Create Interactive Tour

Windows Analysis Report
https:/www.icloud.com/attachment/?u=https%3A%2F%2Fcvws.icloud-content.com%2FB%2FAQ7PIpWD5vdfUnxBYAK_f3HDOpg8Ae4xZdtcbjXEO-puRtqaMyvhIui-%2F%24{f}%3Fo%3DAu1WPFL4u8DFiLlsROvxRPY8Qen5s-ETz7WhMMaY8oov%26v%3D1%26x%3D3%26a%3DCAoguSzMAM-i_PlTyQwGcijNPxna-5kOYLzKPd7XXoUYwBoSehDnx5vdojEY59eWsawxIgEAKgkC6

Overview

General Information

Sample URL:	https:/www.icloud.com/attachment/?u=https%3A%2F%2Fcvws.icloud-content.com%2FB%2FAQ7PIpWD5vdfUnxBYAK_f3HDOpg8Ae4xZdtcbjXEO-puRtqaMyvhIui-%2F%24{f}%3Fo%3DAu1WPFL4u8DFiLlsROvxRPY8Qen5s-ETz7WhMMaY8oov
Analysis ID:	1298447
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

HTML page contains hidden URLs or javascript code

HTML body with high number of embedded SVGs detected

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5992 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank MD5: 8D1C4713ACB7CC2AAAEE4477C58A80BA)

chrome.exe (PID: 4100 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2008 --field-trial-handle=1800,i,11593714683627311481,18293085444874707215,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 8D1C4713ACB7CC2AAAEE4477C58A80BA)

chrome.exe (PID: 2152 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" "https:/www.icloud.com/attachment/?u=https%3A%2F%2Fcvws.icloud-content.com%2FB%2FAQ7PIpWD5vdfUnxBYAK_f3HDOpg8Ae4xZdtcbjXEO-puRtqaMyvhIui-%2F%24%7Bf%7D%3Fo%3DAu1WPFL4u8DFiLlsROvxRPY8Qen5s-ETz7WhMMaY8oov%26v%3D1%26x%3D3%26a%3DCAoguSzMAM-i_PlTyQwGcijNPxna-5kOYLzKPd7XXoUYwBoSehDnx5vdojEY59eWsawxIgEAKgkC6AMA_2CXDHRSBMM6mDxaBOEi6L5qJ5DT-vmt3jkreyjm8s13kUVzkthDzuAISIS9-LCzRTLmXQ7ah4lmB3InAzxMQrpS0Vv86qL8pXXxXBh7zKv1i1F810HXVjdR0ZXTG6JcywrU%26e%3D1695541472%26fl%3D%26r%3D42D5478F-97BF-46BD-8BB2-9510A8E93652-1%26k%3D%24%7Buk%7D%26ckc%3Dcom.apple.largeattachment%26ckz%3DF05FBE90-B396-4187-96E3-0BBAFE4EED3A%26p%3D53%26s%3DbCq9_u7cBJ4ME9AjKTh-i8Wup_A&uk=lRVER_HjNHGV1B6qlqukFA&f=Images.zip&sz=110039 MD5: 8D1C4713ACB7CC2AAAEE4477C58A80BA)

cleanup

Joe Sandbox Signatures

• Phishing
• Compliance
• Networking
• System Summary

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: https://www.icloud.com/attachment/?u=https%3A%2F%2Fcvws.icloud-content.com%2FB%2FAQ7PIpWD5vdfUnxBYAK_f3HDOpg8Ae4xZdtcbjXEO-puRtqaMyvhIui-%2F%24%7Bf%7D%3Fo%3DAu1WPFL4u8DFiLlsROvxRPY8Qen5s-ETz7WhMMaY8oov%26v%3D1%26x%3D3%26a%3DCAoguSzMAM-i_PlTyQwGcijNPxna-5kOYLzKPd7XXoUYwBoSehDnx5vdojEY59eWsawxIgEAKgkC6AMA_2CXDHRSBMM6mDxaBOEi6L5qJ5DT-vmt3jkreyjm8s13kUVzkthDzuAISIS9-LCzRTLmXQ7ah4lmB3InAzxMQrpS0Vv86qL8pXXxXBh7zKv1i1F810HXVjdR0ZXTG6JcywrU%26e%3D1695541472%26fl%3D%26r%3D42D5478F-97BF-46BD-8BB2-9510A8E93652-1%26k%3D%24%7Buk%7D%26ckc%3Dcom.apple.largeattachment%26ckz%3DF05FBE90-B396-4187-96E3-0BBAFE4EED3A%26p%3D53%26s%3DbCq9_u7cBJ4ME9AjKTh-i8Wup_A&uk=lRVER_HjNHGV1B6qlqukFA&f=Images.zip&sz=110039

HTTP Parser: Base64 decoded: .cloudos-alert .alert-main-content .alert-icon{background-image:url("blob:https://www.icloud.com/0c8c3958-062a-4288-9a6e-f031da13a757")}.cloudos-alert .alert-main-content .alert-icon.icloud-icon{background-image:url("blob:https://www.icloud.com/f35d61ea-...

Source: https://www.apple.com/chde/iphone-14/

HTTP Parser: Total embedded SVG size: 214349

Source: https://www.apple.com/	HTTP Parser: No favicon
Source: https://www.apple.com/	HTTP Parser: No favicon
Source: https://www.apple.com/	HTTP Parser: No favicon
Source: https://www.apple.com/mac/	HTTP Parser: No favicon
Source: https://www.apple.com/mac/	HTTP Parser: No favicon
Source: https://www.apple.com/mac/	HTTP Parser: No favicon
Source: https://www.apple.com/ipad/	HTTP Parser: No favicon
Source: https://www.apple.com/ipad/	HTTP Parser: No favicon
Source: https://www.apple.com/ipad/	HTTP Parser: No favicon
Source: https://www.apple.com/iphone/	HTTP Parser: No favicon
Source: https://www.apple.com/iphone/	HTTP Parser: No favicon
Source: https://www.apple.com/chde/iphone/	HTTP Parser: No favicon
Source: https://www.apple.com/chde/iphone/	HTTP Parser: No favicon
Source: https://www.apple.com/chde/iphone/	HTTP Parser: No favicon
Source: https://www.apple.com/chde/iphone-14/	HTTP Parser: No favicon
Source: https://www.apple.com/chde/iphone-14/	HTTP Parser: No favicon
Source: https://www.apple.com/chde/iphone-14/	HTTP Parser: No favicon

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_BITS_5992_284071600	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_1787455252	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_1787455252\keys.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_1787455252\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_1787455252\LICENSE	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_1787455252\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_1787455252\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_1787455252\manifest.fingerprint	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_BITS_5992_1413163535	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_1007498864	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_1007498864\ssl_error_assistant.pb	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_1007498864\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_1007498864\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_1007498864\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_1007498864\manifest.fingerprint	Jump to behavior

Source: unknown

DNS traffic detected: queries for: clients2.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50214
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 50626 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50626
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 50214 -> 443

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=115.0.5790.171&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-115.0.5790.171Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /reportStats HTTP/1.1Host: feedbackws.icloud.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: chromecache_568.1.dr, chromecache_492.1.dr, chromecache_737.1.dr, chromecache_420.1.dr	String found in binary or memory: "https://www.facebook.com/Apple", equals www.facebook.com (Facebook)
Source: chromecache_568.1.dr, chromecache_492.1.dr, chromecache_737.1.dr, chromecache_420.1.dr	String found in binary or memory: "https://www.linkedin.com/company/apple", equals www.linkedin.com (Linkedin)
Source: chromecache_568.1.dr, chromecache_492.1.dr, chromecache_737.1.dr, chromecache_420.1.dr	String found in binary or memory: "https://www.twitter.com/Apple" equals www.twitter.com (Twitter)
Source: chromecache_568.1.dr, chromecache_492.1.dr, chromecache_737.1.dr, chromecache_420.1.dr	String found in binary or memory: "https://www.youtube.com/user/Apple", equals www.youtube.com (Youtube)

