Edit tour

Windows Analysis Report
https://www.coatsgolds.com/871rc5m/21748tpd?sub1=177772&sub2=14437210-6546&sub3=8676

Overview

General Information

Sample URL:	https://www.coatsgolds.com/871rc5m/21748tpd?sub1=177772&sub2=14437210-6546&sub3=8676
Analysis ID:	1346381
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Stores files to the Windows start menu directory

Creates files inside the system directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6340 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.coatsgolds.com/871rc5m/21748tpd?sub1=177772&sub2=14437210-6546&sub3=8676 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6496 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2024 --field-trial-handle=1896,i,18030200112660565471,16170946260577905929,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://www.coatsgolds.com/871rc5m/21748tpd?sub1=177772&sub2=14437210-6546&sub3=8676

Avira URL Cloud: detection malicious, Label: phishing

Antivirus detection for URL or domain

Source: https://www.coatsgolds.com	Avira URL Cloud: Label: phishing
Source: https://www.coatsgolds.com/favicon.ico	Avira URL Cloud: Label: phishing

Source: https://www.coatsgolds.com/

HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 23.1.237.25:443 -> 192.168.2.16:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:49727 version: TLS 1.2

Source: unknown

DNS traffic detected: queries for: www.coatsgolds.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknown	TCP traffic detected without corresponding DNS query: 72.21.81.240
Source: unknown	TCP traffic detected without corresponding DNS query: 72.21.81.240
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 23.223.36.114
Source: unknown	TCP traffic detected without corresponding DNS query: 23.223.36.114
Source: unknown	TCP traffic detected without corresponding DNS query: 23.223.36.114

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.132&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-117.0.5938.132Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /871rc5m/21748tpd?sub1=177772&sub2=14437210-6546&sub3=8676 HTTP/1.1Host: www.coatsgolds.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=lRXAfyvvY4MUoC9&MD=2OmnUGED HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=lRXAfyvvY4MUoC9&MD=2OmnUGED HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2Fwww.coatsgolds.com&oit=3&cp=26&pgcl=4&gs_rn=42&psi=oeT4fW2ixss-Ryo4&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlqHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=LtGInZ4I4WDrCvCHQBVMHOy4a-sqzpSrMO-Rwr8ezStTz_kfoi2bri7uGdXfNvskAEO_Tj5Jkwl0XSN-qA6MYiGShcDB_vNQOl1bpl3aua7gMrDRvWsHLpAuFBlBnNxTMeen95XElzx3r4myG8p8sgSHdx4NBawYGaI5oFn_dZ8
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.coatsgolds.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.coatsgolds.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-mobile: ?0sec-ch-ua-model: ""User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.coatsgolds.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tools/pso/ping?as=chrome&brand=ONGR&pid=&hl=en&events=C1F,C1I,C2I,C7I,C1S,C7S&rep=2&rlz=C1:,C2:,C7:&id=0000000000000000000000000000000000000000A89759AE57 HTTP/1.1Host: clients1.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br

Source: chromecache_64.1.dr

String found in binary or memory: https://www.coatsgolds.com

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=LtGInZ4I4WDrCvCHQBVMHOy4a-sqzpSrMO-Rwr8ezStTz_kfoi2bri7uGdXfNvskAEO_Tj5Jkwl0XSN-qA6MYiGShcDB_vNQOl1bpl3aua7gMrDRvWsHLpAuFBlBnNxTMeen95XElzx3r4myG8p8sgSHdx4NBawYGaI5oFn_dZ8

Source: unknown	HTTPS traffic detected: 23.1.237.25:443 -> 192.168.2.16:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:49727 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\chrome_BITS_6340_2127123518

Jump to behavior

Source: classification engine

Classification label: mal56.win@14/9@10/7

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.coatsgolds.com/871rc5m/21748tpd?sub1=177772&sub2=14437210-6546&sub3=8676
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2024 --field-trial-handle=1896,i,18030200112660565471,16170946260577905929,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2024 --field-trial-handle=1896,i,18030200112660565471,16170946260577905929,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	11 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Abuse Accessibility Features	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	3 Non-Application Layer Protocol	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	4 Application Layer Protocol			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Traffic Duplication	1 Ingress Tool Transfer			Data Destruction	Virtual Private Server	Employee Names

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://www.coatsgolds.com/871rc5m/21748tpd?sub1=177772&sub2=14437210-6546&sub3=8676	100%	Avira URL Cloud	phishing

Source	Detection	Scanner	Label	Link
https://www.coatsgolds.com	100%	Avira URL Cloud	phishing
https://www.coatsgolds.com/favicon.ico	100%	Avira URL Cloud	phishing
https://www.coatsgolds.com/	4%	Virustotal		Browse
https://www.coatsgolds.com	4%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
accounts.google.com	142.250.31.84	true	false	high
www.coatsgolds.com	45.41.205.104	true	false	unknown
www.google.com	172.253.122.99	true	false	high
clients.l.google.com	142.251.16.101	true	false	high
clients1.google.com	unknown	unknown	false	high
clients2.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.132&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1	false		high
https://www.coatsgolds.com/871rc5m/21748tpd?sub1=177772&sub2=14437210-6546&sub3=8676	true		unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2Fwww.coatsgolds.com&oit=3&cp=26&pgcl=4&gs_rn=42&psi=oeT4fW2ixss-Ryo4&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://www.coatsgolds.com/	false	4%, Virustotal, Browse	unknown
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false		high
https://www.coatsgolds.com/	false	4%, Virustotal, Browse	unknown
https://clients1.google.com/tools/pso/ping?as=chrome&brand=ONGR&pid=&hl=en&events=C1F,C1I,C2I,C7I,C1S,C7S&rep=2&rlz=C1:,C2:,C7:&id=0000000000000000000000000000000000000000A89759AE57	false		high
https://www.coatsgolds.com/favicon.ico	false	Avira URL Cloud: phishing	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.coatsgolds.com	chromecache_64.1.dr	false	4%, Virustotal, Browse Avira URL Cloud: phishing	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.251.16.101	clients.l.google.com	United States	15169	GOOGLEUS	false
172.253.122.99	www.google.com	United States	15169	GOOGLEUS	false
45.41.205.104	www.coatsgolds.com	Reserved	22400	WEB2OBJECTSUS	false
142.250.31.84	accounts.google.com	United States	15169	GOOGLEUS	false
172.253.122.100	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.16

General Information

Joe Sandbox Version:	38.0.0 Ammolite
Analysis ID:	1346381
Start date and time:	2023-11-22 12:52:00 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 3m 18s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://www.coatsgolds.com/871rc5m/21748tpd?sub1=177772&sub2=14437210-6546&sub3=8676
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal56.win@14/9@10/7
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 142.251.163.94, 34.104.35.123, 192.229.211.108, 172.253.115.94
Excluded domains from analysis (whitelisted): ocsp.digicert.com, edgedl.me.gvt1.com, slscr.update.microsoft.com, update.googleapis.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Nov 22 10:52:30 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.987540311478969
Encrypted:	false
SSDEEP:	48:8EddTFBGH5idAKZdA1FehwiZUklqehTy+3:8SHAgy
MD5:	760346EBFB51DBC21420D2538E4A7CEE
SHA1:	9330F46D0422EF975B23AAA3FD3BA4A43D062ED4
SHA-256:	AFCF7A25B3B8EC85CEA9E0E796086376399C63444BA77A655EC2B46D12046982
SHA-512:	BA7697CFA4E57664BBDD30848337E42BDD9399983C8BFD6DB3D9F63BF49A79F7CC4B413F5B1186E7BBFF3C98D08A8E5D234A9E867A70C315DBF354D986810558
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....wE_:...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IvW.^....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VvW.^....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VvW.^....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VvW.^..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VvW.^...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............Y.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Nov 22 10:52:30 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	4.005164584443692
Encrypted:	false
SSDEEP:	48:8/ddTFBGH5idAKZdA1seh/iZUkAQkqehQy+2:8HHW9Q5y
MD5:	6718ED11E7DBDDE441DAA5F1832D3B5C
SHA1:	428352DA12952A4AB933F5D6A18672860C163C4D
SHA-256:	23A81C324D50B942490EF6D26D713A3B80476EAEC7BC00CC58EDA809C49EDD17
SHA-512:	0C223314C1C6D7D20D684FAA53F5B56E49E8E9307399D61508FBAE894C7B6DA30EB07DB3486B9A11E19584F5676B9F61AAF68F84C53B80A618DBC2EC611DF1EF
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......;_:...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IvW.^....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VvW.^....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VvW.^....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VvW.^..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VvW.^...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............Y.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.009960087141545
Encrypted:	false
SSDEEP:	48:8WddTFBAH5idAKZdA14meh7sFiZUkmgqeh7suy+BX:8UHgnsy
MD5:	8BD214C1116B993EE88104A8A4C59734
SHA1:	406A6143BAD1B69185C1C9684591556362FD99C3
SHA-256:	93287E77ADE16FF450EEB69234F4B782D4B292774C45F4BEB9A38CADF7CB1B27
SHA-512:	E9B4566FA71E52498F0ED1CECD7630C7FFB2594E0274B5B2C2C0C5F70648B6630B01D834D74964B0141956AE6BC3EF3008CF1C5750446CA552C57CF82A4E70CD
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IvW.^....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VvW.^....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VvW.^....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VvW.^..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............Y.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Nov 22 10:52:30 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	4.001359056895579
Encrypted:	false
SSDEEP:	48:8wddTFBGH5idAKZdA1TehDiZUkwqehUy+R:8uHN2y
MD5:	A5F45F1FEE6469906E69306CA429450C
SHA1:	E8B5C6C445DE8E452A4D6A3F58506EB60962C652
SHA-256:	ADB6BA22C94D772907A1AA417EBB5753AB24ADBC0F859F618BB24C4A313242C7
SHA-512:	9F00BC071143DDEC9176A4C54EB444BA88F9A1C400F653D10EE7E5973D029C7C875942982F23ED69218E060676C8D47E824ED02F73E01B88D3E5B48CAD0D5BE4
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....+.4_:...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IvW.^....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VvW.^....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VvW.^....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VvW.^..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VvW.^...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............Y.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Nov 22 10:52:30 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9888390448942217
Encrypted:	false
SSDEEP:	48:8mddTFBGH5idAKZdA1dehBiZUk1W1qehqy+C:8EHt9Ky
MD5:	F0154916DA027D451182E76B69453995
SHA1:	6D2E91E2A2261D05ADDE245FE5B62C18251550F6
SHA-256:	85EB1F58424D78C23D4CB1DD4F5113CDEF4D3A96DEF2F87820A3D09C6EB73F88
SHA-512:	39613FF03877822FEA626C5B629FCC2E7E5311B790032D5D0617AB17970A8182563230320FE288F000E83BDAB8F33885DB76BD02539DF350DD1124A5E0397CDD
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....n@_:...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IvW.^....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VvW.^....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VvW.^....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VvW.^..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VvW.^...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............Y.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Nov 22 10:52:30 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.000711231211141
Encrypted:	false
SSDEEP:	48:8bddTFBGH5idAKZdA1duTeehOuTbbiZUk5OjqehOuTbsy+yT+:8THVTfTbxWOvTbsy7T
MD5:	FE77675093DA84E93BB047B757113405
SHA1:	AE5077FC6A9A9A2382963912A0A6AC61632C9905
SHA-256:	0B6E7C563F57B3F991BD4A54645F6E56519D50F09CF63ED1581B0B82B27734E9
SHA-512:	3B73454E3E39F5355F8EDA7871953EB1E9187160AE16753899D7EFB4F6319386BB0D0A31B4EADBC1D1AD9AA0E363EF4A1FF9E8A5B04BE1C2A6309CD6059151D7
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......+_:...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IvW.^....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VvW.^....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VvW.^....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VvW.^..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VvW.^...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............Y.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 64

