Joe Sandbox Cloud Basic Analysis Report
Edit tour

Windows Analysis Report
http://brounelink.com

Overview

General Information

Sample URL:http://brounelink.com
Analysis ID:1306959
Infos:

Detection

Score:72
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Antivirus detection for URL or domain

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

Process Tree

  • System is w10x64
  • chrome.exe (PID: 6044 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank MD5: 8D1C4713ACB7CC2AAAEE4477C58A80BA)
    • chrome.exe (PID: 3128 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1956 --field-trial-handle=1872,i,8846809057498325788,147951764276462395,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 8D1C4713ACB7CC2AAAEE4477C58A80BA)
  • chrome.exe (PID: 6128 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" "http://brounelink.com MD5: 8D1C4713ACB7CC2AAAEE4477C58A80BA)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

  • • AV Detection
  • • Phishing
  • • Compliance
  • • Networking
  • • System Summary

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: http://brounelink.comAvira URL Cloud: detection malicious, Label: malware
Source: http://brounelink.com/Virustotal: Detection: 14%Perma Link
Source: http://brounelink.com/favicon.icoVirustotal: Detection: 8%Perma Link
Source: http://brounelink.comVirustotal: Detection: 14%Perma Link
Source: http://brounelink.com/favicon.icoAvira URL Cloud: Label: malware
Source: http://brounelink.com/HTTP Parser: No favicon
Source: C:\Program Files\Google\Chrome\Application\chrome.exeDirectory created: C:\Program Files\chrome_BITS_6044_1759064737Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeDirectory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping6044_2143805831Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeDirectory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping6044_2143805831\keys.jsonJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeDirectory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping6044_2143805831\manifest.jsonJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeDirectory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping6044_2143805831\LICENSEJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeDirectory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping6044_2143805831\_metadata\Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeDirectory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping6044_2143805831\_metadata\verified_contents.jsonJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeDirectory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping6044_2143805831\manifest.fingerprintJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeDirectory created: C:\Program Files\chrome_BITS_6044_1426985376Jump to behavior
Source: unknownDNS traffic detected: queries for: clients2.google.com
Source: unknownNetwork traffic detected: HTTP traffic on port 49698 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49722
Source: unknownNetwork traffic detected: HTTP traffic on port 49699 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49699
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49698
Source: unknownNetwork traffic detected: HTTP traffic on port 49705 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49722 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49705
Source: global trafficHTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=115.0.5790.171&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-115.0.5790.171Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: brounelink.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /favicon.ico HTTP/1.1Host: brounelink.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://brounelink.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Mon, 11 Sep 2023 01:16:58 GMTContent-Type: text/htmlContent-Length: 548Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 11 Sep 2023 01:16:59 GMTContent-Type: text/htmlContent-Length: 548Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: keys.json.0.drString found in binary or memory: https://polyset.xyz
Source: keys.json.0.drString found in binary or memory: https://pst-issuer.hcaptcha.com
Source: keys.json.0.drString found in binary or memory: https://trusttoken.dev
Source: unknownHTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CONSENT=PENDING+904; SOCS=CAISHAgCEhJnd3NfMjAyMjA4MDgtMF9SQzEaAmVuIAEaBgiAvOuXBg; AEC=Ad49MVGiijyX5dxPFAKxKYso-rIS24Ht-Pxs5fU9hHrAzfASnm-jqdQE1g; NID=511=WyMJovC2uA2AEbHQkGfP-KDdYCeg5Q7Mv6gxYT-qeugtrnXImrhmp1SixwS4ydh_E8Z0hdfCLAXvg2WUqsBSfqpx5SFvCCoeGeevqlEfkoxYi9FTISb8Cu7rr5rf9PyyNbLqf2QbxG7ja7jAB6UJQd5CPvMGcYUasORCRKRL1-arNYzfADAWHJvBLXml-Km_uewDreOyJ-MjxAI-i38Tl6LXI3zB
Source: classification engineClassification label: mal72.win@24/7@8/6
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1956 --field-trial-handle=1872,i,8846809057498325788,147951764276462395,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" "http://brounelink.com
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1956 --field-trial-handle=1872,i,8846809057498325788,147951764276462395,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" "http://brounelink.comJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Program Files\chrome_BITS_6044_1759064737Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeDirectory created: C:\Program Files\chrome_BITS_6044_1759064737Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeDirectory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping6044_2143805831Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeDirectory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping6044_2143805831\keys.jsonJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeDirectory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping6044_2143805831\manifest.jsonJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeDirectory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping6044_2143805831\LICENSEJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeDirectory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping6044_2143805831\_metadata\Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeDirectory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping6044_2143805831\_metadata\verified_contents.jsonJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeDirectory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping6044_2143805831\manifest.fingerprintJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeDirectory created: C:\Program Files\chrome_BITS_6044_1426985376Jump to behavior

Mitre Att&ck Matrix

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
Valid AccountsWindows Management InstrumentationPath Interception1
Process Injection		2
Masquerading		OS Credential DumpingSystem Service DiscoveryRemote ServicesData from Local SystemExfiltration Over Other Network Medium1
Encrypted Channel		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
Process Injection		LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable MediaExfiltration Over Bluetooth4
Non-Application Layer Protocol		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration5
Application Layer Protocol		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Binary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureScheduled Transfer3
Ingress Tool Transfer		SIM Card SwapCarrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1306959 URL: http://brounelink.com Startdate: 11/09/2023 Architecture: WINDOWS Score: 72 24 Multi AV Scanner detection for domain / URL 2->24 26 Antivirus detection for URL or domain 2->26 28 Antivirus / Scanner detection for submitted sample 2->28 30 Multi AV Scanner detection for submitted file 2->30 6 chrome.exe 9 2->6         started        9 chrome.exe 2->9         started        process3 dnsIp4 14 192.168.2.1 unknown unknown 6->14 16 239.255.255.250 unknown Reserved 6->16 11 chrome.exe 6->11         started        process5 dnsIp6 18 brounelink.com 5.149.255.154, 49702, 49703, 80 HZ-NL-ASGB United Kingdom 11->18 20 www.google.com 142.250.72.100, 443, 49705, 49722 GOOGLEUS United States 11->20 22 3 other IPs or domains 11->22

