weui.min.js HTTP/1.1Host: usdtmen.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://usdtmen.com/index/passport/login.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_var=en-us; PHPSESSID=vg2hurq6g2m72it0ujr3nddhg4
Source: global traffic	HTTP traffic detected: GET /layer3.1/layer.js HTTP/1.1Host: usdtmen.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://usdtmen.com/index/passport/login.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_var=en-us; PHPSESSID=vg2hurq6g2m72it0ujr3nddhg4
Source: global traffic	HTTP traffic detected: GET /image/common.js HTTP/1.1Host: usdtmen.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://usdtmen.com/index/passport/login.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_var=en-us; PHPSESSID=vg2hurq6g2m72it0ujr3nddhg4
Source: global traffic	HTTP traffic detected: GET /layer3.1/theme/default/layer.css?v=3.1.1 HTTP/1.1Host: usdtmen.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?1User-Agent: Mozilla/5.0 (Linux; Android 9.0; SAMSUNG SM-F900U Build/PPR1.180610.011) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Mobile Safari/537.36sec-ch-ua-platform: "Android"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://usdtmen.com/index/passport/login.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_var=en-us; PHPSESSID=vg2hurq6g2m72it0ujr3nddhg4
Source: global traffic	HTTP traffic detected: GET /image/logo.cba20b1b.png HTTP/1.1Host: usdtmen.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://usdtmen.com/index/passport/login.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_var=en-us; PHPSESSID=vg2hurq6g2m72it0ujr3nddhg4
Source: global traffic	HTTP traffic detected: GET /image/username_icon.png HTTP/1.1Host: usdtmen.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://usdtmen.com/index/passport/login.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_var=en-us; PHPSESSID=vg2hurq6g2m72it0ujr3nddhg4
Source: global traffic	HTTP traffic detected: GET /image/password_icon.png HTTP/1.1Host: usdtmen.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://usdtmen.com/index/passport/login.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_var=en-us; PHPSESSID=vg2hurq6g2m72it0ujr3nddhg4
Source: global traffic	HTTP traffic detected: GET /image/bg1.6c9f941a.png HTTP/1.1Host: usdtmen.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?1User-Agent: Mozilla/5.0 (Linux; Android 9.0; SAMSUNG SM-F900U Build/PPR1.180610.011) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Mobile Safari/537.36sec-ch-ua-platform: "Android"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://usdtmen.com/index/passport/login.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_var=en-us; PHPSESSID=vg2hurq6g2m72it0ujr3nddhg4
Source: global traffic	HTTP traffic detected: GET /image/en-us.jpg HTTP/1.1Host: usdtmen.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://usdtmen.com/index/passport/login.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_var=en-us; PHPSESSID=vg2hurq6g2m72it0ujr3nddhg4
Source: global traffic	HTTP traffic detected: GET /image/es-es.jpg HTTP/1.1Host: usdtmen.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://usdtmen.com/index/passport/login.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_var=en-us; PHPSESSID=vg2hurq6g2m72it0ujr3nddhg4
Source: global traffic	HTTP traffic detected: GET /image/pt-pt.jpg HTTP/1.1Host: usdtmen.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://usdtmen.com/index/passport/login.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_var=en-us; PHPSESSID=vg2hurq6g2m72it0ujr3nddhg4
Source: global traffic	HTTP traffic detected: GET /image/fr.jpg HTTP/1.1Host: usdtmen.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://usdtmen.com/index/passport/login.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_var=en-us; PHPSESSID=vg2hurq6g2m72it0ujr3nddhg4
Source: global traffic	HTTP traffic detected: GET /image/es-es.jpg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: usdtmen.com
Source: global traffic	HTTP traffic detected: GET /image/ar-ae.jpg HTTP/1.1Host: usdtmen.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://usdtmen.com/index/passport/login.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_var=en-us; PHPSESSID=vg2hurq6g2m72it0ujr3nddhg4
Source: global traffic	HTTP traffic detected: GET /image/ko.jpg HTTP/1.1Host: usdtmen.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://usdtmen.com/index/passport/login.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_var=en-us; PHPSESSID=vg2hurq6g2m72it0ujr3nddhg4
Source: global traffic	HTTP traffic detected: GET /image/en-us.jpg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: usdtmen.com
Source: global traffic	HTTP traffic detected: GET /image/pt-pt.jpg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: usdtmen.com
Source: global traffic	HTTP traffic detected: GET /image/fr.jpg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: usdtmen.com
Source: global traffic	HTTP traffic detected: GET /image/ar-ae.jpg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: usdtmen.com
Source: global traffic	HTTP traffic detected: GET /image/bootstrap.min.css.map HTTP/1.1Host: usdtmen.comConnection: keep-alivePragma: no-cacheCache-Control: no-cacheSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_var=en-us; PHPSESSID=vg2hurq6g2m72it0ujr3nddhg4
Source: global traffic	HTTP traffic detected: GET /image/ko.jpg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: usdtmen.com
Source: global traffic	HTTP traffic detected: GET /image/logo.cba20b1b.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: usdtmen.com
Source: global traffic	HTTP traffic detected: GET /image/username_icon.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: usdtmen.com
Source: global traffic	HTTP traffic detected: GET /image/password_icon.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: usdtmen.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: usdtmen.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: think_var=en-us; PHPSESSID=vg2hurq6g2m72it0ujr3nddhg4

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 29 Nov 2022 15:34:09 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encoding

