Edit tour

Windows Analysis Report
http://gateway.facebook.com

Overview

General Information

Sample URL:http://gateway.facebook.com
Analysis ID:1484216
Infos:
Errors
  • URL not reachable

Detection

Score:0
Range:0 - 100
Whitelisted:false
Confidence:60%

Signatures

No high impact signatures.

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
  • System is w10x64
  • chrome.exe (PID: 5700 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • chrome.exe (PID: 1700 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 --field-trial-handle=2252,i,18010828196976095766,8005583791433805203,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • chrome.exe (PID: 6328 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://gateway.facebook.com" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • cleanup
No configs have been found
No yara matches
No Sigma rule has matched
No Snort rule has matched
Timestamp:2024-07-29T19:23:34.543788+0200
SID:2022930
Source Port:443
Destination Port:49742
Protocol:TCP
Classtype:A Network Trojan was detected

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: gateway.facebook.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: gateway.facebook.comConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global trafficDNS traffic detected: DNS query: gateway.facebook.com
Source: global trafficDNS traffic detected: DNS query: www.google.com
Source: unknownNetwork traffic detected: HTTP traffic on port 49675 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49739
Source: unknownNetwork traffic detected: HTTP traffic on port 49739 -> 443
Source: classification engineClassification label: unknown0.win@18/0@4/4
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 --field-trial-handle=2252,i,18010828196976095766,8005583791433805203,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://gateway.facebook.com"
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 --field-trial-handle=2252,i,18010828196976095766,8005583791433805203,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath Interception1
Process Injection
1
Process Injection
OS Credential DumpingSystem Service DiscoveryRemote ServicesData from Local System2
Encrypted Channel
Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media2
Non-Application Layer Protocol
Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive3
Application Layer Protocol
Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture1
Ingress Tool Transfer
Traffic DuplicationData Destruction
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1484216 URL: http://gateway.facebook.com Startdate: 29/07/2024 Architecture: WINDOWS Score: 0 5 chrome.exe 2->5         started        8 chrome.exe 2->8         started        dnsIp3 13 192.168.2.4, 138, 443, 49242 unknown unknown 5->13 15 239.255.255.250 unknown Reserved 5->15 10 chrome.exe 5->10         started        process4 dnsIp5 17 www.google.com 142.250.184.196, 443, 49739 GOOGLEUS United States 10->17 19 dgw.c10r.facebook.com 157.240.252.17, 49735, 49736, 49748 FACEBOOKUS United States 10->19 21 gateway.facebook.com 10->21

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand
SourceDetectionScannerLabelLink
http://gateway.facebook.com0%Avira URL Cloudsafe
No Antivirus matches
No Antivirus matches
No Antivirus matches
SourceDetectionScannerLabelLink
http://gateway.facebook.com/0%Avira URL Cloudsafe

Download Network PCAP: filteredfull

NameIPActiveMaliciousAntivirus DetectionReputation
bg.microsoft.map.fastly.net
199.232.214.172
truefalse
    unknown
    www.google.com
    142.250.184.196
    truefalse
      unknown
      dgw.c10r.facebook.com
      157.240.252.17
      truefalse
        unknown
        fp2e7a.wpc.phicdn.net
        192.229.221.95
        truefalse
          unknown
          gateway.facebook.com
          unknown
          unknownfalse
            unknown
            NameMaliciousAntivirus DetectionReputation
            http://gateway.facebook.com/false
            • Avira URL Cloud: safe
            unknown
            • No. of IPs < 25%
            • 25% < No. of IPs < 50%
            • 50% < No. of IPs < 75%
            • 75% < No. of IPs
            IPDomainCountryFlagASNASN NameMalicious
            157.240.252.17
            dgw.c10r.facebook.comUnited States
            32934FACEBOOKUSfalse
            142.250.184.196
            www.google.comUnited States
            15169GOOGLEUSfalse
            239.255.255.250
            unknownReserved
            unknownunknownfalse
            IP
            192.168.2.4
            Joe Sandbox version:40.0.0 Tourmaline
            Analysis ID:1484216
            Start date and time:2024-07-29 19:22:26 +02:00
            Joe Sandbox product:CloudBasic
            Overall analysis duration:0h 2m 9s
            Hypervisor based Inspection enabled:false
            Report type:full
            Cookbook file name:browseurl.jbs
            Sample URL:http://gateway.facebook.com
            Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
            Number of analysed new started processes analysed:7
            Number of new started drivers analysed:0
            Number of existing processes analysed:0
            Number of existing drivers analysed:0
            Number of injected processes analysed:0
            Technologies:
            • HCA enabled
            • EGA enabled
            • AMSI enabled
            Analysis Mode:default
            Analysis stop reason:Timeout
            Detection:UNKNOWN
            Classification:unknown0.win@18/0@4/4
            EGA Information:Failed
            HCA Information:
            • Successful, ratio: 100%
            • Number of executed functions: 0
            • Number of non-executed functions: 0
            Cookbook Comments:
            • URL browsing timeout or error
            • URL not reachable
            • Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe, svchost.exe
            • Excluded IPs from analysis (whitelisted): 142.250.186.35, 142.250.185.142, 74.125.71.84, 34.104.35.123, 184.28.90.27, 13.85.23.86, 199.232.214.172, 192.229.221.95, 20.242.39.171, 13.95.31.18
            • Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, clientservices.googleapis.com, ctldl.windowsupdate.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, ocsp.digicert.com, e16604.g.akamaiedge.net, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, clients.l.google.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
            • Not all processes where analyzed, report is missing behavior information
            • Report size getting too big, too many NtSetInformationFile calls found.
            • VT rate limit hit for: http://gateway.facebook.com
            No simulations
            No context
            No context
            No context
            No context
            No context
            No created / dropped files found
            No static file info