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
http://brounelink.com14%VirustotalBrowse
http://brounelink.com100%Avira URL Cloudmalware

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
https://trusttoken.dev0%URL Reputationsafe
https://trusttoken.dev0%URL Reputationsafe
https://polyset.xyz0%URL Reputationsafe
https://pst-issuer.hcaptcha.com0%URL Reputationsafe
https://pst-issuer.hcaptcha.com0%URL Reputationsafe
http://brounelink.com/14%VirustotalBrowse
http://brounelink.com/favicon.ico9%VirustotalBrowse
http://brounelink.com/favicon.ico100%Avira URL Cloudmalware

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
accounts.google.com
142.251.40.205
truefalse
    		high
    www.google.com
    		142.250.72.100
    		truefalse
      		high
      clients.l.google.com
      		142.251.41.14
      		truefalse
        		high
        brounelink.com
        		5.149.255.154
        		truefalse
          		unknown
          clients2.google.com
          		unknown
          		unknownfalse
            		high

            Contacted URLs

            NameMaliciousAntivirus DetectionReputation
            http://brounelink.com/favicon.icofalse
            • 9%, Virustotal, Browse
            • Avira URL Cloud: malware
            		unknown
            https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=115.0.5790.171&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1false
              		high
              https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standardfalse
                		high
                http://brounelink.com/falseunknown
                http://brounelink.com/falseunknown
                NameSourceMaliciousAntivirus DetectionReputation
                https://trusttoken.devkeys.json.0.drfalse
                • URL Reputation: safe
                • URL Reputation: safe
                		unknown
                https://polyset.xyzkeys.json.0.drfalse
                • URL Reputation: safe
                		unknown
                https://pst-issuer.hcaptcha.comkeys.json.0.drfalse
                • URL Reputation: safe
                • URL Reputation: safe
                		unknown

                World Map of Contacted IPs

                • No. of IPs < 25%
                • 25% < No. of IPs < 50%
                • 50% < No. of IPs < 75%
                • 75% < No. of IPs

                Public IPs

                IPDomainCountryFlagASNASN NameMalicious
                142.251.41.14
                		clients.l.google.comUnited States
                		15169GOOGLEUSfalse
                239.255.255.250
                		unknownReserved
                		unknownunknownfalse
                142.251.40.205
                		accounts.google.comUnited States
                		15169GOOGLEUSfalse
                142.250.72.100
                		www.google.comUnited States
                		15169GOOGLEUSfalse
                5.149.255.154
                		brounelink.comUnited Kingdom
                		59711HZ-NL-ASGBfalse

                Private

                IP
                192.168.2.1

                General Information

                Joe Sandbox Version:38.0.0 Beryl
                Analysis ID:1306959
                Start date and time:2023-09-11 03:16:04 +02:00
                Joe Sandbox Product:CloudBasic
                Overall analysis duration:0h 4m 6s
                Hypervisor based Inspection enabled:false
                Report type:full
                Cookbook file name:browseurl.jbs
                Sample URL:http://brounelink.com
                Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
                Number of analysed new started processes analysed:16
                Number of new started drivers analysed:0
                Number of existing processes analysed:0
                Number of existing drivers analysed:0
                Number of injected processes analysed:0
                Technologies:
                • HCA enabled
                • EGA enabled
                • AMSI enabled
                Analysis Mode:default
                Analysis stop reason:Timeout
                Detection:MAL
                Classification:mal72.win@24/7@8/6
                EGA Information:Failed
                HCA Information:
                • Successful, ratio: 100%
                • Number of executed functions: 0
                • Number of non-executed functions: 0
                • Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
                • Excluded IPs from analysis (whitelisted): 142.250.80.35, 34.104.35.123, 142.251.40.99
                • Excluded domains from analysis (whitelisted): edgedl.me.gvt1.com, update.googleapis.com, tse1.mm.bing.net, clientservices.googleapis.com, arc.msn.com
                • Not all processes where analyzed, report is missing behavior information
                • Report size getting too big, too many NtSetInformationFile calls found.

                Simulations

                Behavior and APIs

                ⊘No simulations

                Joe Sandbox View / Context

                IPs

                ⊘No context

                Domains

                ⊘No context

                ASNs

                ⊘No context

                JA3 Fingerprints

                ⊘No context

                Dropped Files

                ⊘No context

                Created / dropped Files

                C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping6044_2143805831\LICENSE

                Download File
                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                File Type:ASCII text
                Category:dropped
                Size (bytes):1558
                Entropy (8bit):5.11458514637545
                Encrypted:false
                SSDEEP:48:OBOCrYJ4rYJVwUCLHDy43HV713XEyMmZ3teTHn:LCrYJ4rYJVwUCHZ3Z13XtdUTH
                MD5:EE002CB9E51BB8DFA89640A406A1090A
                SHA1:49EE3AD535947D8821FFDEB67FFC9BC37D1EBBB2
                SHA-256:3DBD2C90050B652D63656481C3E5871C52261575292DB77D4EA63419F187A55B
                SHA-512:D1FDCC436B8CA8C68D4DC7077F84F803A535BF2CE31D9EB5D0C466B62D6567B2C59974995060403ED757E92245DB07E70C6BDDBF1C3519FED300CC5B9BF9177C
                Malicious:false
                Reputation:low
                Preview:// Copyright 2015 The Chromium Authors. All rights reserved..//.// Redistribution and use in source and binary forms, with or without.// modification, are permitted provided that the following conditions are.// met:.//.// * Redistributions of source code must retain the above copyright.// notice, this list of conditions and the following disclaimer..// * Redistributions in binary form must reproduce the above.// copyright notice, this list of conditions and the following disclaimer.// in the documentation and/or other materials provided with the.// distribution..// * Neither the name of Google Inc. nor the names of its.// contributors may be used to endorse or promote products derived from.// this software without specific prior written permission..//.// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS.// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT.// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR.// A PARTICULAR

                C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping6044_2143805831\_metadata\verified_contents.json