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	237
Entropy (8bit):	4.800429681621492
Encrypted:	false
SSDEEP:	6:Vw2OLbWZisyK4NnBHsL2YriFGHLTwGRVj9wGdUwWeXFEL13:u2SWMsyKonBHslriFuPwuj9w4UwzC3
MD5:	32B8C4E739FBA93ED442CB3382D5D2BF
SHA1:	B133DA95787FEE011682BA799F568AFAE0B8D2D5
SHA-256:	D82499DB4DE81CA02F529B00DDEC3C2B9596AFB0AD1C78B1A0666DA9287572F4
SHA-512:	AAEAFB2E97389E81E4765B90EAC152CEACEB56313C8FFD89D701ACD1BB567670F87070E44FB1A0D13A5A8F66E8DB67CC96EE59E53B363BFF8C4422ECB269870D
Malicious:	false
Reputation:	low
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2Fwww.coatsgolds.com&oit=3&cp=26&pgcl=4&gs_rn=42&psi=oeT4fW2ixss-Ryo4&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["https://www.coatsgolds.com",["cotswolds"],[""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:suggestrelevance":[600],"google:suggestsubtypes":[[22,30,10]],"google:suggesttype":["QUERY"],"google:verbatimrelevance":851}]

Chrome Cache Entry: 65

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	1093
Entropy (8bit):	4.64990449533814
Encrypted:	false
SSDEEP:	24:hYzp8bh5O+CUJsf01jJfVTZMCScfK5kdflM:8HUJThJE375kdflM
MD5:	06C162752EB53F3F96CF521841403E83
SHA1:	AEDB7942897DF887DD782679853AF317743B230D
SHA-256:	B5E774A2B98F0517DB8C2938B05D51249897D4B853C39F62A5DAA5E2F61CDDFC
SHA-512:	F900145138F5E6349A7268E9FEC21D6DD583DFAF8F2F38CFDF74942F2EF540839FC326F9181F2875561286822C10EC983E86D63A8C18CA910BBCC4FFCA81778F
Malicious:	false
Reputation:	low
URL:	https://www.coatsgolds.com/
Preview:	<!DOCTYPE html>.<html lang="en">..<head>. <meta charset="utf-8">. <title>Performance Marketing Platform</title>. <style>. body {. background-color: #111d30;. color: #FFF;. font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol";. }.. a {. color: #FFF;. }. </style>.</head>..<body>. <div style="background-color: #293c5a; margin: 10px auto; width: 600px; padding: 15px; border: 1px solid #d3d3d3">. <h1>Performance Tracking</h1>. <p>. The ultimate performance marketing platform. This server handles billions of events per day.. </p>. <h2>Key features include</h2>. <ul>. <li>Fraud Prevention</li>. <li>Smart Link Campaigns</li>. <li>Smart Alerts</li>. <li>Deep Analytics and Reporting</li>. <li>View Through Attri

Chrome Cache Entry: 66

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	548
Entropy (8bit):	4.688532577858027
Encrypted:	false
SSDEEP:	12:TjeRHVIdtklI5r8INGlTF5TF5TF5TF5TF5TFK:neRH68DTPTPTPTPTPTc
MD5:	370E16C3B7DBA286CFF055F93B9A94D8
SHA1:	65F3537C3C798F7DA146C55AEF536F7B5D0CB943
SHA-256:	D465172175D35D493FB1633E237700022BD849FA123164790B168B8318ACB090
SHA-512:	75CD6A0AC7D6081D35140ABBEA018D1A2608DD936E2E21F61BF69E063F6FA16DD31C62392F5703D7A7C828EE3D4ECC838E73BFF029A98CED8986ACB5C8364966
Malicious:	false
Reputation:	low
URL:	https://www.coatsgolds.com/favicon.ico
Preview:	<html>..<head><title>404 Not Found</title></head>..<body>..<center><h1>404 Not Found</h1></center>..<hr><center>nginx</center>..</body>..</html>.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->..