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CONSENT=PENDING+620; __Secure-ENID=6.SE=cJKCBuSaL1dV3R8z2Y2al7-m2m5bGA74lqbYYkqC3uy-NtZ1f6n_bCBr25tlnnjvdmLpGQ81ZKzP3Te5vVjpSQjYWCwvlOMApK7tmZNWcORu0p4wniPJGQfTslQNnpQWhG9qkwkEgy49-6UG3UQ1eiUyFolJZWLeUM1p4KvjM9E

Source: unknown	HTTPS traffic detected: 154.211.96.136:443 -> 192.168.2.3:49889 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 154.211.96.136:443 -> 192.168.2.3:49888 version: TLS 1.2

Source: classification engine

Classification label: clean0.win@46/0@26/12

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://usdtmen.com/
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1768,i,5818765958052219750,8192306715576805166,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1768,i,5818765958052219750,8192306715576805166,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\GoogleUpdater

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\GoogleUpdater

Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	2 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	4 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	5 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	3 Ingress Tool Transfer	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://usdtmen.com	1%	Virustotal		Browse
https://usdtmen.com	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label	Link
https://beacons.gcp.gvt2.com/domainreliability/upload	0%	URL Reputation	safe
https://beacons.gvt2.com/domainreliability/upload	0%	URL Reputation	safe
https://usdtmen.com/index/passport/logout.html	0%	Avira URL Cloud	safe
https://usdtmen.com/image/weui.min.js	0%	Avira URL Cloud	safe
https://usdtmen.com/image/bg1.6c9f941a.png	0%	Avira URL Cloud	safe
https://usdtmen.com/image/fr.jpg	0%	Avira URL Cloud	safe
https://usdtmen.com/layer3.1/layer.js	0%	Avira URL Cloud	safe
https://usdtmen.com/image/common.css	0%	Avira URL Cloud	safe
https://usdtmen.com/layer3.1/theme/default/layer.css?v=3.1.1	0%	Avira URL Cloud	safe
https://beacons2.gvt2.com/domainreliability/upload-nel	0%	Avira URL Cloud	safe
https://usdtmen.com/index/passport/logout.html	3%	Virustotal		Browse
https://usdtmen.com/image/zepto.min.js	0%	Avira URL Cloud	safe
https://e2c27.gcp.gvt2.com/nel/	0%	Avira URL Cloud	safe
https://usdtmen.com/image/weui.css	0%	Avira URL Cloud	safe
https://usdtmen.com/	0%	Avira URL Cloud	safe
https://usdtmen.com/image/iconfont.css	0%	Avira URL Cloud	safe
https://usdtmen.com/image/jquery.min.js	0%	Avira URL Cloud	safe
https://usdtmen.com/image/es-es.jpg	0%	Avira URL Cloud	safe
https://usdtmen.com/image/password_icon.png	0%	Avira URL Cloud	safe
https://usdtmen.com/image/bootstrap.min.css	0%	Avira URL Cloud	safe
https://usdtmen.com/image/common.js	0%	Avira URL Cloud	safe
https://usdtmen.com/image/ko.jpg	0%	Avira URL Cloud	safe
https://usdtmen.com/image/username_icon.png	0%	Avira URL Cloud	safe
https://usdtmen.com/image/bootstrap.min.css.map	0%	Avira URL Cloud	safe
https://usdtmen.com/image/logo.cba20b1b.png	0%	Avira URL Cloud	safe
https://usdtmen.com/image/ar-ae.jpg	0%	Avira URL Cloud	safe
http://usdtmen.com/	0%	Avira URL Cloud	safe
https://usdtmen.com/image/pt-pt.jpg	0%	Avira URL Cloud	safe
https://usdtmen.com/image/en-us.jpg	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
accounts.google.com	142.250.186.109	true	false	high
beacons-handoff.gcp.gvt2.com	142.251.143.67	true	false	unknown
usdtmen.com	154.211.96.136	true	false	unknown
e2c27.gcp.gvt2.com	35.227.159.135	true	false	unknown
www.google.com	142.250.186.100	true	false	high
beacons2.gvt2.com	172.217.13.227	true	false	unknown
clients.l.google.com	142.250.185.206	true	false	high
beacons.gvt2.com	216.58.212.163	true	false	unknown
clients2.google.com	unknown	unknown	false	high
www.usdtmen.com	unknown	unknown	false	unknown
beacons.gcp.gvt2.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=USDTME&oit=1&cp=6&gs_rn=42&psi=qRYiebaDLQ80oWIb&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=usd&oit=1&cp=3&gs_rn=42&psi=qRYiebaDLQ80oWIb&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=wwusdtmen.com&oit=3&cp=2&gs_rn=42&psi=qRYiebaDLQ80oWIb&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=USDT&oit=1&cp=4&gs_rn=42&psi=qRYiebaDLQ80oWIb&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://usdtmen.com/layer3.1/layer.js	false	Avira URL Cloud: safe	unknown
https://beacons.gcp.gvt2.com/domainreliability/upload	false	URL Reputation: safe	unknown
https://usdtmen.com/image/fr.jpg	false	Avira URL Cloud: safe	unknown
https://usdtmen.com/image/bg1.6c9f941a.png	false	Avira URL Cloud: safe	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=USDTMEN&oit=1&cp=7&gs_rn=42&psi=qRYiebaDLQ80oWIb&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://usdtmen.com/index/passport/logout.html	false	3%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=usdtmen%3ECO&oit=4&cp=10&gs_rn=42&psi=qRYiebaDLQ80oWIb&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://usdtmen.com/image/weui.min.js	false	Avira URL Cloud: safe	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=usdtmen.com&oit=3&cp=0&gs_rn=42&psi=qRYiebaDLQ80oWIb&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=usdtmen%3E&oit=4&cp=8&gs_rn=42&psi=qRYiebaDLQ80oWIb&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://usdtmen.com/layer3.1/theme/default/layer.css?v=3.1.1	false	Avira URL Cloud: safe	unknown
