Windows Analysis Report
http://simxtrackredirecttszz.pages.dev/

Overview

General Information

Sample URL:	http://simxtrackredirecttszz.pages.dev/
Analysis ID:	1446908
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

AI detected suspicious javascript

Detected non-DNS traffic on DNS port

Detected suspicious crossdomain redirect

Stores files to the Windows start menu directory

Classification

Signatures

AV Detection

Antivirus / Scanner detection for submitted sample

Source: http://simxtrackredirecttszz.pages.dev/	Avira URL Cloud: detection malicious, Label: phishing
Source: http://simxtrackredirecttszz.pages.dev/	SlashNext: detection malicious, Label: Fraudulent Website type: Phishing & Social Engineering

Antivirus detection for URL or domain

Source: https://secretsafedomain.com/smclick?a=81528&c=342883&o=135901&oc=216576&co=112356&mt=16&svi=EwBjNDF	Avira URL Cloud: Label: malware
Source: https://secretsafedomain.com/s?a=81528&sm=235&s=8&sso=1&spt=1716504721184&co=112356&mt=16&rc=71_1969	Avira URL Cloud: Label: malware
Source: https://secretsafedomain.com/service-worker.js	Avira URL Cloud: Label: malware
Source: https://simxtrackredirecttszz.pages.dev/img/profile-1.jpg	Avira URL Cloud: Label: phishing
Source: https://secretsafedomain.com/s?a=81528&sm=235&s=8&sbp=1&spt=1716504721184&co=112356&mt=16&rc=71_1969	Avira URL Cloud: Label: malware
Source: https://simxtrackredirecttszz.pages.dev/style.css	Avira URL Cloud: Label: phishing

Phishing

AI detected suspicious javascript

Source: https://secretsafedomain.com/s?a=81528&sm=235&co=112356&mt=16&s1=EVOS_TAZZ&s2=576747	LLM: Score: 8 Reasons: The code contains an XMLHttpRequest that fetches and executes code from an external source using eval(). This is a high-risk operation as it can lead to the execution of malicious code. The use of eval() is generally considered dangerous and should be avoided. DOM: 2.4.pages.csv
Source: http://ww12.ngelit.com/?usid=18&utid=25970526717	LLM: Score: 7 Reasons: The code contains an attempt to redirect the top-level window to the current location, which is a common technique used in phishing attacks to prevent users from navigating away from the malicious page. Additionally, the code includes functionality to track user interactions and send data to a server, which could be used for malicious purposes beyond simple tracking or advertisement. DOM: 3.6.pages.csv

Source: http://ww12.ngelit.com/?usid=18&utid=25970526717	HTTP Parser: No favicon
Source: http://ww12.ngelit.com/?usid=18&utid=25970526717	HTTP Parser: No favicon
Source: https://www.adsensecustomsearchads.com/afs/ads?adtest=off&psid=7840396037&pcsa=false&channel=000002%2Cbucket011&client=dp-teaminternet09_3ph&r=m&hl=en&rpbu=http%3A%2F%2Fww12.ngelit.com%2F%3Fts%3DfENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQwMTF8fHx8fHw2NjRmYzg5YzYxZWZhfHx8MTcxNjUwNDczMi40NDMzfGY1MjczYTQ0ZmJkZTRlZDViZTNjMmNiMzczZGVjN2E2NmEwODRlYWZ8fHx8fDF8fDB8MHx8fHwxfHx8fHwwfDB8fHx8fHx8fHx8MHwwfHwwfHx8MHwwfFcxMD18fDF8VzEwPXxkZGExZTc1ZjBjNTczNTBkMmQ3ZjI4YzA5ZDllYzQ2OWM3MGRiMWIwfDB8ZHAtdGVhbWludGVybmV0MDlfM3BofDB8MHx8&max_radlink_len=40&type=3&uiopt=true&swp=as-drid-2733393318609526&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300003%2C17301431%2C17301433%2C17301436&client_gdprApplies=0&format=r3%7Cs&nocache=8561716504734778&num=0&output=afd_ads&domain_name=ww12.ngelit.com&v=3&bsl=8&pac=0&u_his=1&u_tz=-240&dt=1716504734780&u_w=1280&u_h=1024&biw=1280&bih=907&psw=1280&psh=754&frm=0&uio=--&cont=tc&drt=0&jsid=caf&nfp=1&jsv=635538657&rurl=http%3A%2F%2Fww12.ngelit.com%2F%3Fusid%3D18%26utid%3D25970526717	HTTP Parser: No favicon
Source: https://www.adsensecustomsearchads.com/afs/ads?adtest=off&psid=7840396037&pcsa=false&channel=000002%2Cbucket011&client=dp-teaminternet09_3ph&r=m&hl=en&rpbu=http%3A%2F%2Fww12.ngelit.com%2F%3Fts%3DfENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQwMTF8fHx8fHw2NjRmYzg5YzYxZWZhfHx8MTcxNjUwNDczMi40NDMzfGY1MjczYTQ0ZmJkZTRlZDViZTNjMmNiMzczZGVjN2E2NmEwODRlYWZ8fHx8fDF8fDB8MHx8fHwxfHx8fHwwfDB8fHx8fHx8fHx8MHwwfHwwfHx8MHwwfFcxMD18fDF8VzEwPXxkZGExZTc1ZjBjNTczNTBkMmQ3ZjI4YzA5ZDllYzQ2OWM3MGRiMWIwfDB8ZHAtdGVhbWludGVybmV0MDlfM3BofDB8MHx8&max_radlink_len=40&type=3&uiopt=true&swp=as-drid-2733393318609526&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300003%2C17301431%2C17301433%2C17301436&client_gdprApplies=0&format=r3%7Cs&nocache=8561716504734778&num=0&output=afd_ads&domain_name=ww12.ngelit.com&v=3&bsl=8&pac=0&u_his=1&u_tz=-240&dt=1716504734780&u_w=1280&u_h=1024&biw=1280&bih=907&psw=1280&psh=754&frm=0&uio=--&cont=tc&drt=0&jsid=caf&nfp=1&jsv=635538657&rurl=http%3A%2F%2Fww12.ngelit.com%2F%3Fusid%3D18%26utid%3D25970526717	HTTP Parser: No favicon
Source: https://www.adsensecustomsearchads.com/afs/ads?adtest=off&psid=7840396037&pcsa=false&channel=000002%2Cbucket011&client=dp-teaminternet09_3ph&r=m&hl=en&rpbu=http%3A%2F%2Fww12.ngelit.com%2F%3Fts%3DfENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQwMTF8fHx8fHw2NjRmYzg5YzYxZWZhfHx8MTcxNjUwNDczMi40NDMzfGY1MjczYTQ0ZmJkZTRlZDViZTNjMmNiMzczZGVjN2E2NmEwODRlYWZ8fHx8fDF8fDB8MHx8fHwxfHx8fHwwfDB8fHx8fHx8fHx8MHwwfHwwfHx8MHwwfFcxMD18fDF8VzEwPXxkZGExZTc1ZjBjNTczNTBkMmQ3ZjI4YzA5ZDllYzQ2OWM3MGRiMWIwfDB8ZHAtdGVhbWludGVybmV0MDlfM3BofDB8MHx8&max_radlink_len=40&type=3&uiopt=true&swp=as-drid-2733393318609526&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300003%2C17301431%2C17301433%2C17301436&client_gdprApplies=0&format=r3%7Cs&nocache=8561716504734778&num=0&output=afd_ads&domain_name=ww12.ngelit.com&v=3&bsl=8&pac=0&u_his=1&u_tz=-240&dt=1716504734780&u_w=1280&u_h=1024&biw=1280&bih=907&psw=1280&psh=754&frm=0&uio=--&cont=tc&drt=0&jsid=caf&nfp=1&jsv=635538657&rurl=http%3A%2F%2Fww12.ngelit.com%2F%3Fusid%3D18%26utid%3D25970526717	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 23.211.8.90:443 -> 192.168.2.5:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.211.8.90:443 -> 192.168.2.5:49728 version: TLS 1.2

Detected non-DNS traffic on DNS port

Source: global traffic

TCP traffic: 192.168.2.5:49755 -> 1.1.1.1:53

Detected suspicious crossdomain redirect

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

HTTP traffic: Redirect from: simxtrack.com to https://secretsafedomain.com/s?a=81528&sm=235&co=112356&mt=16&s1=evos_tazz&s2=576747