                Download File
                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                File Type:JSON data
                Category:dropped
                Size (bytes):1862
                Entropy (8bit):6.007795404172325
                Encrypted:false
                SSDEEP:48:p/hUksmAdtpkakrNx9vNmUBQjoktzT4hIZ1Di:R9fQtia4LVmV8SzJZc
                MD5:1D63DDAD86600A3CAD88D67A6CB132C7
                SHA1:11A475F32BC8125564E19D76065D46FDBFF6F1C3
                SHA-256:78933430FF577532242F8FA44C9E87D3A4D30F08B0FBC5AF48663ABB16F5F52E
                SHA-512:AE69344AE3EA0322ECFB6AB99EDF65F7B35D40D06EE5541A38992CA0397738FDD97839B816AD20A19DE0EE2D6EDD9E436657AE0A007CD0DA4157FA1C0B139E8E
                Malicious:false
                Reputation:low
                Preview:[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJMSUNFTlNFIiwicm9vdF9oYXNoIjoiUGIwc2tBVUxaUzFqWldTQnctV0hIRkltRlhVcExiZDlUcVkwR2ZHSHBWcyJ9LHsicGF0aCI6ImtleXMuanNvbiIsInJvb3RfaGFzaCI6InZHRU95OXF6d1JUVnd0SHFRMWM2MnhnZERLWHBQOWVZTG1KTnJwYW9DanMifSx7InBhdGgiOiJtYW5pZmVzdC5qc29uIiwicm9vdF9oYXNoIjoiQmxfMVZtRVJfbHZvZ3Z1aU9wd0JuQV9nay1FMzliWmJTaGtsRl9ZM0tDUSJ9XSwiZm9ybWF0IjoidHJlZWhhc2giLCJoYXNoX2Jsb2NrX3NpemUiOjQwOTZ9XSwiaXRlbV9pZCI6ImtpYWJoYWJqZGJramRwamJwaWdmb2RiZGptYmdsY29vIiwiaXRlbV92ZXJzaW9uIjoiMjAyMy45LjQuMSIsInByb3RvY29sX3ZlcnNpb24iOjF9","signatures":[{"header":{"kid":"publisher"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"XLjrDhE6Thv44duSFoWCww_40gcqA5ZgZntFYdJaTz9l8fQpOXypVs1wlcpjuVzVAT_ujBw2cky8Wo6HiF3_PdAe07nj8CV0G4huWzTKq6jbkUgvzrhZLypce5rn1-QG56RY3V34vOlCDaGr3fB1hGFdNy5sWyttY8z9ur9zS43pO0iI7pnbaeJbKcaG_PU3iJJF-tMrBMW3tXcEdyJ0ukz4SbTrVGM0HBPaFfG4gX_Ea4_Ws_582Cl6e

                C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping6044_2143805831\keys.json

                Download File
                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                File Type:JSON data
                Category:dropped
                Size (bytes):3785
                Entropy (8bit):5.9760383777426895
                Encrypted:false
                SSDEEP:48:YDsaFVa7e+LaC8MRxFp9PCCJEMYhWYEWCi60PKEy/++taBDETAo7Usjcs3CFOL3h:UDyi+m0plhYvPuW+ozdswsDm4+y
                MD5:4C5679DCB8C4DEDFECBE6CF659A4BB19
                SHA1:32654A6213F24DAD48271D725CA8FC3F3B342CDD
                SHA-256:BC610ECBDAB3C114D5C2D1EA43573ADB181D0CA5E93FD7982E624DAE96A80A3B
                SHA-512:C638A465540711E75C601F6F9ADE444D596A9CDD7894E39A58E0896926CD9CE95F637E4BA66850F89FAFBA73E7D4564F296E7F2EF3551CFB0F0CA7948E354975
                Malicious:false
                Reputation:low
                Preview:{"https://polyset.xyz":{"PrivateStateTokenV1VOPRF":{"batchsize":1,"id":1,"keys":{"1":{"Y":"AAAAAQQ7W5gOubJT3kTpzNGsekT9RZPXgXGrOMB2+QPw/ZzAuLrM3kc8eyHuTc1KmKjH4sh5+ev5GCI4HVVd46o6rWvNvk0iZQtVuUPhT8X54Ajebng8v5zUnpnPuTjGqlc7+MM=","expiry":"1725389687915000"}},"protocol_version":"PrivateStateTokenV1VOPRF"}},"https://pst-issuer.hcaptcha.com":{"PrivateStateTokenV1VOPRF":{"batchsize":1,"id":1,"keys":{"0":{"Y":"AAAAAAQn0iKkl4Xm6zKsIwQxrjdWuG5y1Dx/HhjZEzg5gzHs/bMzXRC4YqKI8JtrTOg1kzZLcQT4hDYmeuEnGZRSS4ZBtEVwnbk72AH9CB3041g+A2Y8AvXdrBZyBJaswydxU70=","expiry":"1691836104000000"},"102":{"Y":"AAAAZgStKBZhkdiDfCd2M72lOVQEm/8Gs8OokCr6q689DfraBUy2OAqS3fT3CRtHcIFsHHWTmFKfYNYbhDV9lOTeJiwGh/o2c5kSPczpgca9LEoJoNvCttwUfhzApxRQipTktSs=","expiry":"1699612104000000"},"118":{"Y":"AAAAdgTPJ4DSXNbDsSzd0lau1l+PDvS7j7rvWaXeb8Dq+bVbsHi49gWgtAmOvEhrx7qqlsMbowW9oFp+8hpMz0iPetfzNlpZ/rgchHMVGA2mAcUUD6hZpLFwi/WzzjPNzNjghiU=","expiry":"1694428104000000"},"134":{"Y":"AAAAhgQdOOxzj3+ff1GYbZKKas301vAlY5T1+HuRLecI7+aSpZHiJD

                C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping6044_2143805831\manifest.fingerprint