https://usdtmen.com/index/passport/login.html	false		unknown
https://usdtmen.com/image/common.css	false	Avira URL Cloud: safe	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=U&oit=1&cp=1&gs_rn=42&psi=qRYiebaDLQ80oWIb&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://beacons2.gvt2.com/domainreliability/upload-nel	false	Avira URL Cloud: safe	unknown
https://usdtmen.com/index/passport/login.html	false		unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=usdtm&oit=1&cp=5&gs_rn=42&psi=qRYiebaDLQ80oWIb&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://usdtmen.com/image/zepto.min.js	false	Avira URL Cloud: safe	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=usdtmen%3ECOM&oit=4&cp=11&gs_rn=42&psi=qRYiebaDLQ80oWIb&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://e2c27.gcp.gvt2.com/nel/	false	Avira URL Cloud: safe	unknown
https://usdtmen.com/image/weui.css	false	Avira URL Cloud: safe	unknown
https://usdtmen.com/	false	Avira URL Cloud: safe	unknown
https://usdtmen.com/image/iconfont.css	false	Avira URL Cloud: safe	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=usdt&oit=1&cp=4&gs_rn=42&psi=qRYiebaDLQ80oWIb&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://usdtmen.com/image/jquery.min.js	false	Avira URL Cloud: safe	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=usdtmen&oit=1&cp=7&gs_rn=42&psi=qRYiebaDLQ80oWIb&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://usdtmen.com/image/es-es.jpg	false	Avira URL Cloud: safe	unknown
https://usdtmen.com/image/password_icon.png	false	Avira URL Cloud: safe	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=u&oit=1&cp=1&gs_rn=42&psi=qRYiebaDLQ80oWIb&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false		high
https://usdtmen.com/image/bootstrap.min.css	false	Avira URL Cloud: safe	unknown
https://beacons.gvt2.com/domainreliability/upload	false	URL Reputation: safe	unknown
https://usdtmen.com/image/common.js	false	Avira URL Cloud: safe	unknown
https://usdtmen.com/image/ko.jpg	false	Avira URL Cloud: safe	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=usdtmen%3EC&oit=4&cp=9&gs_rn=42&psi=qRYiebaDLQ80oWIb&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=USD&oit=1&cp=3&gs_rn=42&psi=qRYiebaDLQ80oWIb&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=us&oit=1&cp=2&gs_rn=42&psi=qRYiebaDLQ80oWIb&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=usdtme&oit=1&cp=6&gs_rn=42&psi=qRYiebaDLQ80oWIb&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://usdtmen.com/image/username_icon.png	false	Avira URL Cloud: safe	unknown
https://usdtmen.com/image/bootstrap.min.css.map	false	Avira URL Cloud: safe	unknown
https://usdtmen.com/image/logo.cba20b1b.png	false	Avira URL Cloud: safe	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=usdtmeN&oit=1&cp=7&gs_rn=42&psi=qRYiebaDLQ80oWIb&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://usdtmen.com/image/ar-ae.jpg	false	Avira URL Cloud: safe	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=US&oit=1&cp=2&gs_rn=42&psi=qRYiebaDLQ80oWIb&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://usdtmen.com/image/pt-pt.jpg	false	Avira URL Cloud: safe	unknown
https://usdtmen.com/image/en-us.jpg	false	Avira URL Cloud: safe	unknown
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=104.0.5112.102&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1	false		high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=USDTM&oit=1&cp=5&gs_rn=42&psi=qRYiebaDLQ80oWIb&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=wusdtmen.com&oit=3&cp=1&gs_rn=42&psi=qRYiebaDLQ80oWIb&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
http://usdtmen.com/	false	Avira URL Cloud: safe	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=usdtme%3C&oit=4&cp=7&gs_rn=42&psi=qRYiebaDLQ80oWIb&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.185.206	clients.l.google.com	United States	15169	GOOGLEUS	false
154.211.96.136	usdtmen.com	Seychelles	134705	ITACE-AS-APItaceInternationalLimitedHK	false
142.250.185.132	unknown	United States	15169	GOOGLEUS	false
142.250.186.109	accounts.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
35.227.159.135	e2c27.gcp.gvt2.com	United States	15169	GOOGLEUS	false
172.217.13.227	beacons2.gvt2.com	United States	15169	GOOGLEUS	false
142.251.143.67	beacons-handoff.gcp.gvt2.com	United States	15169	GOOGLEUS	false
216.58.212.163	beacons.gvt2.com	United States	15169	GOOGLEUS	false
172.217.18.100	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.1
127.0.0.1