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 22, 2023 12:52:27.050872087 CET	443	49703	23.1.237.25	192.168.2.16
Nov 22, 2023 12:52:27.050968885 CET	49703	443	192.168.2.16	23.1.237.25
Nov 22, 2023 12:52:30.313982964 CET	49719	443	192.168.2.16	45.41.205.104
Nov 22, 2023 12:52:30.314075947 CET	443	49719	45.41.205.104	192.168.2.16
Nov 22, 2023 12:52:30.314157009 CET	49719	443	192.168.2.16	45.41.205.104
Nov 22, 2023 12:52:30.315006018 CET	49720	443	192.168.2.16	45.41.205.104
Nov 22, 2023 12:52:30.315049887 CET	443	49720	45.41.205.104	192.168.2.16
Nov 22, 2023 12:52:30.315113068 CET	49720	443	192.168.2.16	45.41.205.104
Nov 22, 2023 12:52:30.315745115 CET	49721	443	192.168.2.16	142.251.16.101
Nov 22, 2023 12:52:30.315769911 CET	443	49721	142.251.16.101	192.168.2.16
Nov 22, 2023 12:52:30.315834999 CET	49721	443	192.168.2.16	142.251.16.101
Nov 22, 2023 12:52:30.316056013 CET	49720	443	192.168.2.16	45.41.205.104
Nov 22, 2023 12:52:30.316071987 CET	443	49720	45.41.205.104	192.168.2.16
Nov 22, 2023 12:52:30.316286087 CET	49719	443	192.168.2.16	45.41.205.104
Nov 22, 2023 12:52:30.316323042 CET	443	49719	45.41.205.104	192.168.2.16
Nov 22, 2023 12:52:30.316687107 CET	49722	443	192.168.2.16	142.250.31.84
Nov 22, 2023 12:52:30.316710949 CET	443	49722	142.250.31.84	192.168.2.16
Nov 22, 2023 12:52:30.316776037 CET	49722	443	192.168.2.16	142.250.31.84
Nov 22, 2023 12:52:30.317049026 CET	49721	443	192.168.2.16	142.251.16.101
Nov 22, 2023 12:52:30.317079067 CET	443	49721	142.251.16.101	192.168.2.16
Nov 22, 2023 12:52:30.317280054 CET	49722	443	192.168.2.16	142.250.31.84
Nov 22, 2023 12:52:30.317295074 CET	443	49722	142.250.31.84	192.168.2.16
Nov 22, 2023 12:52:30.561389923 CET	443	49722	142.250.31.84	192.168.2.16
Nov 22, 2023 12:52:30.561682940 CET	49722	443	192.168.2.16	142.250.31.84
Nov 22, 2023 12:52:30.561708927 CET	443	49722	142.250.31.84	192.168.2.16
Nov 22, 2023 12:52:30.563146114 CET	443	49722	142.250.31.84	192.168.2.16
Nov 22, 2023 12:52:30.563227892 CET	49722	443	192.168.2.16	142.250.31.84
Nov 22, 2023 12:52:30.563440084 CET	443	49721	142.251.16.101	192.168.2.16
Nov 22, 2023 12:52:30.563848019 CET	49721	443	192.168.2.16	142.251.16.101
Nov 22, 2023 12:52:30.563864946 CET	443	49721	142.251.16.101	192.168.2.16
Nov 22, 2023 12:52:30.564243078 CET	443	49721	142.251.16.101	192.168.2.16
Nov 22, 2023 12:52:30.564275026 CET	49722	443	192.168.2.16	142.250.31.84
Nov 22, 2023 12:52:30.564306974 CET	49721	443	192.168.2.16	142.251.16.101
Nov 22, 2023 12:52:30.564348936 CET	443	49722	142.250.31.84	192.168.2.16
Nov 22, 2023 12:52:30.564728975 CET	49722	443	192.168.2.16	142.250.31.84
Nov 22, 2023 12:52:30.564739943 CET	443	49722	142.250.31.84	192.168.2.16
Nov 22, 2023 12:52:30.564933062 CET	443	49721	142.251.16.101	192.168.2.16
Nov 22, 2023 12:52:30.564992905 CET	49721	443	192.168.2.16	142.251.16.101
Nov 22, 2023 12:52:30.565834045 CET	49721	443	192.168.2.16	142.251.16.101
Nov 22, 2023 12:52:30.565902948 CET	443	49721	142.251.16.101	192.168.2.16
Nov 22, 2023 12:52:30.565998077 CET	49721	443	192.168.2.16	142.251.16.101
Nov 22, 2023 12:52:30.566010952 CET	443	49721	142.251.16.101	192.168.2.16
Nov 22, 2023 12:52:30.609688997 CET	49722	443	192.168.2.16	142.250.31.84
Nov 22, 2023 12:52:30.609690905 CET	49721	443	192.168.2.16	142.251.16.101
Nov 22, 2023 12:52:30.689786911 CET	49673	443	192.168.2.16	23.1.237.25
Nov 22, 2023 12:52:30.689954996 CET	49674	443	192.168.2.16	23.1.237.25
Nov 22, 2023 12:52:30.726272106 CET	443	49720	45.41.205.104	192.168.2.16
Nov 22, 2023 12:52:30.726294041 CET	443	49719	45.41.205.104	192.168.2.16
Nov 22, 2023 12:52:30.726603985 CET	49720	443	192.168.2.16	45.41.205.104
Nov 22, 2023 12:52:30.726625919 CET	443	49720	45.41.205.104	192.168.2.16
Nov 22, 2023 12:52:30.726742983 CET	49719	443	192.168.2.16	45.41.205.104
Nov 22, 2023 12:52:30.726800919 CET	443	49719	45.41.205.104	192.168.2.16
Nov 22, 2023 12:52:30.727658987 CET	443	49720	45.41.205.104	192.168.2.16
Nov 22, 2023 12:52:30.727783918 CET	49720	443	192.168.2.16	45.41.205.104
Nov 22, 2023 12:52:30.727840900 CET	443	49719	45.41.205.104	192.168.2.16
Nov 22, 2023 12:52:30.727932930 CET	49719	443	192.168.2.16	45.41.205.104
Nov 22, 2023 12:52:30.728797913 CET	49720	443	192.168.2.16	45.41.205.104
Nov 22, 2023 12:52:30.728858948 CET	443	49720	45.41.205.104	192.168.2.16
Nov 22, 2023 12:52:30.729053974 CET	49719	443	192.168.2.16	45.41.205.104
Nov 22, 2023 12:52:30.729121923 CET	443	49719	45.41.205.104	192.168.2.16
Nov 22, 2023 12:52:30.729299068 CET	49720	443	192.168.2.16	45.41.205.104
Nov 22, 2023 12:52:30.729305983 CET	443	49720	45.41.205.104	192.168.2.16
Nov 22, 2023 12:52:30.766098022 CET	443	49721	142.251.16.101	192.168.2.16
Nov 22, 2023 12:52:30.766227007 CET	443	49721	142.251.16.101	192.168.2.16
Nov 22, 2023 12:52:30.766283989 CET	49721	443	192.168.2.16	142.251.16.101
Nov 22, 2023 12:52:30.767079115 CET	49721	443	192.168.2.16	142.251.16.101
Nov 22, 2023 12:52:30.767100096 CET	443	49721	142.251.16.101	192.168.2.16
Nov 22, 2023 12:52:30.769680977 CET	49720	443	192.168.2.16	45.41.205.104
Nov 22, 2023 12:52:30.770253897 CET	49719	443	192.168.2.16	45.41.205.104
Nov 22, 2023 12:52:30.770266056 CET	443	49719	45.41.205.104	192.168.2.16
Nov 22, 2023 12:52:30.786114931 CET	443	49722	142.250.31.84	192.168.2.16
Nov 22, 2023 12:52:30.786245108 CET	443	49722	142.250.31.84	192.168.2.16
Nov 22, 2023 12:52:30.798000097 CET	49722	443	192.168.2.16	142.250.31.84
Nov 22, 2023 12:52:30.802227020 CET	49722	443	192.168.2.16	142.250.31.84
Nov 22, 2023 12:52:30.802248955 CET	443	49722	142.250.31.84	192.168.2.16
Nov 22, 2023 12:52:30.817686081 CET	49719	443	192.168.2.16	45.41.205.104
Nov 22, 2023 12:52:30.915590048 CET	443	49720	45.41.205.104	192.168.2.16
Nov 22, 2023 12:52:30.915633917 CET	443	49720	45.41.205.104	192.168.2.16
Nov 22, 2023 12:52:30.915678978 CET	49720	443	192.168.2.16	45.41.205.104
Nov 22, 2023 12:52:30.919070005 CET	49720	443	192.168.2.16	45.41.205.104
Nov 22, 2023 12:52:30.919080019 CET	443	49720	45.41.205.104	192.168.2.16
Nov 22, 2023 12:52:31.070715904 CET	49672	443	192.168.2.16	23.1.237.25
Nov 22, 2023 12:52:34.657639027 CET	49724	443	192.168.2.16	172.253.122.99
Nov 22, 2023 12:52:34.657737017 CET	443	49724	172.253.122.99	192.168.2.16
Nov 22, 2023 12:52:34.657825947 CET	49724	443	192.168.2.16	172.253.122.99
Nov 22, 2023 12:52:34.658175945 CET	49724	443	192.168.2.16	172.253.122.99
Nov 22, 2023 12:52:34.658214092 CET	443	49724	172.253.122.99	192.168.2.16
Nov 22, 2023 12:52:34.847949028 CET	443	49724	172.253.122.99	192.168.2.16
Nov 22, 2023 12:52:34.848484993 CET	49724	443	192.168.2.16	172.253.122.99
Nov 22, 2023 12:52:34.848536015 CET	443	49724	172.253.122.99	192.168.2.16
Nov 22, 2023 12:52:34.849411011 CET	443	49724	172.253.122.99	192.168.2.16
Nov 22, 2023 12:52:34.849493027 CET	49724	443	192.168.2.16	172.253.122.99
Nov 22, 2023 12:52:34.851011992 CET	49724	443	192.168.2.16	172.253.122.99
Nov 22, 2023 12:52:34.851075888 CET	443	49724	172.253.122.99	192.168.2.16
Nov 22, 2023 12:52:34.896792889 CET	49724	443	192.168.2.16	172.253.122.99
Nov 22, 2023 12:52:34.896816015 CET	443	49724	172.253.122.99	192.168.2.16
Nov 22, 2023 12:52:34.944732904 CET	49724	443	192.168.2.16	172.253.122.99
Nov 22, 2023 12:52:40.711363077 CET	443	49719	45.41.205.104	192.168.2.16
Nov 22, 2023 12:52:40.711436033 CET	443	49719	45.41.205.104	192.168.2.16
Nov 22, 2023 12:52:40.711555958 CET	49719	443	192.168.2.16	45.41.205.104
Nov 22, 2023 12:52:41.396096945 CET	49725	443	192.168.2.16	20.114.59.183
Nov 22, 2023 12:52:41.396183014 CET	443	49725	20.114.59.183	192.168.2.16
Nov 22, 2023 12:52:41.396334887 CET	49725	443	192.168.2.16	20.114.59.183
Nov 22, 2023 12:52:41.402606964 CET	49725	443	192.168.2.16	20.114.59.183
Nov 22, 2023 12:52:41.402645111 CET	443	49725	20.114.59.183	192.168.2.16
Nov 22, 2023 12:52:41.732779026 CET	49703	443	192.168.2.16	23.1.237.25
Nov 22, 2023 12:52:41.886864901 CET	443	49703	23.1.237.25	192.168.2.16
Nov 22, 2023 12:52:41.887799025 CET	443	49703	23.1.237.25	192.168.2.16
Nov 22, 2023 12:52:41.887856960 CET	443	49703	23.1.237.25	192.168.2.16
Nov 22, 2023 12:52:41.887902021 CET	49703	443	192.168.2.16	23.1.237.25
Nov 22, 2023 12:52:41.887931108 CET	49703	443	192.168.2.16	23.1.237.25
Nov 22, 2023 12:52:41.887969971 CET	443	49703	23.1.237.25	192.168.2.16
Nov 22, 2023 12:52:41.888021946 CET	49703	443	192.168.2.16	23.1.237.25
Nov 22, 2023 12:52:41.888052940 CET	443	49703	23.1.237.25	192.168.2.16
Nov 22, 2023 12:52:41.888108969 CET	49703	443	192.168.2.16	23.1.237.25
Nov 22, 2023 12:52:41.898192883 CET	443	49725	20.114.59.183	192.168.2.16
Nov 22, 2023 12:52:41.898320913 CET	49725	443	192.168.2.16	20.114.59.183
Nov 22, 2023 12:52:41.901215076 CET	49725	443	192.168.2.16	20.114.59.183
Nov 22, 2023 12:52:41.901233912 CET	443	49725	20.114.59.183	192.168.2.16
Nov 22, 2023 12:52:41.901485920 CET	443	49725	20.114.59.183	192.168.2.16
Nov 22, 2023 12:52:41.946758986 CET	49725	443	192.168.2.16	20.114.59.183
Nov 22, 2023 12:52:42.008446932 CET	49725	443	192.168.2.16	20.114.59.183
Nov 22, 2023 12:52:42.053261042 CET	443	49725	20.114.59.183	192.168.2.16
Nov 22, 2023 12:52:42.233094931 CET	49703	443	192.168.2.16	23.1.237.25
Nov 22, 2023 12:52:42.331850052 CET	49719	443	192.168.2.16	45.41.205.104
Nov 22, 2023 12:52:42.331942081 CET	443	49719	45.41.205.104	192.168.2.16
Nov 22, 2023 12:52:42.370631933 CET	443	49725	20.114.59.183	192.168.2.16
Nov 22, 2023 12:52:42.370656013 CET	443	49725	20.114.59.183	192.168.2.16
Nov 22, 2023 12:52:42.370661974 CET	443	49725	20.114.59.183	192.168.2.16
Nov 22, 2023 12:52:42.370676041 CET	443	49725	20.114.59.183	192.168.2.16
Nov 22, 2023 12:52:42.370712042 CET	443	49725	20.114.59.183	192.168.2.16
Nov 22, 2023 12:52:42.370754004 CET	49725	443	192.168.2.16	20.114.59.183
Nov 22, 2023 12:52:42.370805979 CET	443	49725	20.114.59.183	192.168.2.16
Nov 22, 2023 12:52:42.370847940 CET	443	49725	20.114.59.183	192.168.2.16
Nov 22, 2023 12:52:42.370866060 CET	443	49725	20.114.59.183	192.168.2.16
Nov 22, 2023 12:52:42.370886087 CET	49725	443	192.168.2.16	20.114.59.183
Nov 22, 2023 12:52:42.370887041 CET	49725	443	192.168.2.16	20.114.59.183
Nov 22, 2023 12:52:42.370919943 CET	49725	443	192.168.2.16	20.114.59.183
Nov 22, 2023 12:52:42.385700941 CET	443	49703	23.1.237.25	192.168.2.16
Nov 22, 2023 12:52:42.393583059 CET	49725	443	192.168.2.16	20.114.59.183
Nov 22, 2023 12:52:42.393613100 CET	443	49725	20.114.59.183	192.168.2.16
Nov 22, 2023 12:52:42.393644094 CET	49725	443	192.168.2.16	20.114.59.183
Nov 22, 2023 12:52:42.393656969 CET	443	49725	20.114.59.183	192.168.2.16
Nov 22, 2023 12:52:42.394123077 CET	443	49703	23.1.237.25	192.168.2.16
Nov 22, 2023 12:52:42.394185066 CET	49703	443	192.168.2.16	23.1.237.25
Nov 22, 2023 12:52:42.396044970 CET	49703	443	192.168.2.16	23.1.237.25
Nov 22, 2023 12:52:42.396110058 CET	49703	443	192.168.2.16	23.1.237.25
Nov 22, 2023 12:52:42.396725893 CET	49703	443	192.168.2.16	23.1.237.25
Nov 22, 2023 12:52:42.396807909 CET	49703	443	192.168.2.16	23.1.237.25
Nov 22, 2023 12:52:42.549722910 CET	443	49703	23.1.237.25	192.168.2.16
Nov 22, 2023 12:52:42.549793005 CET	443	49703	23.1.237.25	192.168.2.16
Nov 22, 2023 12:52:42.549840927 CET	443	49703	23.1.237.25	192.168.2.16
Nov 22, 2023 12:52:42.549864054 CET	49703	443	192.168.2.16	23.1.237.25
Nov 22, 2023 12:52:42.549894094 CET	49703	443	192.168.2.16	23.1.237.25
Nov 22, 2023 12:52:42.552402020 CET	443	49703	23.1.237.25	192.168.2.16
Nov 22, 2023 12:52:42.593702078 CET	443	49703	23.1.237.25	192.168.2.16
Nov 22, 2023 12:52:42.593760967 CET	49703	443	192.168.2.16	23.1.237.25
Nov 22, 2023 12:52:42.593791962 CET	443	49703	23.1.237.25	192.168.2.16
Nov 22, 2023 12:52:42.593844891 CET	49703	443	192.168.2.16	23.1.237.25
Nov 22, 2023 12:52:44.885706902 CET	443	49724	172.253.122.99	192.168.2.16
Nov 22, 2023 12:52:44.885796070 CET	443	49724	172.253.122.99	192.168.2.16
Nov 22, 2023 12:52:44.885915041 CET	49724	443	192.168.2.16	172.253.122.99
Nov 22, 2023 12:52:46.340450048 CET	49724	443	192.168.2.16	172.253.122.99
Nov 22, 2023 12:52:46.340485096 CET	443	49724	172.253.122.99	192.168.2.16
Nov 22, 2023 12:53:17.143110991 CET	49712	80	192.168.2.16	72.21.81.240
Nov 22, 2023 12:53:17.234543085 CET	80	49712	72.21.81.240	192.168.2.16
Nov 22, 2023 12:53:17.234695911 CET	49712	80	192.168.2.16	72.21.81.240
Nov 22, 2023 12:53:18.870141983 CET	49727	443	192.168.2.16	20.114.59.183
Nov 22, 2023 12:53:18.870187998 CET	443	49727	20.114.59.183	192.168.2.16
Nov 22, 2023 12:53:18.870418072 CET	49727	443	192.168.2.16	20.114.59.183
Nov 22, 2023 12:53:18.871247053 CET	49727	443	192.168.2.16	20.114.59.183
Nov 22, 2023 12:53:18.871264935 CET	443	49727	20.114.59.183	192.168.2.16
Nov 22, 2023 12:53:19.372747898 CET	443	49727	20.114.59.183	192.168.2.16
Nov 22, 2023 12:53:19.372997999 CET	49727	443	192.168.2.16	20.114.59.183
Nov 22, 2023 12:53:19.377043962 CET	49727	443	192.168.2.16	20.114.59.183
Nov 22, 2023 12:53:19.377054930 CET	443	49727	20.114.59.183	192.168.2.16
Nov 22, 2023 12:53:19.377475977 CET	443	49727	20.114.59.183	192.168.2.16
Nov 22, 2023 12:53:19.379226923 CET	49727	443	192.168.2.16	20.114.59.183
Nov 22, 2023 12:53:19.421286106 CET	443	49727	20.114.59.183	192.168.2.16
Nov 22, 2023 12:53:19.844831944 CET	443	49727	20.114.59.183	192.168.2.16
Nov 22, 2023 12:53:19.844939947 CET	443	49727	20.114.59.183	192.168.2.16
Nov 22, 2023 12:53:19.844983101 CET	443	49727	20.114.59.183	192.168.2.16
Nov 22, 2023 12:53:19.845159054 CET	49727	443	192.168.2.16	20.114.59.183
Nov 22, 2023 12:53:19.845159054 CET	49727	443	192.168.2.16	20.114.59.183
Nov 22, 2023 12:53:19.845179081 CET	443	49727	20.114.59.183	192.168.2.16
Nov 22, 2023 12:53:19.845189095 CET	443	49727	20.114.59.183	192.168.2.16
Nov 22, 2023 12:53:19.845262051 CET	49727	443	192.168.2.16	20.114.59.183
Nov 22, 2023 12:53:19.845269918 CET	443	49727	20.114.59.183	192.168.2.16
Nov 22, 2023 12:53:19.845318079 CET	443	49727	20.114.59.183	192.168.2.16
Nov 22, 2023 12:53:19.845321894 CET	49727	443	192.168.2.16	20.114.59.183
Nov 22, 2023 12:53:19.845374107 CET	49727	443	192.168.2.16	20.114.59.183
Nov 22, 2023 12:53:19.849297047 CET	49727	443	192.168.2.16	20.114.59.183
Nov 22, 2023 12:53:19.849312067 CET	443	49727	20.114.59.183	192.168.2.16
Nov 22, 2023 12:53:19.849342108 CET	49727	443	192.168.2.16	20.114.59.183
Nov 22, 2023 12:53:19.849347115 CET	443	49727	20.114.59.183	192.168.2.16
Nov 22, 2023 12:53:34.587301970 CET	49729	443	192.168.2.16	172.253.122.99
Nov 22, 2023 12:53:34.587349892 CET	443	49729	172.253.122.99	192.168.2.16
Nov 22, 2023 12:53:34.587609053 CET	49729	443	192.168.2.16	172.253.122.99
Nov 22, 2023 12:53:34.588205099 CET	49729	443	192.168.2.16	172.253.122.99
Nov 22, 2023 12:53:34.588217974 CET	443	49729	172.253.122.99	192.168.2.16
Nov 22, 2023 12:53:34.800910950 CET	443	49729	172.253.122.99	192.168.2.16
Nov 22, 2023 12:53:34.801314116 CET	49729	443	192.168.2.16	172.253.122.99
Nov 22, 2023 12:53:34.801332951 CET	443	49729	172.253.122.99	192.168.2.16
Nov 22, 2023 12:53:34.801815033 CET	443	49729	172.253.122.99	192.168.2.16
Nov 22, 2023 12:53:34.802304983 CET	49729	443	192.168.2.16	172.253.122.99
Nov 22, 2023 12:53:34.802382946 CET	443	49729	172.253.122.99	192.168.2.16
Nov 22, 2023 12:53:34.855974913 CET	49729	443	192.168.2.16	172.253.122.99
Nov 22, 2023 12:53:38.825500965 CET	49729	443	192.168.2.16	172.253.122.99
Nov 22, 2023 12:53:38.869260073 CET	443	49729	172.253.122.99	192.168.2.16
Nov 22, 2023 12:53:38.961119890 CET	443	49729	172.253.122.99	192.168.2.16
Nov 22, 2023 12:53:38.964237928 CET	443	49729	172.253.122.99	192.168.2.16
Nov 22, 2023 12:53:38.964344978 CET	49729	443	192.168.2.16	172.253.122.99
Nov 22, 2023 12:53:38.965521097 CET	49729	443	192.168.2.16	172.253.122.99
Nov 22, 2023 12:53:38.965538025 CET	443	49729	172.253.122.99	192.168.2.16
Nov 22, 2023 12:53:39.569520950 CET	49730	443	192.168.2.16	45.41.205.104
Nov 22, 2023 12:53:39.569561005 CET	443	49730	45.41.205.104	192.168.2.16
Nov 22, 2023 12:53:39.569672108 CET	49730	443	192.168.2.16	45.41.205.104
Nov 22, 2023 12:53:39.569785118 CET	49731	443	192.168.2.16	45.41.205.104
Nov 22, 2023 12:53:39.569814920 CET	443	49731	45.41.205.104	192.168.2.16
Nov 22, 2023 12:53:39.569895029 CET	49731	443	192.168.2.16	45.41.205.104
Nov 22, 2023 12:53:39.570691109 CET	49731	443	192.168.2.16	45.41.205.104
Nov 22, 2023 12:53:39.570703030 CET	443	49731	45.41.205.104	192.168.2.16
Nov 22, 2023 12:53:39.571177006 CET	49730	443	192.168.2.16	45.41.205.104
Nov 22, 2023 12:53:39.571193933 CET	443	49730	45.41.205.104	192.168.2.16
Nov 22, 2023 12:53:39.800199986 CET	443	49731	45.41.205.104	192.168.2.16
Nov 22, 2023 12:53:39.804629087 CET	443	49730	45.41.205.104	192.168.2.16
Nov 22, 2023 12:53:39.809556961 CET	49730	443	192.168.2.16	45.41.205.104
Nov 22, 2023 12:53:39.809580088 CET	443	49730	45.41.205.104	192.168.2.16
Nov 22, 2023 12:53:39.809657097 CET	49731	443	192.168.2.16	45.41.205.104
Nov 22, 2023 12:53:39.809669018 CET	443	49731	45.41.205.104	192.168.2.16
Nov 22, 2023 12:53:39.810009956 CET	443	49731	45.41.205.104	192.168.2.16
Nov 22, 2023 12:53:39.810729980 CET	443	49730	45.41.205.104	192.168.2.16
Nov 22, 2023 12:53:39.811244011 CET	49731	443	192.168.2.16	45.41.205.104
Nov 22, 2023 12:53:39.811314106 CET	443	49731	45.41.205.104	192.168.2.16
Nov 22, 2023 12:53:39.811486959 CET	49730	443	192.168.2.16	45.41.205.104
Nov 22, 2023 12:53:39.811614990 CET	49731	443	192.168.2.16	45.41.205.104
Nov 22, 2023 12:53:39.811664104 CET	443	49730	45.41.205.104	192.168.2.16
Nov 22, 2023 12:53:39.853262901 CET	443	49731	45.41.205.104	192.168.2.16
Nov 22, 2023 12:53:39.863899946 CET	49730	443	192.168.2.16	45.41.205.104
Nov 22, 2023 12:53:40.121768951 CET	443	49731	45.41.205.104	192.168.2.16
Nov 22, 2023 12:53:40.121841908 CET	443	49731	45.41.205.104	192.168.2.16
Nov 22, 2023 12:53:40.121999979 CET	49731	443	192.168.2.16	45.41.205.104
Nov 22, 2023 12:53:40.153587103 CET	49731	443	192.168.2.16	45.41.205.104
Nov 22, 2023 12:53:40.153604984 CET	443	49731	45.41.205.104	192.168.2.16
Nov 22, 2023 12:53:40.211971045 CET	49730	443	192.168.2.16	45.41.205.104
Nov 22, 2023 12:53:40.253266096 CET	443	49730	45.41.205.104	192.168.2.16
Nov 22, 2023 12:53:40.382896900 CET	443	49730	45.41.205.104	192.168.2.16
Nov 22, 2023 12:53:40.383002043 CET	443	49730	45.41.205.104	192.168.2.16
Nov 22, 2023 12:53:40.383119106 CET	49730	443	192.168.2.16	45.41.205.104
Nov 22, 2023 12:53:40.383753061 CET	49730	443	192.168.2.16	45.41.205.104
Nov 22, 2023 12:53:40.383768082 CET	443	49730	45.41.205.104	192.168.2.16
Nov 22, 2023 12:53:59.662760019 CET	49733	443	192.168.2.16	172.253.122.100
Nov 22, 2023 12:53:59.662785053 CET	443	49733	172.253.122.100	192.168.2.16
Nov 22, 2023 12:53:59.662866116 CET	49733	443	192.168.2.16	172.253.122.100
Nov 22, 2023 12:53:59.663501024 CET	49733	443	192.168.2.16	172.253.122.100
Nov 22, 2023 12:53:59.663511992 CET	443	49733	172.253.122.100	192.168.2.16
Nov 22, 2023 12:53:59.868190050 CET	443	49733	172.253.122.100	192.168.2.16
Nov 22, 2023 12:53:59.868724108 CET	49733	443	192.168.2.16	172.253.122.100
Nov 22, 2023 12:53:59.868745089 CET	443	49733	172.253.122.100	192.168.2.16
Nov 22, 2023 12:53:59.870304108 CET	443	49733	172.253.122.100	192.168.2.16
Nov 22, 2023 12:53:59.870464087 CET	49733	443	192.168.2.16	172.253.122.100
Nov 22, 2023 12:53:59.870913029 CET	443	49733	172.253.122.100	192.168.2.16
Nov 22, 2023 12:53:59.871001005 CET	49733	443	192.168.2.16	172.253.122.100
Nov 22, 2023 12:53:59.873461008 CET	49733	443	192.168.2.16	172.253.122.100
Nov 22, 2023 12:53:59.873516083 CET	443	49733	172.253.122.100	192.168.2.16
Nov 22, 2023 12:53:59.873699903 CET	49733	443	192.168.2.16	172.253.122.100
Nov 22, 2023 12:53:59.873707056 CET	443	49733	172.253.122.100	192.168.2.16
Nov 22, 2023 12:53:59.921044111 CET	49733	443	192.168.2.16	172.253.122.100
Nov 22, 2023 12:54:00.071038961 CET	443	49733	172.253.122.100	192.168.2.16
Nov 22, 2023 12:54:00.071969032 CET	443	49733	172.253.122.100	192.168.2.16
Nov 22, 2023 12:54:00.072175026 CET	49733	443	192.168.2.16	172.253.122.100
Nov 22, 2023 12:54:00.072230101 CET	49733	443	192.168.2.16	172.253.122.100
Nov 22, 2023 12:54:00.072244883 CET	443	49733	172.253.122.100	192.168.2.16
Nov 22, 2023 12:54:09.377460003 CET	49714	443	192.168.2.16	23.223.36.114
Nov 22, 2023 12:54:09.468969107 CET	443	49714	23.223.36.114	192.168.2.16
Nov 22, 2023 12:54:09.468992949 CET	443	49714	23.223.36.114	192.168.2.16
Nov 22, 2023 12:54:09.469072104 CET	49714	443	192.168.2.16	23.223.36.114
Nov 22, 2023 12:54:09.469136000 CET	49714	443	192.168.2.16	23.223.36.114
Nov 22, 2023 12:54:10.096400976 CET	49716	443	192.168.2.16	23.223.36.114
Nov 22, 2023 12:54:10.189685106 CET	443	49716	23.223.36.114	192.168.2.16
Nov 22, 2023 12:54:10.189706087 CET	443	49716	23.223.36.114	192.168.2.16
Nov 22, 2023 12:54:10.189852953 CET	49716	443	192.168.2.16	23.223.36.114
Nov 22, 2023 12:54:10.189891100 CET	49716	443	192.168.2.16	23.223.36.114
Nov 22, 2023 12:54:34.651519060 CET	49734	443	192.168.2.16	172.253.122.99
Nov 22, 2023 12:54:34.651567936 CET	443	49734	172.253.122.99	192.168.2.16
Nov 22, 2023 12:54:34.651670933 CET	49734	443	192.168.2.16	172.253.122.99
Nov 22, 2023 12:54:34.652033091 CET	49734	443	192.168.2.16	172.253.122.99
Nov 22, 2023 12:54:34.652048111 CET	443	49734	172.253.122.99	192.168.2.16
Nov 22, 2023 12:54:34.839379072 CET	443	49734	172.253.122.99	192.168.2.16
Nov 22, 2023 12:54:34.889940977 CET	49734	443	192.168.2.16	172.253.122.99