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: simxtrackredirecttszz.pages.devConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /style.css HTTP/1.1Host: simxtrackredirecttszz.pages.devConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://simxtrackredirecttszz.pages.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /css/bootstrap.min.css?3 HTTP/1.1Host: telegram.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://simxtrackredirecttszz.pages.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /css/telegram.css?227 HTTP/1.1Host: telegram.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://simxtrackredirecttszz.pages.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/tgwallpaper.min.js?3 HTTP/1.1Host: telegram.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://simxtrackredirecttszz.pages.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/profile-1.jpg HTTP/1.1Host: simxtrackredirecttszz.pages.devConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://simxtrackredirecttszz.pages.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/tgme/pattern.svg?1 HTTP/1.1Host: telegram.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://telegram.org/css/telegram.css?227Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/profile-1.jpg HTTP/1.1Host: simxtrackredirecttszz.pages.devConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/favicon.ico HTTP/1.1Host: telegram.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://simxtrackredirecttszz.pages.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/tgme/pattern.svg?1 HTTP/1.1Host: telegram.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /img/favicon.ico HTTP/1.1Host: telegram.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /link-1 HTTP/1.1Host: simxtrackredirecttszz.pages.devConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /style.css HTTP/1.1Host: simxtrackredirecttszz.pages.devConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://simxtrackredirecttszz.pages.dev/link-1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "90f6d7cd3044dadc6d9b9f251b985245"
Source: global traffic	HTTP traffic detected: GET /img/profile-1.jpg HTTP/1.1Host: simxtrackredirecttszz.pages.devConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://simxtrackredirecttszz.pages.dev/link-1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "398570c34aafa08182d3cd0963670b22"
Source: global traffic	HTTP traffic detected: GET /img/profile-1.jpg HTTP/1.1Host: simxtrackredirecttszz.pages.devConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "398570c34aafa08182d3cd0963670b22"
Source: global traffic	HTTP traffic detected: GET /tracking202/redirect/rtr.php?t202id=5236&c1=EVOS_TAZZ&t202kw=EVOS_TAZZ HTTP/1.1Host: simxtrack.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s?a=81528&sm=235&co=112356&mt=16&s1=EVOS_TAZZ&s2=576747 HTTP/1.1Host: secretsafedomain.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /user-segments/?pid=TH HTTP/1.1Host: statisticresearch.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://secretsafedomain.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /color?x=1&forScheme=aHR0cHM6Ly9zZWNyZXRzYWZlZG9tYWluLmNvbS9zP2E9ODE1Mjgmc209MjM1JmNvPTExMjM1NiZtdD0xNiZzMT1FVk9TX1RBWlomczI9NTc2NzQ3 HTTP/1.1Host: cloudflrcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://secretsafedomain.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://secretsafedomain.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/v1/retargeting/set/3f949dfe-3372-4caa-baf0-047f88323cfa?pageviewe={pageviewe}&lead={lead} HTTP/1.1Host: tsyndicate.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://secretsafedomain.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /service-worker.js HTTP/1.1Host: secretsafedomain.comConnection: keep-aliveCache-Control: max-age=0Accept: /Service-Worker: scriptSec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: serviceworkerReferer: https://secretsafedomain.com/s?a=81528&sm=235&co=112356&mt=16&s1=EVOS_TAZZ&s2=576747User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: v_rule_freq_v2_1_001=gdXLFugAbf4IueEdLRjw0thA7hUlhtzwKDvv5kumE971xuqr9DMZSKeN5JMVNn+i; gdm_uid_v2_1_001=U/r8lLUPAWcxDaviLTpwFaKcPwxoewHxyP3PvdEcoZBqGwiXr2tBu5efBif1Hpu0; v_rule_freq_v1_1_001=gdXLFugAbf4IueEdLRjw0thA7hUlhtzwKDvv5kumE971xuqr9DMZSKeN5JMVNn+i; v_seg_freq_v1_1_001=w+sV2Dl79C1RO54AAC2G/oufeiLDs7TJHVltH+BRr3s=; gdm_visit_freq_v2_1_001=oXa+SKDZFOD0jqa0rxAdlM/pSb3k2TlE1cALdU3RA5w=; v_seg_freq_v2_1_001=w+sV2Dl79C1RO54AAC2G/oufeiLDs7TJHVltH+BRr3s=; gdm_visit_freq_v1_1_001=oXa+SKDZFOD0jqa0rxAdlM/pSb3k2TlE1cALdU3RA5w=; gdm_suid_v2_1_001=HPfHs3OFxkaNOwO68jCjbQ==; gdm_uid_v1_1_001=U/r8lLUPAWcxDaviLTpwFaKcPwxoewHxyP3PvdEcoZBqGwiXr2tBu5efBif1Hpu0; gdm_suid_v1_1_001=HPfHs3OFxkaNOwO68jCjbQ==
Source: global traffic	HTTP traffic detected: GET /js/mp.min.js HTTP/1.1Host: static.trafficjunky.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://secretsafedomain.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/v1/retargeting/set/3f949dfe-3372-4caa-baf0-047f88323cfa?pageviewe={pageviewe}&lead={lead} HTTP/1.1Host: tsyndicate.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ts_rt_3f949dfe-3372-4caa-baf0-047f88323cfa=ANmUCUOmR4kbQgQSPEjEBJwwZ8rYSVPmThmDCB9GnFixDMOA
Source: global traffic	HTTP traffic detected: GET /j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-179148962-2&cid=343168255.1716504726&jid=1258097187&gjid=971496842&_gid=1698602312.1716504726&_u=YEBAAEAAAAAAACAAI~&z=1890898182 HTTP/1.1Host: stats.g.doubleclick.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /adsense/domains/caf.js?abp=1&adsdeli=true HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: http://ww12.ngelit.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /afs/ads?adtest=off&psid=7840396037&pcsa=false&channel=000002%2Cbucket011&client=dp-teaminternet09_3ph&r=m&hl=en&rpbu=http%3A%2F%2Fww12.ngelit.com%2F%3Fts%3DfENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQwMTF8fHx8fHw2NjRmYzg5YzYxZWZhfHx8MTcxNjUwNDczMi40NDMzfGY1MjczYTQ0ZmJkZTRlZDViZTNjMmNiMzczZGVjN2E2NmEwODRlYWZ8fHx8fDF8fDB8MHx8fHwxfHx8fHwwfDB8fHx8fHx8fHx8MHwwfHwwfHx8MHwwfFcxMD18fDF8VzEwPXxkZGExZTc1ZjBjNTczNTBkMmQ3ZjI4YzA5ZDllYzQ2OWM3MGRiMWIwfDB8ZHAtdGVhbWludGVybmV0MDlfM3BofDB8MHx8&max_radlink_len=40&type=3&uiopt=true&swp=as-drid-2733393318609526&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300003%2C17301431%2C17301433%2C17301436&client_gdprApplies=0&format=r3%7Cs&nocache=8561716504734778&num=0&output=afd_ads&domain_name=ww12.ngelit.com&v=3&bsl=8&pac=0&u_his=1&u_tz=-240&dt=1716504734780&u_w=1280&u_h=1024&biw=1280&bih=907&psw=1280&psh=754&frm=0&uio=--&cont=tc&drt=0&jsid=caf&nfp=1&jsv=635538657&rurl=http%3A%2F%2Fww12.ngelit.com%2F%3Fusid%3D18%26utid%3D25970526717 HTTP/1.1Host: www.adsensecustomsearchads.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: http://ww12.ngelit.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /adsense/domains/caf.js?pac=0 HTTP/1.1Host: www.adsensecustomsearchads.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.adsensecustomsearchads.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ad_icons/standard/publisher_icon_image/chevron.svg?c=%23ffffff HTTP/1.1Host: afs.googleusercontent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.adsensecustomsearchads.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ad_icons/standard/publisher_icon_image/search.svg?c=%23ffffff HTTP/1.1Host: afs.googleusercontent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.adsensecustomsearchads.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /afs/gen_204?client=dp-teaminternet09_3ph&output=uds_ads_only&zx=35mgsdqnx1tq&aqid=oMhPZvCxD6uijuwPiPui6Qk&psid=7840396037&pbt=bs&adbx=375&adby=93&adbh=496&adbw=530&adbah=160%2C160%2C160&adbn=master-1&eawp=partner-dp-teaminternet09_3ph&errv=635538657&csala=7%7C0%7C1139%7C1372%7C276&lle=0&ifv=1&hpt=1&wbd=false HTTP/1.1Host: www.adsensecustomsearchads.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: http://ww12.ngelit.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /afs/gen_204?client=dp-teaminternet09_3ph&output=uds_ads_only&zx=vhf3wk3421c2&aqid=oMhPZvCxD6uijuwPiPui6Qk&psid=7840396037&pbt=bv&adbx=375&adby=93&adbh=496&adbw=530&adbah=160%2C160%2C160&adbn=master-1&eawp=partner-dp-teaminternet09_3ph&errv=635538657&csala=7%7C0%7C1139%7C1372%7C276&lle=0&ifv=1&hpt=1&wbd=false HTTP/1.1Host: www.adsensecustomsearchads.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: http://ww12.ngelit.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ad_icons/standard/publisher_icon_image/chevron.svg?c=%23ffffff HTTP/1.1Host: afs.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ad_icons/standard/publisher_icon_image/search.svg?c=%23ffffff HTTP/1.1Host: afs.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: fauzi3.ngelit.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?usid=18&utid=25970526717 HTTP/1.1Host: ww12.ngelit.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /page/enhance.js?pcId=12&domain=ngelit.com HTTP/1.1Host: parking.parklogic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://ww12.ngelit.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /track.php?domain=ngelit.com&toggle=browserjs&uid=MTcxNjUwNDczMi40MDEzOmJhMzRiY2Q0YTY5Y2I1ODg1Yzg4ZTJiZDg0NmRlYTc5YTUzZWMxMGEwMmY0MmU2ZjEzNGJiMTgyZTgzYzY5Zjk6NjY0ZmM4OWM2MWY5Mw%3D%3D HTTP/1.1Host: ww12.ngelit.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://ww12.ngelit.com/?usid=18&utid=25970526717Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /page/scribe.php?pcId=12&domain=ngelit.com&pId=449&usid=18&utid=25970526717&query=null&domainJs=ww12.ngelit.com&path=/&ss=true&lp=1 HTTP/1.1Host: parking.parklogic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Origin: http://ww12.ngelit.comReferer: http://ww12.ngelit.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ls.php?t=664fc89c&token=dda1e75f0c57350d2d7f28c09d9ec469c70db1b0 HTTP/1.1Host: ww12.ngelit.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://ww12.ngelit.com/?usid=18&utid=25970526717Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /themes/cleanPeppermintBlack_657d9013/img/arrows.png HTTP/1.1Host: d38psrni17bvxu.cloudfront.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://ww12.ngelit.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /track.php?domain=ngelit.com&toggle=browserjs&uid=MTcxNjUwNDczMi40MDEzOmJhMzRiY2Q0YTY5Y2I1ODg1Yzg4ZTJiZDg0NmRlYTc5YTUzZWMxMGEwMmY0MmU2ZjEzNGJiMTgyZTgzYzY5Zjk6NjY0ZmM4OWM2MWY5Mw%3D%3D HTTP/1.1Host: ww12.ngelit.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /page/scribe.php?pcId=12&domain=ngelit.com&pId=449&usid=18&utid=25970526717&query=null&domainJs=ww12.ngelit.com&path=/&ss=true&lp=1 HTTP/1.1Host: parking.parklogic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /themes/cleanPeppermintBlack_657d9013/img/arrows.png HTTP/1.1Host: d38psrni17bvxu.cloudfront.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /track.php?domain=ngelit.com&caf=1&toggle=answercheck&answer=yes&uid=MTcxNjUwNDczMi40MDEzOmJhMzRiY2Q0YTY5Y2I1ODg1Yzg4ZTJiZDg0NmRlYTc5YTUzZWMxMGEwMmY0MmU2ZjEzNGJiMTgyZTgzYzY5Zjk6NjY0ZmM4OWM2MWY5Mw%3D%3D HTTP/1.1Host: ww12.ngelit.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://ww12.ngelit.com/?usid=18&utid=25970526717Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: __gsas=ID=92b55ae556c71643:T=1716504736:RT=1716504736:S=ALNI_MbC761s07K7Y91R73mkAvtsJB0EBA
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: ww12.ngelit.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://ww12.ngelit.com/?usid=18&utid=25970526717Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: __gsas=ID=92b55ae556c71643:T=1716504736:RT=1716504736:S=ALNI_MbC761s07K7Y91R73mkAvtsJB0EBA
Source: global traffic	HTTP traffic detected: GET /track.php?domain=ngelit.com&caf=1&toggle=answercheck&answer=yes&uid=MTcxNjUwNDczMi40MDEzOmJhMzRiY2Q0YTY5Y2I1ODg1Yzg4ZTJiZDg0NmRlYTc5YTUzZWMxMGEwMmY0MmU2ZjEzNGJiMTgyZTgzYzY5Zjk6NjY0ZmM4OWM2MWY5Mw%3D%3D HTTP/1.1Host: ww12.ngelit.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: __gsas=ID=92b55ae556c71643:T=1716504736:RT=1716504736:S=ALNI_MbC761s07K7Y91R73mkAvtsJB0EBA
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: ww12.ngelit.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: __gsas=ID=92b55ae556c71643:T=1716504736:RT=1716504736:S=ALNI_MbC761s07K7Y91R73mkAvtsJB0EBA

Source: chromecache_117.2.dr	String found in binary or memory: Math.round(p);u["gtm.videoCurrentTime"]=Math.round(q);u["gtm.videoElapsedTime"]=Math.round(f);u["gtm.videoPercent"]=r;u["gtm.videoVisible"]=t;return u},bk:function(){e=Db()},pd:function(){d()}}};var ic=ma(["data-gtm-yt-inspected-"]),GC=["www.youtube.com","www.youtube-nocookie.com"],HC,IC=!1; equals www.youtube.com (Youtube)
Source: chromecache_117.2.dr	String found in binary or memory: e\|\|f\|\|g.length\|\|h.length))return;var n={Wg:d,Ug:e,Vg:f,Lh:g,Mh:h,xe:m,Ab:b},p=G.YT,q=function(){OC(n)};if(p)return p.ready&&p.ready(q),b;var r=G.onYouTubeIframeAPIReady;G.onYouTubeIframeAPIReady=function(){r&&r();q()};I(function(){for(var t=H.getElementsByTagName("script"),v=t.length,u=0;u<v;u++){var w=t[u].getAttribute("src");if(RC(w,"iframe_api")\|\|RC(w,"player_api"))return b}for(var y=H.getElementsByTagName("iframe"),x=y.length,B=0;B<x;B++)if(!IC&&PC(y[B],n.xe))return yc("https://www.youtube.com/iframe_api"), equals www.youtube.com (Youtube)
Source: chromecache_114.2.dr, chromecache_119.2.dr	String found in binary or memory: return b}EC.K="internal.enableAutoEventOnTimer";var ic=ma(["data-gtm-yt-inspected-"]),GC=["www.youtube.com","www.youtube-nocookie.com"],HC,IC=!1; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: simxtrackredirecttszz.pages.dev
Source: global traffic	DNS traffic detected: DNS query: cdn.jsdelivr.net
Source: global traffic	DNS traffic detected: DNS query: telegram.org
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: simxtrack.com
Source: global traffic	DNS traffic detected: DNS query: secretsafedomain.com
Source: global traffic	DNS traffic detected: DNS query: cdn.jmp-assets.com
Source: global traffic	DNS traffic detected: DNS query: statisticresearch.com
Source: global traffic	DNS traffic detected: DNS query: cdn.smrt-content.com
Source: global traffic	DNS traffic detected: DNS query: cloudflrcdn.com
Source: global traffic	DNS traffic detected: DNS query: static.trafficjunky.com
Source: global traffic	DNS traffic detected: DNS query: tsyndicate.com
Source: global traffic	DNS traffic detected: DNS query: cdn.jmpcdn.com
Source: global traffic	DNS traffic detected: DNS query: stats.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: fauzi3.ngelit.com
Source: global traffic	DNS traffic detected: DNS query: ww12.ngelit.com
Source: global traffic	DNS traffic detected: DNS query: parking.parklogic.com
Source: global traffic	DNS traffic detected: DNS query: d38psrni17bvxu.cloudfront.net
Source: global traffic	DNS traffic detected: DNS query: www.adsensecustomsearchads.com
Source: global traffic	DNS traffic detected: DNS query: afs.googleusercontent.com