Source: chromecache_731.1.dr	String found in binary or memory: http://jedwatson.github.io/classnames
Source: chromecache_420.1.dr	String found in binary or memory: http://schema.org
Source: chromecache_492.1.dr, chromecache_830.1.dr, chromecache_737.1.dr, chromecache_420.1.dr	String found in binary or memory: http://schema.org/
Source: chromecache_568.1.dr, chromecache_492.1.dr, chromecache_737.1.dr, chromecache_420.1.dr	String found in binary or memory: http://www.wikidata.org/entity/Q312
Source: chromecache_568.1.dr, chromecache_492.1.dr, chromecache_737.1.dr, chromecache_420.1.dr	String found in binary or memory: https://appleid.apple.com/us/
Source: chromecache_568.1.dr, chromecache_492.1.dr, chromecache_737.1.dr, chromecache_420.1.dr	String found in binary or memory: https://apps.apple.com/us/app/apple-store/id375380948
Source: chromecache_887.1.dr	String found in binary or memory: https://assets.adobedtm.com/extensions/EP308220a2a4c4403f97fc1960100db40f/AppMeasurement.js
Source: chromecache_568.1.dr	String found in binary or memory: https://card.apple.com/apply/application?referrer=cid%3Dapy-200-10000036&start=false
Source: chromecache_467.1.dr	String found in binary or memory: https://cdn.apple-cloudkit.com/ck/2/acknowledgements.txt
Source: chromecache_1006.1.dr	String found in binary or memory: https://cdn.apple-cloudkit.com/ck/2/cloudkit.js
Source: chromecache_524.1.dr	String found in binary or memory: https://che-de-applegiveback.brightstar.com/
Source: chromecache_713.1.dr, chromecache_787.1.dr	String found in binary or memory: https://checkcoverage.apple.com/ch/de?cid=gn-ols-checkcoverage-lp-get_help
Source: chromecache_713.1.dr, chromecache_787.1.dr	String found in binary or memory: https://communities.apple.com/de/welcome?cid=gn-com-community-lp-get_help
Source: chromecache_492.1.dr	String found in binary or memory: https://contactretail.apple.com/?pg=COM:imac&ap=COM&c=us&l=en
Source: chromecache_737.1.dr	String found in binary or memory: https://contactretail.apple.com/?pg=COM:iphone&ap=COM&c=us&l=en
Source: chromecache_737.1.dr	String found in binary or memory: https://fitness.apple.com/subscribe?itscg=10000&itsct=fit-promo-iph_fp-apl-avl-201111
Source: chromecache_713.1.dr, chromecache_787.1.dr	String found in binary or memory: https://getsupport.apple.com/?caller=support.header&cid=gn-ols-contact-mgs_lp-get_help
Source: chromecache_568.1.dr, chromecache_492.1.dr, chromecache_737.1.dr, chromecache_420.1.dr	String found in binary or memory: https://investor.apple.com/
Source: chromecache_492.1.dr	String found in binary or memory: https://itunes.apple.com/WebObjects/MZStore.woa/wa/viewGrouping?id=&mt=12&ls=
Source: chromecache_568.1.dr, chromecache_492.1.dr, chromecache_830.1.dr, chromecache_737.1.dr, chromecache_420.1.dr	String found in binary or memory: https://locate.apple.com/
Source: chromecache_737.1.dr, chromecache_420.1.dr	String found in binary or memory: https://music.apple.com/deeplink?app=music&p=subscribe&at=1000l4QJ&ct&#x3
Source: chromecache_420.1.dr	String found in binary or memory: https://one.apple.com/us?itscg=10000&itsct=one-NA-ipad-tile-apl-avl-102020
Source: chromecache_737.1.dr	String found in binary or memory: https://one.apple.com/us?itscg=10000&itsct=one-NA-iphone-tile-apl-avl-102020
Source: chromecache_492.1.dr	String found in binary or memory: https://one.apple.com/us?itscg=10000&itsct=one-NA-mac-tile-apl-avl-102020
Source: chromecache_731.1.dr	String found in binary or memory: https://preactjs.com
Source: chromecache_1006.1.dr	String found in binary or memory: https://setup.$
Source: chromecache_1006.1.dr	String found in binary or memory: https://stackoverflow.com/a/27232658)
Source: chromecache_568.1.dr, chromecache_492.1.dr, chromecache_830.1.dr, chromecache_737.1.dr, chromecache_420.1.dr	String found in binary or memory: https://support.apple.com
Source: chromecache_568.1.dr, chromecache_492.1.dr, chromecache_737.1.dr, chromecache_420.1.dr	String found in binary or memory: https://support.apple.com/#organization
Source: chromecache_568.1.dr, chromecache_492.1.dr, chromecache_737.1.dr, chromecache_420.1.dr	String found in binary or memory: https://support.apple.com/?cid=gn-ols-home-hp-tab
Source: chromecache_713.1.dr, chromecache_787.1.dr	String found in binary or memory: https://support.apple.com/de-ch/?cid=gn-ols-home-hp-explore
Source: chromecache_713.1.dr, chromecache_787.1.dr	String found in binary or memory: https://support.apple.com/de-ch/accessibility?cid=gn-ols-accessibility-psp-helpful_topics
Source: chromecache_713.1.dr, chromecache_787.1.dr	String found in binary or memory: https://support.apple.com/de-ch/airpods?cid=gn-ols-airpods-psp-explore
Source: chromecache_713.1.dr, chromecache_787.1.dr	String found in binary or memory: https://support.apple.com/de-ch/airpods?cid=gn-ols-airpods-psp-prodfly
Source: chromecache_713.1.dr, chromecache_787.1.dr	String found in binary or memory: https://support.apple.com/de-ch/apple-id?cid=gn-ols-appleid-psp-helpful_topics
Source: chromecache_713.1.dr, chromecache_787.1.dr	String found in binary or memory: https://support.apple.com/de-ch/apple-tv?cid=gn-ols-appletv-psp-prodfly
Source: chromecache_713.1.dr, chromecache_787.1.dr	String found in binary or memory: https://support.apple.com/de-ch/billing?cid=gn-ols-billing-collection-helpful_topics
Source: chromecache_713.1.dr, chromecache_787.1.dr	String found in binary or memory: https://support.apple.com/de-ch/find-my?cid=gn-ols-findmy-collection-helpful_topics
Source: chromecache_713.1.dr, chromecache_787.1.dr	String found in binary or memory: https://support.apple.com/de-ch/ipad?cid=gn-ols-ipad-psp-explore
Source: chromecache_713.1.dr, chromecache_787.1.dr	String found in binary or memory: https://support.apple.com/de-ch/ipad?cid=gn-ols-ipad-psp-prodfly
Source: chromecache_713.1.dr, chromecache_787.1.dr	String found in binary or memory: https://support.apple.com/de-ch/iphone?cid=gn-ols-iphone-psp-explore
Source: chromecache_713.1.dr, chromecache_787.1.dr	String found in binary or memory: https://support.apple.com/de-ch/iphone?cid=gn-ols-iphone-psp-prodfly
Source: chromecache_713.1.dr, chromecache_787.1.dr	String found in binary or memory: https://support.apple.com/de-ch/mac?cid=gn-ols-mac-psp-explore
Source: chromecache_713.1.dr, chromecache_787.1.dr	String found in binary or memory: https://support.apple.com/de-ch/mac?cid=gn-ols-mac-psp-prodfly
Source: chromecache_713.1.dr, chromecache_787.1.dr	String found in binary or memory: https://support.apple.com/de-ch/music?cid=gn-ols-music-psp-explore
Source: chromecache_713.1.dr, chromecache_787.1.dr	String found in binary or memory: https://support.apple.com/de-ch/music?cid=gn-ols-music-psp-prodfly
Source: chromecache_713.1.dr, chromecache_787.1.dr	String found in binary or memory: https://support.apple.com/de-ch/repair?cid=gn-ols-repair-lp-get_help
Source: chromecache_713.1.dr, chromecache_787.1.dr	String found in binary or memory: https://support.apple.com/de-ch/tv?cid=gn-ols-tv-psp-explore
Source: chromecache_713.1.dr, chromecache_787.1.dr	String found in binary or memory: https://support.apple.com/de-ch/tv?cid=gn-ols-tvplus-psp-prodfly
Source: chromecache_713.1.dr, chromecache_787.1.dr	String found in binary or memory: https://support.apple.com/de-ch/watch?cid=gn-ols-watch-psp-explore
Source: chromecache_713.1.dr, chromecache_787.1.dr	String found in binary or memory: https://support.apple.com/de-ch/watch?cid=gn-ols-watch-psp-prodfly
Source: chromecache_492.1.dr, chromecache_737.1.dr, chromecache_420.1.dr	String found in binary or memory: https://support.apple.com/en-us/HT201541
Source: chromecache_492.1.dr, chromecache_737.1.dr, chromecache_420.1.dr	String found in binary or memory: https://support.apple.com/en-us/HT202716
Source: chromecache_492.1.dr, chromecache_737.1.dr, chromecache_420.1.dr	String found in binary or memory: https://support.apple.com/en-us/HT204204
Source: chromecache_420.1.dr	String found in binary or memory: https://support.apple.com/ios/update
Source: chromecache_568.1.dr, chromecache_492.1.dr, chromecache_420.1.dr	String found in binary or memory: https://support.apple.com/kb/HT209218
Source: chromecache_420.1.dr	String found in binary or memory: https://support.apple.com/kb/HT211204
Source: chromecache_830.1.dr	String found in binary or memory: https://support.apple.com/kb/index
Source: chromecache_830.1.dr	String found in binary or memory: https://support.apple.com/kb/index?page=search&locale=en_US
Source: chromecache_887.1.dr	String found in binary or memory: https://support.apple.com/launch/launch-ENa1d69f1a17ae45a1a2df9385c05ffcb9.js
Source: chromecache_420.1.dr	String found in binary or memory: https://tv.apple.com/channel/tvs.sbd.4000?itscg=10000&itsct=atv-ipad_fp-pmo_try-atv-22
Source: chromecache_737.1.dr	String found in binary or memory: https://tv.apple.com/channel/tvs.sbd.4000?itscg=10000&itsct=atv-iphone_fp-pmo_try-atv-
Source: chromecache_492.1.dr	String found in binary or memory: https://tv.apple.com/channel/tvs.sbd.4000?itscg=10000&itsct=atv-mac_fp-pmo_try-atv-220
Source: chromecache_568.1.dr	String found in binary or memory: https://tv.apple.com/room/edt.item.62327df1-6874-470e-98b2-a5bbeac509a2
Source: chromecache_568.1.dr	String found in binary or memory: https://tv.apple.com/us/show/the-morning-show/umc.cmc.25tn3v8ku4b39tr6ccgb8nl6m?itscg=10000&itsct=at
Source: chromecache_568.1.dr	String found in binary or memory: https://wallet.apple.com/apple-card/setup/feature/ccs?referrer=cid%3Dapy-200-10000036
Source: chromecache_830.1.dr	String found in binary or memory: https://www.apple.com
Source: chromecache_568.1.dr, chromecache_492.1.dr, chromecache_737.1.dr, chromecache_420.1.dr	String found in binary or memory: https://www.apple.com/
Source: chromecache_568.1.dr, chromecache_492.1.dr, chromecache_737.1.dr, chromecache_420.1.dr	String found in binary or memory: https://www.apple.com/#organization
Source: chromecache_568.1.dr	String found in binary or memory: https://www.apple.com/#webpage
Source: chromecache_568.1.dr	String found in binary or memory: https://www.apple.com/#website
Source: chromecache_830.1.dr	String found in binary or memory: https://www.apple.com/ac/globalnav/4/en_US/scripts/ac-globalnav.built.js
Source: chromecache_830.1.dr	String found in binary or memory: https://www.apple.com/ac/globalnav/4/en_US/styles/ac-globalnav.built.css
Source: chromecache_568.1.dr	String found in binary or memory: https://www.apple.com/ac/structured-data/images/knowledge_graph_logo.png?202110180743
Source: chromecache_420.1.dr	String found in binary or memory: https://www.apple.com/ac/structured-data/images/knowledge_graph_logo.png?202307181020
Source: chromecache_492.1.dr	String found in binary or memory: https://www.apple.com/ac/structured-data/images/knowledge_graph_logo.png?202308141633
Source: chromecache_737.1.dr	String found in binary or memory: https://www.apple.com/ac/structured-data/images/knowledge_graph_logo.png?202308151524
Source: chromecache_568.1.dr	String found in binary or memory: https://www.apple.com/ac/structured-data/images/open_graph_logo.png?202110180743
Source: chromecache_847.1.dr, chromecache_897.1.dr	String found in binary or memory: https://www.apple.com/airpods/
Source: chromecache_847.1.dr, chromecache_897.1.dr	String found in binary or memory: https://www.apple.com/airtag/
Source: chromecache_847.1.dr, chromecache_897.1.dr	String found in binary or memory: https://www.apple.com/apple-vision-pro/
Source: chromecache_813.1.dr, chromecache_940.1.dr	String found in binary or memory: https://www.apple.com/ch-de/shop/goto/accessories/apple_accessories
Source: chromecache_813.1.dr, chromecache_940.1.dr	String found in binary or memory: https://www.apple.com/ch-de/shop/goto/trade_in
Source: chromecache_813.1.dr, chromecache_940.1.dr	String found in binary or memory: https://www.apple.com/chde/airpods/
Source: chromecache_813.1.dr, chromecache_940.1.dr	String found in binary or memory: https://www.apple.com/chde/airtag/
Source: chromecache_813.1.dr, chromecache_940.1.dr	String found in binary or memory: https://www.apple.com/chde/retail/
Source: chromecache_857.1.dr, chromecache_900.1.dr	String found in binary or memory: https://www.apple.com/choose-country-region/
Source: chromecache_420.1.dr	String found in binary or memory: https://www.apple.com/ipad/
Source: chromecache_420.1.dr	String found in binary or memory: https://www.apple.com/ipad/#brand
Source: chromecache_737.1.dr	String found in binary or memory: https://www.apple.com/iphone/
Source: chromecache_737.1.dr	String found in binary or memory: https://www.apple.com/iphone/#brand
Source: chromecache_492.1.dr	String found in binary or memory: https://www.apple.com/mac/
Source: chromecache_492.1.dr	String found in binary or memory: https://www.apple.com/mac/#brand
Source: chromecache_847.1.dr, chromecache_897.1.dr	String found in binary or memory: https://www.apple.com/retail/
Source: chromecache_568.1.dr	String found in binary or memory: https://www.apple.com/us/search/
Source: chromecache_847.1.dr, chromecache_897.1.dr	String found in binary or memory: https://www.apple.com/us/shop/goto/trade_in
Source: chromecache_420.1.dr	String found in binary or memory: https://www.apple.com/us/xc/ipad?cid=AOS_ASA
Source: chromecache_737.1.dr	String found in binary or memory: https://www.apple.com/us/xc/iphone?cid=AOS_ASA
Source: chromecache_492.1.dr	String found in binary or memory: https://www.apple.com/us/xc/mac?cid=AOS_ASA
Source: chromecache_420.1.dr	String found in binary or memory: https://www.apple.com/v/ipad/home/cf/images/meta/ipad__o3qwbzdfrlmy_og.png
Source: chromecache_420.1.dr	String found in binary or memory: https://www.apple.com/v/ipad/home/cf/images/meta/ipad__o3qwbzdfrlmy_og.png?202307181020
Source: chromecache_737.1.dr	String found in binary or memory: https://www.apple.com/v/iphone/home/bo/images/meta/iphone__ky2k6x5u6vue_og.png
Source: chromecache_737.1.dr	String found in binary or memory: https://www.apple.com/v/iphone/home/bo/images/meta/iphone__ky2k6x5u6vue_og.png?202308151524
Source: chromecache_492.1.dr	String found in binary or memory: https://www.apple.com/v/mac/home/bu/images/meta/mac__bfa414svyuc2_og.png
Source: chromecache_492.1.dr	String found in binary or memory: https://www.apple.com/v/mac/home/bu/images/meta/mac__bfa414svyuc2_og.png?202308141633
Source: chromecache_737.1.dr, chromecache_420.1.dr	String found in binary or memory: https://www.goldmansachs.com/terms-and-conditions/Apple-Card-Customer-Agreement.pdf
Source: chromecache_568.1.dr, chromecache_492.1.dr, chromecache_737.1.dr, chromecache_420.1.dr	String found in binary or memory: https://www.icloud.com
Source: chromecache_1006.1.dr	String found in binary or memory: https://www.icloud.com/icloud_logo/icloud_logo.png
Source: chromecache_902.1.dr	String found in binary or memory: https://www.icloud.com/system/icloud.com/2317Hotfix55/en-us/acknowledgements.txt
Source: chromecache_568.1.dr, chromecache_492.1.dr, chromecache_737.1.dr, chromecache_420.1.dr	String found in binary or memory: https://www.linkedin.com/company/apple
Source: chromecache_568.1.dr, chromecache_492.1.dr, chromecache_737.1.dr, chromecache_420.1.dr	String found in binary or memory: https://www.twitter.com/Apple
Source: chromecache_568.1.dr, chromecache_492.1.dr, chromecache_737.1.dr, chromecache_420.1.dr	String found in binary or memory: https://www.youtube.com/user/Apple