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	756095
Start date and time:	2022-11-29 16:31:55 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 4m 6s
Hypervisor based Inspection enabled:	false
Report type:	light
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://usdtmen.com
Analysis system description:	Windows 10 64 bit version 1909 (MS Office 2019, IE 11, Chrome 104, Firefox 88, Adobe Reader DC 21, Java 8 u291, 7-Zip)
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean0.win@46/0@26/12
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): SIHClient.exe, SgrmBroker.exe, usocoreworker.exe, svchost.exe, WindowsInternal.ComposableShell.Experiences.TextInput.InputApp.exe
TCP Packets have been reduced to 100
Excluded IPs from analysis (whitelisted): 216.58.212.131, 34.104.35.123, 142.250.185.78, 142.250.185.227, 142.250.186.74, 142.250.181.234, 172.217.18.106, 142.250.186.138, 142.250.184.202, 172.217.23.106, 142.250.185.170, 142.250.186.106, 142.250.185.234, 172.217.16.202, 142.250.185.202, 172.217.18.10, 142.250.186.42, 142.250.186.170, 142.250.74.202, 216.58.212.138
Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, fs.microsoft.com, edgedl.me.gvt1.com, content-autofill.googleapis.com, login.live.com, slscr.update.microsoft.com, encrypted-tbn0.gstatic.com, update.googleapis.com, ctldl.windowsupdate.com, clientservices.googleapis.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtWriteVirtualMemory calls found.

