Play interactive tourEdit tour

Windows Analysis Report
https://google.dz/url?q=nrnq5JLi6z3yh&rct=tTPvvq6xRyj7Y00xDjnlx9kIjusucT&sa=t&url=amp/s%2falvoradavisual.com.br%2fyoya/cjbh/a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%A3%E2%82%AC%E2%80%9A$$$%C3%A3%E2%82%AC%E2%80%9A&c=E,1,acdMIvaoQStC4aiulDn5jPGsnimtLMV1JFn6BeW342oWxCIFHFvSiA0y2yY0Hz6ZJg_fxZUtnDRFz4Y_7GVcOkttSE

Overview

General Information

Sample URL:	https://google.dz/url?q=nrnq5JLi6z3yh&rct=tTPvvq6xRyj7Y00xDjnlx9kIjusucT&sa=t&url=amp/s%2falvoradavisual.com.br%2fyoya/cjbh/a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%A3%E2%82%AC%E2%80%9A$$$%C3%A3%E2%82%AC%E2%80
Analysis ID:	1568921
Infos:

Detection

HTMLPhisher

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Antivirus detection for URL or domain

Suricata IDS alerts for network traffic

Yara detected HtmlPhish54

AI detected suspicious Javascript

Detected hidden input values containing email addresses (often used in phishing pages)

Detected suspicious crossdomain redirect

HTML body contains low number of good links

HTML page contains hidden javascript code

HTML title does not match URL

Stores files to the Windows start menu directory

Classification

×

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://8cacc656-3c4125ca.gharelokhana.com/sbo.co.at/winauth/ssoprobe?client-request-id=a1e188a0-68bf-4354-b37c-5c94feca2ce3&_=1733383463857	Avira URL Cloud: Label: malware
Source: https://33767741-3c4125ca.gharelokhana.com/shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif	Avira URL Cloud: Label: malware
Source: https://33767741-3c4125ca.gharelokhana.com/shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif	Avira URL Cloud: Label: malware
Source: https://b1a4e5aa-3c4125ca.gharelokhana.com/OneCollector/1.0/?cors=true&content-type=application/x-json-stream&w=0	Avira URL Cloud: Label: malware
Source: https://djdjkdlellekkff.gharelokhana.com/4.5.1/npm-monitoring	Avira URL Cloud: Label: malware
Source: https://djdjkdlellekkff.gharelokhana.com/common/instrumentation/dssostatus	Avira URL Cloud: Label: malware
Source: https://33767741-3c4125ca.gharelokhana.com/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico	Avira URL Cloud: Label: malware
Source: https://33767741-3c4125ca.gharelokhana.com/shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_d0a803279e7397bef834.js	Avira URL Cloud: Label: malware
Source: https://4b553e95-3c4125ca.gharelokhana.com/api/report?catId=GW+estsfd+SEC	Avira URL Cloud: Label: malware
Source: https://707242bf-3c4125ca.gharelokhana.com/shared/1.0/content/js/BssoInterrupt_Core_zKox_QMcTIVut7mG_Z9Eew2.js	Avira URL Cloud: Label: malware
Source: https://l1ve.gharelokhana.com/Me.htm?v=3	Avira URL Cloud: Label: malware
Source: https://33767741-3c4125ca.gharelokhana.com/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_i8f-75gfk3tbsm8bmatnqa2.js	Avira URL Cloud: Label: malware
Source: https://33767741-3c4125ca.gharelokhana.com/shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg	Avira URL Cloud: Label: malware
Source: https://33767741-3c4125ca.gharelokhana.com/shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_4285088f1dbaf52a876d.js	Avira URL Cloud: Label: malware
Source: https://33767741-3c4125ca.gharelokhana.com/shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg	Avira URL Cloud: Label: malware
Source: https://33767741-3c4125ca.gharelokhana.com/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_117b650bccea354984d8.js	Avira URL Cloud: Label: malware
Source: https://33767741-3c4125ca.gharelokhana.com/shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg	Avira URL Cloud: Label: malware
Source: https://djdjkdlellekkff.gharelokhana.com/favicon.ico	Avira URL Cloud: Label: malware
Source: https://33767741-3c4125ca.gharelokhana.com/shared/1.0/content/js/ConvergedLogin_PCore_i5YupurhQAo9inu_OetqHw2.js	Avira URL Cloud: Label: malware
Source: https://33767741-3c4125ca.gharelokhana.com/ests/2.1/content/cdnbundles/converged.v2.login.min_81imvbluez-v5hbzpkxfcg2.css	Avira URL Cloud: Label: malware
Source: https://djdjkdlellekkff.gharelokhana.com/3c4125ca1ce249aea8b425e8555a32e2/	Avira URL Cloud: Label: malware
Source: https://33767741-3c4125ca.gharelokhana.com/shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js	Avira URL Cloud: Label: malware
Source: https://c65af2e9-3c4125ca.gharelokhana.com/Prefetch/Prefetch.aspx	Avira URL Cloud: Label: malware