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CONSENT=PENDING+904; SOCS=CAISHAgCEhJnd3NfMjAyMjA4MDgtMF9SQzEaAmVuIAEaBgiAvOuXBg; AEC=Ad49MVGiijyX5dxPFAKxKYso-rIS24Ht-Pxs5fU9hHrAzfASnm-jqdQE1g; NID=511=WyMJovC2uA2AEbHQkGfP-KDdYCeg5Q7Mv6gxYT-qeugtrnXImrhmp1SixwS4ydh_E8Z0hdfCLAXvg2WUqsBSfqpx5SFvCCoeGeevqlEfkoxYi9FTISb8Cu7rr5rf9PyyNbLqf2QbxG7ja7jAB6UJQd5CPvMGcYUasORCRKRL1-arNYzfADAWHJvBLXml-Km_uewDreOyJ-MjxAI-i38Tl6LXI3zB; 1P_JAR=2023-08-10-10

Source: classification engine

Classification label: clean1.win@32/613@40/10

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2008 --field-trial-handle=1800,i,11593714683627311481,18293085444874707215,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" "https:/www.icloud.com/attachment/?u=https%3A%2F%2Fcvws.icloud-content.com%2FB%2FAQ7PIpWD5vdfUnxBYAK_f3HDOpg8Ae4xZdtcbjXEO-puRtqaMyvhIui-%2F%24%7Bf%7D%3Fo%3DAu1WPFL4u8DFiLlsROvxRPY8Qen5s-ETz7WhMMaY8oov%26v%3D1%26x%3D3%26a%3DCAoguSzMAM-i_PlTyQwGcijNPxna-5kOYLzKPd7XXoUYwBoSehDnx5vdojEY59eWsawxIgEAKgkC6AMA_2CXDHRSBMM6mDxaBOEi6L5qJ5DT-vmt3jkreyjm8s13kUVzkthDzuAISIS9-LCzRTLmXQ7ah4lmB3InAzxMQrpS0Vv86qL8pXXxXBh7zKv1i1F810HXVjdR0ZXTG6JcywrU%26e%3D1695541472%26fl%3D%26r%3D42D5478F-97BF-46BD-8BB2-9510A8E93652-1%26k%3D%24%7Buk%7D%26ckc%3Dcom.apple.largeattachment%26ckz%3DF05FBE90-B396-4187-96E3-0BBAFE4EED3A%26p%3D53%26s%3DbCq9_u7cBJ4ME9AjKTh-i8Wup_A&uk=lRVER_HjNHGV1B6qlqukFA&f=Images.zip&sz=110039
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2008 --field-trial-handle=1800,i,11593714683627311481,18293085444874707215,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\chrome_BITS_5992_284071600

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_BITS_5992_284071600	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_1787455252	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_1787455252\keys.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_1787455252\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_1787455252\LICENSE	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_1787455252\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_1787455252\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_1787455252\manifest.fingerprint	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_BITS_5992_1413163535	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_1007498864	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_1007498864\ssl_error_assistant.pb	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_1007498864\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_1007498864\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_1007498864\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_1007498864\manifest.fingerprint	Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	2 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	3 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	4 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	1 Ingress Tool Transfer	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https:/www.icloud.com/attachment/?u=https%3A%2F%2Fcvws.icloud-content.com%2FB%2FAQ7PIpWD5vdfUnxBYAK_f3HDOpg8Ae4xZdtcbjXEO-puRtqaMyvhIui-%2F%24%7Bf%7D%3Fo%3DAu1WPFL4u8DFiLlsROvxRPY8Qen5s-ETz7WhMMaY8oov%26v%3D1%26x%3D3%26a%3DCAoguSzMAM-i_PlTyQwGcijNPxna-5kOYLzKPd7XXoUYwBoSehDnx5vdojEY59eWsawxIgEAKgkC6AMA_2CXDHRSBMM6mDxaBOEi6L5qJ5DT-vmt3jkreyjm8s13kUVzkthDzuAISIS9-LCzRTLmXQ7ah4lmB3InAzxMQrpS0Vv86qL8pXXxXBh7zKv1i1F810HXVjdR0ZXTG6JcywrU%26e%3D1695541472%26fl%3D%26r%3D42D5478F-97BF-46BD-8BB2-9510A8E93652-1%26k%3D%24%7Buk%7D%26ckc%3Dcom.apple.largeattachment%26ckz%3DF05FBE90-B396-4187-96E3-0BBAFE4EED3A%26p%3D53%26s%3DbCq9_u7cBJ4ME9AjKTh-i8Wup_A&uk=lRVER_HjNHGV1B6qlqukFA&f=Images.zip&sz=110039	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label	Link
http://jedwatson.github.io/classnames	0%	URL Reputation	safe
https://setup.$	0%	Avira URL Cloud	safe
https://cdn.apple-cloudkit.com/ck/2/cloudkit.js	0%	Avira URL Cloud	safe
https://cdn.apple-cloudkit.com/ck/2/acknowledgements.txt	0%	Avira URL Cloud	safe
https://cdn.apple-cloudkit.com/ck/2/acknowledgements.txt	0%	Virustotal		Browse
https://cdn.apple-cloudkit.com/ck/2/cloudkit.js	0%	Virustotal		Browse

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
accounts.google.com	172.217.168.77	true	false	high
gateway.fe.apple-dns.net	17.248.209.65	true	false	unknown
www.google.com	172.217.168.68	true	false	high
setup.fe.apple-dns.net	17.248.209.69	true	false	unknown
ckdatabasews.fe.apple-dns.net	17.248.209.67	true	false	unknown
clients.l.google.com	142.250.203.110	true	false	high
feedbackws.fe.apple-dns.net	17.248.209.69	true	false	unknown
cvws.apple-dns.net	17.248.209.36	true	false	unknown
setup.icloud.com	unknown	unknown	false	high
is2-ssl.mzstatic.com	unknown	unknown	false	high
feedbackws.icloud.com	unknown	unknown	false	high
is4-ssl.mzstatic.com	unknown	unknown	false	high
cdn.apple-cloudkit.com	unknown	unknown	false	unknown
appleid.cdn-apple.com	unknown	unknown	false	high
is3-ssl.mzstatic.com	unknown	unknown	false	high
clients2.google.com	unknown	unknown	false	high
is5-ssl.mzstatic.com	unknown	unknown	false	high
cvws.icloud-content.com	unknown	unknown	false	high
ckdatabasews.icloud.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
about:blank	false	low
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=115.0.5790.171&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1	false	high
https://feedbackws.icloud.com/reportStats	false	high
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false	high
https://setup.icloud.com/setup/ws/1/validate?clientBuildNumber=2317Hotfix55&clientMasteringNumber=2317Hotfix55&clientId=be533f9e-d8ab-48ef-83eb-e96e47814431	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://cdn.apple-cloudkit.com/ck/2/acknowledgements.txt	chromecache_467.1.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schema.org	chromecache_420.1.dr	false		high
https://www.linkedin.com/company/apple	chromecache_568.1.dr, chromecache_492.1.dr, chromecache_737.1.dr, chromecache_420.1.dr	false		high
https://setup.$	chromecache_1006.1.dr	false	Avira URL Cloud: safe	low
http://schema.org/	chromecache_492.1.dr, chromecache_830.1.dr, chromecache_737.1.dr, chromecache_420.1.dr	false		high
https://assets.adobedtm.com/extensions/EP308220a2a4c4403f97fc1960100db40f/AppMeasurement.js	chromecache_887.1.dr	false		high
http://www.wikidata.org/entity/Q312	chromecache_568.1.dr, chromecache_492.1.dr, chromecache_737.1.dr, chromecache_420.1.dr	false		high
https://che-de-applegiveback.brightstar.com/	chromecache_524.1.dr	false		high
https://stackoverflow.com/a/27232658)	chromecache_1006.1.dr	false		high
https://www.goldmansachs.com/terms-and-conditions/Apple-Card-Customer-Agreement.pdf	chromecache_737.1.dr, chromecache_420.1.dr	false		high
https://www.youtube.com/user/Apple	chromecache_568.1.dr, chromecache_492.1.dr, chromecache_737.1.dr, chromecache_420.1.dr	false		high
https://preactjs.com	chromecache_731.1.dr	false		high
https://www.twitter.com/Apple	chromecache_568.1.dr, chromecache_492.1.dr, chromecache_737.1.dr, chromecache_420.1.dr	false		high
https://cdn.apple-cloudkit.com/ck/2/cloudkit.js	chromecache_1006.1.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://jedwatson.github.io/classnames	chromecache_731.1.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.203.110	clients.l.google.com	United States	15169	GOOGLEUS	false
172.217.168.68	www.google.com	United States	15169	GOOGLEUS	false
17.248.209.69	setup.fe.apple-dns.net	United States	714	APPLE-ENGINEERINGUS	false
17.248.209.36	cvws.apple-dns.net	United States	714	APPLE-ENGINEERINGUS	false
17.248.209.68	unknown	United States	714	APPLE-ENGINEERINGUS	false
17.248.209.67	ckdatabasews.fe.apple-dns.net	United States	714	APPLE-ENGINEERINGUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
17.248.209.65	gateway.fe.apple-dns.net	United States	714	APPLE-ENGINEERINGUS	false
172.217.168.77	accounts.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	38.0.0 Beryl
Analysis ID:	1298447
Start date and time:	2023-08-28 03:18:39 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https:/www.icloud.com/attachment/?u=https%3A%2F%2Fcvws.icloud-content.com%2FB%2FAQ7PIpWD5vdfUnxBYAK_f3HDOpg8Ae4xZdtcbjXEO-puRtqaMyvhIui-%2F%24{f}%3Fo%3DAu1WPFL4u8DFiLlsROvxRPY8Qen5s-ETz7WhMMaY8oov%26v%3D1%26x%3D3%26a%3DCAoguSzMAM-i_PlTyQwGcijNPxna-5kOYLzKPd7XXoUYwBoSehDnx5vdojEY59eWsawxIgEAKgkC6AMA_2CXDHRSBMM6mDxaBOEi6L5qJ5DT-vmt3jkreyjm8s13kUVzkthDzuAISIS9-LCzRTLmXQ7ah4lmB3InAzxMQrpS0Vv86qL8pXXxXBh7zKv1i1F810HXVjdR0ZXTG6JcywrU%26e%3D1695541472%26fl%3D%26r%3D42D5478F-97BF-46BD-8BB2-9510A8E93652-1%26k%3D%24{uk}%26ckc%3Dcom.apple.largeattachment%26ckz%3DF05FBE90-B396-4187-96E3-0BBAFE4EED3A%26p%3D53%26s%3DbCq9_u7cBJ4ME9AjKTh-i8Wup_A&uk=lRVER_HjNHGV1B6qlqukFA&f=Images.zip&sz=110039
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean1.win@32/613@40/10
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Browse: https://www.apple.com/support/systemstatus/ Browse: https://www.apple.com/ Browse: https://www.apple.com/mac/ Browse: https://www.apple.com/ipad/ Browse: https://www.apple.com/iphone/