Source: unknown

HTTP traffic detected: POST /j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-179148962-2&cid=343168255.1716504726&jid=1258097187&gjid=971496842&_gid=1698602312.1716504726&_u=YEBAAEAAAAAAACAAI~&z=1890898182 HTTP/1.1Host: stats.g.doubleclick.netConnection: keep-aliveContent-Length: 0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: text/plainAccept: */*Origin: https://secretsafedomain.comX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://secretsafedomain.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: chromecache_123.2.dr, chromecache_110.2.dr	String found in binary or memory: http://fauzi3.ngelit.com
Source: chromecache_142.2.dr	String found in binary or memory: http://getbootstrap.com)
Source: chromecache_142.2.dr	String found in binary or memory: http://getbootstrap.com/customize/?id=92d2ac1b31978642b6b6)
Source: chromecache_124.2.dr	String found in binary or memory: http://parking.parklogic.com/page/scribe.php?pcId=12&domain=ngelit.com&pId=449&usid=$
Source: chromecache_117.2.dr	String found in binary or memory: https://adservice.google.com/pagead/regclk
Source: chromecache_117.2.dr	String found in binary or memory: https://adservice.googlesyndication.com/pagead/regclk
Source: chromecache_112.2.dr	String found in binary or memory: https://ampcid.google.com/v1/publisher:getClientId
Source: chromecache_114.2.dr, chromecache_117.2.dr, chromecache_119.2.dr	String found in binary or memory: https://cct.google/taggy/agent.js
Source: chromecache_151.2.dr	String found in binary or memory: https://cdn.jmp-assets.com/assets/1373/other/favicon.ico
Source: chromecache_151.2.dr	String found in binary or memory: https://cdn.jmp-assets.com/assets/1387/js/backoffer.js
Source: chromecache_151.2.dr	String found in binary or memory: https://cdn.jmp-assets.com/assets/1714/js/jquery.min.js
Source: chromecache_151.2.dr	String found in binary or memory: https://cdn.jmp-assets.com/assets/2246/css/age-styles-new.css
Source: chromecache_151.2.dr	String found in binary or memory: https://cdn.jmp-assets.com/assets/2843/css/main.css
Source: chromecache_151.2.dr	String found in binary or memory: https://cdn.jmp-assets.com/devassets/3198/js/multilang_main_gender.js
Source: chromecache_151.2.dr	String found in binary or memory: https://cdn.jmp-assets.com/prod/push-lang-config.js
Source: chromecache_151.2.dr	String found in binary or memory: https://cdn.jmp-assets.com/prod/push-subscriber.js
Source: chromecache_151.2.dr	String found in binary or memory: https://cdn.jmpcdn.com/assets/3420/images/1.ico
Source: chromecache_151.2.dr	String found in binary or memory: https://cdn.jmpcdn.com/assets/3420/images/2.ico
Source: chromecache_151.2.dr	String found in binary or memory: https://cdn.jmpcdn.com/assets/3420/images/3.ico
Source: chromecache_151.2.dr	String found in binary or memory: https://cdn.jmpcdn.com/assets/3420/images/4.ico
Source: chromecache_151.2.dr	String found in binary or memory: https://cdn.jmpcdn.com/assets/3420/images/5.ico
Source: chromecache_151.2.dr	String found in binary or memory: https://cdn.jmpcdn.com/assets/3420/images/6.ico
Source: chromecache_123.2.dr, chromecache_110.2.dr	String found in binary or memory: https://cdn.jsdelivr.net/npm/bootstrap-icons
Source: chromecache_116.2.dr	String found in binary or memory: https://cdn.smrt-content.com/prod
Source: chromecache_151.2.dr	String found in binary or memory: https://cloudflrcdn.com/color?x=1&forScheme=
Source: chromecache_154.2.dr, chromecache_106.2.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=
Source: chromecache_156.2.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Montserrat:400
Source: chromecache_123.2.dr, chromecache_110.2.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Roboto:400
Source: chromecache_158.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459W1hyzbi.woff2)
Source: chromecache_158.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459WRhyzbi.woff2)
Source: chromecache_158.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459WZhyzbi.woff2)
Source: chromecache_158.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459Wdhyzbi.woff2)
Source: chromecache_158.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2)
Source: chromecache_133.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfABc4EsA.woff2)
Source: chromecache_133.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2)
Source: chromecache_133.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBxc4EsA.woff2)
Source: chromecache_133.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfCBc4EsA.woff2)
Source: chromecache_133.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfCRc4EsA.woff2)
Source: chromecache_133.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfChc4EsA.woff2)
Source: chromecache_133.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfCxc4EsA.woff2)
Source: chromecache_133.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4WxKOzY.woff2)
Source: chromecache_133.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2)
Source: chromecache_133.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu5mxKOzY.woff2)
Source: chromecache_133.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu72xKOzY.woff2)
Source: chromecache_133.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu7GxKOzY.woff2)
Source: chromecache_133.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu7WxKOzY.woff2)
Source: chromecache_133.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu7mxKOzY.woff2)
Source: chromecache_142.2.dr	String found in binary or memory: https://gist.github.com/92d2ac1b31978642b6b6
Source: chromecache_142.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: chromecache_111.2.dr	String found in binary or memory: https://osx.telegram.org/updates/site/artboard.png)
Source: chromecache_111.2.dr	String found in binary or memory: https://osx.telegram.org/updates/site/artboard_2x.png);
Source: chromecache_117.2.dr, chromecache_119.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com
Source: chromecache_154.2.dr, chromecache_114.2.dr, chromecache_117.2.dr, chromecache_119.2.dr, chromecache_106.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=tcfe
Source: chromecache_154.2.dr, chromecache_106.2.dr	String found in binary or memory: https://partner.googleadservices.com/gampad/cookie.js
Source: chromecache_151.2.dr	String found in binary or memory: https://secretsafedomain.com/s?a=81528&sm=235&s=8&sbp=1&spt=1716504721184&co=112356&mt=16&rc=71_1969
Source: chromecache_151.2.dr	String found in binary or memory: https://secretsafedomain.com/s?a=81528&sm=235&s=8&sso=1&spt=1716504721184&co=112356&mt=16&rc=71_1969
Source: chromecache_151.2.dr	String found in binary or memory: https://secretsafedomain.com/smclick?a=81528&c=342883&o=135901&oc=216576&co=112356&mt=16&svi=EwBjNDF
Source: chromecache_110.2.dr	String found in binary or memory: https://simxtrack.com/tracking202/redirect/rtr.php?t202id=5236&c1=EVOS_TAZZ&t202kw=EVOS_TAZZ
Source: chromecache_116.2.dr	String found in binary or memory: https://statisticresearch.com/match?p=PS&adxguid=
Source: chromecache_151.2.dr	String found in binary or memory: https://statisticresearch.com/user-segments/?pid=TH
Source: chromecache_117.2.dr	String found in binary or memory: https://stats.g.doubleclick.net/g/collect
Source: chromecache_112.2.dr	String found in binary or memory: https://stats.g.doubleclick.net/j/collect
Source: chromecache_154.2.dr, chromecache_106.2.dr	String found in binary or memory: https://syndicatedsearch.goog
Source: chromecache_112.2.dr	String found in binary or memory: https://tagassistant.google.com/
Source: chromecache_114.2.dr, chromecache_117.2.dr, chromecache_119.2.dr	String found in binary or memory: https://td.doubleclick.net
Source: chromecache_123.2.dr, chromecache_110.2.dr	String found in binary or memory: https://telegram.org/css/bootstrap.min.css?3
Source: chromecache_123.2.dr, chromecache_110.2.dr	String found in binary or memory: https://telegram.org/css/telegram.css?227
Source: chromecache_123.2.dr, chromecache_110.2.dr	String found in binary or memory: https://telegram.org/img/apple-touch-icon.png
Source: chromecache_123.2.dr, chromecache_110.2.dr	String found in binary or memory: https://telegram.org/img/favicon-16x16.png
Source: chromecache_123.2.dr, chromecache_110.2.dr	String found in binary or memory: https://telegram.org/img/favicon-32x32.png
Source: chromecache_123.2.dr, chromecache_110.2.dr	String found in binary or memory: https://telegram.org/img/favicon.ico
Source: chromecache_123.2.dr, chromecache_110.2.dr	String found in binary or memory: https://telegram.org/img/website_icon.svg?4
Source: chromecache_123.2.dr, chromecache_110.2.dr	String found in binary or memory: https://telegram.org/js/tgwallpaper.min.js?3
Source: chromecache_116.2.dr, chromecache_160.2.dr	String found in binary or memory: https://theseoffersforyou.com
Source: chromecache_114.2.dr	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: chromecache_112.2.dr	String found in binary or memory: https://www.google-analytics.com/debug/bootstrap?id=
Source: chromecache_112.2.dr	String found in binary or memory: https://www.google-analytics.com/gtm/js?id=
Source: chromecache_112.2.dr	String found in binary or memory: https://www.google.%/ads/ga-audiences
Source: chromecache_117.2.dr, chromecache_119.2.dr	String found in binary or memory: https://www.google.com
Source: chromecache_112.2.dr	String found in binary or memory: https://www.google.com/ads/ga-audiences
Source: chromecache_114.2.dr, chromecache_117.2.dr, chromecache_119.2.dr	String found in binary or memory: https://www.googleadservices.com
Source: chromecache_154.2.dr, chromecache_106.2.dr	String found in binary or memory: https://www.googleadservices.com/pagead/conversion/16521530460/?gad_source=1&adview_type=3
Source: chromecache_114.2.dr, chromecache_117.2.dr, chromecache_119.2.dr	String found in binary or memory: https://www.googletagmanager.com
Source: chromecache_112.2.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=
Source: chromecache_151.2.dr	String found in binary or memory: https://www.googletagmanager.com/gtm.js?id=
Source: chromecache_151.2.dr	String found in binary or memory: https://www.googletagmanager.com/ns.html?id=GTM-TR8VQRX
Source: chromecache_151.2.dr, chromecache_160.2.dr	String found in binary or memory: https://www.gstatic.com/firebasejs/5.0.2/firebase-app.js
Source: chromecache_151.2.dr, chromecache_160.2.dr	String found in binary or memory: https://www.gstatic.com/firebasejs/5.0.2/firebase-messaging.js
Source: chromecache_117.2.dr	String found in binary or memory: https://www.merchant-center-analytics.goog
Source: chromecache_117.2.dr	String found in binary or memory: https://www.youtube.com/iframe_api

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 23.211.8.90:443 -> 192.168.2.5:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.211.8.90:443 -> 192.168.2.5:49728 version: TLS 1.2

Source: classification engine

Classification label: mal60.phis.win@23/115@66/26

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=2028,i,8292762305425428644,7564485751747783064,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://simxtrackredirecttszz.pages.dev/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=2028,i,8292762305425428644,7564485751747783064,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
67.225.218.50	parking.parklogic.com	United States	32244	LIQUIDWEBUS	false
142.250.185.78	www3.l.google.com	United States	15169	GOOGLEUS	false
172.66.46.238	unknown	United States	13335	CLOUDFLARENETUS	false
149.154.167.99	telegram.org	United Kingdom	62041	TELEGRAMRU	false
216.58.206.36	unknown	United States	15169	GOOGLEUS	false
74.125.206.154	stats.g.doubleclick.net	United States	15169	GOOGLEUS	false
45.141.157.146	cdpxy.cdtechbox.link	Germany	209696	NILSATBG	false
103.247.11.107	simxtrack.com	Indonesia	58487	RUMAHWEB-AS-IDRumahwebIndonesiaCVID	false
142.250.186.110	unknown	United States	15169	GOOGLEUS	false
13.248.148.254	726512.parkingcrew.net	United States	16509	AMAZON-02US	false
172.66.45.18	simxtrackredirecttszz.pages.dev	United States	13335	CLOUDFLARENETUS	false
18.245.173.78	unknown	United States	16509	AMAZON-02US	false
18.239.102.57	d38psrni17bvxu.cloudfront.net	United States	16509	AMAZON-02US	false
172.217.18.4	www.google.com	United States	15169	GOOGLEUS	false
168.119.1.208	tsyndicate.com	Germany	24940	HETZNER-ASDE	false
136.243.43.25	unknown	Germany	24940	HETZNER-ASDE	false
172.217.18.1	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
142.250.185.193	unknown	United States	15169	GOOGLEUS	false
64.233.166.156	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
35.153.14.190	statisticresearch.com	United States	14618	AMAZON-AESUS	false
66.254.122.19	static.trafficjunky.com.sds.rncdn7.com	United States	29789	REFLECTEDUS	false
34.207.50.203	cloudflrcdn.com	United States	14618	AMAZON-AESUS	false
69.16.230.42	fauzi3.ngelit.com	United States	32244	LIQUIDWEBUS	false