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 22, 2023 12:52:30.163250923 CET	56725	53	192.168.2.16	1.1.1.1
Nov 22, 2023 12:52:30.163569927 CET	54285	53	192.168.2.16	1.1.1.1
Nov 22, 2023 12:52:30.172565937 CET	64225	53	192.168.2.16	1.1.1.1
Nov 22, 2023 12:52:30.172926903 CET	62988	53	192.168.2.16	1.1.1.1
Nov 22, 2023 12:52:30.173463106 CET	63963	53	192.168.2.16	1.1.1.1
Nov 22, 2023 12:52:30.173804998 CET	56317	53	192.168.2.16	1.1.1.1
Nov 22, 2023 12:52:30.300273895 CET	53	56611	1.1.1.1	192.168.2.16
Nov 22, 2023 12:52:30.306849003 CET	53	54285	1.1.1.1	192.168.2.16
Nov 22, 2023 12:52:30.309457064 CET	53	56725	1.1.1.1	192.168.2.16
Nov 22, 2023 12:52:30.312424898 CET	53	64225	1.1.1.1	192.168.2.16
Nov 22, 2023 12:52:30.312912941 CET	53	63963	1.1.1.1	192.168.2.16
Nov 22, 2023 12:52:30.313676119 CET	53	56317	1.1.1.1	192.168.2.16
Nov 22, 2023 12:52:30.315118074 CET	53	62988	1.1.1.1	192.168.2.16
Nov 22, 2023 12:52:30.957029104 CET	53	64787	1.1.1.1	192.168.2.16
Nov 22, 2023 12:52:34.530663967 CET	64169	53	192.168.2.16	1.1.1.1
Nov 22, 2023 12:52:34.530834913 CET	61965	53	192.168.2.16	1.1.1.1
Nov 22, 2023 12:52:34.651403904 CET	53	64169	1.1.1.1	192.168.2.16
Nov 22, 2023 12:52:34.652028084 CET	53	61965	1.1.1.1	192.168.2.16
Nov 22, 2023 12:52:43.021344900 CET	138	138	192.168.2.16	192.168.2.255
Nov 22, 2023 12:52:47.931502104 CET	53	60731	1.1.1.1	192.168.2.16
Nov 22, 2023 12:53:06.779838085 CET	53	52964	1.1.1.1	192.168.2.16
Nov 22, 2023 12:53:29.363640070 CET	53	59741	1.1.1.1	192.168.2.16
Nov 22, 2023 12:53:29.860517979 CET	53	56972	1.1.1.1	192.168.2.16
Nov 22, 2023 12:53:57.425666094 CET	53	63696	1.1.1.1	192.168.2.16
Nov 22, 2023 12:53:59.540339947 CET	51914	53	192.168.2.16	1.1.1.1
Nov 22, 2023 12:53:59.540868044 CET	65353	53	192.168.2.16	1.1.1.1
Nov 22, 2023 12:53:59.661550999 CET	53	51914	1.1.1.1	192.168.2.16
Nov 22, 2023 12:53:59.662059069 CET	53	65353	1.1.1.1	192.168.2.16