            Download Network PCAP: filteredfull

            TimestampProtocolSIDSignatureSource PortDest PortSource IPDest IP
            2024-07-29T19:23:34.543788+0200TCP2022930ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow4434974213.85.23.86192.168.2.4
            • Total Packets: 30
            • 443 (HTTPS)
            • 80 (HTTP)
            • 53 (DNS)
            TimestampSource PortDest PortSource IPDest IP
            Jul 29, 2024 19:23:10.649528027 CEST49675443192.168.2.4173.222.162.32
            Jul 29, 2024 19:23:17.534436941 CEST4973580192.168.2.4157.240.252.17
            Jul 29, 2024 19:23:17.534576893 CEST4973680192.168.2.4157.240.252.17
            Jul 29, 2024 19:23:17.545665979 CEST8049735157.240.252.17192.168.2.4
            Jul 29, 2024 19:23:17.545721054 CEST4973580192.168.2.4157.240.252.17
            Jul 29, 2024 19:23:17.545749903 CEST8049736157.240.252.17192.168.2.4
            Jul 29, 2024 19:23:17.545794964 CEST4973680192.168.2.4157.240.252.17
            Jul 29, 2024 19:23:17.545902014 CEST4973580192.168.2.4157.240.252.17
            Jul 29, 2024 19:23:17.552695990 CEST8049735157.240.252.17192.168.2.4
            Jul 29, 2024 19:23:20.263330936 CEST49675443192.168.2.4173.222.162.32
            Jul 29, 2024 19:23:20.782582045 CEST49739443192.168.2.4142.250.184.196
            Jul 29, 2024 19:23:20.782675982 CEST44349739142.250.184.196192.168.2.4
            Jul 29, 2024 19:23:20.783205986 CEST49739443192.168.2.4142.250.184.196
            Jul 29, 2024 19:23:20.783205986 CEST49739443192.168.2.4142.250.184.196
            Jul 29, 2024 19:23:20.783294916 CEST44349739142.250.184.196192.168.2.4
            Jul 29, 2024 19:23:21.487097979 CEST44349739142.250.184.196192.168.2.4
            Jul 29, 2024 19:23:21.487783909 CEST49739443192.168.2.4142.250.184.196
            Jul 29, 2024 19:23:21.487852097 CEST44349739142.250.184.196192.168.2.4
            Jul 29, 2024 19:23:21.488756895 CEST44349739142.250.184.196192.168.2.4
            Jul 29, 2024 19:23:21.489136934 CEST49739443192.168.2.4142.250.184.196
            Jul 29, 2024 19:23:21.889064074 CEST49739443192.168.2.4142.250.184.196
            Jul 29, 2024 19:23:21.889327049 CEST44349739142.250.184.196192.168.2.4
            Jul 29, 2024 19:23:21.934087992 CEST49739443192.168.2.4142.250.184.196
            Jul 29, 2024 19:23:21.934127092 CEST44349739142.250.184.196192.168.2.4
            Jul 29, 2024 19:23:21.975929976 CEST49739443192.168.2.4142.250.184.196
            Jul 29, 2024 19:23:31.380788088 CEST44349739142.250.184.196192.168.2.4
            Jul 29, 2024 19:23:31.380841970 CEST44349739142.250.184.196192.168.2.4
            Jul 29, 2024 19:23:31.381052971 CEST49739443192.168.2.4142.250.184.196
            Jul 29, 2024 19:23:32.528737068 CEST49739443192.168.2.4142.250.184.196
            Jul 29, 2024 19:23:32.528805017 CEST44349739142.250.184.196192.168.2.4
            Jul 29, 2024 19:23:38.915230036 CEST8049736157.240.252.17192.168.2.4
            Jul 29, 2024 19:23:38.915410995 CEST4973680192.168.2.4157.240.252.17
            Jul 29, 2024 19:23:38.916313887 CEST8049735157.240.252.17192.168.2.4
            Jul 29, 2024 19:23:38.916430950 CEST4973580192.168.2.4157.240.252.17
            Jul 29, 2024 19:23:38.917028904 CEST4973580192.168.2.4157.240.252.17
            Jul 29, 2024 19:23:38.921911955 CEST8049735157.240.252.17192.168.2.4
            Jul 29, 2024 19:23:39.419617891 CEST4973680192.168.2.4157.240.252.17
            Jul 29, 2024 19:23:39.424683094 CEST8049736157.240.252.17192.168.2.4
            Jul 29, 2024 19:23:40.005573034 CEST4974880192.168.2.4157.240.252.17
            Jul 29, 2024 19:23:40.005693913 CEST4974980192.168.2.4157.240.252.17
            Jul 29, 2024 19:23:40.046644926 CEST8049748157.240.252.17192.168.2.4
            Jul 29, 2024 19:23:40.048032045 CEST4974880192.168.2.4157.240.252.17
            Jul 29, 2024 19:23:40.048221111 CEST4974880192.168.2.4157.240.252.17
            Jul 29, 2024 19:23:40.049889088 CEST8049749157.240.252.17192.168.2.4
            Jul 29, 2024 19:23:40.049963951 CEST4974980192.168.2.4157.240.252.17