                Download File
                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                File Type:ASCII text, with no line terminators
                Category:dropped
                Size (bytes):66
                Entropy (8bit):3.8008506520558254
                Encrypted:false
                SSDEEP:3:SbzQRXmduB0RgWjQVRtUSqRGn:SnQR1b37tUSqRGn
                MD5:CD5C5BE8BB4AF01A611849D1A2C6DB93
                SHA1:54F31907FE7801B6BA896F84F8380D102B5ED18F
                SHA-256:2B0AA4025B5A730B4E82B9C8F68DC7EF2862AB9E06392F4D2E58045E4436F5BD
                SHA-512:B49A0FE14C66CC52E70330738712816D3645F19AF215B4F85C97F5D27290C595E19B39636AEF2E8E2C6F7AC160180EF9641F5DEBAB16F6B23394E56EF885F336
                Malicious:false
                Reputation:low
                Preview:1.d777e561d401292893abda887af337f2d2e9755e47dd4a42402130484d09429b

                C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping6044_2143805831\manifest.json

                Download File
                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                File Type:JSON data
                Category:dropped
                Size (bytes):78
                Entropy (8bit):4.461657354427988
                Encrypted:false
                SSDEEP:3:rR6TAulhFphifFIPgS1Cc/:F6VlMyPgS1Cc/
                MD5:443A81033B27A223C24CF48E4D9AAE1D
                SHA1:9ED8E922D5DF302FD3D603E56E4376277FE999EC
                SHA-256:065FF5566111FE5BE882FBA23A9C019C0FE093E137F5B65B4A192517F6372824
                SHA-512:6428762F32CA76D822C3C84FAE2F11B9F2EECDCA43BFD50DAC4AC1CC39FB58A8936695393FF48360477EB03B8BFF8D5BD8EA1697257B07ED687A7AEA062C84B8
                Malicious:false
                Reputation:low
                Preview:{. "manifest_version": 2,. "name": "trustToken",. "version": "2023.9.4.1".}

                Chrome Cache Entry: 167

                Download File
                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                File Type:HTML document, ASCII text, with CRLF line terminators
                Category:downloaded
                Size (bytes):548
                Entropy (8bit):4.688532577858027
                Encrypted:false
                SSDEEP:12:TjeRHVIdtklI5r8INGlTF5TF5TF5TF5TF5TFK:neRH68DTPTPTPTPTPTc
                MD5:370E16C3B7DBA286CFF055F93B9A94D8
                SHA1:65F3537C3C798F7DA146C55AEF536F7B5D0CB943
                SHA-256:D465172175D35D493FB1633E237700022BD849FA123164790B168B8318ACB090
                SHA-512:75CD6A0AC7D6081D35140ABBEA018D1A2608DD936E2E21F61BF69E063F6FA16DD31C62392F5703D7A7C828EE3D4ECC838E73BFF029A98CED8986ACB5C8364966
                Malicious:false
                Reputation:low
                URL:http://brounelink.com/favicon.ico
                Preview:<html>..<head><title>404 Not Found</title></head>..<body>..<center><h1>404 Not Found</h1></center>..<hr><center>nginx</center>..</body>..</html>.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->..

                Chrome Cache Entry: 168

                Download File
                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                File Type:HTML document, ASCII text, with CRLF line terminators
                Category:downloaded
                Size (bytes):548
                Entropy (8bit):4.660801881684815
                Encrypted:false
                SSDEEP:12:TvgsoCVIogs01lI5r8INGlTF5TF5TF5TF5TF5TFK:cEQtnDTPTPTPTPTPTc
                MD5:4B074B0B59693FA9F94FB71B175FB187
                SHA1:0004D4F82B546013424B2E0DE084395071EEF98B
                SHA-256:25FB23868EBF48348F9E438E00CB9B9D9B3A054F32482A781C762CC4F9CC6393
                SHA-512:F928E9FAA0BC776FC5D8A0326981853709D437B7B1C2E238894BFB2ACBB627442C425CBB00D369C52D15876B6C795E67F7580341686696D569A908A6ADD4B444
                Malicious:false
                Reputation:low
                URL:http://brounelink.com/
                Preview:<html>..<head><title>403 Forbidden</title></head>..<body>..<center><h1>403 Forbidden</h1></center>..<hr><center>nginx</center>..</body>..</html>.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->..