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 29, 2022 16:32:24.708003044 CET	49694	443	192.168.2.3	142.250.185.206
Nov 29, 2022 16:32:24.708069086 CET	443	49694	142.250.185.206	192.168.2.3
Nov 29, 2022 16:32:24.708170891 CET	49694	443	192.168.2.3	142.250.185.206
Nov 29, 2022 16:32:24.709017038 CET	49695	443	192.168.2.3	142.250.186.109
Nov 29, 2022 16:32:24.709076881 CET	443	49695	142.250.186.109	192.168.2.3
Nov 29, 2022 16:32:24.709172010 CET	49695	443	192.168.2.3	142.250.186.109
Nov 29, 2022 16:32:24.710900068 CET	49694	443	192.168.2.3	142.250.185.206
Nov 29, 2022 16:32:24.710937023 CET	443	49694	142.250.185.206	192.168.2.3
Nov 29, 2022 16:32:24.711082935 CET	49695	443	192.168.2.3	142.250.186.109
Nov 29, 2022 16:32:24.711122036 CET	443	49695	142.250.186.109	192.168.2.3
Nov 29, 2022 16:32:24.807111025 CET	443	49694	142.250.185.206	192.168.2.3
Nov 29, 2022 16:32:24.807537079 CET	49694	443	192.168.2.3	142.250.185.206
Nov 29, 2022 16:32:24.807569027 CET	443	49694	142.250.185.206	192.168.2.3
Nov 29, 2022 16:32:24.808891058 CET	443	49694	142.250.185.206	192.168.2.3
Nov 29, 2022 16:32:24.809051991 CET	49694	443	192.168.2.3	142.250.185.206
Nov 29, 2022 16:32:24.811466932 CET	443	49695	142.250.186.109	192.168.2.3
Nov 29, 2022 16:32:24.812520027 CET	443	49694	142.250.185.206	192.168.2.3
Nov 29, 2022 16:32:24.812593937 CET	49694	443	192.168.2.3	142.250.185.206
Nov 29, 2022 16:32:24.812896013 CET	49695	443	192.168.2.3	142.250.186.109
Nov 29, 2022 16:32:24.812937021 CET	443	49695	142.250.186.109	192.168.2.3
Nov 29, 2022 16:32:24.814241886 CET	443	49695	142.250.186.109	192.168.2.3
Nov 29, 2022 16:32:24.814347982 CET	49695	443	192.168.2.3	142.250.186.109
Nov 29, 2022 16:32:24.864588976 CET	49696	443	192.168.2.3	154.211.96.136
Nov 29, 2022 16:32:24.864680052 CET	443	49696	154.211.96.136	192.168.2.3
Nov 29, 2022 16:32:24.864778042 CET	49696	443	192.168.2.3	154.211.96.136
Nov 29, 2022 16:32:24.868828058 CET	49696	443	192.168.2.3	154.211.96.136
Nov 29, 2022 16:32:24.868891954 CET	443	49696	154.211.96.136	192.168.2.3
Nov 29, 2022 16:32:24.869621038 CET	49697	443	192.168.2.3	154.211.96.136
Nov 29, 2022 16:32:24.869697094 CET	443	49697	154.211.96.136	192.168.2.3
Nov 29, 2022 16:32:24.869796991 CET	49697	443	192.168.2.3	154.211.96.136
Nov 29, 2022 16:32:24.870282888 CET	49697	443	192.168.2.3	154.211.96.136
Nov 29, 2022 16:32:24.870317936 CET	443	49697	154.211.96.136	192.168.2.3
Nov 29, 2022 16:32:25.112036943 CET	49695	443	192.168.2.3	142.250.186.109
Nov 29, 2022 16:32:25.112126112 CET	443	49695	142.250.186.109	192.168.2.3
Nov 29, 2022 16:32:25.112443924 CET	443	49695	142.250.186.109	192.168.2.3
Nov 29, 2022 16:32:25.112585068 CET	49694	443	192.168.2.3	142.250.185.206
Nov 29, 2022 16:32:25.112657070 CET	443	49694	142.250.185.206	192.168.2.3
Nov 29, 2022 16:32:25.112723112 CET	49695	443	192.168.2.3	142.250.186.109
Nov 29, 2022 16:32:25.112760067 CET	443	49695	142.250.186.109	192.168.2.3
Nov 29, 2022 16:32:25.112907887 CET	443	49694	142.250.185.206	192.168.2.3
Nov 29, 2022 16:32:25.113239050 CET	49694	443	192.168.2.3	142.250.185.206
Nov 29, 2022 16:32:25.113274097 CET	443	49694	142.250.185.206	192.168.2.3
Nov 29, 2022 16:32:25.141805887 CET	443	49694	142.250.185.206	192.168.2.3
Nov 29, 2022 16:32:25.142009974 CET	49694	443	192.168.2.3	142.250.185.206
Nov 29, 2022 16:32:25.142059088 CET	443	49694	142.250.185.206	192.168.2.3
Nov 29, 2022 16:32:25.142101049 CET	443	49694	142.250.185.206	192.168.2.3
Nov 29, 2022 16:32:25.142169952 CET	49694	443	192.168.2.3	142.250.185.206
Nov 29, 2022 16:32:25.153376102 CET	49695	443	192.168.2.3	142.250.186.109
Nov 29, 2022 16:32:25.155416965 CET	49694	443	192.168.2.3	142.250.185.206