Phishing

AI detected phishing page

Source: https://djdjkdlellekkff.gharelokhana.com/?km=a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A$$$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true

Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'., The provided URL 'djdjkdlellekkff.gharelokhana.com' does not match the legitimate domain for Microsoft., The domain 'gharelokhana.com' does not have any known association with Microsoft., The subdomain 'djdjkdlellekkff' appears random and suspicious, which is a common tactic in phishing URLs., The email domain 'sbo.co.at' does not provide any context or association with Microsoft, adding to the suspicion. DOM: 3.9.pages.csv

Yara detected HtmlPhish54

Source: Yara match	File source: 1.10.id.script.csv, type: HTML
Source: Yara match	File source: 1.3.id.script.csv, type: HTML
Source: Yara match	File source: 2.2.pages.csv, type: HTML
Source: Yara match	File source: 3.3.pages.csv, type: HTML
Source: Yara match	File source: 3.6.pages.csv, type: HTML
Source: Yara match	File source: 3.4.pages.csv, type: HTML
Source: Yara match	File source: 3.9.pages.csv, type: HTML
Source: Yara match	File source: 3.8.pages.csv, type: HTML

AI detected suspicious Javascript

Source: 1.3.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://djdjkdlellekkff.gharelokhana.com/?km=a2xhd... High-risk indicators present: Script uses suspicious domains (gharelokhana.com) masquerading as Microsoft login, contains obfuscated/encoded content, and appears to be a sophisticated phishing attempt targeting Microsoft credentials. Multiple suspicious endpoints for data collection and potential credential harvesting.
Source: 1.0.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://djdjkdlellekkff.gharelokhana.com/?km=a2xhd... Script shows multiple high-risk indicators: heavy obfuscation (encoded strings and variable names), suspicious DOM manipulation patterns (multiple ad-related selectors), and potential data collection behaviors. The code appears to be deliberately obscured and contains references to tracking and advertising elements.
Source: 1.10.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://djdjkdlellekkff.gharelokhana.com/?km=a2xhd... High-risk script showing multiple red flags: 1) Uses suspicious domains (gharelokhana.com) masquerading as legitimate Microsoft login flow, 2) Contains OAuth authorization endpoints pointing to potentially malicious domains, 3) Shows signs of a sophisticated phishing attack targeting Microsoft/Azure credentials with carefully crafted authorization parameters and redirect URIs.
Source: 1.7.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://djdjkdlellekkff.gharelokhana.com/?km=a2xhd... This code shows multiple high-risk indicators: heavy obfuscation (encoded strings, numeric hex values), complex control flow obfuscation (nested functions, while loops with shift operations), and potential dynamic code execution patterns. The code structure is characteristic of malware that attempts to hide its true functionality.

Detected hidden input values containing email addresses (often used in phishing pages)

Source: https://djdjkdlellekkff.gharelokhana.com/?km=a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A$$$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true

HTTP Parser: klaus.mader@sbo.co.at

HTML body contains low number of good links

Source: https://djdjkdlellekkff.gharelokhana.com/?km=a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A$$$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true

HTTP Parser: Number of links: 0

HTML page contains hidden javascript code

Source: https://djdjkdlellekkff.gharelokhana.com/?km=a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A$$$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A

HTTP Parser: Base64 decoded: a[href="http://www.salidzini.lv/"][style="display: block; width: 88px; height: 31px; overflow: hidden; position: relative;"]

HTML title does not match URL

Source: https://djdjkdlellekkff.gharelokhana.com/?km=a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A$$$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true