                Static File Info

                ⊘No static file info

                Network Behavior

                Download Network PCAP: filtered – full

                Network Port Distribution

                • Total Packets: 63
                • • 443 (HTTPS)
                • • 80 (HTTP)
                • • 53 (DNS)
                TimestampSource PortDest PortSource IPDest IP
                Sep 11, 2023 03:16:57.382385015 CEST49698443192.168.2.3142.251.40.205
                Sep 11, 2023 03:16:57.382488012 CEST44349698142.251.40.205192.168.2.3
                Sep 11, 2023 03:16:57.382601976 CEST49698443192.168.2.3142.251.40.205
                Sep 11, 2023 03:16:57.383379936 CEST49699443192.168.2.3142.251.41.14
                Sep 11, 2023 03:16:57.383460999 CEST44349699142.251.41.14192.168.2.3
                Sep 11, 2023 03:16:57.383550882 CEST49699443192.168.2.3142.251.41.14
                Sep 11, 2023 03:16:57.384501934 CEST49699443192.168.2.3142.251.41.14
                Sep 11, 2023 03:16:57.384540081 CEST44349699142.251.41.14192.168.2.3
                Sep 11, 2023 03:16:57.384776115 CEST49698443192.168.2.3142.251.40.205
                Sep 11, 2023 03:16:57.384833097 CEST44349698142.251.40.205192.168.2.3
                Sep 11, 2023 03:16:57.662909985 CEST44349699142.251.41.14192.168.2.3
                Sep 11, 2023 03:16:57.664036989 CEST49699443192.168.2.3142.251.41.14
                Sep 11, 2023 03:16:57.664076090 CEST44349699142.251.41.14192.168.2.3
                Sep 11, 2023 03:16:57.664679050 CEST44349699142.251.41.14192.168.2.3
                Sep 11, 2023 03:16:57.664788961 CEST49699443192.168.2.3142.251.41.14
                Sep 11, 2023 03:16:57.666081905 CEST44349699142.251.41.14192.168.2.3
                Sep 11, 2023 03:16:57.666182041 CEST49699443192.168.2.3142.251.41.14
                Sep 11, 2023 03:16:57.668246984 CEST49699443192.168.2.3142.251.41.14
                Sep 11, 2023 03:16:57.668359041 CEST44349699142.251.41.14192.168.2.3
                Sep 11, 2023 03:16:57.668492079 CEST49699443192.168.2.3142.251.41.14
                Sep 11, 2023 03:16:57.668517113 CEST44349699142.251.41.14192.168.2.3
                Sep 11, 2023 03:16:57.708250046 CEST49699443192.168.2.3142.251.41.14
                Sep 11, 2023 03:16:57.713912010 CEST44349698142.251.40.205192.168.2.3
                Sep 11, 2023 03:16:57.720583916 CEST49698443192.168.2.3142.251.40.205
                Sep 11, 2023 03:16:57.720654011 CEST44349698142.251.40.205192.168.2.3
                Sep 11, 2023 03:16:57.722105026 CEST44349698142.251.40.205192.168.2.3
                Sep 11, 2023 03:16:57.722251892 CEST49698443192.168.2.3142.251.40.205
                Sep 11, 2023 03:16:57.724648952 CEST49698443192.168.2.3142.251.40.205
                Sep 11, 2023 03:16:57.724802971 CEST44349698142.251.40.205192.168.2.3
                Sep 11, 2023 03:16:57.724875927 CEST49698443192.168.2.3142.251.40.205
                Sep 11, 2023 03:16:57.767488003 CEST44349698142.251.40.205192.168.2.3
                Sep 11, 2023 03:16:57.770701885 CEST49698443192.168.2.3142.251.40.205
                Sep 11, 2023 03:16:57.770741940 CEST44349698142.251.40.205192.168.2.3
                Sep 11, 2023 03:16:57.817645073 CEST49698443192.168.2.3142.251.40.205
                Sep 11, 2023 03:16:57.870028019 CEST44349699142.251.41.14192.168.2.3
                Sep 11, 2023 03:16:57.870429993 CEST44349699142.251.41.14192.168.2.3
                Sep 11, 2023 03:16:57.870549917 CEST49699443192.168.2.3142.251.41.14
                Sep 11, 2023 03:16:57.872695923 CEST49699443192.168.2.3142.251.41.14
                Sep 11, 2023 03:16:57.872747898 CEST44349699142.251.41.14192.168.2.3
                Sep 11, 2023 03:16:57.986828089 CEST44349698142.251.40.205192.168.2.3
                Sep 11, 2023 03:16:57.986968994 CEST49698443192.168.2.3142.251.40.205
                Sep 11, 2023 03:16:57.987025023 CEST44349698142.251.40.205192.168.2.3
                Sep 11, 2023 03:16:57.987813950 CEST44349698142.251.40.205192.168.2.3
                Sep 11, 2023 03:16:57.987920046 CEST49698443192.168.2.3142.251.40.205
                Sep 11, 2023 03:16:57.988137007 CEST49698443192.168.2.3142.251.40.205
                Sep 11, 2023 03:16:57.988174915 CEST44349698142.251.40.205192.168.2.3
                Sep 11, 2023 03:16:58.446791887 CEST4970280192.168.2.35.149.255.154
                Sep 11, 2023 03:16:58.447676897 CEST4970380192.168.2.35.149.255.154
                Sep 11, 2023 03:16:58.613598108 CEST80497025.149.255.154192.168.2.3
                Sep 11, 2023 03:16:58.613734007 CEST4970280192.168.2.35.149.255.154
                Sep 11, 2023 03:16:58.614217997 CEST80497035.149.255.154192.168.2.3
                Sep 11, 2023 03:16:58.614341021 CEST4970380192.168.2.35.149.255.154
                Sep 11, 2023 03:16:58.615845919 CEST4970380192.168.2.35.149.255.154
                Sep 11, 2023 03:16:58.782380104 CEST80497035.149.255.154192.168.2.3
                Sep 11, 2023 03:16:58.782427073 CEST80497035.149.255.154192.168.2.3
                Sep 11, 2023 03:16:58.823618889 CEST4970380192.168.2.35.149.255.154
                Sep 11, 2023 03:16:59.348927975 CEST4970380192.168.2.35.149.255.154
                Sep 11, 2023 03:16:59.516105890 CEST80497035.149.255.154192.168.2.3
                Sep 11, 2023 03:16:59.557694912 CEST4970380192.168.2.35.149.255.154
                Sep 11, 2023 03:17:01.235830069 CEST49705443192.168.2.3142.250.72.100
                Sep 11, 2023 03:17:01.235939026 CEST44349705142.250.72.100192.168.2.3
                Sep 11, 2023 03:17:01.236043930 CEST49705443192.168.2.3142.250.72.100
                Sep 11, 2023 03:17:01.236536026 CEST49705443192.168.2.3142.250.72.100
                Sep 11, 2023 03:17:01.236577034 CEST44349705142.250.72.100192.168.2.3
                Sep 11, 2023 03:17:01.446969032 CEST44349705142.250.72.100192.168.2.3
                Sep 11, 2023 03:17:01.447490931 CEST49705443192.168.2.3142.250.72.100
                Sep 11, 2023 03:17:01.447571039 CEST44349705142.250.72.100192.168.2.3
                Sep 11, 2023 03:17:01.448923111 CEST44349705142.250.72.100192.168.2.3
                Sep 11, 2023 03:17:01.449021101 CEST49705443192.168.2.3142.250.72.100
                Sep 11, 2023 03:17:01.450653076 CEST49705443192.168.2.3142.250.72.100
                Sep 11, 2023 03:17:01.450783014 CEST44349705142.250.72.100192.168.2.3
                Sep 11, 2023 03:17:01.504937887 CEST49705443192.168.2.3142.250.72.100
                Sep 11, 2023 03:17:01.505013943 CEST44349705142.250.72.100192.168.2.3
                Sep 11, 2023 03:17:01.552229881 CEST49705443192.168.2.3142.250.72.100
                Sep 11, 2023 03:17:11.428459883 CEST44349705142.250.72.100192.168.2.3
                Sep 11, 2023 03:17:11.428653955 CEST44349705142.250.72.100192.168.2.3
                Sep 11, 2023 03:17:11.428766966 CEST49705443192.168.2.3142.250.72.100
                Sep 11, 2023 03:17:12.459696054 CEST49705443192.168.2.3142.250.72.100
                Sep 11, 2023 03:17:12.459779024 CEST44349705142.250.72.100192.168.2.3
                Sep 11, 2023 03:17:43.631127119 CEST4970280192.168.2.35.149.255.154
                Sep 11, 2023 03:17:43.798954010 CEST80497025.149.255.154192.168.2.3
                Sep 11, 2023 03:17:44.521945000 CEST4970380192.168.2.35.149.255.154
                Sep 11, 2023 03:17:44.688966036 CEST80497035.149.255.154192.168.2.3
                Sep 11, 2023 03:17:58.781380892 CEST80497025.149.255.154192.168.2.3
                Sep 11, 2023 03:17:58.781486988 CEST4970280192.168.2.35.149.255.154
                Sep 11, 2023 03:17:59.603547096 CEST4970280192.168.2.35.149.255.154
                Sep 11, 2023 03:17:59.770239115 CEST80497025.149.255.154192.168.2.3
                Sep 11, 2023 03:18:01.149424076 CEST49722443192.168.2.3142.250.72.100
                Sep 11, 2023 03:18:01.149545908 CEST44349722142.250.72.100192.168.2.3
                Sep 11, 2023 03:18:01.149760962 CEST49722443192.168.2.3142.250.72.100
                Sep 11, 2023 03:18:01.150218964 CEST49722443192.168.2.3142.250.72.100
                Sep 11, 2023 03:18:01.150259018 CEST44349722142.250.72.100192.168.2.3
                Sep 11, 2023 03:18:01.352973938 CEST44349722142.250.72.100192.168.2.3
                Sep 11, 2023 03:18:01.353355885 CEST49722443192.168.2.3142.250.72.100
                Sep 11, 2023 03:18:01.353410006 CEST44349722142.250.72.100192.168.2.3
                Sep 11, 2023 03:18:01.354043961 CEST44349722142.250.72.100192.168.2.3
                Sep 11, 2023 03:18:01.354594946 CEST49722443192.168.2.3142.250.72.100
                Sep 11, 2023 03:18:01.354727983 CEST44349722142.250.72.100192.168.2.3
                Sep 11, 2023 03:18:01.397598982 CEST49722443192.168.2.3142.250.72.100
                Sep 11, 2023 03:18:04.518431902 CEST80497035.149.255.154192.168.2.3
                Sep 11, 2023 03:18:04.518784046 CEST4970380192.168.2.35.149.255.154
                Sep 11, 2023 03:18:05.603660107 CEST4970380192.168.2.35.149.255.154
                Sep 11, 2023 03:18:05.774112940 CEST80497035.149.255.154192.168.2.3
                Sep 11, 2023 03:18:11.338181973 CEST44349722142.250.72.100192.168.2.3
                Sep 11, 2023 03:18:11.338277102 CEST44349722142.250.72.100192.168.2.3
                Sep 11, 2023 03:18:11.338386059 CEST49722443192.168.2.3142.250.72.100
                Sep 11, 2023 03:18:11.604274988 CEST49722443192.168.2.3142.250.72.100
                Sep 11, 2023 03:18:11.604341984 CEST44349722142.250.72.100192.168.2.3
                TimestampSource PortDest PortSource IPDest IP
                Sep 11, 2023 03:16:57.278346062 CEST5195953192.168.2.38.8.8.8
                Sep 11, 2023 03:16:57.278587103 CEST5420353192.168.2.38.8.8.8
                Sep 11, 2023 03:16:57.279130936 CEST5084253192.168.2.38.8.8.8
                Sep 11, 2023 03:16:57.279424906 CEST5321053192.168.2.38.8.8.8
                Sep 11, 2023 03:16:57.376368999 CEST53508748.8.8.8192.168.2.3
                Sep 11, 2023 03:16:57.377568007 CEST53519598.8.8.8192.168.2.3
                Sep 11, 2023 03:16:57.377775908 CEST53542038.8.8.8192.168.2.3
                Sep 11, 2023 03:16:57.377950907 CEST53532108.8.8.8192.168.2.3
                Sep 11, 2023 03:16:57.378722906 CEST53508428.8.8.8192.168.2.3
                Sep 11, 2023 03:16:58.074461937 CEST53612618.8.8.8192.168.2.3
                Sep 11, 2023 03:16:58.310106039 CEST5645253192.168.2.38.8.8.8
                Sep 11, 2023 03:16:58.311014891 CEST5948953192.168.2.38.8.8.8
                Sep 11, 2023 03:16:58.419821978 CEST53564528.8.8.8192.168.2.3
                Sep 11, 2023 03:16:58.495748043 CEST53594898.8.8.8192.168.2.3
                Sep 11, 2023 03:17:01.093081951 CEST6000053192.168.2.38.8.8.8
                Sep 11, 2023 03:17:01.093691111 CEST5419353192.168.2.38.8.8.8
                Sep 11, 2023 03:17:01.190656900 CEST53600008.8.8.8192.168.2.3
                Sep 11, 2023 03:17:01.190844059 CEST53541938.8.8.8192.168.2.3
                Sep 11, 2023 03:17:56.900572062 CEST53618718.8.8.8192.168.2.3
                TimestampSource IPDest IPChecksumCodeType
                Sep 11, 2023 03:16:58.495857954 CEST192.168.2.38.8.8.8d031(Port unreachable)Destination Unreachable