Nov 29, 2022 16:32:25.155456066 CET	443	49694	142.250.185.206	192.168.2.3
Nov 29, 2022 16:32:25.162925005 CET	443	49695	142.250.186.109	192.168.2.3
Nov 29, 2022 16:32:25.163044930 CET	49695	443	192.168.2.3	142.250.186.109
Nov 29, 2022 16:32:25.163091898 CET	443	49695	142.250.186.109	192.168.2.3
Nov 29, 2022 16:32:25.163386106 CET	443	49695	142.250.186.109	192.168.2.3
Nov 29, 2022 16:32:25.163472891 CET	49695	443	192.168.2.3	142.250.186.109
Nov 29, 2022 16:32:25.164813995 CET	49695	443	192.168.2.3	142.250.186.109
Nov 29, 2022 16:32:25.164843082 CET	443	49695	142.250.186.109	192.168.2.3
Nov 29, 2022 16:32:25.611713886 CET	443	49696	154.211.96.136	192.168.2.3
Nov 29, 2022 16:32:25.612323999 CET	49696	443	192.168.2.3	154.211.96.136
Nov 29, 2022 16:32:25.612380981 CET	443	49696	154.211.96.136	192.168.2.3
Nov 29, 2022 16:32:25.613661051 CET	443	49696	154.211.96.136	192.168.2.3
Nov 29, 2022 16:32:25.613925934 CET	49696	443	192.168.2.3	154.211.96.136
Nov 29, 2022 16:32:25.625515938 CET	49696	443	192.168.2.3	154.211.96.136
Nov 29, 2022 16:32:25.625571966 CET	443	49696	154.211.96.136	192.168.2.3
Nov 29, 2022 16:32:25.625761032 CET	49696	443	192.168.2.3	154.211.96.136
Nov 29, 2022 16:32:25.625778913 CET	443	49696	154.211.96.136	192.168.2.3
Nov 29, 2022 16:32:25.625838041 CET	443	49696	154.211.96.136	192.168.2.3
Nov 29, 2022 16:32:25.666445017 CET	49696	443	192.168.2.3	154.211.96.136
Nov 29, 2022 16:32:25.666507959 CET	443	49696	154.211.96.136	192.168.2.3
Nov 29, 2022 16:32:25.766500950 CET	49696	443	192.168.2.3	154.211.96.136
Nov 29, 2022 16:32:26.333307028 CET	443	49696	154.211.96.136	192.168.2.3
Nov 29, 2022 16:32:26.333479881 CET	443	49696	154.211.96.136	192.168.2.3
Nov 29, 2022 16:32:26.333652973 CET	49696	443	192.168.2.3	154.211.96.136
Nov 29, 2022 16:32:26.334096909 CET	49696	443	192.168.2.3	154.211.96.136
Nov 29, 2022 16:32:26.334134102 CET	443	49696	154.211.96.136	192.168.2.3
Nov 29, 2022 16:32:26.625600100 CET	443	49697	154.211.96.136	192.168.2.3
Nov 29, 2022 16:32:26.637968063 CET	49697	443	192.168.2.3	154.211.96.136
Nov 29, 2022 16:32:26.638020992 CET	443	49697	154.211.96.136	192.168.2.3
Nov 29, 2022 16:32:26.640913963 CET	443	49697	154.211.96.136	192.168.2.3
Nov 29, 2022 16:32:26.641068935 CET	49697	443	192.168.2.3	154.211.96.136
Nov 29, 2022 16:32:26.651804924 CET	49697	443	192.168.2.3	154.211.96.136
Nov 29, 2022 16:32:26.651832104 CET	443	49697	154.211.96.136	192.168.2.3
Nov 29, 2022 16:32:26.652049065 CET	443	49697	154.211.96.136	192.168.2.3
Nov 29, 2022 16:32:26.652206898 CET	49697	443	192.168.2.3	154.211.96.136
Nov 29, 2022 16:32:26.652234077 CET	443	49697	154.211.96.136	192.168.2.3
Nov 29, 2022 16:32:26.767512083 CET	49697	443	192.168.2.3	154.211.96.136
Nov 29, 2022 16:32:27.743208885 CET	443	49697	154.211.96.136	192.168.2.3
Nov 29, 2022 16:32:27.743351936 CET	443	49697	154.211.96.136	192.168.2.3
Nov 29, 2022 16:32:27.743583918 CET	49697	443	192.168.2.3	154.211.96.136
Nov 29, 2022 16:32:27.799185038 CET	49697	443	192.168.2.3	154.211.96.136
Nov 29, 2022 16:32:27.799241066 CET	443	49697	154.211.96.136	192.168.2.3
Nov 29, 2022 16:32:27.803515911 CET	49699	443	192.168.2.3	154.211.96.136
Nov 29, 2022 16:32:27.803599119 CET	443	49699	154.211.96.136	192.168.2.3
Nov 29, 2022 16:32:27.803699017 CET	49699	443	192.168.2.3	154.211.96.136
Nov 29, 2022 16:32:27.804119110 CET	49699	443	192.168.2.3	154.211.96.136
Nov 29, 2022 16:32:27.804153919 CET	443	49699	154.211.96.136	192.168.2.3
Nov 29, 2022 16:32:28.408863068 CET	49703	443	192.168.2.3	142.250.185.132
Nov 29, 2022 16:32:28.408904076 CET	443	49703	142.250.185.132	192.168.2.3
Nov 29, 2022 16:32:28.408998013 CET	49703	443	192.168.2.3	142.250.185.132
Nov 29, 2022 16:32:28.409378052 CET	49703	443	192.168.2.3	142.250.185.132