HTTP Parser: Title: Sign in to your account does not match URL

Found iframes

Source: https://djdjkdlellekkff.gharelokhana.com/?km=a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A$$$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	HTTP Parser: Iframe src: https://c65af2e9-3c4125ca.gharelokhana.com/Prefetch/Prefetch.aspx
Source: https://djdjkdlellekkff.gharelokhana.com/?km=a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A$$$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	HTTP Parser: Iframe src: https://c65af2e9-3c4125ca.gharelokhana.com/Prefetch/Prefetch.aspx
Source: https://djdjkdlellekkff.gharelokhana.com/?km=a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A$$$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	HTTP Parser: Iframe src: https://c65af2e9-3c4125ca.gharelokhana.com/Prefetch/Prefetch.aspx
Source: https://djdjkdlellekkff.gharelokhana.com/?km=a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A$$$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	HTTP Parser: Iframe src: https://c65af2e9-3c4125ca.gharelokhana.com/Prefetch/Prefetch.aspx

HTML body contains password input

Source: https://djdjkdlellekkff.gharelokhana.com/?km=a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A$$$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true

HTTP Parser: <input type="password" .../> found

HTML page is missing a favicon

Source: https://djdjkdlellekkff.gharelokhana.com/?km=a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A$$$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A	HTTP Parser: No favicon
Source: https://djdjkdlellekkff.gharelokhana.com/?km=a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A$$$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	HTTP Parser: No favicon
Source: https://djdjkdlellekkff.gharelokhana.com/?km=a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A$$$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	HTTP Parser: No favicon
Source: https://djdjkdlellekkff.gharelokhana.com/?km=a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A$$$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	HTTP Parser: No favicon
Source: https://djdjkdlellekkff.gharelokhana.com/?km=a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A$$$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	HTTP Parser: No favicon
Source: https://djdjkdlellekkff.gharelokhana.com/?km=a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A$$$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	HTTP Parser: No favicon
Source: https://djdjkdlellekkff.gharelokhana.com/?km=a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A$$$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	HTTP Parser: No favicon
Source: https://djdjkdlellekkff.gharelokhana.com/?km=a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A$$$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	HTTP Parser: No favicon

META author tag missing

Source: https://djdjkdlellekkff.gharelokhana.com/?km=a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A$$$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://djdjkdlellekkff.gharelokhana.com/?km=a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A$$$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://djdjkdlellekkff.gharelokhana.com/?km=a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A$$$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://djdjkdlellekkff.gharelokhana.com/?km=a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A$$$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://djdjkdlellekkff.gharelokhana.com/?km=a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A$$$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	HTTP Parser: No <meta name="author".. found

META copyright tag missing

Source: https://djdjkdlellekkff.gharelokhana.com/?km=a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A$$$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://djdjkdlellekkff.gharelokhana.com/?km=a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A$$$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://djdjkdlellekkff.gharelokhana.com/?km=a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A$$$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://djdjkdlellekkff.gharelokhana.com/?km=a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A$$$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://djdjkdlellekkff.gharelokhana.com/?km=a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A$$$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	HTTP Parser: No <meta name="copyright".. found

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2857090 - Severity 1 - ETPRO PHISHING JS/PsyduckPockeball Payload Inbound : 164.92.191.86:443 -> 192.168.2.5:49790
Source: Network traffic	Suricata IDS: 2857090 - Severity 1 - ETPRO PHISHING JS/PsyduckPockeball Payload Inbound : 164.92.191.86:443 -> 192.168.2.5:49801
Source: Network traffic	Suricata IDS: 2857090 - Severity 1 - ETPRO PHISHING JS/PsyduckPockeball Payload Inbound : 164.92.191.86:443 -> 192.168.2.5:49789

Detected suspicious crossdomain redirect

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

HTTP traffic: Redirect from: www.google.dz to https://alvoradavisual.com.br/yoya/cjbh/a2xhdxmubwfkzxjac2jvlmnvlmf0$$$

Connects to IPs without corresponding DNS lookups

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Downloads files from webservers via HTTP