                DNS Queries

                TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                Sep 11, 2023 03:16:57.278346062 CEST192.168.2.38.8.8.80xd87bStandard query (0)clients2.google.comA (IP address)IN (0x0001)false
                Sep 11, 2023 03:16:57.278587103 CEST192.168.2.38.8.8.80x1f62Standard query (0)clients2.google.com65IN (0x0001)false
                Sep 11, 2023 03:16:57.279130936 CEST192.168.2.38.8.8.80x38b3Standard query (0)accounts.google.comA (IP address)IN (0x0001)false
                Sep 11, 2023 03:16:57.279424906 CEST192.168.2.38.8.8.80x590cStandard query (0)accounts.google.com65IN (0x0001)false
                Sep 11, 2023 03:16:58.310106039 CEST192.168.2.38.8.8.80xf065Standard query (0)brounelink.comA (IP address)IN (0x0001)false
                Sep 11, 2023 03:16:58.311014891 CEST192.168.2.38.8.8.80xb077Standard query (0)brounelink.com65IN (0x0001)false
                Sep 11, 2023 03:17:01.093081951 CEST192.168.2.38.8.8.80xfe3cStandard query (0)www.google.comA (IP address)IN (0x0001)false
                Sep 11, 2023 03:17:01.093691111 CEST192.168.2.38.8.8.80x8504Standard query (0)www.google.com65IN (0x0001)false