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 22, 2023 12:52:30.163250923 CET	192.168.2.16	1.1.1.1	0xf102	Standard query (0)	www.coatsgolds.com	A (IP address)	IN (0x0001)	false
Nov 22, 2023 12:52:30.163569927 CET	192.168.2.16	1.1.1.1	0xee7e	Standard query (0)	www.coatsgolds.com	65	IN (0x0001)	false
Nov 22, 2023 12:52:30.172565937 CET	192.168.2.16	1.1.1.1	0xaea0	Standard query (0)	clients2.google.com	A (IP address)	IN (0x0001)	false
Nov 22, 2023 12:52:30.172926903 CET	192.168.2.16	1.1.1.1	0x6653	Standard query (0)	clients2.google.com	65	IN (0x0001)	false
Nov 22, 2023 12:52:30.173463106 CET	192.168.2.16	1.1.1.1	0xce6e	Standard query (0)	accounts.google.com	A (IP address)	IN (0x0001)	false
Nov 22, 2023 12:52:30.173804998 CET	192.168.2.16	1.1.1.1	0xf729	Standard query (0)	accounts.google.com	65	IN (0x0001)	false
Nov 22, 2023 12:52:34.530663967 CET	192.168.2.16	1.1.1.1	0xd2fd	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 22, 2023 12:52:34.530834913 CET	192.168.2.16	1.1.1.1	0x6e33	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 22, 2023 12:53:59.540339947 CET	192.168.2.16	1.1.1.1	0xd832	Standard query (0)	clients1.google.com	A (IP address)	IN (0x0001)	false
Nov 22, 2023 12:53:59.540868044 CET	192.168.2.16	1.1.1.1	0x86f4	Standard query (0)	clients1.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 22, 2023 12:52:30.309457064 CET	1.1.1.1	192.168.2.16	0xf102	No error (0)	www.coatsgolds.com		45.41.205.104	A (IP address)	IN (0x0001)	false
Nov 22, 2023 12:52:30.312424898 CET	1.1.1.1	192.168.2.16	0xaea0	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2023 12:52:30.312424898 CET	1.1.1.1	192.168.2.16	0xaea0	No error (0)	clients.l.google.com		142.251.16.101	A (IP address)	IN (0x0001)	false
Nov 22, 2023 12:52:30.312424898 CET	1.1.1.1	192.168.2.16	0xaea0	No error (0)	clients.l.google.com		142.251.16.102	A (IP address)	IN (0x0001)	false
Nov 22, 2023 12:52:30.312424898 CET	1.1.1.1	192.168.2.16	0xaea0	No error (0)	clients.l.google.com		142.251.16.100	A (IP address)	IN (0x0001)	false
Nov 22, 2023 12:52:30.312424898 CET	1.1.1.1	192.168.2.16	0xaea0	No error (0)	clients.l.google.com		142.251.16.139	A (IP address)	IN (0x0001)	false
Nov 22, 2023 12:52:30.312424898 CET	1.1.1.1	192.168.2.16	0xaea0	No error (0)	clients.l.google.com		142.251.16.138	A (IP address)	IN (0x0001)	false
Nov 22, 2023 12:52:30.312424898 CET	1.1.1.1	192.168.2.16	0xaea0	No error (0)	clients.l.google.com		142.251.16.113	A (IP address)	IN (0x0001)	false
Nov 22, 2023 12:52:30.312912941 CET	1.1.1.1	192.168.2.16	0xce6e	No error (0)	accounts.google.com		142.250.31.84	A (IP address)	IN (0x0001)	false
Nov 22, 2023 12:52:30.315118074 CET	1.1.1.1	192.168.2.16	0x6653	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2023 12:52:34.651403904 CET	1.1.1.1	192.168.2.16	0xd2fd	No error (0)	www.google.com		172.253.122.99	A (IP address)	IN (0x0001)	false
Nov 22, 2023 12:52:34.651403904 CET	1.1.1.1	192.168.2.16	0xd2fd	No error (0)	www.google.com		172.253.122.147	A (IP address)	IN (0x0001)	false
Nov 22, 2023 12:52:34.651403904 CET	1.1.1.1	192.168.2.16	0xd2fd	No error (0)	www.google.com		172.253.122.104	A (IP address)	IN (0x0001)	false
Nov 22, 2023 12:52:34.651403904 CET	1.1.1.1	192.168.2.16	0xd2fd	No error (0)	www.google.com		172.253.122.103	A (IP address)	IN (0x0001)	false
Nov 22, 2023 12:52:34.651403904 CET	1.1.1.1	192.168.2.16	0xd2fd	No error (0)	www.google.com		172.253.122.106	A (IP address)	IN (0x0001)	false
Nov 22, 2023 12:52:34.651403904 CET	1.1.1.1	192.168.2.16	0xd2fd	No error (0)	www.google.com		172.253.122.105	A (IP address)	IN (0x0001)	false
Nov 22, 2023 12:52:34.652028084 CET	1.1.1.1	192.168.2.16	0x6e33	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 22, 2023 12:53:59.661550999 CET	1.1.1.1	192.168.2.16	0xd832	No error (0)	clients1.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2023 12:53:59.661550999 CET	1.1.1.1	192.168.2.16	0xd832	No error (0)	clients.l.google.com		172.253.122.100	A (IP address)	IN (0x0001)	false
Nov 22, 2023 12:53:59.661550999 CET	1.1.1.1	192.168.2.16	0xd832	No error (0)	clients.l.google.com		172.253.122.101	A (IP address)	IN (0x0001)	false
Nov 22, 2023 12:53:59.661550999 CET	1.1.1.1	192.168.2.16	0xd832	No error (0)	clients.l.google.com		172.253.122.113	A (IP address)	IN (0x0001)	false
Nov 22, 2023 12:53:59.661550999 CET	1.1.1.1	192.168.2.16	0xd832	No error (0)	clients.l.google.com		172.253.122.139	A (IP address)	IN (0x0001)	false
Nov 22, 2023 12:53:59.661550999 CET	1.1.1.1	192.168.2.16	0xd832	No error (0)	clients.l.google.com		172.253.122.102	A (IP address)	IN (0x0001)	false
Nov 22, 2023 12:53:59.661550999 CET	1.1.1.1	192.168.2.16	0xd832	No error (0)	clients.l.google.com		172.253.122.138	A (IP address)	IN (0x0001)	false
Nov 22, 2023 12:53:59.662059069 CET	1.1.1.1	192.168.2.16	0x86f4	No error (0)	clients1.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