Source: global traffic	HTTP traffic detected: GET /url?q=nrnq5JLi6z3yh&rct=tTPvvq6xRyj7Y00xDjnlx9kIjusucT&sa=t&url=amp/s%2falvoradavisual.com.br%2fyoya/cjbh/a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%A3%E2%82%AC%E2%80%9A$$$%C3%A3%E2%82%AC%E2%80%9A&c=E,1,acdMIvaoQStC4aiulDn5jPGsnimtLMV1JFn6BeW342oWxCIFHFvSiA0y2yY0Hz6ZJg_fxZUtnDRFz4Y_7GVcOkttSEslJfLPkj2AwC2wEfirVZI,&typo=1 HTTP/1.1Host: google.dzConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /url?q=nrnq5JLi6z3yh&rct=tTPvvq6xRyj7Y00xDjnlx9kIjusucT&sa=t&url=amp/s%2Falvoradavisual.com.br%2Fyoya/cjbh/a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%A3%E2%82%AC%E2%80%9A$$$%C3%A3%E2%82%AC%E2%80%9A&c=E,1,acdMIvaoQStC4aiulDn5jPGsnimtLMV1JFn6BeW342oWxCIFHFvSiA0y2yY0Hz6ZJg_fxZUtnDRFz4Y_7GVcOkttSEslJfLPkj2AwC2wEfirVZI,&typo=1 HTTP/1.1Host: www.google.dzConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /amp/s/alvoradavisual.com.br/yoya/cjbh/a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%A3%E2%82%AC%E2%80%9A$$$%C3%A3%E2%82%AC%E2%80%9A HTTP/1.1Host: www.google.dzConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=519=lp3uNzDSgibs_FNtydKoUoejVwdQ25A9425oEpPvEfPWMtciM4D-ST1PxZ56f216U_ZvgZG2vjDZy6fVTY2vT86_7QvcdpgI1ytRwD7qYJ-k8kZOsVHvwbKKCsoh5OwoCicBsRcspAr1-5d6U0bQzbZe4ATRPwedOUGtJoq0idIsuni5WiAB7NaUuuvUd6uEDwrQ
Source: global traffic	HTTP traffic detected: GET /yoya/cjbh/a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%A3%E2%82%AC%E2%80%9A$$$%C3%A3%E2%82%AC%E2%80%9A HTTP/1.1Host: alvoradavisual.com.brConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: alvoradavisual.com.brConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://alvoradavisual.com.br/yoya/cjbh/a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%A3%E2%82%AC%E2%80%9A$$$%C3%A3%E2%82%AC%E2%80%9AAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?km=a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A$$$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A HTTP/1.1Host: djdjkdlellekkff.gharelokhana.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://alvoradavisual.com.br/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /4.5.1/npm-monitoring HTTP/1.1Host: djdjkdlellekkff.gharelokhana.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://djdjkdlellekkff.gharelokhana.com/?km=a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A$$$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9AAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /4.5.1/npm-monitoring HTTP/1.1Host: djdjkdlellekkff.gharelokhana.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?km=a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A$$$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A HTTP/1.1Host: djdjkdlellekkff.gharelokhana.comConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://djdjkdlellekkff.gharelokhana.com/?km=a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A$$$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9AAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="M2M0MTI1Y2EtMWNlMi00OWFlLWE4YjQtMjVlODU1NWEzMmUyOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/BssoInterrupt_Core_zKox_QMcTIVut7mG_Z9Eew2.js HTTP/1.1Host: 707242bf-3c4125ca.gharelokhana.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://djdjkdlellekkff.gharelokhana.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://djdjkdlellekkff.gharelokhana.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /3c4125ca1ce249aea8b425e8555a32e2/ HTTP/1.1Host: djdjkdlellekkff.gharelokhana.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://djdjkdlellekkff.gharelokhana.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="M2M0MTI1Y2EtMWNlMi00OWFlLWE4YjQtMjVlODU1NWEzMmUyOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="Sec-WebSocket-Key: nkKeI43bRauZvPLRMgt+4g==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /?km=a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A$$$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true HTTP/1.1Host: djdjkdlellekkff.gharelokhana.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://djdjkdlellekkff.gharelokhana.com/?km=a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A$$$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9AAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="M2M0MTI1Y2EtMWNlMi00OWFlLWE4YjQtMjVlODU1NWEzMmUyOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="; AADSSO=NA|NoExtension; SSOCOOKIEPULLED=1