                DNS Answers

                TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                Sep 11, 2023 03:16:57.377568007 CEST8.8.8.8192.168.2.30xd87bNo error (0)clients2.google.comclients.l.google.comCNAME (Canonical name)IN (0x0001)false
                Sep 11, 2023 03:16:57.377568007 CEST8.8.8.8192.168.2.30xd87bNo error (0)clients.l.google.com142.251.41.14A (IP address)IN (0x0001)false
                Sep 11, 2023 03:16:57.377775908 CEST8.8.8.8192.168.2.30x1f62No error (0)clients2.google.comclients.l.google.comCNAME (Canonical name)IN (0x0001)false
                Sep 11, 2023 03:16:57.378722906 CEST8.8.8.8192.168.2.30x38b3No error (0)accounts.google.com142.251.40.205A (IP address)IN (0x0001)false
                Sep 11, 2023 03:16:58.419821978 CEST8.8.8.8192.168.2.30xf065No error (0)brounelink.com5.149.255.154A (IP address)IN (0x0001)false
                Sep 11, 2023 03:16:58.419821978 CEST8.8.8.8192.168.2.30xf065No error (0)brounelink.com5.149.248.141A (IP address)IN (0x0001)false
                Sep 11, 2023 03:16:58.419821978 CEST8.8.8.8192.168.2.30xf065No error (0)brounelink.com5.149.254.180A (IP address)IN (0x0001)false
                Sep 11, 2023 03:16:58.419821978 CEST8.8.8.8192.168.2.30xf065No error (0)brounelink.com79.141.160.71A (IP address)IN (0x0001)false
                Sep 11, 2023 03:16:58.419821978 CEST8.8.8.8192.168.2.30xf065No error (0)brounelink.com5.149.254.210A (IP address)IN (0x0001)false
                Sep 11, 2023 03:16:58.419821978 CEST8.8.8.8192.168.2.30xf065No error (0)brounelink.com79.141.160.87A (IP address)IN (0x0001)false
                Sep 11, 2023 03:17:01.190656900 CEST8.8.8.8192.168.2.30xfe3cNo error (0)www.google.com142.250.72.100A (IP address)IN (0x0001)false
                Sep 11, 2023 03:17:01.190844059 CEST8.8.8.8192.168.2.30x8504No error (0)www.google.com65IN (0x0001)false

                HTTP Request Dependency Graph

                • clients2.google.com
                • accounts.google.com
                • brounelink.com

                HTTP Packets

                Session IDSource IPSource PortDestination IPDestination PortProcess
                0192.168.2.349699142.251.41.14443C:\Program Files\Google\Chrome\Application\chrome.exe
                TimestampkBytes transferredDirectionData


                Session IDSource IPSource PortDestination IPDestination PortProcess
                1192.168.2.349698142.251.40.205443C:\Program Files\Google\Chrome\Application\chrome.exe
                TimestampkBytes transferredDirectionData


                Session IDSource IPSource PortDestination IPDestination PortProcess
                2192.168.2.3497035.149.255.15480C:\Program Files\Google\Chrome\Application\chrome.exe
                TimestampkBytes transferredDirectionData
                Sep 11, 2023 03:16:58.615845919 CEST482OUTGET / HTTP/1.1
                Host: brounelink.com
                Connection: keep-alive
                Upgrade-Insecure-Requests: 1
                User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36
                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                Accept-Encoding: gzip, deflate
                Accept-Language: en-US,en;q=0.9
                Sep 11, 2023 03:16:58.782427073 CEST548INHTTP/1.1 403 Forbidden
                Server: nginx
                Date: Mon, 11 Sep 2023 01:16:58 GMT
                Content-Type: text/html
                Content-Length: 548
                Connection: keep-alive
                Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a
                Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
                Sep 11, 2023 03:16:59.348927975 CEST549OUTGET /favicon.ico HTTP/1.1
                Host: brounelink.com
                Connection: keep-alive
                User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36
                Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                Referer: http://brounelink.com/
                Accept-Encoding: gzip, deflate
                Accept-Language: en-US,en;q=0.9
                Sep 11, 2023 03:16:59.516105890 CEST550INHTTP/1.1 404 Not Found
                Server: nginx
                Date: Mon, 11 Sep 2023 01:16:59 GMT
                Content-Type: text/html
                Content-Length: 548
                Connection: keep-alive
                Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a
                Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
                Sep 11, 2023 03:17:44.521945000 CEST623OUTData Raw: 00
                Data Ascii:


                Session IDSource IPSource PortDestination IPDestination PortProcess
                3192.168.2.3497025.149.255.15480C:\Program Files\Google\Chrome\Application\chrome.exe
                TimestampkBytes transferredDirectionData
                Sep 11, 2023 03:17:43.631127119 CEST623OUTData Raw: 00
                Data Ascii:


                HTTPS Proxied Packets

                Session IDSource IPSource PortDestination IPDestination PortProcess
                0192.168.2.349699142.251.41.14443C:\Program Files\Google\Chrome\Application\chrome.exe
                TimestampkBytes transferredDirectionData
                2023-09-11 01:16:57 UTC0OUTGET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=115.0.5790.171&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1
                Host: clients2.google.com
                Connection: keep-alive
                X-Goog-Update-Interactivity: fg
                X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda
                X-Goog-Update-Updater: chromecrx-115.0.5790.171
                Sec-Fetch-Site: none
                Sec-Fetch-Mode: no-cors
                Sec-Fetch-Dest: empty
                User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36
                Accept-Encoding: gzip, deflate, br
                Accept-Language: en-US,en;q=0.9
                2023-09-11 01:16:57 UTC1INHTTP/1.1 200 OK
                Content-Security-Policy: script-src 'report-sample' 'nonce-hnGY3JWNIV1PoktAjbPnWg' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1
                Cache-Control: no-cache, no-store, max-age=0, must-revalidate
                Pragma: no-cache
                Expires: Mon, 01 Jan 1990 00:00:00 GMT
                Date: Mon, 11 Sep 2023 01:16:57 GMT
                Content-Type: text/xml; charset=UTF-8
                X-Daynum: 6096
                X-Daystart: 65817
                X-Content-Type-Options: nosniff
                X-Frame-Options: SAMEORIGIN
                X-XSS-Protection: 1; mode=block
                Server: GSE
                Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                Accept-Ranges: none
                Vary: Accept-Encoding
                Connection: close
                Transfer-Encoding: chunked
                2023-09-11 01:16:57 UTC2INData Raw: 32 63 39 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 36 30 39 36 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 36 35 38 31 37 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22
                Data Ascii: 2c9<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="6096" elapsed_seconds="65817"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
                2023-09-11 01:16:57 UTC2INData Raw: 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 2f 67 75 70 64 61 74 65 3e 0d 0a
                Data Ascii: 723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app></gupdate>
                2023-09-11 01:16:57 UTC2INData Raw: 30 0d 0a 0d 0a
                Data Ascii: 0


                Session IDSource IPSource PortDestination IPDestination PortProcess
                1192.168.2.349698142.251.40.205443C:\Program Files\Google\Chrome\Application\chrome.exe
                TimestampkBytes transferredDirectionData
                2023-09-11 01:16:57 UTC0OUTPOST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1
                Host: accounts.google.com
                Connection: keep-alive
                Content-Length: 1
                Origin: https://www.google.com
                Content-Type: application/x-www-form-urlencoded
                Sec-Fetch-Site: none
                Sec-Fetch-Mode: no-cors
                Sec-Fetch-Dest: empty
                User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36
                Accept-Encoding: gzip, deflate, br
                Accept-Language: en-US,en;q=0.9
                Cookie: CONSENT=PENDING+904; SOCS=CAISHAgCEhJnd3NfMjAyMjA4MDgtMF9SQzEaAmVuIAEaBgiAvOuXBg; AEC=Ad49MVGiijyX5dxPFAKxKYso-rIS24Ht-Pxs5fU9hHrAzfASnm-jqdQE1g; NID=511=WyMJovC2uA2AEbHQkGfP-KDdYCeg5Q7Mv6gxYT-qeugtrnXImrhmp1SixwS4ydh_E8Z0hdfCLAXvg2WUqsBSfqpx5SFvCCoeGeevqlEfkoxYi9FTISb8Cu7rr5rf9PyyNbLqf2QbxG7ja7jAB6UJQd5CPvMGcYUasORCRKRL1-arNYzfADAWHJvBLXml-Km_uewDreOyJ-MjxAI-i38Tl6LXI3zB
                2023-09-11 01:16:57 UTC1OUTData Raw: 20
                Data Ascii:
                2023-09-11 01:16:57 UTC2INHTTP/1.1 200 OK
                Content-Type: application/json; charset=utf-8
                Access-Control-Allow-Origin: https://www.google.com
                Access-Control-Allow-Credentials: true
                X-Content-Type-Options: nosniff
                Cache-Control: no-cache, no-store, max-age=0, must-revalidate
                Pragma: no-cache
                Expires: Mon, 01 Jan 1990 00:00:00 GMT
                Date: Mon, 11 Sep 2023 01:16:57 GMT
                Strict-Transport-Security: max-age=31536000; includeSubDomains
                Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
                Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport
                Content-Security-Policy: script-src 'report-sample' 'nonce-889qyZyL-eP2E6QYBPmJKg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self'
                Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport/allowlist
                Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                Cross-Origin-Opener-Policy: same-origin
                Server: ESF
                X-XSS-Protection: 0
                Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                Accept-Ranges: none
                Vary: Accept-Encoding
                Connection: close
                Transfer-Encoding: chunked
                2023-09-11 01:16:57 UTC4INData Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a
                Data Ascii: 11["gaia.l.a.r",[]]
                2023-09-11 01:16:57 UTC4INData Raw: 30 0d 0a 0d 0a
                Data Ascii: 0


                Statistics

                CPU Usage

                020406080s020406080100

                Click to jump to process

                Memory Usage

                020406080s0.0020406080100MB

                Click to jump to process

                Behavior

                Click to jump to process

                System Behavior

                General

                Target ID:0
                Start time:03:16:53
                Start date:11/09/2023
                Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                Wow64 process (32bit):false
                Commandline:C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
                Imagebase:0x7ff67bb30000
                File size:3'219'224 bytes
                MD5 hash:8D1C4713ACB7CC2AAAEE4477C58A80BA
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Reputation:low
                Has exited:false
                Show Windows behavior

                File Activities

                There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                Show Windows behavior

                Process Activities

                There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                Show Windows behavior

                Memory Activities

                There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                Show Windows behavior

                Process Token Activities


                General

                Target ID:1
                Start time:03:16:55
                Start date:11/09/2023
                Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                Wow64 process (32bit):false
                Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1956 --field-trial-handle=1872,i,8846809057498325788,147951764276462395,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
                Imagebase:0x7ff67bb30000
                File size:3'219'224 bytes
                MD5 hash:8D1C4713ACB7CC2AAAEE4477C58A80BA
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Reputation:low
                Has exited:false
                Show Windows behavior

                File Activities

                There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                Show Windows behavior

                Memory Activities


                General

                Target ID:2
                Start time:03:16:57
                Start date:11/09/2023
                Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                Wow64 process (32bit):false
                Commandline:C:\Program Files\Google\Chrome\Application\chrome.exe" "http://brounelink.com
                Imagebase:0x7ff67bb30000
                File size:3'219'224 bytes
                MD5 hash:8D1C4713ACB7CC2AAAEE4477C58A80BA
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Reputation:low
                Has exited:true
                There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

                Disassembly

                ⊘No disassembly