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 29, 2022 16:32:24.675823927 CET	62586	53	192.168.2.3	1.1.1.1
Nov 29, 2022 16:32:24.676929951 CET	64208	53	192.168.2.3	1.1.1.1
Nov 29, 2022 16:32:24.677033901 CET	49405	53	192.168.2.3	1.1.1.1
Nov 29, 2022 16:32:24.694432974 CET	53	62586	1.1.1.1	192.168.2.3
Nov 29, 2022 16:32:24.695607901 CET	53	49405	1.1.1.1	192.168.2.3
Nov 29, 2022 16:32:24.850765944 CET	53	64208	1.1.1.1	192.168.2.3
Nov 29, 2022 16:32:28.347985029 CET	58968	53	192.168.2.3	1.1.1.1
Nov 29, 2022 16:32:28.365712881 CET	53	58968	1.1.1.1	192.168.2.3
Nov 29, 2022 16:32:28.383533955 CET	60752	53	192.168.2.3	1.1.1.1
Nov 29, 2022 16:32:28.401398897 CET	53	60752	1.1.1.1	192.168.2.3
Nov 29, 2022 16:33:07.758765936 CET	49753	53	192.168.2.3	1.1.1.1
Nov 29, 2022 16:33:08.083023071 CET	53	49753	1.1.1.1	192.168.2.3
Nov 29, 2022 16:33:08.126359940 CET	53744	53	192.168.2.3	1.1.1.1
Nov 29, 2022 16:33:08.147835970 CET	53	53744	1.1.1.1	192.168.2.3
Nov 29, 2022 16:33:09.346384048 CET	54957	53	192.168.2.3	1.1.1.1
Nov 29, 2022 16:33:09.405230045 CET	53	54957	1.1.1.1	192.168.2.3
Nov 29, 2022 16:33:11.070312023 CET	62677	53	192.168.2.3	1.1.1.1
Nov 29, 2022 16:33:11.638418913 CET	53	62677	1.1.1.1	192.168.2.3
Nov 29, 2022 16:33:14.836524010 CET	62507	53	192.168.2.3	1.1.1.1
Nov 29, 2022 16:33:14.893490076 CET	53	62507	1.1.1.1	192.168.2.3
Nov 29, 2022 16:33:19.956929922 CET	57517	53	192.168.2.3	1.1.1.1
Nov 29, 2022 16:33:20.132723093 CET	53	57517	1.1.1.1	192.168.2.3
Nov 29, 2022 16:33:23.238204956 CET	64040	53	192.168.2.3	1.1.1.1
Nov 29, 2022 16:33:23.407876968 CET	53	64040	1.1.1.1	192.168.2.3
Nov 29, 2022 16:33:23.476464033 CET	55241	53	192.168.2.3	1.1.1.1
Nov 29, 2022 16:33:23.646177053 CET	53	55241	1.1.1.1	192.168.2.3
Nov 29, 2022 16:33:24.804167032 CET	52387	53	192.168.2.3	1.1.1.1
Nov 29, 2022 16:33:24.834027052 CET	53	52387	1.1.1.1	192.168.2.3
Nov 29, 2022 16:33:28.402385950 CET	51807	53	192.168.2.3	1.1.1.1
Nov 29, 2022 16:33:28.420521021 CET	53	51807	1.1.1.1	192.168.2.3
Nov 29, 2022 16:33:28.424760103 CET	60310	53	192.168.2.3	1.1.1.1
Nov 29, 2022 16:33:28.442527056 CET	53	60310	1.1.1.1	192.168.2.3
Nov 29, 2022 16:33:29.899596930 CET	57646	53	192.168.2.3	1.1.1.1
Nov 29, 2022 16:33:29.962117910 CET	53	57646	1.1.1.1	192.168.2.3
Nov 29, 2022 16:33:33.938812017 CET	54880	53	192.168.2.3	1.1.1.1
Nov 29, 2022 16:33:34.335639954 CET	53	54880	1.1.1.1	192.168.2.3
Nov 29, 2022 16:33:36.911083937 CET	62304	53	192.168.2.3	1.1.1.1
Nov 29, 2022 16:33:37.082370996 CET	53	62304	1.1.1.1	192.168.2.3
Nov 29, 2022 16:33:50.214030027 CET	61115	53	192.168.2.3	1.1.1.1
Nov 29, 2022 16:33:50.270365000 CET	53	61115	1.1.1.1	192.168.2.3
Nov 29, 2022 16:33:55.175709009 CET	49243	53	192.168.2.3	1.1.1.1
Nov 29, 2022 16:33:55.193550110 CET	53	49243	1.1.1.1	192.168.2.3
Nov 29, 2022 16:33:55.353043079 CET	59424	53	192.168.2.3	1.1.1.1
Nov 29, 2022 16:33:55.353043079 CET	63769	53	192.168.2.3	1.1.1.1
Nov 29, 2022 16:33:55.372543097 CET	53	59424	1.1.1.1	192.168.2.3
Nov 29, 2022 16:33:55.372581959 CET	53	63769	1.1.1.1	192.168.2.3
Nov 29, 2022 16:33:56.519668102 CET	63858	53	192.168.2.3	1.1.1.1
Nov 29, 2022 16:33:56.537300110 CET	53	63858	1.1.1.1	192.168.2.3
Nov 29, 2022 16:34:00.010442972 CET	60408	53	192.168.2.3	1.1.1.1
Nov 29, 2022 16:34:00.185385942 CET	53	60408	1.1.1.1	192.168.2.3
Nov 29, 2022 16:34:03.454722881 CET	50401	53	192.168.2.3	1.1.1.1
Nov 29, 2022 16:34:03.479424953 CET	53	50401	1.1.1.1	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 29, 2022 16:32:24.675823927 CET	192.168.2.3	1.1.1.1	0x1946	Standard query (0)	clients2.google.com	A (IP address)	IN (0x0001)	false
Nov 29, 2022 16:32:24.676929951 CET	192.168.2.3	1.1.1.1	0x308e	Standard query (0)	usdtmen.com	A (IP address)	IN (0x0001)	false
Nov 29, 2022 16:32:24.677033901 CET	192.168.2.3	1.1.1.1	0x1a2e	Standard query (0)	accounts.google.com	A (IP address)	IN (0x0001)	false
Nov 29, 2022 16:32:28.347985029 CET	192.168.2.3	1.1.1.1	0xd789	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 29, 2022 16:32:28.383533955 CET	192.168.2.3	1.1.1.1	0x9f1	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 29, 2022 16:33:07.758765936 CET	192.168.2.3	1.1.1.1	0x3fc2	Standard query (0)	www.usdtmen.com	A (IP address)	IN (0x0001)	false
Nov 29, 2022 16:33:08.126359940 CET	192.168.2.3	1.1.1.1	0xce86	Standard query (0)	www.usdtmen.com	A (IP address)	IN (0x0001)	false
Nov 29, 2022 16:33:09.346384048 CET	192.168.2.3	1.1.1.1	0x6284	Standard query (0)	www.usdtmen.com	A (IP address)	IN (0x0001)	false
Nov 29, 2022 16:33:11.070312023 CET	192.168.2.3	1.1.1.1	0xda2d	Standard query (0)	www.usdtmen.com	A (IP address)	IN (0x0001)	false
Nov 29, 2022 16:33:14.836524010 CET	192.168.2.3	1.1.1.1	0x3a39	Standard query (0)	www.usdtmen.com	A (IP address)	IN (0x0001)	false
Nov 29, 2022 16:33:19.956929922 CET	192.168.2.3	1.1.1.1	0xf446	Standard query (0)	www.usdtmen.com	A (IP address)	IN (0x0001)	false
Nov 29, 2022 16:33:23.238204956 CET	192.168.2.3	1.1.1.1	0x2445	Standard query (0)	www.usdtmen.com	A (IP address)	IN (0x0001)	false
Nov 29, 2022 16:33:23.476464033 CET	192.168.2.3	1.1.1.1	0xd13	Standard query (0)	www.usdtmen.com	A (IP address)	IN (0x0001)	false