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe
Excluded IPs from analysis (whitelisted): 172.217.168.67, 34.104.35.123, 23.36.225.198, 104.79.26.42, 23.211.5.115, 104.77.42.191, 17.8.136.187, 172.217.168.74, 142.250.203.106, 216.58.215.234, 17.8.136.5, 17.8.130.25, 17.8.130.144, 23.54.112.17, 17.8.130.85, 142.250.203.99
Excluded domains from analysis (whitelisted): www.apple.com.edgekey.net.globalredir.akadns.net, www.icloud.com-v1.edgekey.net, gateway.icloud.com, eudb.ris.api.iris.microsoft.com, clientservices.googleapis.com, securemetrics.apple.com, g.bing.com, www.apple.com, arc.msn.com, e4478.dscb.akamaiedge.net, securemvt.apple.com, e2885.e9.akamaiedge.net, update.googleapis.com, displaycatalog.mp.microsoft.com, cdn.apple-cloudkit.com.edgekey.net, appleid.cdn-apple.com.edgekey.net, www.bing.com, client.wns.windows.com, www.icloud.com, content-autofill.googleapis.com, e673.dsce9.akamaiedge.net, ctldl.windowsupdate.com, www-cdn.icloud.com.akadns.net, e6858.dscx.akamaiedge.net, okapi-services.v.aaplimg.com, e9335.b.akamaiedge.net, ris.api.iris.microsoft.com, okapi-services.apple.com, securemvt.v.aaplimg.com, edgedl.me.gvt1.com, appleid.cdn-apple.com.akadns.net, is-ssl.mzstatic.com.itunes-apple.com.akadns.net, securemetrics.v.aaplimg.com, www.apple.com.edgekey.net, mzstatic.com.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1765
Entropy (8bit):	6.016932513650603
Encrypted:	false
SSDEEP:	48:p/hKAGj0FnAp7XgNGIaku9E5tPJXaWqkbszesM:R5Gj0FAlsaBmfPsRD3M
MD5:	6D1D175F88B64546105E3E7C31D1129A
SHA1:	75A1B56F55BB62B05365A0FDBFC7941DE77CBFAF
SHA-256:	A0BC246E8E160A9BB32FA60F4E7A04D148A17125F426509466031E07731FDF81
SHA-512:	5C80908331E30C7EAD67F7F6C5AB064B07626FD9C58925A0D2124D66B25C5AE2F218BDACFB68AFCB332E88EB297CFB7E0A7A9E5E1E54C9B7A510FEF095F9B54F
Malicious:	false
Reputation:	low
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJtYW5pZmVzdC5qc29uIiwicm9vdF9oYXNoIjoiSUxrUllPSmhIVEZacllLRmN5UC12SkJrVjNWbWVLdHo4d1hEb2VPWjBZMCJ9LHsicGF0aCI6InNzbF9lcnJvcl9hc3Npc3RhbnQucGIiLCJyb290X2hhc2giOiJyRFZLUnlPcXBQQnI3RGhkM2VTazBKZzYxUlJXOVNzeHFBYU95WDFiWHFjIn1dLCJmb3JtYXQiOiJ0cmVlaGFzaCIsImhhc2hfYmxvY2tfc2l6ZSI6NDA5Nn1dLCJpdGVtX2lkIjoiZ2lla2NtbWxua2xlbmxhb21wcGtwaGtuam1ubnBuZWgiLCJpdGVtX3ZlcnNpb24iOiI3IiwicHJvdG9jb2xfdmVyc2lvbiI6MX0","signatures":[{"header":{"kid":"publisher"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"nBdNk-7bgnEftAs4hWaHwF1Lk9pt7Eh6pcqe2gyNsE7VnVRp-H27tm1RFAF4htCUlXNJxX6YY-MUiK2DqJpQ3c73KDaFV8DcnadQfcXO3Lbrw7jLYSUaSdzujPkTyhuFcq_BhK0KWiIJ0aJgh7nVOBfAa5AbE6oFlLKMB2Ls0gmzS1-a5hUIu4rw2h9r9jkr6gLYbein5Jk2hdwW3u-1GNjyki4dftG2iZNAI8VhUf5gnCiF4AHCnYSGJsM0RGkmO_HJIzgwpQpP3RDsG2ioeKgxL-kcHhjXWOj3uVGyxpp1FkyHGkeGuqpFZMAxx3CEBiOtFj7i3iQxkgEW-E3uMKI3yA

