Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
https://booking.pathqerunknowns.com

Overview

General Information

Sample URL:https://booking.pathqerunknowns.com
Analysis ID:1586595

Detection

CAPTCHA Scam ClickFix
Score:72
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

AI detected phishing page
Detect drive by download via clipboard copy & paste
Yara detected CAPTCHA Scam ClickFix
AI detected suspicious Javascript
AI detected suspicious URL
HTML body with high number of embedded images detected
HTML page contains hidden javascript code
HTML page contains string obfuscation
Stores files to the Windows start menu directory

Classification

  • System is w10x64_ra
  • chrome.exe (PID: 1824 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • chrome.exe (PID: 6976 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2000 --field-trial-handle=1912,i,11319810455549900542,12744410090218734110,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • chrome.exe (PID: 6664 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://booking.pathqerunknowns.com" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • notepad.exe (PID: 3364 cmdline: "C:\Windows\system32\notepad.exe" MD5: 27F71B12CB585541885A31BE22F61C83)
  • cleanup
SourceRuleDescriptionAuthorStrings
4.6.pages.csvJoeSecurity_CAPTCHAScamYara detected CAPTCHA Scam/ ClickFixJoe Security
    4.5.pages.csvJoeSecurity_CAPTCHAScamYara detected CAPTCHA Scam/ ClickFixJoe Security
      No Sigma rule has matched
      No Suricata rule has matched