Private

IP
192.168.2.6
192.168.2.5

Contacted Domains

Name	IP	Active
726512.parkingcrew.net	13.248.148.254	true
telegram.org	149.154.167.99	true
parking.parklogic.com	67.225.218.50	true
simxtrack.com	103.247.11.107	true
cdpxy.cdtechbox.link	45.141.157.146	true
fp2e7a.wpc.phicdn.net	192.229.221.95	true
stats.g.doubleclick.net	74.125.206.154	true
cloudflrcdn.com	34.207.50.203	true
www3.l.google.com	142.250.185.78	true
simxtrackredirecttszz.pages.dev	172.66.45.18	true
www.google.com	172.217.18.4	true
fauzi3.ngelit.com	69.16.230.42	true
tsyndicate.com	168.119.1.208	true
statisticresearch.com	35.153.14.190	true
googlehosted.l.googleusercontent.com	172.217.18.1	true
static.trafficjunky.com.sds.rncdn7.com	66.254.122.19	true
d38psrni17bvxu.cloudfront.net	18.239.102.57	true
static.trafficjunky.com	unknown	unknown
cdn.jmp-assets.com	unknown	unknown
ww12.ngelit.com	unknown	unknown
cdn.jsdelivr.net	unknown	unknown
afs.googleusercontent.com	unknown	unknown
www.adsensecustomsearchads.com	unknown	unknown
secretsafedomain.com	unknown	unknown
cdn.jmpcdn.com	unknown	unknown
cdn.smrt-content.com	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.google.com/adsense/domains/caf.js?abp=1&adsdeli=true	false	Avira URL Cloud: safe	unknown
https://telegram.org/img/favicon.ico	false	Avira URL Cloud: safe	unknown
https://telegram.org/css/bootstrap.min.css?3	false	Avira URL Cloud: safe	unknown
http://ww12.ngelit.com/favicon.ico	false	Avira URL Cloud: safe	unknown
https://www.adsensecustomsearchads.com/afs/gen_204?client=dp-teaminternet09_3ph&output=uds_ads_only&zx=vhf3wk3421c2&aqid=oMhPZvCxD6uijuwPiPui6Qk&psid=7840396037&pbt=bv&adbx=375&adby=93&adbh=496&adbw=530&adbah=160%2C160%2C160&adbn=master-1&eawp=partner-dp-teaminternet09_3ph&errv=635538657&csala=7%7C0%7C1139%7C1372%7C276&lle=0&ifv=1&hpt=1&wbd=false	false	Avira URL Cloud: safe	unknown
https://simxtrackredirecttszz.pages.dev/link-1	false		unknown
https://telegram.org/css/telegram.css?227	false	Avira URL Cloud: safe	unknown
https://afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/chevron.svg?c=%23ffffff	false	Avira URL Cloud: safe	unknown
http://ww12.ngelit.com/ls.php?t=664fc89c&token=dda1e75f0c57350d2d7f28c09d9ec469c70db1b0	false	Avira URL Cloud: safe	unknown
http://d38psrni17bvxu.cloudfront.net/themes/cleanPeppermintBlack_657d9013/img/arrows.png	false	URL Reputation: safe	unknown
https://telegram.org/img/tgme/pattern.svg?1	false	Avira URL Cloud: safe	unknown
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-179148962-2&cid=343168255.1716504726&jid=1258097187&gjid=971496842&_gid=1698602312.1716504726&_u=YEBAAEAAAAAAACAAI~&z=1890898182	false	Avira URL Cloud: safe	unknown
https://cloudflrcdn.com/color?x=1&forScheme=aHR0cHM6Ly9zZWNyZXRzYWZlZG9tYWluLmNvbS9zP2E9ODE1Mjgmc209MjM1JmNvPTExMjM1NiZtdD0xNiZzMT1FVk9TX1RBWlomczI9NTc2NzQ3	false	Avira URL Cloud: safe	unknown
http://fauzi3.ngelit.com/	false	Avira URL Cloud: safe	unknown
https://telegram.org/js/tgwallpaper.min.js?3	false	Avira URL Cloud: safe	unknown
https://statisticresearch.com/user-segments/?pid=TH	false	Avira URL Cloud: safe	unknown
http://ww12.ngelit.com/track.php?domain=ngelit.com&caf=1&toggle=answercheck&answer=yes&uid=MTcxNjUwNDczMi40MDEzOmJhMzRiY2Q0YTY5Y2I1ODg1Yzg4ZTJiZDg0NmRlYTc5YTUzZWMxMGEwMmY0MmU2ZjEzNGJiMTgyZTgzYzY5Zjk6NjY0ZmM4OWM2MWY5Mw%3D%3D	false	Avira URL Cloud: safe	unknown
https://static.trafficjunky.com/js/mp.min.js	false	Avira URL Cloud: safe	unknown
https://secretsafedomain.com/s?a=81528&sm=235&co=112356&mt=16&s1=EVOS_TAZZ&s2=576747	true		unknown
http://ww12.ngelit.com/track.php?domain=ngelit.com&toggle=browserjs&uid=MTcxNjUwNDczMi40MDEzOmJhMzRiY2Q0YTY5Y2I1ODg1Yzg4ZTJiZDg0NmRlYTc5YTUzZWMxMGEwMmY0MmU2ZjEzNGJiMTgyZTgzYzY5Zjk6NjY0ZmM4OWM2MWY5Mw%3D%3D	false	Avira URL Cloud: safe	unknown
http://parking.parklogic.com/page/enhance.js?pcId=12&domain=ngelit.com	false	Avira URL Cloud: safe	unknown
https://www.adsensecustomsearchads.com/adsense/domains/caf.js?pac=0	false	Avira URL Cloud: safe	unknown
https://simxtrackredirecttszz.pages.dev/img/profile-1.jpg	false	Avira URL Cloud: phishing	unknown
https://www.adsensecustomsearchads.com/afs/gen_204?client=dp-teaminternet09_3ph&output=uds_ads_only&zx=35mgsdqnx1tq&aqid=oMhPZvCxD6uijuwPiPui6Qk&psid=7840396037&pbt=bs&adbx=375&adby=93&adbh=496&adbw=530&adbah=160%2C160%2C160&adbn=master-1&eawp=partner-dp-teaminternet09_3ph&errv=635538657&csala=7%7C0%7C1139%7C1372%7C276&lle=0&ifv=1&hpt=1&wbd=false	false	Avira URL Cloud: safe	unknown
https://simxtrackredirecttszz.pages.dev/	false		unknown
https://secretsafedomain.com/service-worker.js	false	Avira URL Cloud: malware	unknown
https://simxtrack.com/tracking202/redirect/rtr.php?t202id=5236&c1=EVOS_TAZZ&t202kw=EVOS_TAZZ	false	Avira URL Cloud: safe	unknown
https://afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/search.svg?c=%23ffffff	false	Avira URL Cloud: safe	unknown
https://tsyndicate.com/api/v1/retargeting/set/3f949dfe-3372-4caa-baf0-047f88323cfa?pageviewe={pageviewe}&lead={lead}	false	Avira URL Cloud: safe	unknown
http://ww12.ngelit.com/?usid=18&utid=25970526717	true		unknown
http://parking.parklogic.com/page/scribe.php?pcId=12&domain=ngelit.com&pId=449&usid=18&utid=25970526717&query=null&domainJs=ww12.ngelit.com&path=/&ss=true&lp=1	false	Avira URL Cloud: safe	unknown
https://simxtrackredirecttszz.pages.dev/style.css	false	Avira URL Cloud: phishing	unknown