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 28, 2023 03:19:36.282244921 CEST	49722	443	192.168.2.3	142.250.203.110
Aug 28, 2023 03:19:36.282367945 CEST	443	49722	142.250.203.110	192.168.2.3
Aug 28, 2023 03:19:36.282536983 CEST	49722	443	192.168.2.3	142.250.203.110
Aug 28, 2023 03:19:36.282780886 CEST	49723	443	192.168.2.3	172.217.168.77
Aug 28, 2023 03:19:36.282846928 CEST	443	49723	172.217.168.77	192.168.2.3
Aug 28, 2023 03:19:36.282949924 CEST	49723	443	192.168.2.3	172.217.168.77
Aug 28, 2023 03:19:36.283210039 CEST	49722	443	192.168.2.3	142.250.203.110
Aug 28, 2023 03:19:36.283258915 CEST	443	49722	142.250.203.110	192.168.2.3
Aug 28, 2023 03:19:36.283351898 CEST	49723	443	192.168.2.3	172.217.168.77
Aug 28, 2023 03:19:36.283390999 CEST	443	49723	172.217.168.77	192.168.2.3
Aug 28, 2023 03:19:36.376210928 CEST	443	49723	172.217.168.77	192.168.2.3
Aug 28, 2023 03:19:36.376650095 CEST	443	49722	142.250.203.110	192.168.2.3
Aug 28, 2023 03:19:36.376893044 CEST	49723	443	192.168.2.3	172.217.168.77
Aug 28, 2023 03:19:36.376960993 CEST	443	49723	172.217.168.77	192.168.2.3
Aug 28, 2023 03:19:36.377043962 CEST	49722	443	192.168.2.3	142.250.203.110
Aug 28, 2023 03:19:36.377106905 CEST	443	49722	142.250.203.110	192.168.2.3
Aug 28, 2023 03:19:36.377620935 CEST	443	49722	142.250.203.110	192.168.2.3
Aug 28, 2023 03:19:36.377734900 CEST	49722	443	192.168.2.3	142.250.203.110
Aug 28, 2023 03:19:36.378747940 CEST	443	49723	172.217.168.77	192.168.2.3
Aug 28, 2023 03:19:36.378765106 CEST	443	49722	142.250.203.110	192.168.2.3
Aug 28, 2023 03:19:36.378855944 CEST	49722	443	192.168.2.3	142.250.203.110
Aug 28, 2023 03:19:36.378866911 CEST	49723	443	192.168.2.3	172.217.168.77
Aug 28, 2023 03:19:36.380187988 CEST	49722	443	192.168.2.3	142.250.203.110
Aug 28, 2023 03:19:36.380291939 CEST	443	49722	142.250.203.110	192.168.2.3
Aug 28, 2023 03:19:36.380601883 CEST	49723	443	192.168.2.3	172.217.168.77
Aug 28, 2023 03:19:36.380716085 CEST	49722	443	192.168.2.3	142.250.203.110
Aug 28, 2023 03:19:36.380733013 CEST	443	49723	172.217.168.77	192.168.2.3
Aug 28, 2023 03:19:36.380736113 CEST	443	49722	142.250.203.110	192.168.2.3
Aug 28, 2023 03:19:36.380841017 CEST	49723	443	192.168.2.3	172.217.168.77
Aug 28, 2023 03:19:36.380877018 CEST	443	49723	172.217.168.77	192.168.2.3
Aug 28, 2023 03:19:36.414002895 CEST	443	49722	142.250.203.110	192.168.2.3
Aug 28, 2023 03:19:36.414285898 CEST	443	49722	142.250.203.110	192.168.2.3
Aug 28, 2023 03:19:36.414516926 CEST	49722	443	192.168.2.3	142.250.203.110
Aug 28, 2023 03:19:36.417443991 CEST	49722	443	192.168.2.3	142.250.203.110
Aug 28, 2023 03:19:36.417474031 CEST	443	49722	142.250.203.110	192.168.2.3
Aug 28, 2023 03:19:36.421104908 CEST	49723	443	192.168.2.3	172.217.168.77
Aug 28, 2023 03:19:36.432558060 CEST	443	49723	172.217.168.77	192.168.2.3
Aug 28, 2023 03:19:36.432732105 CEST	443	49723	172.217.168.77	192.168.2.3
Aug 28, 2023 03:19:36.432838917 CEST	49723	443	192.168.2.3	172.217.168.77
Aug 28, 2023 03:19:36.464178085 CEST	49723	443	192.168.2.3	172.217.168.77
Aug 28, 2023 03:19:36.464238882 CEST	443	49723	172.217.168.77	192.168.2.3
Aug 28, 2023 03:19:37.979542017 CEST	49735	443	192.168.2.3	17.248.209.65
Aug 28, 2023 03:19:37.979585886 CEST	443	49735	17.248.209.65	192.168.2.3
Aug 28, 2023 03:19:37.979685068 CEST	49735	443	192.168.2.3	17.248.209.65
Aug 28, 2023 03:19:37.983525991 CEST	49736	443	192.168.2.3	17.248.209.69
Aug 28, 2023 03:19:37.983565092 CEST	443	49736	17.248.209.69	192.168.2.3
Aug 28, 2023 03:19:37.983666897 CEST	49736	443	192.168.2.3	17.248.209.69
Aug 28, 2023 03:19:37.984174967 CEST	49735	443	192.168.2.3	17.248.209.65
Aug 28, 2023 03:19:37.984200954 CEST	443	49735	17.248.209.65	192.168.2.3
Aug 28, 2023 03:19:37.995985985 CEST	49737	443	192.168.2.3	17.248.209.67
Aug 28, 2023 03:19:37.996049881 CEST	443	49737	17.248.209.67	192.168.2.3
Aug 28, 2023 03:19:37.996145964 CEST	49737	443	192.168.2.3	17.248.209.67
Aug 28, 2023 03:19:37.996459961 CEST	49736	443	192.168.2.3	17.248.209.69
Aug 28, 2023 03:19:37.996494055 CEST	443	49736	17.248.209.69	192.168.2.3
Aug 28, 2023 03:19:37.997873068 CEST	49737	443	192.168.2.3	17.248.209.67
Aug 28, 2023 03:19:37.997905970 CEST	443	49737	17.248.209.67	192.168.2.3
Aug 28, 2023 03:19:38.012409925 CEST	49738	443	192.168.2.3	17.248.209.36
Aug 28, 2023 03:19:38.012469053 CEST	443	49738	17.248.209.36	192.168.2.3
Aug 28, 2023 03:19:38.012573004 CEST	49738	443	192.168.2.3	17.248.209.36
Aug 28, 2023 03:19:38.013271093 CEST	49738	443	192.168.2.3	17.248.209.36
Aug 28, 2023 03:19:38.013333082 CEST	443	49738	17.248.209.36	192.168.2.3
Aug 28, 2023 03:19:38.568200111 CEST	443	49736	17.248.209.69	192.168.2.3
Aug 28, 2023 03:19:38.568625927 CEST	49736	443	192.168.2.3	17.248.209.69
Aug 28, 2023 03:19:38.568660021 CEST	443	49736	17.248.209.69	192.168.2.3
Aug 28, 2023 03:19:38.569907904 CEST	443	49736	17.248.209.69	192.168.2.3
Aug 28, 2023 03:19:38.569983006 CEST	49736	443	192.168.2.3	17.248.209.69
Aug 28, 2023 03:19:38.571312904 CEST	443	49736	17.248.209.69	192.168.2.3
Aug 28, 2023 03:19:38.571378946 CEST	49736	443	192.168.2.3	17.248.209.69
Aug 28, 2023 03:19:38.574142933 CEST	49736	443	192.168.2.3	17.248.209.69
Aug 28, 2023 03:19:38.574219942 CEST	443	49738	17.248.209.36	192.168.2.3
Aug 28, 2023 03:19:38.574274063 CEST	443	49736	17.248.209.69	192.168.2.3
Aug 28, 2023 03:19:38.574506044 CEST	49736	443	192.168.2.3	17.248.209.69
Aug 28, 2023 03:19:38.574523926 CEST	443	49736	17.248.209.69	192.168.2.3
Aug 28, 2023 03:19:38.574771881 CEST	49738	443	192.168.2.3	17.248.209.36
Aug 28, 2023 03:19:38.574789047 CEST	443	49738	17.248.209.36	192.168.2.3
Aug 28, 2023 03:19:38.577266932 CEST	443	49738	17.248.209.36	192.168.2.3
Aug 28, 2023 03:19:38.577349901 CEST	49738	443	192.168.2.3	17.248.209.36
Aug 28, 2023 03:19:38.578840017 CEST	49738	443	192.168.2.3	17.248.209.36
Aug 28, 2023 03:19:38.579078913 CEST	443	49738	17.248.209.36	192.168.2.3
Aug 28, 2023 03:19:38.614518881 CEST	49736	443	192.168.2.3	17.248.209.69
Aug 28, 2023 03:19:38.619533062 CEST	49738	443	192.168.2.3	17.248.209.36
Aug 28, 2023 03:19:38.619556904 CEST	443	49738	17.248.209.36	192.168.2.3
Aug 28, 2023 03:19:38.659565926 CEST	49738	443	192.168.2.3	17.248.209.36
Aug 28, 2023 03:19:38.667102098 CEST	443	49737	17.248.209.67	192.168.2.3
Aug 28, 2023 03:19:38.667463064 CEST	49737	443	192.168.2.3	17.248.209.67
Aug 28, 2023 03:19:38.667489052 CEST	443	49737	17.248.209.67	192.168.2.3
Aug 28, 2023 03:19:38.668766022 CEST	443	49737	17.248.209.67	192.168.2.3
Aug 28, 2023 03:19:38.668891907 CEST	49737	443	192.168.2.3	17.248.209.67
Aug 28, 2023 03:19:38.670481920 CEST	443	49737	17.248.209.67	192.168.2.3
Aug 28, 2023 03:19:38.670588970 CEST	49737	443	192.168.2.3	17.248.209.67
Aug 28, 2023 03:19:38.672156096 CEST	49737	443	192.168.2.3	17.248.209.67
Aug 28, 2023 03:19:38.672461033 CEST	443	49737	17.248.209.67	192.168.2.3
Aug 28, 2023 03:19:38.712533951 CEST	49737	443	192.168.2.3	17.248.209.67
Aug 28, 2023 03:19:38.712575912 CEST	443	49737	17.248.209.67	192.168.2.3
Aug 28, 2023 03:19:38.725398064 CEST	443	49735	17.248.209.65	192.168.2.3
Aug 28, 2023 03:19:38.726087093 CEST	49735	443	192.168.2.3	17.248.209.65
Aug 28, 2023 03:19:38.726152897 CEST	443	49735	17.248.209.65	192.168.2.3
Aug 28, 2023 03:19:38.728569984 CEST	443	49735	17.248.209.65	192.168.2.3
Aug 28, 2023 03:19:38.728652954 CEST	49735	443	192.168.2.3	17.248.209.65
Aug 28, 2023 03:19:38.729441881 CEST	443	49736	17.248.209.69	192.168.2.3
Aug 28, 2023 03:19:38.729593039 CEST	443	49736	17.248.209.69	192.168.2.3
Aug 28, 2023 03:19:38.729692936 CEST	49736	443	192.168.2.3	17.248.209.69
Aug 28, 2023 03:19:38.737369061 CEST	49736	443	192.168.2.3	17.248.209.69
Aug 28, 2023 03:19:38.737411976 CEST	443	49736	17.248.209.69	192.168.2.3
Aug 28, 2023 03:19:38.738595963 CEST	49742	443	192.168.2.3	17.248.209.69
Aug 28, 2023 03:19:38.738667965 CEST	443	49742	17.248.209.69	192.168.2.3
Aug 28, 2023 03:19:38.738782883 CEST	49742	443	192.168.2.3	17.248.209.69
Aug 28, 2023 03:19:38.738892078 CEST	49735	443	192.168.2.3	17.248.209.65
Aug 28, 2023 03:19:38.739099026 CEST	443	49735	17.248.209.65	192.168.2.3
Aug 28, 2023 03:19:38.739876986 CEST	49742	443	192.168.2.3	17.248.209.69
Aug 28, 2023 03:19:38.739913940 CEST	443	49742	17.248.209.69	192.168.2.3
Aug 28, 2023 03:19:38.752528906 CEST	49737	443	192.168.2.3	17.248.209.67
Aug 28, 2023 03:19:38.780700922 CEST	49735	443	192.168.2.3	17.248.209.65
Aug 28, 2023 03:19:38.780736923 CEST	443	49735	17.248.209.65	192.168.2.3
Aug 28, 2023 03:19:38.821530104 CEST	49735	443	192.168.2.3	17.248.209.65
Aug 28, 2023 03:19:38.832753897 CEST	443	49742	17.248.209.69	192.168.2.3
Aug 28, 2023 03:19:38.843832970 CEST	49742	443	192.168.2.3	17.248.209.69
Aug 28, 2023 03:19:38.843859911 CEST	443	49742	17.248.209.69	192.168.2.3
Aug 28, 2023 03:19:38.844633102 CEST	443	49742	17.248.209.69	192.168.2.3
Aug 28, 2023 03:19:38.846729040 CEST	49742	443	192.168.2.3	17.248.209.69
Aug 28, 2023 03:19:38.846863031 CEST	443	49742	17.248.209.69	192.168.2.3
Aug 28, 2023 03:19:38.847197056 CEST	49742	443	192.168.2.3	17.248.209.69
Aug 28, 2023 03:19:38.887475014 CEST	443	49742	17.248.209.69	192.168.2.3
Aug 28, 2023 03:19:39.008307934 CEST	443	49742	17.248.209.69	192.168.2.3
Aug 28, 2023 03:19:39.008521080 CEST	443	49742	17.248.209.69	192.168.2.3
Aug 28, 2023 03:19:39.008629084 CEST	49742	443	192.168.2.3	17.248.209.69
Aug 28, 2023 03:19:39.009715080 CEST	49742	443	192.168.2.3	17.248.209.69
Aug 28, 2023 03:19:39.009744883 CEST	443	49742	17.248.209.69	192.168.2.3
Aug 28, 2023 03:19:42.092138052 CEST	49747	443	192.168.2.3	172.217.168.68
Aug 28, 2023 03:19:42.092217922 CEST	443	49747	172.217.168.68	192.168.2.3
Aug 28, 2023 03:19:42.092302084 CEST	49747	443	192.168.2.3	172.217.168.68
Aug 28, 2023 03:19:42.092571974 CEST	49747	443	192.168.2.3	172.217.168.68
Aug 28, 2023 03:19:42.092605114 CEST	443	49747	172.217.168.68	192.168.2.3
Aug 28, 2023 03:19:42.156825066 CEST	443	49747	172.217.168.68	192.168.2.3
Aug 28, 2023 03:19:42.185380936 CEST	49747	443	192.168.2.3	172.217.168.68
Aug 28, 2023 03:19:42.185431957 CEST	443	49747	172.217.168.68	192.168.2.3
Aug 28, 2023 03:19:42.187730074 CEST	443	49747	172.217.168.68	192.168.2.3
Aug 28, 2023 03:19:42.187874079 CEST	49747	443	192.168.2.3	172.217.168.68
Aug 28, 2023 03:19:42.189757109 CEST	49747	443	192.168.2.3	172.217.168.68
Aug 28, 2023 03:19:42.189949036 CEST	443	49747	172.217.168.68	192.168.2.3
Aug 28, 2023 03:19:42.378818035 CEST	49747	443	192.168.2.3	172.217.168.68
Aug 28, 2023 03:19:42.378840923 CEST	443	49747	172.217.168.68	192.168.2.3
Aug 28, 2023 03:19:42.478818893 CEST	49747	443	192.168.2.3	172.217.168.68
Aug 28, 2023 03:19:48.454196930 CEST	49753	443	192.168.2.3	17.248.209.69
Aug 28, 2023 03:19:48.454251051 CEST	443	49753	17.248.209.69	192.168.2.3
Aug 28, 2023 03:19:48.454346895 CEST	49753	443	192.168.2.3	17.248.209.69
Aug 28, 2023 03:19:48.454751968 CEST	49753	443	192.168.2.3	17.248.209.69
Aug 28, 2023 03:19:48.454773903 CEST	443	49753	17.248.209.69	192.168.2.3
Aug 28, 2023 03:19:48.509855986 CEST	443	49753	17.248.209.69	192.168.2.3
Aug 28, 2023 03:19:48.584404945 CEST	49753	443	192.168.2.3	17.248.209.69
Aug 28, 2023 03:19:48.617225885 CEST	49753	443	192.168.2.3	17.248.209.69
Aug 28, 2023 03:19:48.617275953 CEST	443	49753	17.248.209.69	192.168.2.3
Aug 28, 2023 03:19:48.618751049 CEST	443	49753	17.248.209.69	192.168.2.3
Aug 28, 2023 03:19:48.618788004 CEST	443	49753	17.248.209.69	192.168.2.3
Aug 28, 2023 03:19:48.618853092 CEST	49753	443	192.168.2.3	17.248.209.69
Aug 28, 2023 03:19:48.621151924 CEST	443	49753	17.248.209.69	192.168.2.3
Aug 28, 2023 03:19:48.621252060 CEST	49753	443	192.168.2.3	17.248.209.69
Aug 28, 2023 03:19:48.621287107 CEST	443	49753	17.248.209.69	192.168.2.3
Aug 28, 2023 03:19:48.624085903 CEST	49753	443	192.168.2.3	17.248.209.69
Aug 28, 2023 03:19:48.624366045 CEST	443	49753	17.248.209.69	192.168.2.3
Aug 28, 2023 03:19:48.624407053 CEST	49753	443	192.168.2.3	17.248.209.69
Aug 28, 2023 03:19:48.624485970 CEST	49753	443	192.168.2.3	17.248.209.69
Aug 28, 2023 03:19:48.624641895 CEST	443	49753	17.248.209.69	192.168.2.3
Aug 28, 2023 03:19:48.679841995 CEST	49753	443	192.168.2.3	17.248.209.69
Aug 28, 2023 03:19:48.679898024 CEST	443	49753	17.248.209.69	192.168.2.3
Aug 28, 2023 03:19:48.724842072 CEST	49753	443	192.168.2.3	17.248.209.69
Aug 28, 2023 03:19:48.799144030 CEST	443	49753	17.248.209.69	192.168.2.3
Aug 28, 2023 03:19:48.799330950 CEST	443	49753	17.248.209.69	192.168.2.3
Aug 28, 2023 03:19:48.799438000 CEST	49753	443	192.168.2.3	17.248.209.69
Aug 28, 2023 03:19:48.991234064 CEST	49753	443	192.168.2.3	17.248.209.69
Aug 28, 2023 03:19:48.991308928 CEST	443	49753	17.248.209.69	192.168.2.3
Aug 28, 2023 03:19:51.727834940 CEST	49754	443	192.168.2.3	17.248.209.68
Aug 28, 2023 03:19:51.727885008 CEST	443	49754	17.248.209.68	192.168.2.3
Aug 28, 2023 03:19:51.727957010 CEST	49754	443	192.168.2.3	17.248.209.68
Aug 28, 2023 03:19:51.728360891 CEST	49754	443	192.168.2.3	17.248.209.68
Aug 28, 2023 03:19:51.728382111 CEST	443	49754	17.248.209.68	192.168.2.3
Aug 28, 2023 03:19:51.775558949 CEST	443	49754	17.248.209.68	192.168.2.3
Aug 28, 2023 03:19:51.782273054 CEST	49754	443	192.168.2.3	17.248.209.68
Aug 28, 2023 03:19:51.782341003 CEST	443	49754	17.248.209.68	192.168.2.3
Aug 28, 2023 03:19:51.782978058 CEST	443	49754	17.248.209.68	192.168.2.3
Aug 28, 2023 03:19:51.783052921 CEST	49754	443	192.168.2.3	17.248.209.68
Aug 28, 2023 03:19:51.784054995 CEST	443	49754	17.248.209.68	192.168.2.3
Aug 28, 2023 03:19:51.784123898 CEST	49754	443	192.168.2.3	17.248.209.68
Aug 28, 2023 03:19:51.784713984 CEST	49754	443	192.168.2.3	17.248.209.68
Aug 28, 2023 03:19:51.784921885 CEST	443	49754	17.248.209.68	192.168.2.3
Aug 28, 2023 03:19:51.785263062 CEST	49754	443	192.168.2.3	17.248.209.68
Aug 28, 2023 03:19:51.785303116 CEST	443	49754	17.248.209.68	192.168.2.3
Aug 28, 2023 03:19:51.825716019 CEST	49754	443	192.168.2.3	17.248.209.68
Aug 28, 2023 03:19:51.943492889 CEST	443	49754	17.248.209.68	192.168.2.3
Aug 28, 2023 03:19:51.943583012 CEST	443	49754	17.248.209.68	192.168.2.3
Aug 28, 2023 03:19:51.943692923 CEST	49754	443	192.168.2.3	17.248.209.68
Aug 28, 2023 03:19:52.015058994 CEST	49754	443	192.168.2.3	17.248.209.68
Aug 28, 2023 03:19:52.015074968 CEST	443	49754	17.248.209.68	192.168.2.3
Aug 28, 2023 03:19:52.132148027 CEST	443	49747	172.217.168.68	192.168.2.3
Aug 28, 2023 03:19:52.132303953 CEST	443	49747	172.217.168.68	192.168.2.3
Aug 28, 2023 03:19:52.132460117 CEST	49747	443	192.168.2.3	172.217.168.68
Aug 28, 2023 03:19:53.944195986 CEST	49747	443	192.168.2.3	172.217.168.68
Aug 28, 2023 03:19:53.944221973 CEST	443	49747	172.217.168.68	192.168.2.3
Aug 28, 2023 03:20:23.624852896 CEST	49738	443	192.168.2.3	17.248.209.36
Aug 28, 2023 03:20:23.624886036 CEST	443	49738	17.248.209.36	192.168.2.3
Aug 28, 2023 03:20:23.731805086 CEST	49737	443	192.168.2.3	17.248.209.67
Aug 28, 2023 03:20:23.731852055 CEST	443	49737	17.248.209.67	192.168.2.3
Aug 28, 2023 03:20:23.824871063 CEST	49735	443	192.168.2.3	17.248.209.65
Aug 28, 2023 03:20:23.824913979 CEST	443	49735	17.248.209.65	192.168.2.3
Aug 28, 2023 03:20:38.105103016 CEST	443	49738	17.248.209.36	192.168.2.3
Aug 28, 2023 03:20:38.105309010 CEST	443	49738	17.248.209.36	192.168.2.3
Aug 28, 2023 03:20:38.105413914 CEST	49738	443	192.168.2.3	17.248.209.36
Aug 28, 2023 03:20:38.423032045 CEST	443	49735	17.248.209.65	192.168.2.3
Aug 28, 2023 03:20:38.423316002 CEST	443	49735	17.248.209.65	192.168.2.3
Aug 28, 2023 03:20:38.423398972 CEST	49735	443	192.168.2.3	17.248.209.65
Aug 28, 2023 03:20:38.472744942 CEST	443	49737	17.248.209.67	192.168.2.3
Aug 28, 2023 03:20:38.472846031 CEST	443	49737	17.248.209.67	192.168.2.3
Aug 28, 2023 03:20:38.472914934 CEST	49737	443	192.168.2.3	17.248.209.67
Aug 28, 2023 03:20:39.204870939 CEST	49737	443	192.168.2.3	17.248.209.67
Aug 28, 2023 03:20:39.204921961 CEST	443	49737	17.248.209.67	192.168.2.3
Aug 28, 2023 03:20:39.204946995 CEST	49735	443	192.168.2.3	17.248.209.65
Aug 28, 2023 03:20:39.204971075 CEST	49738	443	192.168.2.3	17.248.209.36
Aug 28, 2023 03:20:39.204977989 CEST	443	49735	17.248.209.65	192.168.2.3
Aug 28, 2023 03:20:39.205024958 CEST	443	49738	17.248.209.36	192.168.2.3
Aug 28, 2023 03:20:40.160762072 CEST	50214	443	192.168.2.3	172.217.168.68
Aug 28, 2023 03:20:40.160849094 CEST	443	50214	172.217.168.68	192.168.2.3
Aug 28, 2023 03:20:40.160945892 CEST	50214	443	192.168.2.3	172.217.168.68
Aug 28, 2023 03:20:40.173341990 CEST	50214	443	192.168.2.3	172.217.168.68
Aug 28, 2023 03:20:40.173397064 CEST	443	50214	172.217.168.68	192.168.2.3
Aug 28, 2023 03:20:40.229557037 CEST	443	50214	172.217.168.68	192.168.2.3
Aug 28, 2023 03:20:40.231642962 CEST	50214	443	192.168.2.3	172.217.168.68
Aug 28, 2023 03:20:40.231717110 CEST	443	50214	172.217.168.68	192.168.2.3
Aug 28, 2023 03:20:40.232589006 CEST	443	50214	172.217.168.68	192.168.2.3
Aug 28, 2023 03:20:40.233098030 CEST	50214	443	192.168.2.3	172.217.168.68
Aug 28, 2023 03:20:40.233261108 CEST	443	50214	172.217.168.68	192.168.2.3
Aug 28, 2023 03:20:40.344451904 CEST	50214	443	192.168.2.3	172.217.168.68
Aug 28, 2023 03:20:50.217834949 CEST	443	50214	172.217.168.68	192.168.2.3
Aug 28, 2023 03:20:50.217984915 CEST	443	50214	172.217.168.68	192.168.2.3
Aug 28, 2023 03:20:50.218077898 CEST	50214	443	192.168.2.3	172.217.168.68
Aug 28, 2023 03:20:50.410734892 CEST	50214	443	192.168.2.3	172.217.168.68
Aug 28, 2023 03:20:50.410783052 CEST	443	50214	172.217.168.68	192.168.2.3
Aug 28, 2023 03:21:40.449843884 CEST	50626	443	192.168.2.3	172.217.168.68
Aug 28, 2023 03:21:40.449913025 CEST	443	50626	172.217.168.68	192.168.2.3
Aug 28, 2023 03:21:40.450031996 CEST	50626	443	192.168.2.3	172.217.168.68
Aug 28, 2023 03:21:40.450351000 CEST	50626	443	192.168.2.3	172.217.168.68
Aug 28, 2023 03:21:40.450381994 CEST	443	50626	172.217.168.68	192.168.2.3
Aug 28, 2023 03:21:40.507180929 CEST	443	50626	172.217.168.68	192.168.2.3
Aug 28, 2023 03:21:40.507692099 CEST	50626	443	192.168.2.3	172.217.168.68
Aug 28, 2023 03:21:40.507750034 CEST	443	50626	172.217.168.68	192.168.2.3
Aug 28, 2023 03:21:40.508838892 CEST	443	50626	172.217.168.68	192.168.2.3
Aug 28, 2023 03:21:40.509442091 CEST	50626	443	192.168.2.3	172.217.168.68
Aug 28, 2023 03:21:40.509607077 CEST	443	50626	172.217.168.68	192.168.2.3
Aug 28, 2023 03:21:40.621608973 CEST	50626	443	192.168.2.3	172.217.168.68
Aug 28, 2023 03:21:50.528517962 CEST	443	50626	172.217.168.68	192.168.2.3
Aug 28, 2023 03:21:50.528687954 CEST	443	50626	172.217.168.68	192.168.2.3
Aug 28, 2023 03:21:50.529025078 CEST	50626	443	192.168.2.3	172.217.168.68
Aug 28, 2023 03:21:51.017278910 CEST	50626	443	192.168.2.3	172.217.168.68
Aug 28, 2023 03:21:51.017323017 CEST	443	50626	172.217.168.68	192.168.2.3