accounts.google.com

clients2.google.com

www.coatsgolds.com

slscr.update.microsoft.com

www.google.com

https:

clients1.google.com

HTTPS Connections

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Nov 22, 2023 12:52:41.887969971 CET	23.1.237.25	443	192.168.2.16	49703	CN=r.bing.com, O=Microsoft Corporation, L=Redmond, ST=WA, C=US CN=Microsoft Azure ECC TLS Issuing CA 05, O=Microsoft Corporation, C=US	CN=Microsoft Azure ECC TLS Issuing CA 05, O=Microsoft Corporation, C=US CN=DigiCert Global Root G3, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Oct 18 22:32:40 CEST 2023 Wed Aug 12 02:00:00 CEST 2020	Fri Jun 28 01:59:59 CEST 2024 Fri Jun 28 01:59:59 CEST 2024	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-5-10-11-13-35-16-23-65281,29-23-24,0	28a2c9bd18a11de089ef85a160da29e4
Nov 22, 2023 12:52:41.887969971 CET	23.1.237.25	443	192.168.2.16	49703	CN=Microsoft Azure ECC TLS Issuing CA 05, O=Microsoft Corporation, C=US	CN=DigiCert Global Root G3, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Aug 12 02:00:00 CEST 2020	Fri Jun 28 01:59:59 CEST 2024		28a2c9bd18a11de089ef85a160da29e4