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu May 23 21:51:23 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	6F998CD3A25FB163D643180AB3CD8AEC	A0DBCA6D5870BC6EF999FCDE6B00D45C2DFD0B23	3710CC21C7B45001FA46954604147EE436951FE2183EDB28A8CE535E22412CAB
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu May 23 21:51:22 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	E59C0A52A71992DB9DD3071CD635AFD2	6B550E9C8E6D825631120BF1542A3C3ED86F4F2D	CDD4AB5396BD5EA562C2CB5BF6E2644FF49D2514F567063501FD93E74C315FDB
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	9C0EE1680691375CA57035C60DCDFD4C	42581FF7A4251F50874C486D1D60D5BA9682B7E5	5DB75D7B4BD5C588B30AAEC5471DDA57758F2A4F1280D50C333C43FEAAFBD7AB
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu May 23 21:51:22 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	186BE2BD02CC6F1D17DAD520055AEA2E	C7EBDADA87D15174FDDF7FDF3FE566EF91C21DAC	2CFC82DD8E837C30AA45B8525633B3073E0D6F2A0840E84B1C8015727628A99D
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu May 23 21:51:22 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	1EDE00C84191203FD04F71A53186D047	24500E7B0A0BBF375FBCB4C776D2834B1A483023	E4B9DA7227B368973716E23E87BC032D5C3143B6A170F0656905F79082A6B334
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu May 23 21:51:22 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	84E8D893F619BFCEC8544677C36479F0	091A08AA0AA44D7293DC8D648C988AE71D2A3E2D	1B4490871B4C1688C1F562DE86DFB81314A37DB3F61C9EE8FA3D9BBE0C0F4EA0
Chrome Cache Entry: 105	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel	C62F95EC3CA566BE8BE396BCA24C92A5	51A6FF0E1A233A612AC33283BBB3D39C8F5E7644	B91D02BA417BB7DEFD5B66E7B6D576EDD428DB676D389A417DFFAF7F01FC0956
Chrome Cache Entry: 106	ASCII text, with very long lines (2247)	A9BF14A677599C1305BF2F0B46028B7D	E21892D64F2CD452D866FEA8D1422DF877BFDABA	B5F128A3EAE867A0CA97502D6A753F21770B33860197A62844ECC9C86952355B
Chrome Cache Entry: 107	ASCII text, with CRLF line terminators	E7E1DC07852A36F89E4BE03AA3787316	0DC3F8E7EB943AF093CF8F4600FCF0E421891025	33B8A5C4F883A3A775162D3C5287FE94BC4B22A86FE8B52FCB5AA615D2FFE388
Chrome Cache Entry: 108	JSON data	7363E85FE9EDEE6F053A4B319588C086	A15E2127145548437173FC17F3E980E3F3DEE2D0	C955E57777EC0D73639DCA6748560D00AA5EB8E12F13EBB2ED9656ADD3908F97
Chrome Cache Entry: 109	ASCII text	D4FBF7B7BB4073DAC1D51576A127C342	BB5E4D4F4DF37F50475FAE0A977AA0C7B23A572D	401C9ECEFD580A307C3B24379B36A9F049EB6F16360C0E1CB0F7D56CB3849A31
Chrome Cache Entry: 110	HTML document, ASCII text, with very long lines (2422), with CRLF line terminators	EAFE0CAF379307BD90BDA46326CB5C80	22CB5AD9D04E631F5533BA97D9C0FEE46E90F356	249644356DC77B4C0782E922B0DBCFF4B5926F1658AEC7F99B2EE5C768726475
Chrome Cache Entry: 111	ASCII text, with very long lines (1267)	8507165C54755807224A197057729D87	ACE8A26F8402BAEE786617E4820A0860822921F2	2DF92C7108CF6788CE6FFE7D3170480C6B6CA0367AE57911849B3760F3753994
Chrome Cache Entry: 112	ASCII text, with very long lines (2343)	575B5480531DA4D14E7453E2016FE0BC	E5C5F3134FE29E60B591C87EA85951F0AEA36EE1	DE36E50194320A7D3EF1ACE9BD34A875A8BD458B253C061979DD628E9BF49AFD
Chrome Cache Entry: 113	ASCII text, with very long lines (25088)	9164D0E8A317ECEB870CCA88C9683127	4617C910005F7100B4FF26A458A8B4463E33CDC6	15C9BD66992EF54979C981763CAE280F28B6845520020ED38B5AB5F3F70F7931
Chrome Cache Entry: 114	ASCII text, with very long lines (2285)	792A19E9185778D41D764EE54114127A	8237C2E8E3B9E7992CBDD5118A76B81768C6106F	10EF3991B4985A4DDB12D193463AD4787D39E41F6890E8B3DBEBE2540544E1C6
Chrome Cache Entry: 115	ASCII text, with very long lines (10683), with no line terminators	77534C644E02AB6356E7D6D7E068A52C	00EE123E14E00B79EA7ADDFBA83CADCCC3A94610	C0B418148076B3E8CFDAE771ED19D95A5C31B73654E0B3B47D36557E8A649D84
Chrome Cache Entry: 116	ASCII text	6B5BCCAD39F7057909AD0660F33CC2FA	A7995E45D98A311F94C3F6F096A7E414B5A34407	765F676A53B5275CB0BF0835962B72ACCD340101AC2E32D8A215F8B1047B0941
Chrome Cache Entry: 117	ASCII text, with very long lines (3034)	80F958F75463DDF82057AC0371855E5B	41BEFF7D1F70082FFAAC9ECA062D22E0EAF93C2B	3EAC7EC7E395C87846C035A564F2E00C1A5AABD3E95F1471D1CD4F296856918D
Chrome Cache Entry: 118	SVG Scalable Vector Graphics image	D0C22C6A97023D85BA6E644A41C44A5D	4284EFB616C182DA4450C123174CE0E81A322845	118ADD53487C02AAF5B5AB9F69380FA06717DEB10492E14AAA487E3C62806AD4
Chrome Cache Entry: 119	ASCII text, with very long lines (4046)	9AE8C1FA68F80EC66DE33E09F616C414	AA8C89C422A6F00BFB3CB8EE3223CB4FBB112F05	4062F1FF7D74ABA77BAF9280FA747CACF2E6A69D952685E7B41FAFC1FBFE6DA4
Chrome Cache Entry: 120	ASCII text, with very long lines (32065)	2F6B11A7E914718E0290410E85366FE9	69BB69E25CA7D5EF0935317584E6153F3FD9A88C	05B85D96F41FFF14D8F608DAD03AB71E2C1017C2DA0914D7C59291BAD7A54F8E
Chrome Cache Entry: 121	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, progressive, precision 8, 1080x1071, components 3	1E4E8BF38A736DDBF3B37F725C2C6996	8665BB1F3713FA53ED4F049847781EE46CC02E39	EB1AFA33DE03F6734510282FBE8CF0C0DBAB3C91FCCBFA379C50681D419ADB65
Chrome Cache Entry: 122	PNG image data, 1500 x 600, 8-bit colormap, non-interlaced	0CB2E5165DC9324EB462199F04E1FFA9	9E0F89847EC8A98D98A6020BC5C4ED32B7A48BF8	67DFF0AAD873050F12609885F2264417CCDD0D438311000A704C89F0865F7865
Chrome Cache Entry: 123	HTML document, ASCII text, with very long lines (2422), with CRLF line terminators	EAFE0CAF379307BD90BDA46326CB5C80	22CB5AD9D04E631F5533BA97D9C0FEE46E90F356	249644356DC77B4C0782E922B0DBCFF4B5926F1658AEC7F99B2EE5C768726475
Chrome Cache Entry: 124	ASCII text	564CBD4C6AF7E77E180723C96DAB3D84	F07757EE7D13D2014A9C7578AA8FD39675611F17	4DFF69908F7EDDD77FDA9F742C34012F54D717B40F4DD7EB97AC733BF282D8CE
Chrome Cache Entry: 125	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 750x1000, components 3	A7F5C64C089D19BEFC6484A4FF4EBD73	71B8CE3F5F6F901D00AB6302C79BC19F72C4EA1E	57E3E5BF513AA7B1F5D493D537FD24CD8DB86F5D503B3797871647F1C1E220CC
Chrome Cache Entry: 126	HTML document, ASCII text, with very long lines (13937)	E6158FFEC5BA46A578AA6BD8909CD9C5	02B4E5EBBEED711E73D330EC502F1A5D48680519	5F5917F163BC4075CD3D2EBBBFB0C7658C0B9A448008F2F7143820DB7C033A2D
Chrome Cache Entry: 127	gzip compressed data, max speed, from Unix, truncated	A4745ABC5E7FDB89CC6DF3069F3C6E69	74789F7DDBEBD5B7323F6F8174005B4BF8C1F1ED	D1111B245F685176180E6F1631E6DC49BADF6672368E9CE260C71355165EFFDF
Chrome Cache Entry: 128	Web Open Font Format (Version 2), TrueType, length 15860, version 1.0	E9F5AAF547F165386CD313B995DDDD8E	ACDEF5603C2387B0E5BFFD744B679A24A8BC1968	F5AEBDFEA35D1E7656EF4ACC5DB1F243209755AE3300943EF8FC6280F363C860
Chrome Cache Entry: 129	ASCII text, with no line terminators	AC0B622721BCFCDC85CDEBB98AD03BF9	F1981B6DFF8AD407BBB760AC6CFD57AE7C921FA0	7B2A79E668B985367B96ED97F0B5544D66CFD8FC78DC1D09110AA62DC1586179
Chrome Cache Entry: 130	Web Open Font Format (Version 2), TrueType, length 102536, version 1.0	1ED478A6B265D4B4F5C26BB063203588	1CA5E8C7D2FB8E9D60AD1A1FEB2A46E98C248A3D	C874E14C63DB86C4C5318C77CB557FCE7036645EDC7D690DCC1D23B389631B13
Chrome Cache Entry: 131	SVG Scalable Vector Graphics image	D0C22C6A97023D85BA6E644A41C44A5D	4284EFB616C182DA4450C123174CE0E81A322845	118ADD53487C02AAF5B5AB9F69380FA06717DEB10492E14AAA487E3C62806AD4
Chrome Cache Entry: 132	ASCII text, with very long lines (35547)	0CB7A0EB328EA70AB360F861314C8820	E3E20EB50DAE36F4CBCEF1890B1CC7878ACB537A	4569845F7C550A55311814032E88541BD3B4A055EC3894E9CF58C4FFF1BE91D9
Chrome Cache Entry: 133	ASCII text	4E3C0364981FEF592C32B4E469B7A715	49A51C52BC78D231B6F0CC2705BE21FB2570DCEE	396BD1AB182A204C8C227C5D6AEF6CBE3A3481500E816635B408DA715695DFA1
Chrome Cache Entry: 134	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 750x1000, components 3	A7F5C64C089D19BEFC6484A4FF4EBD73	71B8CE3F5F6F901D00AB6302C79BC19F72C4EA1E	57E3E5BF513AA7B1F5D493D537FD24CD8DB86F5D503B3797871647F1C1E220CC
Chrome Cache Entry: 135	Unicode text, UTF-8 text, with CRLF line terminators	02E0B033F73DD394E70B548A13574494	AB8B43AD9D0A73D64D84663BD80EAAAADEA7B433	4FDFBEC206059AEC18176ED856E623788966DCB174276881BFC1597FE5C59FE2
Chrome Cache Entry: 136	gzip compressed data, max speed, from Unix, truncated	A4745ABC5E7FDB89CC6DF3069F3C6E69	74789F7DDBEBD5B7323F6F8174005B4BF8C1F1ED	D1111B245F685176180E6F1631E6DC49BADF6672368E9CE260C71355165EFFDF
Chrome Cache Entry: 137	SVG Scalable Vector Graphics image	8959DDCD9712196961D93F58064ED655	62AB1E38E7E9FBF58A04381B76C2D96A9C829F24	17C7A89BF169C2EE400E31B042CEA68513F06B9CD7D1E8990DBEC800F0D771C7
Chrome Cache Entry: 138	MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel	5791D664309E275F4569D2F993C44782	A68F363153614A09F10AE2892C134B9C4B001D4B	4FF54BC38C267DC3A8C95F6ED4590336BAAEC70433EF15D027DDCA608C391E78
Chrome Cache Entry: 139	gzip compressed data, max speed, from Unix, truncated	A4745ABC5E7FDB89CC6DF3069F3C6E69	74789F7DDBEBD5B7323F6F8174005B4BF8C1F1ED	D1111B245F685176180E6F1631E6DC49BADF6672368E9CE260C71355165EFFDF
Chrome Cache Entry: 140	gzip compressed data, max speed, from Unix, truncated	A4745ABC5E7FDB89CC6DF3069F3C6E69	74789F7DDBEBD5B7323F6F8174005B4BF8C1F1ED	D1111B245F685176180E6F1631E6DC49BADF6672368E9CE260C71355165EFFDF
Chrome Cache Entry: 141	Web Open Font Format (Version 2), TrueType, length 15744, version 1.0	15D9F621C3BD1599F0169DCF0BD5E63E	7CA9C5967F3BB8BFFEAB24B639B49C1E7D03FA52	F6734F8177112C0839B961F96D813FCB189D81B60E96C33278C1983B6F419615
Chrome Cache Entry: 142	ASCII text, with very long lines (42164)	C2656E265EF58A9CC9F4B70B15DA5FB9	85C5EBDB89D4574D72688C2650D4B84B9B09770A	F1D083FFAA644C708F11DB29707AA57C19246E6D32643B03FEE3F82C17B224B3
Chrome Cache Entry: 143	ASCII text, with very long lines (374), with no line terminators	589CE6F82F8DCAE1159E534B81AF90BF	E0C83B4C4E50313F76C99021181490E93726DC2B	A08DEF1D5FB217C19B8A74ECD0D88B42B0F73CE3524006008B4765F463F8F632
Chrome Cache Entry: 144	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel	C62F95EC3CA566BE8BE396BCA24C92A5	51A6FF0E1A233A612AC33283BBB3D39C8F5E7644	B91D02BA417BB7DEFD5B66E7B6D576EDD428DB676D389A417DFFAF7F01FC0956
Chrome Cache Entry: 145	Web Open Font Format (Version 2), TrueType, length 33092, version 1.0	057478083C1D55EA0C2182B24F6DD72F	CAF557CD276A76992084EFC4C8857B66791A6B7F	BB2F90081933C0F2475883CA2C5CFEE94E96D7314A09433FFFC42E37F4CFFD3B
Chrome Cache Entry: 146	ASCII text	D4FBF7B7BB4073DAC1D51576A127C342	BB5E4D4F4DF37F50475FAE0A977AA0C7B23A572D	401C9ECEFD580A307C3B24379B36A9F049EB6F16360C0E1CB0F7D56CB3849A31
Chrome Cache Entry: 147	SVG Scalable Vector Graphics image	8959DDCD9712196961D93F58064ED655	62AB1E38E7E9FBF58A04381B76C2D96A9C829F24	17C7A89BF169C2EE400E31B042CEA68513F06B9CD7D1E8990DBEC800F0D771C7
Chrome Cache Entry: 148	SVG Scalable Vector Graphics image	11B3089D616633CA6B73B57AA877EEB4	07632F63E06B30D9B63C97177D3A8122629BDA9B	809FB4619D2A2F1A85DBDA8CC69A7F1659215212D708A098D62150EEE57070C1
Chrome Cache Entry: 149	SVG Scalable Vector Graphics image	11B3089D616633CA6B73B57AA877EEB4	07632F63E06B30D9B63C97177D3A8122629BDA9B	809FB4619D2A2F1A85DBDA8CC69A7F1659215212D708A098D62150EEE57070C1
Chrome Cache Entry: 150	ASCII text	79877FB82DE8CA50845081E3C9A201C5	4F6EA69C0E03431FFA1A097A45453B5B3B246D8B	AF35CC6ABA34E5005DE77099DFA72D4C1A7715D28DDCEC343F48031DC8CB08BC
Chrome Cache Entry: 151	HTML document, ASCII text, with very long lines (524), with CRLF line terminators	95E7EB8871FA4A794E2349BFF84DFBE9	8BE7EB4DFA951CBF710ECC7C827821E9B1F67B3B	79A6DFCD7585EE2A72FA76B4809D8A3BFD286596B5DF16F3D88C1DAD7F8C0CB1
Chrome Cache Entry: 152	PNG image data, 1500 x 600, 8-bit colormap, non-interlaced	0CB2E5165DC9324EB462199F04E1FFA9	9E0F89847EC8A98D98A6020BC5C4ED32B7A48BF8	67DFF0AAD873050F12609885F2264417CCDD0D438311000A704C89F0865F7865
Chrome Cache Entry: 153	Unicode text, UTF-8 text, with very long lines (7658), with no line terminators	7152525F63649929A736F6EFB78B58A5	5BF8138B39EAEEBDF4681AD31FAC3A02075E36AD	F1F5518E39341D6F4189BE101A85C496ADD2A43B569A809BD3193D52F3E61DE1
Chrome Cache Entry: 154	ASCII text, with very long lines (2247)	3947C99F4A1FD3424E8D15C1F81F16DC	9A195FD17D772A3856C0C783729BCD393CE6DBDA	8521CCFFD34558C82E6E5A5DC66238FCB563A7A53581B2ADD5C9F797CD7F57FB
Chrome Cache Entry: 155	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, progressive, precision 8, 1080x1071, components 3	1E4E8BF38A736DDBF3B37F725C2C6996	8665BB1F3713FA53ED4F049847781EE46CC02E39	EB1AFA33DE03F6734510282FBE8CF0C0DBAB3C91FCCBFA379C50681D419ADB65
Chrome Cache Entry: 156	ASCII text, with CRLF line terminators	DB9088E34BFFA3E8929DAA01E88B3935	E41698E831763623C0ADA4A9B33A7C46E8F1AC6E	8A117FB03E90277EB97FD3E70A7581E977C69EADEE9016216EA790A2AA4EE5F4
Chrome Cache Entry: 157	ASCII text	A01E36ED97A0F4E064F9A2AA2B466148	E6A44EA80EEE8AB24C98B1EBA13CBC7FA9317C14	5C892A0A872B30B4DCAD6D5B308C44D1CEB335594B2E330A1EFB1C7B8742A8BC
Chrome Cache Entry: 158	ASCII text	E7DB06B55784B96BFEDF12B53B61CE68	2CE6F8894295E6F7E1F5EB6AF6DAFA62C331A662	156D6126D329168667F3FC9FD67A12202EAE1AC3619318E0FFF058FB74944C1D
Chrome Cache Entry: 159	MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel	5791D664309E275F4569D2F993C44782	A68F363153614A09F10AE2892C134B9C4B001D4B	4FF54BC38C267DC3A8C95F6ED4590336BAAEC70433EF15D027DDCA608C391E78
Chrome Cache Entry: 160	Java source, ASCII text	FA936DB003728604FF3BAC1DBB53E1C4	A9F2FAB7CA62B5AAFA101096F76FB13DB34209D2	FED18ACA19C5A40F85387AA0D06270E7C882D7C57AD95FC5F6F6EC72FC434430
Chrome Cache Entry: 161	ASCII text, with CRLF line terminators	D44C683C190640EC6ABFE970EF7C161E	0A5235022789CAE16A4D471B31C6308294E7C568	F30A1C07EF8E01DA22A72FEDDFCCB6B0007D5830F33E198812E5553DD6530A9F
Chrome Cache Entry: 162	C source, ASCII text, with very long lines (1971)	A288177A606A9686132970835B3E572C	D2DBA49BEFDC68E678B992F454D6E515E10B0A1C	7D1910801973390BD5CBDBE53EF4F788AB50CA5E7A4025415170494AB76FB960
Chrome Cache Entry: 163	gzip compressed data, max speed, from Unix, original size modulo 2^32 15557	5B77D6D80DEB6612B420D1DD0E595419	F538CAA409362697AFAE33780A6A8A58FE53C946	FAE67ECBCC07E623A9EAF4B4CA1787CC9C8546447E0399427BB121121F1C486A
Chrome Cache Entry: 164	ASCII text, with very long lines (2979), with no line terminators	2B89D34702716A8AD2CC3977718F53A3	04406EBD6A9E2CE79DBAC5E5048CFE1384E4574A	2031E418EE10AF8110729B3F327B968462FC0A9D8D1DA095387BB472CCD0DEE6