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 28, 2023 03:19:36.227615118 CEST	51739	53	192.168.2.3	8.8.8.8
Aug 28, 2023 03:19:36.227906942 CEST	63604	53	192.168.2.3	8.8.8.8
Aug 28, 2023 03:19:36.228364944 CEST	60000	53	192.168.2.3	8.8.8.8
Aug 28, 2023 03:19:36.228634119 CEST	54193	53	192.168.2.3	8.8.8.8
Aug 28, 2023 03:19:36.260682106 CEST	53	60000	8.8.8.8	192.168.2.3
Aug 28, 2023 03:19:36.268256903 CEST	53	59489	8.8.8.8	192.168.2.3
Aug 28, 2023 03:19:36.273834944 CEST	53	63604	8.8.8.8	192.168.2.3
Aug 28, 2023 03:19:36.281405926 CEST	53	51739	8.8.8.8	192.168.2.3
Aug 28, 2023 03:19:36.282757998 CEST	53	54193	8.8.8.8	192.168.2.3
Aug 28, 2023 03:19:36.598450899 CEST	53	64088	8.8.8.8	192.168.2.3
Aug 28, 2023 03:19:37.906939030 CEST	51854	53	192.168.2.3	8.8.8.8
Aug 28, 2023 03:19:37.909682035 CEST	57282	53	192.168.2.3	8.8.8.8
Aug 28, 2023 03:19:37.946413994 CEST	61084	53	192.168.2.3	8.8.8.8
Aug 28, 2023 03:19:37.946778059 CEST	61769	53	192.168.2.3	8.8.8.8
Aug 28, 2023 03:19:37.953216076 CEST	55108	53	192.168.2.3	8.8.8.8
Aug 28, 2023 03:19:37.954003096 CEST	62364	53	192.168.2.3	8.8.8.8
Aug 28, 2023 03:19:37.961334944 CEST	53	61769	8.8.8.8	192.168.2.3
Aug 28, 2023 03:19:37.980819941 CEST	53	61084	8.8.8.8	192.168.2.3
Aug 28, 2023 03:19:37.980878115 CEST	53	55108	8.8.8.8	192.168.2.3
Aug 28, 2023 03:19:37.981245041 CEST	49809	53	192.168.2.3	8.8.8.8
Aug 28, 2023 03:19:37.982435942 CEST	52108	53	192.168.2.3	8.8.8.8
Aug 28, 2023 03:19:37.982731104 CEST	53	62364	8.8.8.8	192.168.2.3
Aug 28, 2023 03:19:38.003021002 CEST	53	49809	8.8.8.8	192.168.2.3
Aug 28, 2023 03:19:38.008620024 CEST	53	52108	8.8.8.8	192.168.2.3
Aug 28, 2023 03:19:40.066412926 CEST	54156	53	192.168.2.3	8.8.8.8
Aug 28, 2023 03:19:40.066884041 CEST	50959	53	192.168.2.3	8.8.8.8
Aug 28, 2023 03:19:40.731162071 CEST	60880	53	192.168.2.3	8.8.8.8
Aug 28, 2023 03:19:40.731530905 CEST	65220	53	192.168.2.3	8.8.8.8
Aug 28, 2023 03:19:41.310437918 CEST	57453	53	192.168.2.3	8.8.8.8
Aug 28, 2023 03:19:41.311419964 CEST	65154	53	192.168.2.3	8.8.8.8
Aug 28, 2023 03:19:41.750910997 CEST	58750	53	192.168.2.3	8.8.8.8
Aug 28, 2023 03:19:41.751420975 CEST	60541	53	192.168.2.3	8.8.8.8
Aug 28, 2023 03:19:42.084747076 CEST	53	50959	8.8.8.8	192.168.2.3
Aug 28, 2023 03:19:42.089993000 CEST	53	54156	8.8.8.8	192.168.2.3
Aug 28, 2023 03:19:42.094063997 CEST	53	65154	8.8.8.8	192.168.2.3
Aug 28, 2023 03:19:42.099165916 CEST	53	57453	8.8.8.8	192.168.2.3
Aug 28, 2023 03:19:48.392245054 CEST	53776	53	192.168.2.3	8.8.8.8
Aug 28, 2023 03:19:48.392740965 CEST	49561	53	192.168.2.3	8.8.8.8
Aug 28, 2023 03:19:48.423410892 CEST	53	53776	8.8.8.8	192.168.2.3
Aug 28, 2023 03:19:48.423471928 CEST	53	49561	8.8.8.8	192.168.2.3
Aug 28, 2023 03:19:51.549602985 CEST	50442	53	192.168.2.3	8.8.8.8
Aug 28, 2023 03:19:51.550029993 CEST	61166	53	192.168.2.3	8.8.8.8
Aug 28, 2023 03:19:51.569967031 CEST	53	61166	8.8.8.8	192.168.2.3
Aug 28, 2023 03:19:51.579976082 CEST	53	50442	8.8.8.8	192.168.2.3
Aug 28, 2023 03:19:54.876890898 CEST	53	63462	8.8.8.8	192.168.2.3
Aug 28, 2023 03:20:10.482494116 CEST	63412	53	192.168.2.3	8.8.8.8
Aug 28, 2023 03:20:10.482671022 CEST	50321	53	192.168.2.3	8.8.8.8
Aug 28, 2023 03:20:10.483470917 CEST	62432	53	192.168.2.3	8.8.8.8
Aug 28, 2023 03:20:10.483793974 CEST	55573	53	192.168.2.3	8.8.8.8
Aug 28, 2023 03:20:10.484445095 CEST	54227	53	192.168.2.3	8.8.8.8
Aug 28, 2023 03:20:10.484778881 CEST	64214	53	192.168.2.3	8.8.8.8
Aug 28, 2023 03:20:10.489841938 CEST	52265	53	192.168.2.3	8.8.8.8
Aug 28, 2023 03:20:10.490156889 CEST	53626	53	192.168.2.3	8.8.8.8
Aug 28, 2023 03:20:11.293246031 CEST	51340	53	192.168.2.3	8.8.8.8
Aug 28, 2023 03:20:11.293494940 CEST	64859	53	192.168.2.3	8.8.8.8
Aug 28, 2023 03:20:14.006619930 CEST	63200	53	192.168.2.3	8.8.8.8
Aug 28, 2023 03:20:14.006835938 CEST	57068	53	192.168.2.3	8.8.8.8
Aug 28, 2023 03:20:14.017059088 CEST	56103	53	192.168.2.3	8.8.8.8
Aug 28, 2023 03:20:14.017359972 CEST	56905	53	192.168.2.3	8.8.8.8
Aug 28, 2023 03:20:14.018928051 CEST	64742	53	192.168.2.3	8.8.8.8
Aug 28, 2023 03:20:14.019300938 CEST	56828	53	192.168.2.3	8.8.8.8
Aug 28, 2023 03:20:35.408514977 CEST	53	51841	8.8.8.8	192.168.2.3