            Jul 29, 2024 19:23:40.060478926 CEST8049748157.240.252.17192.168.2.4
            TimestampSource PortDest PortSource IPDest IP
            Jul 29, 2024 19:23:16.194967985 CEST53493591.1.1.1192.168.2.4
            Jul 29, 2024 19:23:16.349776983 CEST53537521.1.1.1192.168.2.4
            Jul 29, 2024 19:23:17.523849964 CEST4980253192.168.2.41.1.1.1
            Jul 29, 2024 19:23:17.523957968 CEST5687553192.168.2.41.1.1.1
            Jul 29, 2024 19:23:17.531332016 CEST53568751.1.1.1192.168.2.4
            Jul 29, 2024 19:23:17.533674955 CEST53498021.1.1.1192.168.2.4
            Jul 29, 2024 19:23:17.806349039 CEST53492421.1.1.1192.168.2.4
            Jul 29, 2024 19:23:20.765127897 CEST5063353192.168.2.41.1.1.1
            Jul 29, 2024 19:23:20.766032934 CEST6320553192.168.2.41.1.1.1
            Jul 29, 2024 19:23:20.779802084 CEST53506331.1.1.1192.168.2.4
            Jul 29, 2024 19:23:20.779814005 CEST53632051.1.1.1192.168.2.4
            Jul 29, 2024 19:23:34.864062071 CEST53553691.1.1.1192.168.2.4
            Jul 29, 2024 19:23:39.225491047 CEST138138192.168.2.4192.168.2.255
            TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
            Jul 29, 2024 19:23:17.523849964 CEST192.168.2.41.1.1.10x9666Standard query (0)gateway.facebook.comA (IP address)IN (0x0001)false
            Jul 29, 2024 19:23:17.523957968 CEST192.168.2.41.1.1.10xacc7Standard query (0)gateway.facebook.com65IN (0x0001)false
            Jul 29, 2024 19:23:20.765127897 CEST192.168.2.41.1.1.10x7b8dStandard query (0)www.google.comA (IP address)IN (0x0001)false
            Jul 29, 2024 19:23:20.766032934 CEST192.168.2.41.1.1.10xdfd8Standard query (0)www.google.com65IN (0x0001)false
            TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
            Jul 29, 2024 19:23:17.531332016 CEST1.1.1.1192.168.2.40xacc7No error (0)gateway.facebook.comdgw.c10r.facebook.comCNAME (Canonical name)IN (0x0001)false
            Jul 29, 2024 19:23:17.533674955 CEST1.1.1.1192.168.2.40x9666No error (0)gateway.facebook.comdgw.c10r.facebook.comCNAME (Canonical name)IN (0x0001)false
            Jul 29, 2024 19:23:17.533674955 CEST1.1.1.1192.168.2.40x9666No error (0)dgw.c10r.facebook.com157.240.252.17A (IP address)IN (0x0001)false
            Jul 29, 2024 19:23:20.779802084 CEST1.1.1.1192.168.2.40x7b8dNo error (0)www.google.com142.250.184.196A (IP address)IN (0x0001)false
            Jul 29, 2024 19:23:20.779814005 CEST1.1.1.1192.168.2.40xdfd8No error (0)www.google.com65IN (0x0001)false
            Jul 29, 2024 19:23:33.739960909 CEST1.1.1.1192.168.2.40x540dNo error (0)bg.microsoft.map.fastly.net199.232.214.172A (IP address)IN (0x0001)false
            Jul 29, 2024 19:23:33.739960909 CEST1.1.1.1192.168.2.40x540dNo error (0)bg.microsoft.map.fastly.net199.232.210.172A (IP address)IN (0x0001)false
            Jul 29, 2024 19:23:34.319437981 CEST1.1.1.1192.168.2.40xb9bdNo error (0)fp2e7a.wpc.2be4.phicdn.netfp2e7a.wpc.phicdn.netCNAME (Canonical name)IN (0x0001)false
            Jul 29, 2024 19:23:34.319437981 CEST1.1.1.1192.168.2.40xb9bdNo error (0)fp2e7a.wpc.phicdn.net192.229.221.95A (IP address)IN (0x0001)false
            Jul 29, 2024 19:23:47.384675980 CEST1.1.1.1192.168.2.40xb8f7No error (0)fp2e7a.wpc.2be4.phicdn.netfp2e7a.wpc.phicdn.netCNAME (Canonical name)IN (0x0001)false
            Jul 29, 2024 19:23:47.384675980 CEST1.1.1.1192.168.2.40xb8f7No error (0)fp2e7a.wpc.phicdn.net192.229.221.95A (IP address)IN (0x0001)false
            • gateway.facebook.com
            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
            0192.168.2.449735157.240.252.17801700C:\Program Files\Google\Chrome\Application\chrome.exe
            TimestampBytes transferredDirectionData
            Jul 29, 2024 19:23:17.545902014 CEST435OUTGET / HTTP/1.1
            Host: gateway.facebook.com
            Connection: keep-alive
            Upgrade-Insecure-Requests: 1
            User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
            Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
            Accept-Encoding: gzip, deflate
            Accept-Language: en-US,en;q=0.9