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: djdjkdlellekkff.gharelokhana.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://djdjkdlellekkff.gharelokhana.com/?km=a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A$$$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9AAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="M2M0MTI1Y2EtMWNlMi00OWFlLWE4YjQtMjVlODU1NWEzMmUyOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="; AADSSO=NA|NoExtension; SSOCOOKIEPULLED=1
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/BssoInterrupt_Core_zKox_QMcTIVut7mG_Z9Eew2.js HTTP/1.1Host: 707242bf-3c4125ca.gharelokhana.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="M2M0MTI1Y2EtMWNlMi00OWFlLWE4YjQtMjVlODU1NWEzMmUyOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/converged.v2.login.min_81imvbluez-v5hbzpkxfcg2.css HTTP/1.1Host: 33767741-3c4125ca.gharelokhana.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://djdjkdlellekkff.gharelokhana.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://djdjkdlellekkff.gharelokhana.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/ConvergedLogin_PCore_i5YupurhQAo9inu_OetqHw2.js HTTP/1.1Host: 33767741-3c4125ca.gharelokhana.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://djdjkdlellekkff.gharelokhana.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://djdjkdlellekkff.gharelokhana.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_i8f-75gfk3tbsm8bmatnqa2.js HTTP/1.1Host: 33767741-3c4125ca.gharelokhana.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://djdjkdlellekkff.gharelokhana.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://djdjkdlellekkff.gharelokhana.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_i8f-75gfk3tbsm8bmatnqa2.js HTTP/1.1Host: 33767741-3c4125ca.gharelokhana.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="M2M0MTI1Y2EtMWNlMi00OWFlLWE4YjQtMjVlODU1NWEzMmUyOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="
Source: global traffic	HTTP traffic detected: GET /Me.htm?v=3 HTTP/1.1Host: l1ve.gharelokhana.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://djdjkdlellekkff.gharelokhana.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="M2M0MTI1Y2EtMWNlMi00OWFlLWE4YjQtMjVlODU1NWEzMmUyOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js HTTP/1.1Host: 33767741-3c4125ca.gharelokhana.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://djdjkdlellekkff.gharelokhana.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="M2M0MTI1Y2EtMWNlMi00OWFlLWE4YjQtMjVlODU1NWEzMmUyOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/ConvergedLogin_PCore_i5YupurhQAo9inu_OetqHw2.js HTTP/1.1Host: 33767741-3c4125ca.gharelokhana.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="M2M0MTI1Y2EtMWNlMi00OWFlLWE4YjQtMjVlODU1NWEzMmUyOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="
Source: global traffic	HTTP traffic detected: GET /3c4125ca1ce249aea8b425e8555a32e2/ HTTP/1.1Host: djdjkdlellekkff.gharelokhana.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://djdjkdlellekkff.gharelokhana.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="M2M0MTI1Y2EtMWNlMi00OWFlLWE4YjQtMjVlODU1NWEzMmUyOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="; AADSSO=NA|NoExtension; SSOCOOKIEPULLED=1Sec-WebSocket-Key: 3ffqw7RFxef0UvlWUSHDXg==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js HTTP/1.1Host: 33767741-3c4125ca.gharelokhana.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="M2M0MTI1Y2EtMWNlMi00OWFlLWE4YjQtMjVlODU1NWEzMmUyOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_117b650bccea354984d8.js HTTP/1.1Host: 33767741-3c4125ca.gharelokhana.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://djdjkdlellekkff.gharelokhana.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="M2M0MTI1Y2EtMWNlMi00OWFlLWE4YjQtMjVlODU1NWEzMmUyOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="