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Aug 28, 2023 03:19:36.268378973 CEST	192.168.2.3	8.8.8.8	d039	(Port unreachable)	Destination Unreachable
Aug 28, 2023 03:19:42.094140053 CEST	192.168.2.3	8.8.8.8	d00a	(Port unreachable)	Destination Unreachable
Aug 28, 2023 03:20:10.527954102 CEST	192.168.2.3	8.8.8.8	d0b9	(Port unreachable)	Destination Unreachable
Aug 28, 2023 03:20:27.098823071 CEST	192.168.2.3	8.8.8.8	d034	(Port unreachable)	Destination Unreachable
Aug 28, 2023 03:20:30.798804998 CEST	192.168.2.3	8.8.8.8	d04e	(Port unreachable)	Destination Unreachable

Timestamp	kBytes transferred	Direction	Data
2023-08-28 01:19:36 UTC	0	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=115.0.5790.171&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda X-Goog-Update-Updater: chromecrx-115.0.5790.171 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-08-28 01:19:36 UTC	1	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-YXkCfSzkmy_tphZh50O_cA' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 28 Aug 2023 01:19:36 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 6082 X-Daystart: 65976 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-08-28 01:19:36 UTC	2	IN	Data Raw: 32 63 39 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 36 30 38 32 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 36 35 39 37 36 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 2c9<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="6082" elapsed_seconds="65976"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2023-08-28 01:19:36 UTC	2	IN	Data Raw: 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 2f 67 75 70 64 61 74 65 3e 0d 0a Data Ascii: 723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app></gupdate>
2023-08-28 01:19:36 UTC	3	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2023-08-28 01:19:36 UTC	0	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: CONSENT=PENDING+904; SOCS=CAISHAgCEhJnd3NfMjAyMjA4MDgtMF9SQzEaAmVuIAEaBgiAvOuXBg; AEC=Ad49MVGiijyX5dxPFAKxKYso-rIS24Ht-Pxs5fU9hHrAzfASnm-jqdQE1g; NID=511=WyMJovC2uA2AEbHQkGfP-KDdYCeg5Q7Mv6gxYT-qeugtrnXImrhmp1SixwS4ydh_E8Z0hdfCLAXvg2WUqsBSfqpx5SFvCCoeGeevqlEfkoxYi9FTISb8Cu7rr5rf9PyyNbLqf2QbxG7ja7jAB6UJQd5CPvMGcYUasORCRKRL1-arNYzfADAWHJvBLXml-Km_uewDreOyJ-MjxAI-i38Tl6LXI3zB; 1P_JAR=2023-08-10-10
2023-08-28 01:19:36 UTC	1	OUT	Data Raw: 20 Data Ascii:
2023-08-28 01:19:36 UTC	3	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 28 Aug 2023 01:19:36 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-kTL6xQupbKNrxgPqg2xrOw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-08-28 01:19:36 UTC	4	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2023-08-28 01:19:36 UTC	4	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2023-08-28 01:19:38 UTC	4	OUT	POST /setup/ws/1/validate?clientBuildNumber=2317Hotfix55&clientMasteringNumber=2317Hotfix55&clientId=be533f9e-d8ab-48ef-83eb-e96e47814431 HTTP/1.1 Host: setup.icloud.com Connection: keep-alive Content-Length: 0 sec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.icloud.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.icloud.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-08-28 01:19:38 UTC	5	IN	HTTP/1.1 421 Misdirected Request Server: AppleHttpServer/3faf4ee9434b Date: Mon, 28 Aug 2023 01:19:38 GMT Content-Type: application/json; charset=UTF-8 Content-Length: 1257 Connection: close X-Responding-Instance: setupservice:33000401:mr21p30ic-ibaf07200201:8001:2322B645:ed7ebaad966e Cache-Control: no-cache, no-store, private Access-Control-Allow-Origin: https://www.icloud.com Access-Control-Allow-Credentials: true Strict-Transport-Security: max-age=31536000; includeSubDomains x-apple-user-partition: 30 via: 631194250daa17e24277dea86cf30319:130cfaa4e3c82e90183d108f68b81c65:defra2 X-Apple-Request-UUID: b2701396-f5c8-4d80-9230-f8587cc9637f access-control-expose-headers: X-Apple-Request-UUID,Via X-Apple-Edge-Response-Time: 136
2023-08-28 01:19:38 UTC	6	IN	Data Raw: 7b 22 73 75 63 63 65 73 73 22 3a 66 61 6c 73 65 2c 22 72 65 71 75 65 73 74 49 6e 66 6f 22 3a 5b 7b 22 63 6f 75 6e 74 72 79 22 3a 22 43 48 22 2c 22 74 69 6d 65 5a 6f 6e 65 22 3a 22 47 4d 54 2b 31 22 2c 22 72 65 67 69 6f 6e 22 3a 22 5a 48 22 7d 5d 2c 22 63 6f 6e 66 69 67 42 61 67 22 3a 7b 22 75 72 6c 73 22 3a 7b 22 61 63 63 6f 75 6e 74 43 72 65 61 74 65 55 49 22 3a 22 68 74 74 70 73 3a 2f 2f 61 70 70 6c 65 69 64 2e 61 70 70 6c 65 2e 63 6f 6d 2f 77 69 64 67 65 74 2f 61 63 63 6f 75 6e 74 2f 3f 77 69 64 67 65 74 4b 65 79 3d 64 33 39 62 61 39 39 31 36 62 37 32 35 31 30 35 35 62 32 32 63 37 66 39 31 30 65 32 65 61 37 39 36 65 65 36 35 65 39 38 62 32 64 64 65 63 65 61 38 66 35 64 64 65 38 64 39 64 31 61 38 31 35 64 23 21 63 72 65 61 74 65 22 2c 22 61 63 63 6f 75 Data Ascii: {"success":false,"requestInfo":[{"country":"CH","timeZone":"GMT+1","region":"ZH"}],"configBag":{"urls":{"accountCreateUI":"https://appleid.apple.com/widget/account/?widgetKey=d39ba9916b7251055b22c7f910e2ea796ee65e98b2ddecea8f5dde8d9d1a815d#!create","accou

Timestamp	kBytes transferred	Direction	Data
2023-08-28 01:19:38 UTC	7	OUT	POST /setup/ws/1/validate?clientBuildNumber=2317Hotfix55&clientMasteringNumber=2317Hotfix55&clientId=be533f9e-d8ab-48ef-83eb-e96e47814431 HTTP/1.1 Host: setup.icloud.com Connection: keep-alive Content-Length: 0 sec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.icloud.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.icloud.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-08-28 01:19:39 UTC	7	IN	HTTP/1.1 421 Misdirected Request Server: AppleHttpServer/3faf4ee9434b Date: Mon, 28 Aug 2023 01:19:38 GMT Content-Type: application/json; charset=UTF-8 Content-Length: 1257 Connection: close X-Responding-Instance: setupservice:46900101:pv48p69ic-hygg12090901:8001:2322B645:ed7ebaad966e Cache-Control: no-cache, no-store, private Access-Control-Allow-Origin: https://www.icloud.com Access-Control-Allow-Credentials: true Strict-Transport-Security: max-age=31536000; includeSubDomains x-apple-user-partition: 69 via: 631194250daa17e24277dea86cf30319:7bf8471b5842b37e4e890cbef6deb4bc:defra2 X-Apple-Request-UUID: 2cec9d83-e2a5-473e-8de2-2abcf5e7318c access-control-expose-headers: X-Apple-Request-UUID,Via X-Apple-Edge-Response-Time: 140
2023-08-28 01:19:39 UTC	8	IN	Data Raw: 7b 22 73 75 63 63 65 73 73 22 3a 66 61 6c 73 65 2c 22 72 65 71 75 65 73 74 49 6e 66 6f 22 3a 5b 7b 22 63 6f 75 6e 74 72 79 22 3a 22 43 48 22 2c 22 74 69 6d 65 5a 6f 6e 65 22 3a 22 47 4d 54 2b 31 22 2c 22 72 65 67 69 6f 6e 22 3a 22 5a 48 22 7d 5d 2c 22 63 6f 6e 66 69 67 42 61 67 22 3a 7b 22 75 72 6c 73 22 3a 7b 22 61 63 63 6f 75 6e 74 43 72 65 61 74 65 55 49 22 3a 22 68 74 74 70 73 3a 2f 2f 61 70 70 6c 65 69 64 2e 61 70 70 6c 65 2e 63 6f 6d 2f 77 69 64 67 65 74 2f 61 63 63 6f 75 6e 74 2f 3f 77 69 64 67 65 74 4b 65 79 3d 64 33 39 62 61 39 39 31 36 62 37 32 35 31 30 35 35 62 32 32 63 37 66 39 31 30 65 32 65 61 37 39 36 65 65 36 35 65 39 38 62 32 64 64 65 63 65 61 38 66 35 64 64 65 38 64 39 64 31 61 38 31 35 64 23 21 63 72 65 61 74 65 22 2c 22 61 63 63 6f 75 Data Ascii: {"success":false,"requestInfo":[{"country":"CH","timeZone":"GMT+1","region":"ZH"}],"configBag":{"urls":{"accountCreateUI":"https://appleid.apple.com/widget/account/?widgetKey=d39ba9916b7251055b22c7f910e2ea796ee65e98b2ddecea8f5dde8d9d1a815d#!create","accou