Nov 29, 2022 16:33:24.804167032 CET	192.168.2.3	1.1.1.1	0x6d02	Standard query (0)	www.usdtmen.com	A (IP address)	IN (0x0001)	false
Nov 29, 2022 16:33:28.402385950 CET	192.168.2.3	1.1.1.1	0xab35	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 29, 2022 16:33:28.424760103 CET	192.168.2.3	1.1.1.1	0xc80a	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 29, 2022 16:33:29.899596930 CET	192.168.2.3	1.1.1.1	0x2ce1	Standard query (0)	www.usdtmen.com	A (IP address)	IN (0x0001)	false
Nov 29, 2022 16:33:33.938812017 CET	192.168.2.3	1.1.1.1	0x380d	Standard query (0)	usdtmen.com	A (IP address)	IN (0x0001)	false
Nov 29, 2022 16:33:36.911083937 CET	192.168.2.3	1.1.1.1	0xae51	Standard query (0)	usdtmen.com	A (IP address)	IN (0x0001)	false
Nov 29, 2022 16:33:50.214030027 CET	192.168.2.3	1.1.1.1	0xce88	Standard query (0)	www.usdtmen.com	A (IP address)	IN (0x0001)	false
Nov 29, 2022 16:33:55.175709009 CET	192.168.2.3	1.1.1.1	0x6e2f	Standard query (0)	beacons.gcp.gvt2.com	A (IP address)	IN (0x0001)	false
Nov 29, 2022 16:33:55.353043079 CET	192.168.2.3	1.1.1.1	0x3170	Standard query (0)	e2c27.gcp.gvt2.com	A (IP address)	IN (0x0001)	false
Nov 29, 2022 16:33:55.353043079 CET	192.168.2.3	1.1.1.1	0x279b	Standard query (0)	beacons2.gvt2.com	A (IP address)	IN (0x0001)	false
Nov 29, 2022 16:33:56.519668102 CET	192.168.2.3	1.1.1.1	0xb794	Standard query (0)	beacons.gvt2.com	A (IP address)	IN (0x0001)	false
Nov 29, 2022 16:34:00.010442972 CET	192.168.2.3	1.1.1.1	0xc869	Standard query (0)	www.usdtmen.com	A (IP address)	IN (0x0001)	false
Nov 29, 2022 16:34:03.454722881 CET	192.168.2.3	1.1.1.1	0x81d6	Standard query (0)	usdtmen.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 29, 2022 16:32:24.694432974 CET	1.1.1.1	192.168.2.3	0x1946	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 29, 2022 16:32:24.694432974 CET	1.1.1.1	192.168.2.3	0x1946	No error (0)	clients.l.google.com		142.250.185.206	A (IP address)	IN (0x0001)	false
Nov 29, 2022 16:32:24.695607901 CET	1.1.1.1	192.168.2.3	0x1a2e	No error (0)	accounts.google.com		142.250.186.109	A (IP address)	IN (0x0001)	false
Nov 29, 2022 16:32:24.850765944 CET	1.1.1.1	192.168.2.3	0x308e	No error (0)	usdtmen.com		154.211.96.136	A (IP address)	IN (0x0001)	false
Nov 29, 2022 16:32:28.365712881 CET	1.1.1.1	192.168.2.3	0xd789	No error (0)	www.google.com		142.250.186.100	A (IP address)	IN (0x0001)	false
Nov 29, 2022 16:32:28.401398897 CET	1.1.1.1	192.168.2.3	0x9f1	No error (0)	www.google.com		142.250.185.132	A (IP address)	IN (0x0001)	false
Nov 29, 2022 16:33:28.420521021 CET	1.1.1.1	192.168.2.3	0xab35	No error (0)	www.google.com		142.250.186.100	A (IP address)	IN (0x0001)	false
Nov 29, 2022 16:33:28.442527056 CET	1.1.1.1	192.168.2.3	0xc80a	No error (0)	www.google.com		172.217.18.100	A (IP address)	IN (0x0001)	false
Nov 29, 2022 16:33:34.335639954 CET	1.1.1.1	192.168.2.3	0x380d	No error (0)	usdtmen.com		154.211.96.136	A (IP address)	IN (0x0001)	false
Nov 29, 2022 16:33:37.082370996 CET	1.1.1.1	192.168.2.3	0xae51	No error (0)	usdtmen.com		154.211.96.136	A (IP address)	IN (0x0001)	false
Nov 29, 2022 16:33:55.193550110 CET	1.1.1.1	192.168.2.3	0x6e2f	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 29, 2022 16:33:55.193550110 CET	1.1.1.1	192.168.2.3	0x6e2f	No error (0)	beacons-handoff.gcp.gvt2.com		142.251.143.67	A (IP address)	IN (0x0001)	false
Nov 29, 2022 16:33:55.372543097 CET	1.1.1.1	192.168.2.3	0x3170	No error (0)	e2c27.gcp.gvt2.com		35.227.159.135	A (IP address)	IN (0x0001)	false
Nov 29, 2022 16:33:55.372581959 CET	1.1.1.1	192.168.2.3	0x279b	No error (0)	beacons2.gvt2.com		172.217.13.227	A (IP address)	IN (0x0001)	false
Nov 29, 2022 16:33:56.537300110 CET	1.1.1.1	192.168.2.3	0xb794	No error (0)	beacons.gvt2.com		216.58.212.163	A (IP address)	IN (0x0001)	false
Nov 29, 2022 16:34:03.479424953 CET	1.1.1.1	192.168.2.3	0x81d6	No error (0)	usdtmen.com		154.211.96.136	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

accounts.google.com

clients2.google.com

usdtmen.com

www.google.com

https:

beacons.gcp.gvt2.com

e2c27.gcp.gvt2.com

beacons2.gvt2.com

beacons.gvt2.com

Target ID:	0
Start time:	16:32:21
Start date:	29/11/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://usdtmen.com/
Imagebase:	0x7ff6566b0000
File size:	2852640 bytes
MD5 hash:	7BC7B4AEDC055BB02BCB52710132E9E1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: chrome.exePID: 6160, Parent PID: 3188

General

Target ID:	1
Start time:	16:32:22
Start date:	29/11/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1768,i,5818765958052219750,8192306715576805166,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff6566b0000
File size:	2852640 bytes
MD5 hash:	7BC7B4AEDC055BB02BCB52710132E9E1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Disassembly

⊘No disassembly

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://usdtmen.com

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

Statistics

Behavior

System Behavior

Analysis Process: chrome.exePID: 3188, Parent PID: 2540

General

Analysis Process: chrome.exePID: 6160, Parent PID: 3188

General

Disassembly

Windows Analysis Report
https://usdtmen.com