Source: global traffic	HTTP traffic detected: GET /Prefetch/Prefetch.aspx HTTP/1.1Host: c65af2e9-3c4125ca.gharelokhana.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://djdjkdlellekkff.gharelokhana.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="M2M0MTI1Y2EtMWNlMi00OWFlLWE4YjQtMjVlODU1NWEzMmUyOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="
Source: global traffic	HTTP traffic detected: GET /3c4125ca1ce249aea8b425e8555a32e2/ HTTP/1.1Host: djdjkdlellekkff.gharelokhana.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://djdjkdlellekkff.gharelokhana.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="M2M0MTI1Y2EtMWNlMi00OWFlLWE4YjQtMjVlODU1NWEzMmUyOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="; AADSSO=NA|NoExtension; SSOCOOKIEPULLED=1; MicrosoftApplicationsTelemetryDeviceId=705de295-27a1-4bd9-946b-6b8b666c8137; brcap=0Sec-WebSocket-Key: iX3aSFpSrljZs2BWTlCVsw==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_d0a803279e7397bef834.js HTTP/1.1Host: 33767741-3c4125ca.gharelokhana.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://djdjkdlellekkff.gharelokhana.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="M2M0MTI1Y2EtMWNlMi00OWFlLWE4YjQtMjVlODU1NWEzMmUyOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1Host: 33767741-3c4125ca.gharelokhana.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://djdjkdlellekkff.gharelokhana.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="M2M0MTI1Y2EtMWNlMi00OWFlLWE4YjQtMjVlODU1NWEzMmUyOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_117b650bccea354984d8.js HTTP/1.1Host: 33767741-3c4125ca.gharelokhana.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="M2M0MTI1Y2EtMWNlMi00OWFlLWE4YjQtMjVlODU1NWEzMmUyOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1Host: 33767741-3c4125ca.gharelokhana.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://djdjkdlellekkff.gharelokhana.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="M2M0MTI1Y2EtMWNlMi00OWFlLWE4YjQtMjVlODU1NWEzMmUyOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1Host: 33767741-3c4125ca.gharelokhana.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="M2M0MTI1Y2EtMWNlMi00OWFlLWE4YjQtMjVlODU1NWEzMmUyOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: 33767741-3c4125ca.gharelokhana.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://djdjkdlellekkff.gharelokhana.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="M2M0MTI1Y2EtMWNlMi00OWFlLWE4YjQtMjVlODU1NWEzMmUyOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_d0a803279e7397bef834.js HTTP/1.1Host: 33767741-3c4125ca.gharelokhana.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="M2M0MTI1Y2EtMWNlMi00OWFlLWE4YjQtMjVlODU1NWEzMmUyOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1Host: 33767741-3c4125ca.gharelokhana.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://djdjkdlellekkff.gharelokhana.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="M2M0MTI1Y2EtMWNlMi00OWFlLWE4YjQtMjVlODU1NWEzMmUyOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1Host: 33767741-3c4125ca.gharelokhana.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://djdjkdlellekkff.gharelokhana.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="M2M0MTI1Y2EtMWNlMi00OWFlLWE4YjQtMjVlODU1NWEzMmUyOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1Host: 33767741-3c4125ca.gharelokhana.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="M2M0MTI1Y2EtMWNlMi00OWFlLWE4YjQtMjVlODU1NWEzMmUyOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="
Source: global traffic	HTTP traffic detected: GET /3c4125ca1ce249aea8b425e8555a32e2/ HTTP/1.1Host: djdjkdlellekkff.gharelokhana.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://djdjkdlellekkff.gharelokhana.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="M2M0MTI1Y2EtMWNlMi00OWFlLWE4YjQtMjVlODU1NWEzMmUyOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="; AADSSO=NA|NoExtension; SSOCOOKIEPULLED=1; MicrosoftApplicationsTelemetryDeviceId=705de295-27a1-4bd9-946b-6b8b666c8137; brcap=0Sec-WebSocket-Key: dQbDjazzT9LZ7NLXFmpahA==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1Host: 33767741-3c4125ca.gharelokhana.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="M2M0MTI1Y2EtMWNlMi00OWFlLWE4YjQtMjVlODU1NWEzMmUyOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1Host: 33767741-3c4125ca.gharelokhana.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="M2M0MTI1Y2EtMWNlMi00OWFlLWE4YjQtMjVlODU1NWEzMmUyOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: 33767741-3c4125ca.gharelokhana.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="M2M0MTI1Y2EtMWNlMi00OWFlLWE4YjQtMjVlODU1NWEzMmUyOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="