AV Detection

Antivirus / Scanner detection for submitted sample

Source: http://simxtrackredirecttszz.pages.dev/	Avira URL Cloud: detection malicious, Label: phishing
Source: http://simxtrackredirecttszz.pages.dev/	SlashNext: detection malicious, Label: Fraudulent Website type: Phishing & Social Engineering

Antivirus detection for URL or domain

Source: https://secretsafedomain.com/smclick?a=81528&c=342883&o=135901&oc=216576&co=112356&mt=16&svi=EwBjNDF	Avira URL Cloud: Label: malware
Source: https://secretsafedomain.com/s?a=81528&sm=235&s=8&sso=1&spt=1716504721184&co=112356&mt=16&rc=71_1969	Avira URL Cloud: Label: malware
Source: https://secretsafedomain.com/service-worker.js	Avira URL Cloud: Label: malware
Source: https://simxtrackredirecttszz.pages.dev/img/profile-1.jpg	Avira URL Cloud: Label: phishing
Source: https://secretsafedomain.com/s?a=81528&sm=235&s=8&sbp=1&spt=1716504721184&co=112356&mt=16&rc=71_1969	Avira URL Cloud: Label: malware
Source: https://simxtrackredirecttszz.pages.dev/style.css	Avira URL Cloud: Label: phishing

Phishing

AI detected suspicious javascript

Source: https://secretsafedomain.com/s?a=81528&sm=235&co=112356&mt=16&s1=EVOS_TAZZ&s2=576747	LLM: Score: 8 Reasons: The code contains an XMLHttpRequest that fetches and executes code from an external source using eval(). This is a high-risk operation as it can lead to the execution of malicious code. The use of eval() is generally considered dangerous and should be avoided. DOM: 2.4.pages.csv
Source: http://ww12.ngelit.com/?usid=18&utid=25970526717	LLM: Score: 7 Reasons: The code contains an attempt to redirect the top-level window to the current location, which is a common technique used in phishing attacks to prevent users from navigating away from the malicious page. Additionally, the code includes functionality to track user interactions and send data to a server, which could be used for malicious purposes beyond simple tracking or advertisement. DOM: 3.6.pages.csv

Source: http://ww12.ngelit.com/?usid=18&utid=25970526717	HTTP Parser: No favicon
Source: http://ww12.ngelit.com/?usid=18&utid=25970526717	HTTP Parser: No favicon
Source: https://www.adsensecustomsearchads.com/afs/ads?adtest=off&psid=7840396037&pcsa=false&channel=000002%2Cbucket011&client=dp-teaminternet09_3ph&r=m&hl=en&rpbu=http%3A%2F%2Fww12.ngelit.com%2F%3Fts%3DfENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQwMTF8fHx8fHw2NjRmYzg5YzYxZWZhfHx8MTcxNjUwNDczMi40NDMzfGY1MjczYTQ0ZmJkZTRlZDViZTNjMmNiMzczZGVjN2E2NmEwODRlYWZ8fHx8fDF8fDB8MHx8fHwxfHx8fHwwfDB8fHx8fHx8fHx8MHwwfHwwfHx8MHwwfFcxMD18fDF8VzEwPXxkZGExZTc1ZjBjNTczNTBkMmQ3ZjI4YzA5ZDllYzQ2OWM3MGRiMWIwfDB8ZHAtdGVhbWludGVybmV0MDlfM3BofDB8MHx8&max_radlink_len=40&type=3&uiopt=true&swp=as-drid-2733393318609526&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300003%2C17301431%2C17301433%2C17301436&client_gdprApplies=0&format=r3%7Cs&nocache=8561716504734778&num=0&output=afd_ads&domain_name=ww12.ngelit.com&v=3&bsl=8&pac=0&u_his=1&u_tz=-240&dt=1716504734780&u_w=1280&u_h=1024&biw=1280&bih=907&psw=1280&psh=754&frm=0&uio=--&cont=tc&drt=0&jsid=caf&nfp=1&jsv=635538657&rurl=http%3A%2F%2Fww12.ngelit.com%2F%3Fusid%3D18%26utid%3D25970526717	HTTP Parser: No favicon
Source: https://www.adsensecustomsearchads.com/afs/ads?adtest=off&psid=7840396037&pcsa=false&channel=000002%2Cbucket011&client=dp-teaminternet09_3ph&r=m&hl=en&rpbu=http%3A%2F%2Fww12.ngelit.com%2F%3Fts%3DfENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQwMTF8fHx8fHw2NjRmYzg5YzYxZWZhfHx8MTcxNjUwNDczMi40NDMzfGY1MjczYTQ0ZmJkZTRlZDViZTNjMmNiMzczZGVjN2E2NmEwODRlYWZ8fHx8fDF8fDB8MHx8fHwxfHx8fHwwfDB8fHx8fHx8fHx8MHwwfHwwfHx8MHwwfFcxMD18fDF8VzEwPXxkZGExZTc1ZjBjNTczNTBkMmQ3ZjI4YzA5ZDllYzQ2OWM3MGRiMWIwfDB8ZHAtdGVhbWludGVybmV0MDlfM3BofDB8MHx8&max_radlink_len=40&type=3&uiopt=true&swp=as-drid-2733393318609526&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300003%2C17301431%2C17301433%2C17301436&client_gdprApplies=0&format=r3%7Cs&nocache=8561716504734778&num=0&output=afd_ads&domain_name=ww12.ngelit.com&v=3&bsl=8&pac=0&u_his=1&u_tz=-240&dt=1716504734780&u_w=1280&u_h=1024&biw=1280&bih=907&psw=1280&psh=754&frm=0&uio=--&cont=tc&drt=0&jsid=caf&nfp=1&jsv=635538657&rurl=http%3A%2F%2Fww12.ngelit.com%2F%3Fusid%3D18%26utid%3D25970526717	HTTP Parser: No favicon
Source: https://www.adsensecustomsearchads.com/afs/ads?adtest=off&psid=7840396037&pcsa=false&channel=000002%2Cbucket011&client=dp-teaminternet09_3ph&r=m&hl=en&rpbu=http%3A%2F%2Fww12.ngelit.com%2F%3Fts%3DfENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQwMTF8fHx8fHw2NjRmYzg5YzYxZWZhfHx8MTcxNjUwNDczMi40NDMzfGY1MjczYTQ0ZmJkZTRlZDViZTNjMmNiMzczZGVjN2E2NmEwODRlYWZ8fHx8fDF8fDB8MHx8fHwxfHx8fHwwfDB8fHx8fHx8fHx8MHwwfHwwfHx8MHwwfFcxMD18fDF8VzEwPXxkZGExZTc1ZjBjNTczNTBkMmQ3ZjI4YzA5ZDllYzQ2OWM3MGRiMWIwfDB8ZHAtdGVhbWludGVybmV0MDlfM3BofDB8MHx8&max_radlink_len=40&type=3&uiopt=true&swp=as-drid-2733393318609526&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300003%2C17301431%2C17301433%2C17301436&client_gdprApplies=0&format=r3%7Cs&nocache=8561716504734778&num=0&output=afd_ads&domain_name=ww12.ngelit.com&v=3&bsl=8&pac=0&u_his=1&u_tz=-240&dt=1716504734780&u_w=1280&u_h=1024&biw=1280&bih=907&psw=1280&psh=754&frm=0&uio=--&cont=tc&drt=0&jsid=caf&nfp=1&jsv=635538657&rurl=http%3A%2F%2Fww12.ngelit.com%2F%3Fusid%3D18%26utid%3D25970526717	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 23.211.8.90:443 -> 192.168.2.5:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.211.8.90:443 -> 192.168.2.5:49728 version: TLS 1.2

Detected non-DNS traffic on DNS port

Source: global traffic

TCP traffic: 192.168.2.5:49755 -> 1.1.1.1:53

Detected suspicious crossdomain redirect

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

HTTP traffic: Redirect from: simxtrack.com to https://secretsafedomain.com/s?a=81528&sm=235&co=112356&mt=16&s1=evos_tazz&s2=576747