            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
            1192.168.2.449748157.240.252.17801700C:\Program Files\Google\Chrome\Application\chrome.exe
            TimestampBytes transferredDirectionData
            Jul 29, 2024 19:23:40.048221111 CEST461OUTGET / HTTP/1.1
            Host: gateway.facebook.com
            Connection: keep-alive
            Cache-Control: max-age=0
            Upgrade-Insecure-Requests: 1
            User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
            Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
            Accept-Encoding: gzip, deflate
            Accept-Language: en-US,en;q=0.9


            0102030s020406080100

            Click to jump to process

            0102030s0.0020406080100MB

            Click to jump to process

            Target ID:0
            Start time:13:23:13
            Start date:29/07/2024
            Path:C:\Program Files\Google\Chrome\Application\chrome.exe
            Wow64 process (32bit):false
            Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
            Imagebase:0x7ff76e190000
            File size:3'242'272 bytes
            MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
            Has elevated privileges:true
            Has administrator privileges:true
            Programmed in:C, C++ or other language
            Reputation:low
            Has exited:false

            Target ID:2
            Start time:13:23:15
            Start date:29/07/2024
            Path:C:\Program Files\Google\Chrome\Application\chrome.exe
            Wow64 process (32bit):false
            Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 --field-trial-handle=2252,i,18010828196976095766,8005583791433805203,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
            Imagebase:0x7ff76e190000
            File size:3'242'272 bytes
            MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
            Has elevated privileges:true
            Has administrator privileges:true
            Programmed in:C, C++ or other language
            Reputation:low
            Has exited:false

            Target ID:3
            Start time:13:23:16
            Start date:29/07/2024
            Path:C:\Program Files\Google\Chrome\Application\chrome.exe
            Wow64 process (32bit):false
            Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://gateway.facebook.com"
            Imagebase:0x7ff76e190000
            File size:3'242'272 bytes
            MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
            Has elevated privileges:true
            Has administrator privileges:true
            Programmed in:C, C++ or other language
            Reputation:low
            Has exited:true

            No disassembly