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.16	49722	142.250.31.84	443	6496	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-11-22 11:52:30 UTC	680	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=LtGInZ4I4WDrCvCHQBVMHOy4a-sqzpSrMO-Rwr8ezStTz_kfoi2bri7uGdXfNvskAEO_Tj5Jkwl0XSN-qA6MYiGShcDB_vNQOl1bpl3aua7gMrDRvWsHLpAuFBlBnNxTMeen95XElzx3r4myG8p8sgSHdx4NBawYGaI5oFn_dZ8
2023-11-22 11:52:30 UTC	1	OUT	Data Raw: 20 Data Ascii:
2023-11-22 11:52:30 UTC	1627	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 43 72 65 64 65 6e 74 69 61 6c 73 3a 20 74 72 75 65 0d 0a 58 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 2d 4f 70 74 69 6f 6e 73 3a 20 6e 6f 73 6e 69 66 66 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 2c 20 6e 6f 2d 73 74 6f 72 65 2c 20 6d 61 78 2d 61 67 65 3d 30 2c 20 6d 75 73 74 2d 72 65 76 61 6c 69 64 61 74 65 0d 0a 50 72 Data Ascii: HTTP/1.1 200 OKContent-Type: application/json; charset=utf-8Access-Control-Allow-Origin: https://www.google.comAccess-Control-Allow-Credentials: trueX-Content-Type-Options: nosniffCache-Control: no-cache, no-store, max-age=0, must-revalidatePr
2023-11-22 11:52:30 UTC	23	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2023-11-22 11:52:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.16	49721	142.251.16.101	443	6496	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-11-22 11:52:30 UTC	752	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.132&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda X-Goog-Update-Updater: chromecrx-117.0.5938.132 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-11-22 11:52:30 UTC	732	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 73 63 72 69 70 74 2d 73 72 63 20 27 72 65 70 6f 72 74 2d 73 61 6d 70 6c 65 27 20 27 6e 6f 6e 63 65 2d 44 52 78 45 6d 68 55 62 43 32 2d 75 35 50 44 69 37 75 70 47 75 41 27 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 27 73 74 72 69 63 74 2d 64 79 6e 61 6d 69 63 27 20 68 74 74 70 73 3a 20 68 74 74 70 3a 3b 6f 62 6a 65 63 74 2d 73 72 63 20 27 6e 6f 6e 65 27 3b 62 61 73 65 2d 75 72 69 20 27 73 65 6c 66 27 3b 72 65 70 6f 72 74 2d 75 72 69 20 68 74 74 70 73 3a 2f 2f 63 73 70 2e 77 69 74 68 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 63 73 70 2f 63 6c 69 65 6e 74 75 70 64 61 74 65 2d 61 75 73 2f 31 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c Data Ascii: HTTP/1.1 200 OKContent-Security-Policy: script-src 'report-sample' 'nonce-DRxEmhUbC2-u5PDi7upGuA' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1Cache-Control
2023-11-22 11:52:30 UTC	520	IN	Data Raw: 32 63 39 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 36 31 36 39 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 31 33 39 35 30 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 2c9<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="6169" elapsed_seconds="13950"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2023-11-22 11:52:30 UTC	200	IN	Data Raw: 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 2f 67 75 70 64 61 74 65 3e 0d 0a Data Ascii: 723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app></gupdate>
2023-11-22 11:52:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.16	49720	45.41.205.104	443	6496	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-11-22 11:52:30 UTC	718	OUT	GET /871rc5m/21748tpd?sub1=177772&sub2=14437210-6546&sub3=8676 HTTP/1.1 Host: www.coatsgolds.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-11-22 11:52:30 UTC	225	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 34 20 4e 6f 20 43 6f 6e 74 65 6e 74 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 57 65 64 2c 20 32 32 20 4e 6f 76 20 32 30 32 33 20 31 31 3a 35 32 3a 33 30 20 47 4d 54 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 41 63 63 65 70 74 2d 43 68 3a 20 53 65 63 2d 43 68 2d 55 61 2d 50 6c 61 74 66 6f 72 6d 2d 56 65 72 73 69 6f 6e 2c 53 65 63 2d 43 68 2d 55 61 2d 4d 6f 64 65 6c 0d 0a 56 61 72 79 3a 20 4f 72 69 67 69 6e 0d 0a 58 2d 45 66 6c 6f 77 2d 52 65 71 75 65 73 74 2d 49 64 3a 20 61 34 64 64 39 64 61 33 2d 33 38 61 39 2d 34 64 39 38 2d 61 61 37 66 2d 63 33 61 39 62 33 30 37 38 35 63 34 0d 0a 0d 0a Data Ascii: HTTP/1.1 204 No ContentServer: nginxDate: Wed, 22 Nov 2023 11:52:30 GMTConnection: closeAccept-Ch: Sec-Ch-Ua-Platform-Version,Sec-Ch-Ua-ModelVary: OriginX-Eflow-Request-Id: a4dd9da3-38a9-4d98-aa7f-c3a9b30785c4

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.16	49719	45.41.205.104	443	6496	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-11-22 11:52:40 UTC	102	IN	Data Raw: 48 54 54 50 2f 31 2e 30 20 34 30 38 20 52 65 71 75 65 73 74 20 54 69 6d 65 2d 6f 75 74 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 0d 0a Data Ascii: HTTP/1.0 408 Request Time-outCache-Control: no-cacheConnection: closeContent-Type: text/html
2023-11-22 11:52:40 UTC	110	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 38 20 52 65 71 75 65 73 74 20 54 69 6d 65 2d 6f 75 74 3c 2f 68 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 64 69 64 6e 27 74 20 73 65 6e 64 20 61 20 63 6f 6d 70 6c 65 74 65 20 72 65 71 75 65 73 74 20 69 6e 20 74 69 6d 65 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>408 Request Time-out</h1>Your browser didn't send a complete request in time.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.16	49725	20.114.59.183	443

Timestamp	Bytes transferred	Direction	Data
2023-11-22 11:52:42 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=lRXAfyvvY4MUoC9&MD=2OmnUGED HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2023-11-22 11:52:42 UTC	560	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 45 78 70 69 72 65 73 3a 20 2d 31 0d 0a 4c 61 73 74 2d 4d 6f 64 69 66 69 65 64 3a 20 4d 6f 6e 2c 20 30 31 20 4a 61 6e 20 30 30 30 31 20 30 30 3a 30 30 3a 30 30 20 47 4d 54 0d 0a 45 54 61 67 3a 20 22 58 41 6f 70 61 7a 56 30 30 58 44 57 6e 4a 43 77 6b 6d 45 57 52 76 36 4a 6b 62 6a 52 41 39 51 53 53 5a 32 2b 65 2f 33 4d 7a 45 6b 3d 5f 32 38 38 30 22 0d 0a 4d 53 2d 43 6f 72 72 65 6c 61 74 69 6f 6e 49 64 3a 20 64 30 61 64 35 32 35 36 2d 35 64 35 37 2d 34 62 64 65 2d Data Ascii: HTTP/1.1 200 OKCache-Control: no-cachePragma: no-cacheContent-Type: application/octet-streamExpires: -1Last-Modified: Mon, 01 Jan 0001 00:00:00 GMTETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880"MS-CorrelationId: d0ad5256-5d57-4bde-
2023-11-22 11:52:42 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2023-11-22 11:52:42 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.16	49727	20.114.59.183	443