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: simxtrackredirecttszz.pages.devConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /style.css HTTP/1.1Host: simxtrackredirecttszz.pages.devConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://simxtrackredirecttszz.pages.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /css/bootstrap.min.css?3 HTTP/1.1Host: telegram.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://simxtrackredirecttszz.pages.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /css/telegram.css?227 HTTP/1.1Host: telegram.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://simxtrackredirecttszz.pages.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/tgwallpaper.min.js?3 HTTP/1.1Host: telegram.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://simxtrackredirecttszz.pages.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/profile-1.jpg HTTP/1.1Host: simxtrackredirecttszz.pages.devConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://simxtrackredirecttszz.pages.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/tgme/pattern.svg?1 HTTP/1.1Host: telegram.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://telegram.org/css/telegram.css?227Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/profile-1.jpg HTTP/1.1Host: simxtrackredirecttszz.pages.devConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/favicon.ico HTTP/1.1Host: telegram.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://simxtrackredirecttszz.pages.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/tgme/pattern.svg?1 HTTP/1.1Host: telegram.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /img/favicon.ico HTTP/1.1Host: telegram.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /link-1 HTTP/1.1Host: simxtrackredirecttszz.pages.devConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /style.css HTTP/1.1Host: simxtrackredirecttszz.pages.devConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://simxtrackredirecttszz.pages.dev/link-1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "90f6d7cd3044dadc6d9b9f251b985245"
Source: global traffic	HTTP traffic detected: GET /img/profile-1.jpg HTTP/1.1Host: simxtrackredirecttszz.pages.devConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://simxtrackredirecttszz.pages.dev/link-1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "398570c34aafa08182d3cd0963670b22"
Source: global traffic	HTTP traffic detected: GET /img/profile-1.jpg HTTP/1.1Host: simxtrackredirecttszz.pages.devConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "398570c34aafa08182d3cd0963670b22"
Source: global traffic	HTTP traffic detected: GET /tracking202/redirect/rtr.php?t202id=5236&c1=EVOS_TAZZ&t202kw=EVOS_TAZZ HTTP/1.1Host: simxtrack.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s?a=81528&sm=235&co=112356&mt=16&s1=EVOS_TAZZ&s2=576747 HTTP/1.1Host: secretsafedomain.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /user-segments/?pid=TH HTTP/1.1Host: statisticresearch.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://secretsafedomain.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /color?x=1&forScheme=aHR0cHM6Ly9zZWNyZXRzYWZlZG9tYWluLmNvbS9zP2E9ODE1Mjgmc209MjM1JmNvPTExMjM1NiZtdD0xNiZzMT1FVk9TX1RBWlomczI9NTc2NzQ3 HTTP/1.1Host: cloudflrcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://secretsafedomain.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://secretsafedomain.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/v1/retargeting/set/3f949dfe-3372-4caa-baf0-047f88323cfa?pageviewe={pageviewe}&lead={lead} HTTP/1.1Host: tsyndicate.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://secretsafedomain.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /service-worker.js HTTP/1.1Host: secretsafedomain.comConnection: keep-aliveCache-Control: max-age=0Accept: /Service-Worker: scriptSec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: serviceworkerReferer: https://secretsafedomain.com/s?a=81528&sm=235&co=112356&mt=16&s1=EVOS_TAZZ&s2=576747User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: v_rule_freq_v2_1_001=gdXLFugAbf4IueEdLRjw0thA7hUlhtzwKDvv5kumE971xuqr9DMZSKeN5JMVNn+i; gdm_uid_v2_1_001=U/r8lLUPAWcxDaviLTpwFaKcPwxoewHxyP3PvdEcoZBqGwiXr2tBu5efBif1Hpu0; v_rule_freq_v1_1_001=gdXLFugAbf4IueEdLRjw0thA7hUlhtzwKDvv5kumE971xuqr9DMZSKeN5JMVNn+i; v_seg_freq_v1_1_001=w+sV2Dl79C1RO54AAC2G/oufeiLDs7TJHVltH+BRr3s=; gdm_visit_freq_v2_1_001=oXa+SKDZFOD0jqa0rxAdlM/pSb3k2TlE1cALdU3RA5w=; v_seg_freq_v2_1_001=w+sV2Dl79C1RO54AAC2G/oufeiLDs7TJHVltH+BRr3s=; gdm_visit_freq_v1_1_001=oXa+SKDZFOD0jqa0rxAdlM/pSb3k2TlE1cALdU3RA5w=; gdm_suid_v2_1_001=HPfHs3OFxkaNOwO68jCjbQ==; gdm_uid_v1_1_001=U/r8lLUPAWcxDaviLTpwFaKcPwxoewHxyP3PvdEcoZBqGwiXr2tBu5efBif1Hpu0; gdm_suid_v1_1_001=HPfHs3OFxkaNOwO68jCjbQ==
Source: global traffic	HTTP traffic detected: GET /js/mp.min.js HTTP/1.1Host: static.trafficjunky.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://secretsafedomain.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/v1/retargeting/set/3f949dfe-3372-4caa-baf0-047f88323cfa?pageviewe={pageviewe}&lead={lead} HTTP/1.1Host: tsyndicate.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ts_rt_3f949dfe-3372-4caa-baf0-047f88323cfa=ANmUCUOmR4kbQgQSPEjEBJwwZ8rYSVPmThmDCB9GnFixDMOA
Source: global traffic	HTTP traffic detected: GET /j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-179148962-2&cid=343168255.1716504726&jid=1258097187&gjid=971496842&_gid=1698602312.1716504726&_u=YEBAAEAAAAAAACAAI~&z=1890898182 HTTP/1.1Host: stats.g.doubleclick.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /adsense/domains/caf.js?abp=1&adsdeli=true HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: http://ww12.ngelit.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /afs/ads?adtest=off&psid=7840396037&pcsa=false&channel=000002%2Cbucket011&client=dp-teaminternet09_3ph&r=m&hl=en&rpbu=http%3A%2F%2Fww12.ngelit.com%2F%3Fts%3DfENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQwMTF8fHx8fHw2NjRmYzg5YzYxZWZhfHx8MTcxNjUwNDczMi40NDMzfGY1MjczYTQ0ZmJkZTRlZDViZTNjMmNiMzczZGVjN2E2NmEwODRlYWZ8fHx8fDF8fDB8MHx8fHwxfHx8fHwwfDB8fHx8fHx8fHx8MHwwfHwwfHx8MHwwfFcxMD18fDF8VzEwPXxkZGExZTc1ZjBjNTczNTBkMmQ3ZjI4YzA5ZDllYzQ2OWM3MGRiMWIwfDB8ZHAtdGVhbWludGVybmV0MDlfM3BofDB8MHx8&max_radlink_len=40&type=3&uiopt=true&swp=as-drid-2733393318609526&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300003%2C17301431%2C17301433%2C17301436&client_gdprApplies=0&format=r3%7Cs&nocache=8561716504734778&num=0&output=afd_ads&domain_name=ww12.ngelit.com&v=3&bsl=8&pac=0&u_his=1&u_tz=-240&dt=1716504734780&u_w=1280&u_h=1024&biw=1280&bih=907&psw=1280&psh=754&frm=0&uio=--&cont=tc&drt=0&jsid=caf&nfp=1&jsv=635538657&rurl=http%3A%2F%2Fww12.ngelit.com%2F%3Fusid%3D18%26utid%3D25970526717 HTTP/1.1Host: www.adsensecustomsearchads.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: http://ww12.ngelit.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /adsense/domains/caf.js?pac=0 HTTP/1.1Host: www.adsensecustomsearchads.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.adsensecustomsearchads.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ad_icons/standard/publisher_icon_image/chevron.svg?c=%23ffffff HTTP/1.1Host: afs.googleusercontent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.adsensecustomsearchads.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ad_icons/standard/publisher_icon_image/search.svg?c=%23ffffff HTTP/1.1Host: afs.googleusercontent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.adsensecustomsearchads.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /afs/gen_204?client=dp-teaminternet09_3ph&output=uds_ads_only&zx=35mgsdqnx1tq&aqid=oMhPZvCxD6uijuwPiPui6Qk&psid=7840396037&pbt=bs&adbx=375&adby=93&adbh=496&adbw=530&adbah=160%2C160%2C160&adbn=master-1&eawp=partner-dp-teaminternet09_3ph&errv=635538657&csala=7%7C0%7C1139%7C1372%7C276&lle=0&ifv=1&hpt=1&wbd=false HTTP/1.1Host: www.adsensecustomsearchads.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: http://ww12.ngelit.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /afs/gen_204?client=dp-teaminternet09_3ph&output=uds_ads_only&zx=vhf3wk3421c2&aqid=oMhPZvCxD6uijuwPiPui6Qk&psid=7840396037&pbt=bv&adbx=375&adby=93&adbh=496&adbw=530&adbah=160%2C160%2C160&adbn=master-1&eawp=partner-dp-teaminternet09_3ph&errv=635538657&csala=7%7C0%7C1139%7C1372%7C276&lle=0&ifv=1&hpt=1&wbd=false HTTP/1.1Host: www.adsensecustomsearchads.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: http://ww12.ngelit.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ad_icons/standard/publisher_icon_image/chevron.svg?c=%23ffffff HTTP/1.1Host: afs.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ad_icons/standard/publisher_icon_image/search.svg?c=%23ffffff HTTP/1.1Host: afs.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: fauzi3.ngelit.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?usid=18&utid=25970526717 HTTP/1.1Host: ww12.ngelit.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /page/enhance.js?pcId=12&domain=ngelit.com HTTP/1.1Host: parking.parklogic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://ww12.ngelit.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /track.php?domain=ngelit.com&toggle=browserjs&uid=MTcxNjUwNDczMi40MDEzOmJhMzRiY2Q0YTY5Y2I1ODg1Yzg4ZTJiZDg0NmRlYTc5YTUzZWMxMGEwMmY0MmU2ZjEzNGJiMTgyZTgzYzY5Zjk6NjY0ZmM4OWM2MWY5Mw%3D%3D HTTP/1.1Host: ww12.ngelit.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://ww12.ngelit.com/?usid=18&utid=25970526717Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /page/scribe.php?pcId=12&domain=ngelit.com&pId=449&usid=18&utid=25970526717&query=null&domainJs=ww12.ngelit.com&path=/&ss=true&lp=1 HTTP/1.1Host: parking.parklogic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Origin: http://ww12.ngelit.comReferer: http://ww12.ngelit.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ls.php?t=664fc89c&token=dda1e75f0c57350d2d7f28c09d9ec469c70db1b0 HTTP/1.1Host: ww12.ngelit.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://ww12.ngelit.com/?usid=18&utid=25970526717Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /themes/cleanPeppermintBlack_657d9013/img/arrows.png HTTP/1.1Host: d38psrni17bvxu.cloudfront.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://ww12.ngelit.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /track.php?domain=ngelit.com&toggle=browserjs&uid=MTcxNjUwNDczMi40MDEzOmJhMzRiY2Q0YTY5Y2I1ODg1Yzg4ZTJiZDg0NmRlYTc5YTUzZWMxMGEwMmY0MmU2ZjEzNGJiMTgyZTgzYzY5Zjk6NjY0ZmM4OWM2MWY5Mw%3D%3D HTTP/1.1Host: ww12.ngelit.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /page/scribe.php?pcId=12&domain=ngelit.com&pId=449&usid=18&utid=25970526717&query=null&domainJs=ww12.ngelit.com&path=/&ss=true&lp=1 HTTP/1.1Host: parking.parklogic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /themes/cleanPeppermintBlack_657d9013/img/arrows.png HTTP/1.1Host: d38psrni17bvxu.cloudfront.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /track.php?domain=ngelit.com&caf=1&toggle=answercheck&answer=yes&uid=MTcxNjUwNDczMi40MDEzOmJhMzRiY2Q0YTY5Y2I1ODg1Yzg4ZTJiZDg0NmRlYTc5YTUzZWMxMGEwMmY0MmU2ZjEzNGJiMTgyZTgzYzY5Zjk6NjY0ZmM4OWM2MWY5Mw%3D%3D HTTP/1.1Host: ww12.ngelit.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://ww12.ngelit.com/?usid=18&utid=25970526717Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: __gsas=ID=92b55ae556c71643:T=1716504736:RT=1716504736:S=ALNI_MbC761s07K7Y91R73mkAvtsJB0EBA
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: ww12.ngelit.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://ww12.ngelit.com/?usid=18&utid=25970526717Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: __gsas=ID=92b55ae556c71643:T=1716504736:RT=1716504736:S=ALNI_MbC761s07K7Y91R73mkAvtsJB0EBA
Source: global traffic	HTTP traffic detected: GET /track.php?domain=ngelit.com&caf=1&toggle=answercheck&answer=yes&uid=MTcxNjUwNDczMi40MDEzOmJhMzRiY2Q0YTY5Y2I1ODg1Yzg4ZTJiZDg0NmRlYTc5YTUzZWMxMGEwMmY0MmU2ZjEzNGJiMTgyZTgzYzY5Zjk6NjY0ZmM4OWM2MWY5Mw%3D%3D HTTP/1.1Host: ww12.ngelit.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: __gsas=ID=92b55ae556c71643:T=1716504736:RT=1716504736:S=ALNI_MbC761s07K7Y91R73mkAvtsJB0EBA
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: ww12.ngelit.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: __gsas=ID=92b55ae556c71643:T=1716504736:RT=1716504736:S=ALNI_MbC761s07K7Y91R73mkAvtsJB0EBA