Timestamp	kBytes transferred	Direction	Data
2023-08-28 01:19:48 UTC	9	OUT	POST /reportStats HTTP/1.1 Host: feedbackws.icloud.com Connection: keep-alive Content-Length: 6521 sec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.icloud.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.icloud.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-08-28 01:19:48 UTC	10	OUT	Data Raw: 7b 22 73 74 61 74 73 22 3a 5b 7b 22 63 6f 6e 66 69 67 42 61 67 22 3a 7b 22 75 72 6c 73 22 3a 7b 22 61 63 63 6f 75 6e 74 43 72 65 61 74 65 55 49 22 3a 22 68 74 74 70 73 3a 2f 2f 61 70 70 6c 65 69 64 2e 61 70 70 6c 65 2e 63 6f 6d 2f 77 69 64 67 65 74 2f 61 63 63 6f 75 6e 74 2f 3f 77 69 64 67 65 74 4b 65 79 3d 64 33 39 62 61 39 39 31 36 62 37 32 35 31 30 35 35 62 32 32 63 37 66 39 31 30 65 32 65 61 37 39 36 65 65 36 35 65 39 38 62 32 64 64 65 63 65 61 38 66 35 64 64 65 38 64 39 64 31 61 38 31 35 64 23 21 63 72 65 61 74 65 22 2c 22 61 63 63 6f 75 6e 74 4c 6f 67 69 6e 55 49 22 3a 22 68 74 74 70 73 3a 2f 2f 69 64 6d 73 61 2e 61 70 70 6c 65 2e 63 6f 6d 2f 61 70 70 6c 65 61 75 74 68 2f 61 75 74 68 2f 73 69 67 6e 69 6e 3f 77 69 64 67 65 74 4b 65 79 3d 64 33 39 62 Data Ascii: {"stats":[{"configBag":{"urls":{"accountCreateUI":"https://appleid.apple.com/widget/account/?widgetKey=d39ba9916b7251055b22c7f910e2ea796ee65e98b2ddecea8f5dde8d9d1a815d#!create","accountLoginUI":"https://idmsa.apple.com/appleauth/auth/signin?widgetKey=d39b
2023-08-28 01:19:48 UTC	16	IN	HTTP/1.1 200 OK Server: AppleHttpServer/3faf4ee9434b Date: Mon, 28 Aug 2023 01:19:48 GMT Content-Type: application/json; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Responding-Instance: feedbackws:35403201:mr90p54ic-zteg03133501:20201:2322B29:784b17cc8b4b access-control-allow-credentials: true access-control-allow-origin: * Cache-Control: no-cache, no-store, private Strict-Transport-Security: max-age=31536000; includeSubDomains; x-apple-user-partition: 54 via: xrail:mr47p00ic-qujn05080902.me.com:8301:23R321:grp22,631194250daa17e24277dea86cf30319:130cfaa4e3c82e90183d108f68b81c65:defra2 X-Apple-Request-UUID: b2834c36-1302-4cff-a29d-518786ca7fff access-control-expose-headers: X-Apple-Request-UUID,Via X-Apple-Edge-Response-Time: 138
2023-08-28 01:19:48 UTC	17	IN	Data Raw: 32 0d 0a 7b 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 2{}0

Timestamp	kBytes transferred	Direction	Data
2023-08-28 01:19:51 UTC	17	OUT	GET /reportStats HTTP/1.1 Host: feedbackws.icloud.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-08-28 01:19:51 UTC	18	IN	HTTP/1.1 405 Method Not Allowed Server: AppleHttpServer/3faf4ee9434b Date: Mon, 28 Aug 2023 01:19:51 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 20 Connection: close X-Responding-Instance: feedbackws:33201201:mr22p32ic-ztbu02162201:20201:2322B29:784b17cc8b4b Allow: POST Strict-Transport-Security: max-age=31536000; includeSubDomains; x-apple-user-partition: 32 via: xrail:mr42p00ic-qujn09132301.me.com:8301:23R321:grp20,631194250daa17e24277dea86cf30319:4e4a09da2ad75b69ca87e98420817d0f:defra2 X-Apple-Request-UUID: f43b6c00-22f3-4be3-aa7d-1333b82d6611 access-control-expose-headers: X-Apple-Request-UUID,Via X-Apple-Edge-Response-Time: 137
2023-08-28 01:19:51 UTC	18	IN	Data Raw: 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 0d 0a Data Ascii: Method Not Allowed

Target ID:	0
Start time:	03:19:33
Start date:	28/08/2023
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Imagebase:	0x7ff67bb30000
File size:	3'219'224 bytes
MD5 hash:	8D1C4713ACB7CC2AAAEE4477C58A80BA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1558
Entropy (8bit):	5.11458514637545
Encrypted:	false
SSDEEP:	48:OBOCrYJ4rYJVwUCLHDy43HV713XEyMmZ3teTHn:LCrYJ4rYJVwUCHZ3Z13XtdUTH
MD5:	EE002CB9E51BB8DFA89640A406A1090A
SHA1:	49EE3AD535947D8821FFDEB67FFC9BC37D1EBBB2
SHA-256:	3DBD2C90050B652D63656481C3E5871C52261575292DB77D4EA63419F187A55B
SHA-512:	D1FDCC436B8CA8C68D4DC7077F84F803A535BF2CE31D9EB5D0C466B62D6567B2C59974995060403ED757E92245DB07E70C6BDDBF1C3519FED300CC5B9BF9177C
Malicious:	false
Reputation:	low
Preview:	// Copyright 2015 The Chromium Authors. All rights reserved..//.// Redistribution and use in source and binary forms, with or without.// modification, are permitted provided that the following conditions are.// met:.//.// * Redistributions of source code must retain the above copyright.// notice, this list of conditions and the following disclaimer..// * Redistributions in binary form must reproduce the above.// copyright notice, this list of conditions and the following disclaimer.// in the documentation and/or other materials provided with the.// distribution..// * Neither the name of Google Inc. nor the names of its.// contributors may be used to endorse or promote products derived from.// this software without specific prior written permission..//.// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS.// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT.// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR.// A PARTICULAR

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	3362
Entropy (8bit):	3.937471103584068
Encrypted:	false
SSDEEP:	48:91VvRg4z0s7IoXQpVsZfbXYb6JzTnLsjszvbOF6W+c+F4p4btinj1pE:MK0y2sZDYbNjWTWn+F4peinXE
MD5:	626D2E9C4617F9BFBC59B8992FC5988F
SHA1:	F1CE60C36C07D4BBF5738C45E7683A5A678812A1
SHA-256:	B6B3B6526FE1A6A66316113CFEB112662299E1352FECE3F02E13A17F7698D50F
SHA-512:	DFFD2506715DA97573877A22C8136057E12511957B033BA6BFBEE785E6B23E84FEE5ED66C8353FF961E9450B41F9D9FB7A64C7487D5A3C53BFC33D2CD2E32DCA
Malicious:	false
Reputation:	low
Preview:	<svg height="54" viewBox="0 0 39 54" width="39" xmlns="http://www.w3.org/2000/svg"><path d="m0 0h39v54h-39z" fill="none"/><path d="m27.0328 39.8358a9.6818 9.6818 0 0 0 2.6093.3233v8.4278a1.5394 1.5394 0 0 1 -1.3534 1.4131h-1.5482a1.6036 1.6036 0 0 1 -1.4291-1.6255v-9.19a14.27 14.27 0 0 0 1.7214.6513zm-1.7214-1.7471a11.26 11.26 0 0 1 -3.3114-2.5614 6.1631 6.1631 0 0 1 -1.6061-3.7179 6.5061 6.5061 0 0 1 .8023-3.372 5.831 5.831 0 0 1 4.5575-2.7721q.069 0 .1388.0023c1.3919.046 4.7552.3588 7.7759 4.359a4.8053 4.8053 0 0 0 -.4881.0435 5.8333 5.8333 0 0 0 -3.9685 2.6441 7.6982 7.6982 0 0 0 -1.2354 4.3528 3.7467 3.7467 0 0 0 .0859.6771 4.03 4.03 0 0 0 .5993 1.3713 6.7175 6.7175 0 0 1 -1.3374-.2362 13.0444 13.0444 0 0 1 -2.0128-.7905zm1.0656-6.333a1.018 1.018 0 0 0 1.2815-.1049l.058-.0724a.9837.9837 0 0 0 -.2954-1.5628l-1.51-.9718a1.1436 1.1436 0 0 0 -1.4122.0817l-.0849.0824a.97.97 0 0 0 .25 1.4446zm11.7345 4.1955a4.53 4.53 0 0 1 -.1571.5957 6.3594 6.3594 0 0 1 -.6364 1.3174 6.0093 6.0093 0 0 1

Target ID:	1
Start time:	03:19:34
Start date:	28/08/2023
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2008 --field-trial-handle=1800,i,11593714683627311481,18293085444874707215,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff67bb30000
File size:	3'219'224 bytes
MD5 hash:	8D1C4713ACB7CC2AAAEE4477C58A80BA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	2
Start time:	03:19:36
Start date:	28/08/2023
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" "https:/www.icloud.com/attachment/?u=https%3A%2F%2Fcvws.icloud-content.com%2FB%2FAQ7PIpWD5vdfUnxBYAK_f3HDOpg8Ae4xZdtcbjXEO-puRtqaMyvhIui-%2F%24%7Bf%7D%3Fo%3DAu1WPFL4u8DFiLlsROvxRPY8Qen5s-ETz7WhMMaY8oov%26v%3D1%26x%3D3%26a%3DCAoguSzMAM-i_PlTyQwGcijNPxna-5kOYLzKPd7XXoUYwBoSehDnx5vdojEY59eWsawxIgEAKgkC6AMA_2CXDHRSBMM6mDxaBOEi6L5qJ5DT-vmt3jkreyjm8s13kUVzkthDzuAISIS9-LCzRTLmXQ7ah4lmB3InAzxMQrpS0Vv86qL8pXXxXBh7zKv1i1F810HXVjdR0ZXTG6JcywrU%26e%3D1695541472%26fl%3D%26r%3D42D5478F-97BF-46BD-8BB2-9510A8E93652-1%26k%3D%24%7Buk%7D%26ckc%3Dcom.apple.largeattachment%26ckz%3DF05FBE90-B396-4187-96E3-0BBAFE4EED3A%26p%3D53%26s%3DbCq9_u7cBJ4ME9AjKTh-i8Wup_A&uk=lRVER_HjNHGV1B6qlqukFA&f=Images.zip&sz=110039
Imagebase:	0x7ff67bb30000
File size:	3'219'224 bytes
MD5 hash:	8D1C4713ACB7CC2AAAEE4477C58A80BA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_1007498864\_metadata\verified_contents.json

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_1007498864\manifest.fingerprint

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_1007498864\manifest.json

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_1007498864\ssl_error_assistant.pb

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_1787455252\LICENSE

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_1787455252\_metadata\verified_contents.json

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_1787455252\keys.json

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_1787455252\manifest.fingerprint

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_1787455252\manifest.json

Chrome Cache Entry: 1000

Chrome Cache Entry: 1001

Chrome Cache Entry: 1002

Chrome Cache Entry: 1003

Chrome Cache Entry: 1004

Chrome Cache Entry: 1005

Chrome Cache Entry: 1006

Chrome Cache Entry: 1007

Chrome Cache Entry: 1008

Chrome Cache Entry: 1009

Chrome Cache Entry: 1010

Chrome Cache Entry: 1011

Chrome Cache Entry: 1012

Chrome Cache Entry: 1013

Chrome Cache Entry: 1014

Chrome Cache Entry: 1015

Chrome Cache Entry: 1016

Chrome Cache Entry: 1017

Chrome Cache Entry: 1018

Chrome Cache Entry: 1019

Chrome Cache Entry: 415