Source: global traffic	HTTP traffic detected: GET /sbo.co.at/winauth/ssoprobe?client-request-id=a1e188a0-68bf-4354-b37c-5c94feca2ce3&_=1733383463857 HTTP/1.1Host: 8cacc656-3c4125ca.gharelokhana.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://djdjkdlellekkff.gharelokhana.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="M2M0MTI1Y2EtMWNlMi00OWFlLWE4YjQtMjVlODU1NWEzMmUyOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg HTTP/1.1Host: 33767741-3c4125ca.gharelokhana.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://djdjkdlellekkff.gharelokhana.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="M2M0MTI1Y2EtMWNlMi00OWFlLWE4YjQtMjVlODU1NWEzMmUyOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_4285088f1dbaf52a876d.js HTTP/1.1Host: 33767741-3c4125ca.gharelokhana.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://djdjkdlellekkff.gharelokhana.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="M2M0MTI1Y2EtMWNlMi00OWFlLWE4YjQtMjVlODU1NWEzMmUyOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="
Source: global traffic	HTTP traffic detected: GET /common/instrumentation/dssostatus HTTP/1.1Host: djdjkdlellekkff.gharelokhana.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="M2M0MTI1Y2EtMWNlMi00OWFlLWE4YjQtMjVlODU1NWEzMmUyOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="; AADSSO=NA|NoExtension; SSOCOOKIEPULLED=1; MicrosoftApplicationsTelemetryDeviceId=705de295-27a1-4bd9-946b-6b8b666c8137; brcap=0; ai_session=eVjvSUwhrTpFe3TgKPxN7t|1733383468678|1733383468678
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg HTTP/1.1Host: 33767741-3c4125ca.gharelokhana.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="M2M0MTI1Y2EtMWNlMi00OWFlLWE4YjQtMjVlODU1NWEzMmUyOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_4285088f1dbaf52a876d.js HTTP/1.1Host: 33767741-3c4125ca.gharelokhana.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="M2M0MTI1Y2EtMWNlMi00OWFlLWE4YjQtMjVlODU1NWEzMmUyOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="
Source: global traffic	HTTP traffic detected: GET /3c4125ca1ce249aea8b425e8555a32e2/ HTTP/1.1Host: djdjkdlellekkff.gharelokhana.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://djdjkdlellekkff.gharelokhana.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="M2M0MTI1Y2EtMWNlMi00OWFlLWE4YjQtMjVlODU1NWEzMmUyOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="; AADSSO=NA|NoExtension; SSOCOOKIEPULLED=1; MicrosoftApplicationsTelemetryDeviceId=705de295-27a1-4bd9-946b-6b8b666c8137; brcap=0; ai_session=eVjvSUwhrTpFe3TgKPxN7t|1733383468678|1733383468678Sec-WebSocket-Key: PyaJBLQVr+qsgncEF8gNKw==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /OneCollector/1.0/?cors=true&content-type=application/x-json-stream&w=0 HTTP/1.1Host: b1a4e5aa-3c4125ca.gharelokhana.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="M2M0MTI1Y2EtMWNlMi00OWFlLWE4YjQtMjVlODU1NWEzMmUyOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="; MC1="GUID=87833f2b95ed4eb9b18f2f5ccb3507b7&HASH=8783&LV=202412&V=4&LU=1733383476343"; MS0=2bfcefb984a14c6b991806c27d85da69
Source: global traffic	HTTP traffic detected: GET /3c4125ca1ce249aea8b425e8555a32e2/ HTTP/1.1Host: djdjkdlellekkff.gharelokhana.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://djdjkdlellekkff.gharelokhana.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="M2M0MTI1Y2EtMWNlMi00OWFlLWE4YjQtMjVlODU1NWEzMmUyOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="; AADSSO=NA|NoExtension; SSOCOOKIEPULLED=1; MicrosoftApplicationsTelemetryDeviceId=705de295-27a1-4bd9-946b-6b8b666c8137; brcap=0; ai_session=eVjvSUwhrTpFe3TgKPxN7t|1733383468678|1733383468678; MC1="GUID=87833f2b95ed4eb9b18f2f5ccb3507b7&HASH=8783&LV=202412&V=4&LU=1733383476343"; MS0=2bfcefb984a14c6b991806c27d85da69; MSFPC=GUID=87833f2b95ed4eb9b18f2f5ccb3507b7&HASH=8783&LV=202412&V=4&LU=1733383476343Sec-WebSocket-Key: Fz/IsdVu3LAgy+i40dmOEA==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits

Performs DNS lookups

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: google.dz
Source: global traffic	DNS traffic detected: DNS query: www.google.dz
Source: global traffic	DNS traffic detected: DNS query: alvoradavisual.com.br
Source: global traffic	DNS traffic detected: DNS query: djdjkdlellekkff.gharelokhana.com
Source: global traffic	DNS traffic detected: DNS query: 707242bf-3c4125ca.gharelokhana.com
Source: global traffic	DNS traffic detected: DNS query: 4b553e95-3c4125ca.gharelokhana.com
Source: global traffic	DNS traffic detected: DNS query: 33767741-3c4125ca.gharelokhana.com
Source: global traffic	DNS traffic detected: DNS query: l1ve.gharelokhana.com
Source: global traffic	DNS traffic detected: DNS query: c65af2e9-3c4125ca.gharelokhana.com
Source: global traffic	DNS traffic detected: DNS query: 8cacc656-3c4125ca.gharelokhana.com
Source: global traffic	DNS traffic detected: DNS query: b1a4e5aa-3c4125ca.gharelokhana.com

Posts data to webserver

Source: unknown

HTTP traffic detected: POST /?km=a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A$$$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A HTTP/1.1Host: djdjkdlellekkff.gharelokhana.comConnection: keep-aliveContent-Length: 5056Cache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1Origin: https://djdjkdlellekkff.gharelokhana.comContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://djdjkdlellekkff.gharelokhana.com/?km=a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A$$$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9AAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Tries to download or post to a non-existing HTTP route (HTTP/1.1 404 Not Found / 503 Service Unavailable / 403 Forbidden)

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 05 Dec 2024 07:23:49 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 05 Dec 2024 07:24:11 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 2222f100-abf2-4c30-8be6-4ac878fe6700x-ms-ests-server: 2.1.19492.3 - NEULR1 ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://4b553e95-3c4125ca.gharelokhana.com/api/report?catId=GW+estsfd+SEC"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: *access-control-allow-headers: *
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 05 Dec 2024 07:24:11 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 3344aa90-3048-426d-b50a-4a36a6861400x-ms-ests-server: 2.1.19492.3 - NEULR1 ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://4b553e95-3c4125ca.gharelokhana.com/api/report?catId=GW+estsfd+SEC"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: *access-control-allow-headers: *
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 05 Dec 2024 07:24:18 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: b5622b00-b2d4-4890-88b4-1342476b2e01x-ms-ests-server: 2.1.19568.3 - FRC ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://4b553e95-3c4125ca.gharelokhana.com/api/report?catId=GW+estsfd+SEC"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: *access-control-allow-headers: *
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 05 Dec 2024 07:24:21 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: no-store, no-cachex-ms-correlation-id: a3219723-066d-4229-8cd4-cbb387f7f5e1x-ua-compatible: IE=Edgex-cache: CONFIG_NOCACHEx-msedge-ref: Ref A: 9F26860A257F4B65A1943D025436D21D Ref B: AMS231032602037 Ref C: 2024-12-05T07:24:21Zaccess-control-allow-origin: *access-control-allow-headers: *
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 05 Dec 2024 07:24:22 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: f91f7d07-a8b6-4ea0-9d5c-ed015223d000x-ms-ests-server: 2.1.19568.3 - WEULR1 ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://4b553e95-3c4125ca.gharelokhana.com/api/report?catId=GW+estsfd+SEC"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: *access-control-allow-headers: *
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 05 Dec 2024 07:24:28 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 487fd881-0237-4efa-abe9-0c41dd2e2b00x-ms-ests-server: 2.1.19568.3 - WEULR1 ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://4b553e95-3c4125ca.gharelokhana.com/api/report?catId=GW+estsfd+SEC"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: *access-control-allow-headers: *
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 05 Dec 2024 07:24:37 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: d0432388-0ecd-41f7-9c9c-d432494e8100x-ms-ests-server: 2.1.19568.3 - WEULR1 ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://4b553e95-3c4125ca.gharelokhana.com/api/report?catId=GW+estsfd+SEC"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: *access-control-allow-headers: *
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 05 Dec 2024 07:24:47 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 9e6b77ee-f371-4bab-aca6-17ae95b92f01x-ms-ests-server: 2.1.19568.3 - SEC ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://4b553e95-3c4125ca.gharelokhana.com/api/report?catId=GW+estsfd+SEC"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: *access-control-allow-headers: *

Uses HTTPS

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49900
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

System Summary

Classification label

Source: classification engine

Classification label: mal76.phis.win@18/57@34/7

Creates files inside the user directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Spawns processes

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=2000,i,5425962361269562764,13963646821391754707,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://google.dz/url?q=nrnq5JLi6z3yh&rct=tTPvvq6xRyj7Y00xDjnlx9kIjusucT&sa=t&url=amp/s%2falvoradavisual.com.br%2fyoya/cjbh/a2xhdXMubWFkZXJAc2JvLmNvLmF0 $$$ &c=E,1,acdMIvaoQStC4aiulDn5jPGsnimtLMV1JFn6BeW342oWxCIFHFvSiA0y2yY0Hz6ZJg_fxZUtnDRFz4Y_7GVcOkttSEslJfLPkj2AwC2wEfirVZI,&typo=1"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=2000,i,5425962361269562764,13963646821391754707,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior

Windows shortcut file (LNK) contains relative path

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Boot Survival

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk			Jump to behavior