Timestamp	Bytes transferred	Direction	Data
2023-11-22 11:53:19 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=lRXAfyvvY4MUoC9&MD=2OmnUGED HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2023-11-22 11:53:19 UTC	560	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 45 78 70 69 72 65 73 3a 20 2d 31 0d 0a 4c 61 73 74 2d 4d 6f 64 69 66 69 65 64 3a 20 4d 6f 6e 2c 20 30 31 20 4a 61 6e 20 30 30 30 31 20 30 30 3a 30 30 3a 30 30 20 47 4d 54 0d 0a 45 54 61 67 3a 20 22 4d 78 31 52 6f 4a 48 2f 71 45 77 70 57 66 4b 6c 6c 78 37 73 62 73 6c 32 38 41 75 45 52 7a 35 49 59 64 63 73 76 74 54 4a 63 67 4d 3d 5f 32 31 36 30 22 0d 0a 4d 53 2d 43 6f 72 72 65 6c 61 74 69 6f 6e 49 64 3a 20 66 31 63 32 32 30 37 65 2d 33 34 39 37 2d 34 32 31 32 2d Data Ascii: HTTP/1.1 200 OKCache-Control: no-cachePragma: no-cacheContent-Type: application/octet-streamExpires: -1Last-Modified: Mon, 01 Jan 0001 00:00:00 GMTETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_2160"MS-CorrelationId: f1c2207e-3497-4212-
2023-11-22 11:53:19 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92 Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
2023-11-22 11:53:19 UTC	9633	IN	Data Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.16	49729	172.253.122.99	443	6496	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-11-22 11:53:38 UTC	868	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2Fwww.coatsgolds.com&oit=3&cp=26&pgcl=4&gs_rn=42&psi=oeT4fW2ixss-Ryo4&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlqHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=LtGInZ4I4WDrCvCHQBVMHOy4a-sqzpSrMO-Rwr8ezStTz_kfoi2bri7uGdXfNvskAEO_Tj5Jkwl0XSN-qA6MYiGShcDB_vNQOl1bpl3aua7gMrDRvWsHLpAuFBlBnNxTMeen95XElzx3r4myG8p8sgSHdx4NBawYGaI5oFn_dZ8
2023-11-22 11:53:38 UTC	1880	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 44 61 74 65 3a 20 57 65 64 2c 20 32 32 20 4e 6f 76 20 32 30 32 33 20 31 31 3a 35 33 3a 33 38 20 47 4d 54 0d 0a 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 45 78 70 69 72 65 73 3a 20 2d 31 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 2c 20 6d 75 73 74 2d 72 65 76 61 6c 69 64 61 74 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 53 74 72 69 63 74 2d 54 72 61 6e 73 70 6f 72 74 2d 53 65 63 75 72 69 74 79 3a 20 6d 61 78 2d 61 67 65 3d 33 31 35 33 36 30 30 30 0d 0a 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 6f 62 6a 65 63 74 2d 73 72 63 20 27 Data Ascii: HTTP/1.1 200 OKDate: Wed, 22 Nov 2023 11:53:38 GMTPragma: no-cacheExpires: -1Cache-Control: no-cache, must-revalidateContent-Type: text/javascript; charset=UTF-8Strict-Transport-Security: max-age=31536000Content-Security-Policy: object-src '
2023-11-22 11:53:38 UTC	243	IN	Data Raw: 65 64 0d 0a 29 5d 7d 27 0a 5b 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6f 61 74 73 67 6f 6c 64 73 2e 63 6f 6d 22 2c 5b 22 63 6f 74 73 77 6f 6c 64 73 22 5d 2c 5b 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 72 65 6c 65 76 61 6e 63 65 22 3a 5b 36 30 30 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 73 75 62 74 79 70 65 73 22 3a 5b 5b 32 32 2c 33 30 2c 31 30 5d 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 74 79 70 65 22 3a 5b 22 51 55 45 52 59 22 5d 2c 22 67 6f 6f 67 6c 65 3a 76 65 72 62 61 74 69 6d 72 65 6c 65 76 61 6e 63 65 22 3a 38 35 31 7d 5d 0d 0a Data Ascii: ed)]}'["https://www.coatsgolds.com",["cotswolds"],[""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:suggestrelevance":[600],"google:suggestsubtypes":[[22,30,10]],"google:suggesttype":["QUERY"],"google:verbatimrelevance":851}]
2023-11-22 11:53:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.16	49731	45.41.205.104	443	6496	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-11-22 11:53:39 UTC	661	OUT	GET / HTTP/1.1 Host: www.coatsgolds.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-11-22 11:53:40 UTC	279	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 57 65 64 2c 20 32 32 20 4e 6f 76 20 32 30 32 33 20 31 31 3a 35 33 3a 34 30 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 30 39 33 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 41 63 63 65 70 74 2d 43 68 3a 20 53 65 63 2d 43 68 2d 55 61 2d 50 6c 61 74 66 6f 72 6d 2d 56 65 72 73 69 6f 6e 2c 53 65 63 2d 43 68 2d 55 61 2d 4d 6f 64 65 6c 0d 0a 56 61 72 79 3a 20 4f 72 69 67 69 6e 0d 0a 58 2d 45 66 6c 6f 77 2d 52 65 71 75 65 73 74 2d 49 64 3a 20 63 63 66 64 34 39 63 64 2d 63 66 33 36 2d 34 35 Data Ascii: HTTP/1.1 200 OKServer: nginxDate: Wed, 22 Nov 2023 11:53:40 GMTContent-Type: text/html; charset=utf-8Content-Length: 1093Connection: closeAccept-Ch: Sec-Ch-Ua-Platform-Version,Sec-Ch-Ua-ModelVary: OriginX-Eflow-Request-Id: ccfd49cd-cf36-45
2023-11-22 11:53:40 UTC	1093	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 50 65 72 66 6f 72 6d 61 6e 63 65 20 4d 61 72 6b 65 74 69 6e 67 20 50 6c 61 74 66 6f 72 6d 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 31 31 31 64 33 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 46 46 46 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 20 42 6c 69 6e 6b 4d Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>Performance Marketing Platform</title> <style> body { background-color: #111d30; color: #FFF; font-family: -apple-system, BlinkM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.16	49730	45.41.205.104	443	6496	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-11-22 11:53:40 UTC	651	OUT	GET /favicon.ico HTTP/1.1 Host: www.coatsgolds.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-mobile: ?0 sec-ch-ua-model: "" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.coatsgolds.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-11-22 11:53:40 UTC	143	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 57 65 64 2c 20 32 32 20 4e 6f 76 20 32 30 32 33 20 31 31 3a 35 33 3a 34 30 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 35 34 38 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 0d 0a Data Ascii: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 22 Nov 2023 11:53:40 GMTContent-Type: text/htmlContent-Length: 548Connection: close
2023-11-22 11:53:40 UTC	548	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.16	49733	172.253.122.100	443	6496	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-11-22 11:53:59 UTC	453	OUT	GET /tools/pso/ping?as=chrome&brand=ONGR&pid=&hl=en&events=C1F,C1I,C2I,C7I,C1S,C7S&rep=2&rlz=C1:,C2:,C7:&id=0000000000000000000000000000000000000000A89759AE57 HTTP/1.1 Host: clients1.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br
2023-11-22 11:54:00 UTC	817	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 73 63 72 69 70 74 2d 73 72 63 20 27 72 65 70 6f 72 74 2d 73 61 6d 70 6c 65 27 20 27 6e 6f 6e 63 65 2d 55 6e 54 6a 4f 68 55 72 51 32 31 63 34 7a 69 4f 43 47 42 47 76 77 27 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 27 73 74 72 69 63 74 2d 64 79 6e 61 6d 69 63 27 20 68 74 74 70 73 3a 20 68 74 74 70 3a 3b 6f 62 6a 65 63 74 2d 73 72 63 20 27 6e 6f 6e 65 27 3b 62 61 73 65 2d 75 72 69 20 27 73 65 6c 66 27 3b 72 65 70 6f 72 74 2d 75 72 69 20 68 74 74 70 73 3a 2f 2f 63 73 70 2e 77 69 74 68 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 63 73 70 2f 64 6f 77 6e 6c 6f 61 64 2d 64 74 2f 31 0d 0a 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 Data Ascii: HTTP/1.1 200 OKContent-Security-Policy: script-src 'report-sample' 'nonce-UnTjOhUrQ21c4ziOCGBGvw' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/download-dt/1Content-Security-P
2023-11-22 11:54:00 UTC	240	IN	Data Raw: 72 6c 7a 43 31 3a 20 31 43 31 4f 4e 47 52 5f 65 6e 55 53 31 30 38 35 55 53 31 30 38 35 0a 72 6c 7a 43 32 3a 20 31 43 32 4f 4e 47 52 5f 65 6e 55 53 31 30 38 35 0a 72 6c 7a 43 37 3a 20 31 43 37 4f 4e 47 52 5f 65 6e 55 53 31 30 38 35 0a 64 63 63 3a 20 0a 73 65 74 5f 64 63 63 3a 20 43 31 3a 31 43 31 4f 4e 47 52 5f 65 6e 55 53 31 30 38 35 55 53 31 30 38 35 2c 43 32 3a 31 43 32 4f 4e 47 52 5f 65 6e 55 53 31 30 38 35 2c 43 37 3a 31 43 37 4f 4e 47 52 5f 65 6e 55 53 31 30 38 35 0a 65 76 65 6e 74 73 3a 20 43 31 46 2c 43 31 49 2c 43 32 49 2c 43 37 49 2c 43 31 53 2c 43 37 53 0a 73 74 61 74 65 66 75 6c 2d 65 76 65 6e 74 73 3a 20 43 31 46 2c 43 31 49 2c 43 32 49 2c 43 37 49 0a 63 72 63 33 32 3a 20 36 34 36 61 35 66 37 37 0a Data Ascii: rlzC1: 1C1ONGR_enUS1085US1085rlzC2: 1C2ONGR_enUS1085rlzC7: 1C7ONGR_enUS1085dcc: set_dcc: C1:1C1ONGR_enUS1085US1085,C2:1C2ONGR_enUS1085,C7:1C7ONGR_enUS1085events: C1F,C1I,C2I,C7I,C1S,C7Sstateful-events: C1F,C1I,C2I,C7Icrc32: 646a5f77

Target ID:	0
Start time:	12:52:28
Start date:	22/11/2023
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.coatsgolds.com/871rc5m/21748tpd?sub1=177772&sub2=14437210-6546&sub3=8676
Imagebase:	0x7ff71e7f0000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	12:52:28
Start date:	22/11/2023
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2024 --field-trial-handle=1896,i,18030200112660565471,16170946260577905929,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff71e7f0000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://www.coatsgolds.com/871rc5m/21748tpd?sub1=177772&sub2=14437210-6546&sub3=8676

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 64

Chrome Cache Entry: 65

Chrome Cache Entry: 66

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Connections

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: chrome.exePID: 6340, Parent PID: 6816

General

Chronological Activities

Windows Analysis Report
https://www.coatsgolds.com/871rc5m/21748tpd?sub1=177772&sub2=14437210-6546&sub3=8676