Source: chromecache_117.2.dr	String found in binary or memory: Math.round(p);u["gtm.videoCurrentTime"]=Math.round(q);u["gtm.videoElapsedTime"]=Math.round(f);u["gtm.videoPercent"]=r;u["gtm.videoVisible"]=t;return u},bk:function(){e=Db()},pd:function(){d()}}};var ic=ma(["data-gtm-yt-inspected-"]),GC=["www.youtube.com","www.youtube-nocookie.com"],HC,IC=!1; equals www.youtube.com (Youtube)
Source: chromecache_117.2.dr	String found in binary or memory: e\|\|f\|\|g.length\|\|h.length))return;var n={Wg:d,Ug:e,Vg:f,Lh:g,Mh:h,xe:m,Ab:b},p=G.YT,q=function(){OC(n)};if(p)return p.ready&&p.ready(q),b;var r=G.onYouTubeIframeAPIReady;G.onYouTubeIframeAPIReady=function(){r&&r();q()};I(function(){for(var t=H.getElementsByTagName("script"),v=t.length,u=0;u<v;u++){var w=t[u].getAttribute("src");if(RC(w,"iframe_api")\|\|RC(w,"player_api"))return b}for(var y=H.getElementsByTagName("iframe"),x=y.length,B=0;B<x;B++)if(!IC&&PC(y[B],n.xe))return yc("https://www.youtube.com/iframe_api"), equals www.youtube.com (Youtube)
Source: chromecache_114.2.dr, chromecache_119.2.dr	String found in binary or memory: return b}EC.K="internal.enableAutoEventOnTimer";var ic=ma(["data-gtm-yt-inspected-"]),GC=["www.youtube.com","www.youtube-nocookie.com"],HC,IC=!1; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: simxtrackredirecttszz.pages.dev
Source: global traffic	DNS traffic detected: DNS query: cdn.jsdelivr.net
Source: global traffic	DNS traffic detected: DNS query: telegram.org
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: simxtrack.com
Source: global traffic	DNS traffic detected: DNS query: secretsafedomain.com
Source: global traffic	DNS traffic detected: DNS query: cdn.jmp-assets.com
Source: global traffic	DNS traffic detected: DNS query: statisticresearch.com
Source: global traffic	DNS traffic detected: DNS query: cdn.smrt-content.com
Source: global traffic	DNS traffic detected: DNS query: cloudflrcdn.com
Source: global traffic	DNS traffic detected: DNS query: static.trafficjunky.com
Source: global traffic	DNS traffic detected: DNS query: tsyndicate.com
Source: global traffic	DNS traffic detected: DNS query: cdn.jmpcdn.com
Source: global traffic	DNS traffic detected: DNS query: stats.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: fauzi3.ngelit.com
Source: global traffic	DNS traffic detected: DNS query: ww12.ngelit.com
Source: global traffic	DNS traffic detected: DNS query: parking.parklogic.com
Source: global traffic	DNS traffic detected: DNS query: d38psrni17bvxu.cloudfront.net
Source: global traffic	DNS traffic detected: DNS query: www.adsensecustomsearchads.com
Source: global traffic	DNS traffic detected: DNS query: afs.googleusercontent.com

Source: unknown

Source: chromecache_123.2.dr, chromecache_110.2.dr	String found in binary or memory: http://fauzi3.ngelit.com
Source: chromecache_142.2.dr	String found in binary or memory: http://getbootstrap.com)
Source: chromecache_142.2.dr	String found in binary or memory: http://getbootstrap.com/customize/?id=92d2ac1b31978642b6b6)
Source: chromecache_124.2.dr	String found in binary or memory: http://parking.parklogic.com/page/scribe.php?pcId=12&domain=ngelit.com&pId=449&usid=$
Source: chromecache_117.2.dr	String found in binary or memory: https://adservice.google.com/pagead/regclk
Source: chromecache_117.2.dr	String found in binary or memory: https://adservice.googlesyndication.com/pagead/regclk
Source: chromecache_112.2.dr	String found in binary or memory: https://ampcid.google.com/v1/publisher:getClientId
Source: chromecache_114.2.dr, chromecache_117.2.dr, chromecache_119.2.dr	String found in binary or memory: https://cct.google/taggy/agent.js
Source: chromecache_151.2.dr	String found in binary or memory: https://cdn.jmp-assets.com/assets/1373/other/favicon.ico
Source: chromecache_151.2.dr	String found in binary or memory: https://cdn.jmp-assets.com/assets/1387/js/backoffer.js
Source: chromecache_151.2.dr	String found in binary or memory: https://cdn.jmp-assets.com/assets/1714/js/jquery.min.js
Source: chromecache_151.2.dr	String found in binary or memory: https://cdn.jmp-assets.com/assets/2246/css/age-styles-new.css
Source: chromecache_151.2.dr	String found in binary or memory: https://cdn.jmp-assets.com/assets/2843/css/main.css
Source: chromecache_151.2.dr	String found in binary or memory: https://cdn.jmp-assets.com/devassets/3198/js/multilang_main_gender.js
Source: chromecache_151.2.dr	String found in binary or memory: https://cdn.jmp-assets.com/prod/push-lang-config.js
Source: chromecache_151.2.dr	String found in binary or memory: https://cdn.jmp-assets.com/prod/push-subscriber.js
Source: chromecache_151.2.dr	String found in binary or memory: https://cdn.jmpcdn.com/assets/3420/images/1.ico
Source: chromecache_151.2.dr	String found in binary or memory: https://cdn.jmpcdn.com/assets/3420/images/2.ico
Source: chromecache_151.2.dr	String found in binary or memory: https://cdn.jmpcdn.com/assets/3420/images/3.ico
Source: chromecache_151.2.dr	String found in binary or memory: https://cdn.jmpcdn.com/assets/3420/images/4.ico
Source: chromecache_151.2.dr	String found in binary or memory: https://cdn.jmpcdn.com/assets/3420/images/5.ico
Source: chromecache_151.2.dr	String found in binary or memory: https://cdn.jmpcdn.com/assets/3420/images/6.ico
Source: chromecache_123.2.dr, chromecache_110.2.dr	String found in binary or memory: https://cdn.jsdelivr.net/npm/bootstrap-icons
Source: chromecache_116.2.dr	String found in binary or memory: https://cdn.smrt-content.com/prod
Source: chromecache_151.2.dr	String found in binary or memory: https://cloudflrcdn.com/color?x=1&forScheme=
Source: chromecache_154.2.dr, chromecache_106.2.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=
Source: chromecache_156.2.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Montserrat:400
Source: chromecache_123.2.dr, chromecache_110.2.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Roboto:400
Source: chromecache_158.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459W1hyzbi.woff2)
Source: chromecache_158.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459WRhyzbi.woff2)
Source: chromecache_158.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459WZhyzbi.woff2)
Source: chromecache_158.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459Wdhyzbi.woff2)
Source: chromecache_158.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2)
Source: chromecache_133.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfABc4EsA.woff2)
Source: chromecache_133.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2)
Source: chromecache_133.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBxc4EsA.woff2)
Source: chromecache_133.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfCBc4EsA.woff2)
Source: chromecache_133.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfCRc4EsA.woff2)
Source: chromecache_133.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfChc4EsA.woff2)
Source: chromecache_133.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfCxc4EsA.woff2)
Source: chromecache_133.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4WxKOzY.woff2)
Source: chromecache_133.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2)
Source: chromecache_133.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu5mxKOzY.woff2)
Source: chromecache_133.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu72xKOzY.woff2)
Source: chromecache_133.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu7GxKOzY.woff2)
Source: chromecache_133.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu7WxKOzY.woff2)
Source: chromecache_133.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu7mxKOzY.woff2)
Source: chromecache_142.2.dr	String found in binary or memory: https://gist.github.com/92d2ac1b31978642b6b6
Source: chromecache_142.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: chromecache_111.2.dr	String found in binary or memory: https://osx.telegram.org/updates/site/artboard.png)
Source: chromecache_111.2.dr	String found in binary or memory: https://osx.telegram.org/updates/site/artboard_2x.png);
Source: chromecache_117.2.dr, chromecache_119.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com
Source: chromecache_154.2.dr, chromecache_114.2.dr, chromecache_117.2.dr, chromecache_119.2.dr, chromecache_106.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=tcfe
Source: chromecache_154.2.dr, chromecache_106.2.dr	String found in binary or memory: https://partner.googleadservices.com/gampad/cookie.js
Source: chromecache_151.2.dr	String found in binary or memory: https://secretsafedomain.com/s?a=81528&sm=235&s=8&sbp=1&spt=1716504721184&co=112356&mt=16&rc=71_1969
Source: chromecache_151.2.dr	String found in binary or memory: https://secretsafedomain.com/s?a=81528&sm=235&s=8&sso=1&spt=1716504721184&co=112356&mt=16&rc=71_1969
Source: chromecache_151.2.dr	String found in binary or memory: https://secretsafedomain.com/smclick?a=81528&c=342883&o=135901&oc=216576&co=112356&mt=16&svi=EwBjNDF
Source: chromecache_110.2.dr	String found in binary or memory: https://simxtrack.com/tracking202/redirect/rtr.php?t202id=5236&c1=EVOS_TAZZ&t202kw=EVOS_TAZZ
Source: chromecache_116.2.dr	String found in binary or memory: https://statisticresearch.com/match?p=PS&adxguid=
Source: chromecache_151.2.dr	String found in binary or memory: https://statisticresearch.com/user-segments/?pid=TH
Source: chromecache_117.2.dr	String found in binary or memory: https://stats.g.doubleclick.net/g/collect
Source: chromecache_112.2.dr	String found in binary or memory: https://stats.g.doubleclick.net/j/collect
Source: chromecache_154.2.dr, chromecache_106.2.dr	String found in binary or memory: https://syndicatedsearch.goog
Source: chromecache_112.2.dr	String found in binary or memory: https://tagassistant.google.com/
Source: chromecache_114.2.dr, chromecache_117.2.dr, chromecache_119.2.dr	String found in binary or memory: https://td.doubleclick.net
Source: chromecache_123.2.dr, chromecache_110.2.dr	String found in binary or memory: https://telegram.org/css/bootstrap.min.css?3
Source: chromecache_123.2.dr, chromecache_110.2.dr	String found in binary or memory: https://telegram.org/css/telegram.css?227
Source: chromecache_123.2.dr, chromecache_110.2.dr	String found in binary or memory: https://telegram.org/img/apple-touch-icon.png
Source: chromecache_123.2.dr, chromecache_110.2.dr	String found in binary or memory: https://telegram.org/img/favicon-16x16.png
Source: chromecache_123.2.dr, chromecache_110.2.dr	String found in binary or memory: https://telegram.org/img/favicon-32x32.png
Source: chromecache_123.2.dr, chromecache_110.2.dr	String found in binary or memory: https://telegram.org/img/favicon.ico
Source: chromecache_123.2.dr, chromecache_110.2.dr	String found in binary or memory: https://telegram.org/img/website_icon.svg?4
Source: chromecache_123.2.dr, chromecache_110.2.dr	String found in binary or memory: https://telegram.org/js/tgwallpaper.min.js?3
Source: chromecache_116.2.dr, chromecache_160.2.dr	String found in binary or memory: https://theseoffersforyou.com
Source: chromecache_114.2.dr	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: chromecache_112.2.dr	String found in binary or memory: https://www.google-analytics.com/debug/bootstrap?id=
Source: chromecache_112.2.dr	String found in binary or memory: https://www.google-analytics.com/gtm/js?id=
Source: chromecache_112.2.dr	String found in binary or memory: https://www.google.%/ads/ga-audiences
Source: chromecache_117.2.dr, chromecache_119.2.dr	String found in binary or memory: https://www.google.com
Source: chromecache_112.2.dr	String found in binary or memory: https://www.google.com/ads/ga-audiences
Source: chromecache_114.2.dr, chromecache_117.2.dr, chromecache_119.2.dr	String found in binary or memory: https://www.googleadservices.com
Source: chromecache_154.2.dr, chromecache_106.2.dr	String found in binary or memory: https://www.googleadservices.com/pagead/conversion/16521530460/?gad_source=1&adview_type=3
Source: chromecache_114.2.dr, chromecache_117.2.dr, chromecache_119.2.dr	String found in binary or memory: https://www.googletagmanager.com
Source: chromecache_112.2.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=
Source: chromecache_151.2.dr	String found in binary or memory: https://www.googletagmanager.com/gtm.js?id=
Source: chromecache_151.2.dr	String found in binary or memory: https://www.googletagmanager.com/ns.html?id=GTM-TR8VQRX
Source: chromecache_151.2.dr, chromecache_160.2.dr	String found in binary or memory: https://www.gstatic.com/firebasejs/5.0.2/firebase-app.js
Source: chromecache_151.2.dr, chromecache_160.2.dr	String found in binary or memory: https://www.gstatic.com/firebasejs/5.0.2/firebase-messaging.js
Source: chromecache_117.2.dr	String found in binary or memory: https://www.merchant-center-analytics.goog
Source: chromecache_117.2.dr	String found in binary or memory: https://www.youtube.com/iframe_api

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 23.211.8.90:443 -> 192.168.2.5:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.211.8.90:443 -> 192.168.2.5:49728 version: TLS 1.2

Source: classification engine

Classification label: mal60.phis.win@23/115@66/26

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=2028,i,8292762305425428644,7564485751747783064,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://simxtrackredirecttszz.pages.dev/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=2028,i,8292762305425428644,7564485751747783064,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

ID:	1446908
Product:	CloudBasic
Start time:	00:50:34
Start date:	24.05.2024
Cookbook:	browseurl.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Windows Analysis Report
http://simxtrackredirecttszz.pages.dev/

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report http://simxtrackredirecttszz.pages.dev/

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
http://simxtrackredirecttszz.pages.dev/