      Click to jump to signature section

      Show All Signature Results

      Phishing

      barindex
      Source: https://booking.pathqerunknowns.com/sign-in?op_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00YjJlLThiOGUtNjI0NjllN2Y1ZGQ5In0yK1lHOEtPZGcwYXplS1N1OG5VZ25uQ3pSci1MYkt5TXFxaVNWanNsMjV4WnM6BFMyNTZCBGNvZGUqEzCSipujlK4nOgBCAFjd1NXosDIJoe Sandbox AI: Score: 9 Reasons: The brand 'Booking.com' is a well-known online travel agency., The legitimate domain for Booking.com is 'booking.com'., The provided URL 'booking.pathqerunknowns.com' does not match the legitimate domain., The URL contains an unusual subdomain 'pathqerunknowns', which is not associated with Booking.com., The presence of extra words in the domain name is a common phishing tactic. DOM: 4.5.pages.csv
      Source: https://www.google.com/search?q=mshta+https%3A%2F%2Fantibot-check.icu%2FCapcha.html+%23+%E2%9C%85+%27%27I+am+not+a+robot+-+reCAPTCHA+Verification+ID%3A+3781%27%27&rlz=1C1ONGR_enUS1144&oq=mshta+https%3A%2F%2Fantibot-check.icu%2FCapcha.html+%23+%E2%9C%85+%27%27I+am+not+a+robot+-+reCAPTCHA+Verification+ID%3A+3781%27%27&gs_lcrp=EgZjaHJvbWUyBggAEEUYOdIBCDEyMDdqMGo3qAIAsAIA&sourceid=chrome&ie=UTF-8Joe Sandbox AI: Score: 7 Reasons: The brand McAfee is well-known and typically associated with the domain mcafee.com., The provided URL www.google.com does not match the legitimate domain for McAfee., Google is a well-known brand with its own domain, google.com, which is unrelated to McAfee., The URL does not contain any elements that suggest it is related to McAfee, indicating a potential phishing attempt. DOM: 5.7.pages.csv
      Source: Yara matchFile source: 4.6.pages.csv, type: HTML
      Source: Yara matchFile source: 4.5.pages.csv, type: HTML
      Source: 0.0.id.script.csvJoe Sandbox AI: Detected suspicious JavaScript with source url: https://booking.pathqerunknowns.com/... The provided JavaScript snippet exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code/URLs. The script appears to be part of a Cloudflare challenge system, which is a legitimate use case, but the aggressive DOM manipulation and use of legacy APIs raise concerns about potential misuse or poor implementation. Further review is recommended to ensure the script's integrity and intended purpose.
      Source: 0.19.id.script.csvJoe Sandbox AI: Detected suspicious JavaScript with source url: https://booking.pathqerunknowns.com/sign-in?op_tok... This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to a suspicious domain. The use of the `copyToClipboard` function to execute a `mshta` command and the interaction with the `antibot-check.icu` domain are particularly concerning. Additionally, the script manipulates the DOM in an aggressive manner, which could be indicative of malicious intent. Overall, this script demonstrates a high level of risk and should be further investigated.
      Source: URLJoe Sandbox AI: AI detected Brand spoofing attempt in URL: https://booking.pathqerunknowns.com
      Source: URLJoe Sandbox AI: AI detected Typosquatting in URL: https://booking.pathqerunknowns.com
      Source: https://www.google.com/search?q=mshta+https%3A%2F%2Fantibot-check.icu%2FCapcha.html+%23+%E2%9C%85+%27%27I+am+not+a+robot+-+reCAPTCHA+Verification+ID%3A+3781%27%27&rlz=1C1ONGR_enUS1144&oq=mshta+https%3A%2F%2Fantibot-check.icu%2FCapcha.html+%23+%E2%9C%85+%27%27I+am+not+a+robot+-+reCAPTCHA+Verification+ID%3A+3781%27%27&gs_lcrp=EgZjaHJvbWUyBggAEEUYOdIBCDEyMDdqMGo3qAIAsAIA&sourceid=chrome&ie=UTF-8HTTP Parser: Total embedded image size: 17149
      Source: https://booking.pathqerunknowns.com/HTTP Parser: Base64 decoded: <svg xmlns="http://www.w3.org/2000/svg" width="32" height="32" fill="none"><path fill="#B20F03" d="M16 3a13 13 0 1 0 13 13A13.015 13.015 0 0 0 16 3m0 24a11 11 0 1 1 11-11 11.01 11.01 0 0 1-11 11"/><path fill="#B20F03" d="M17.038 18.615H14.87L14.563 9.5h2....
      Source: https://antibot-check.icu/Capcha.htmlHTTP Parser: Found new string: script /*..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................*/var ppconf...
      Source: https://booking.pathqerunknowns.com/HTTP Parser: No favicon
      Source: https://booking.pathqerunknowns.com/HTTP Parser: No favicon
      Source: https://booking.pathqerunknowns.com/HTTP Parser: No favicon
      Source: https://booking.pathqerunknowns.com/?__cf_chl_tk=yQipogDIg0oHR1tvmIEyJzuSc2pBA31d17NdCFMV1SY-1736418631-1.0.1.1-aiU2oJeOeer7ox3OF4KXSBYicQjdMzI0K1lkCbduS3EHTTP Parser: No favicon
      Source: https://www.google.com/search?q=mshta+https%3A%2F%2Fantibot-check.icu%2FCapcha.html+%23+%E2%9C%85+%27%27I+am+not+a+robot+-+reCAPTCHA+Verification+ID%3A+3781%27%27&rlz=1C1ONGR_enUS1144&oq=mshta+https%3A%2F%2Fantibot-check.icu%2FCapcha.html+%23+%E2%9C%85+%27%27I+am+not+a+robot+-+reCAPTCHA+Verification+ID%3A+3781%27%27&gs_lcrp=EgZjaHJvbWUyBggAEEUYOdIBCDEyMDdqMGo3qAIAsAIA&sourceid=chrome&ie=UTF-8HTTP Parser: No favicon
      Source: https://www.google.com/search?q=mshta+https%3A%2F%2Fantibot-check.icu%2FCapcha.html+%23+%E2%9C%85+%27%27I+am+not+a+robot+-+reCAPTCHA+Verification+ID%3A+3781%27%27&rlz=1C1ONGR_enUS1144&oq=mshta+https%3A%2F%2Fantibot-check.icu%2FCapcha.html+%23+%E2%9C%85+%27%27I+am+not+a+robot+-+reCAPTCHA+Verification+ID%3A+3781%27%27&gs_lcrp=EgZjaHJvbWUyBggAEEUYOdIBCDEyMDdqMGo3qAIAsAIA&sourceid=chrome&ie=UTF-8HTTP Parser: No favicon
      Source: https://www.google.com/search?q=mshta+https%3A%2F%2Fantibot-check.icu%2FCapcha.html+%23+%E2%9C%85+%27%27I+am+not+a+robot+-+reCAPTCHA+Verification+ID%3A+3781%27%27&rlz=1C1ONGR_enUS1144&oq=mshta+https%3A%2F%2Fantibot-check.icu%2FCapcha.html+%23+%E2%9C%85+%27%27I+am+not+a+robot+-+reCAPTCHA+Verification+ID%3A+3781%27%27&gs_lcrp=EgZjaHJvbWUyBggAEEUYOdIBCDEyMDdqMGo3qAIAsAIA&sourceid=chrome&ie=UTF-8HTTP Parser: No favicon
      Source: https://www.google.com/search?q=mshta+https%3A%2F%2Fantibot-check.icu%2FCapcha.html+%23+%E2%9C%85+%27%27I+am+not+a+robot+-+reCAPTCHA+Verification+ID%3A+3781%27%27&rlz=1C1ONGR_enUS1144&oq=mshta+https%3A%2F%2Fantibot-check.icu%2FCapcha.html+%23+%E2%9C%85+%27%27I+am+not+a+robot+-+reCAPTCHA+Verification+ID%3A+3781%27%27&gs_lcrp=EgZjaHJvbWUyBggAEEUYOdIBCDEyMDdqMGo3qAIAsAIA&sourceid=chrome&ie=UTF-8HTTP Parser: No favicon
      Source: https://antibot-check.icu/Capcha.htmlHTTP Parser: No favicon
      Source: unknownHTTPS traffic detected: 23.56.254.164:443 -> 192.168.2.16:49750 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 23.56.254.164:443 -> 192.168.2.16:49752 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49753 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49905 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 204.79.197.200:443 -> 192.168.2.16:49906 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 204.79.197.200:443 -> 192.168.2.16:49907 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 40.126.31.73:443 -> 192.168.2.16:49908 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 23.1.33.206:443 -> 192.168.2.16:49909 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 204.79.197.222:443 -> 192.168.2.16:49914 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 2.23.227.209:443 -> 192.168.2.16:49923 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 23.1.33.206:443 -> 192.168.2.16:49926 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 150.171.73.254:443 -> 192.168.2.16:49928 version: TLS 1.2
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
      Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
      Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
      Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
      Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
      Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
      Source: unknownTCP traffic detected without corresponding DNS query: 23.56.254.164
      Source: unknownTCP traffic detected without corresponding DNS query: 23.56.254.164
      Source: unknownTCP traffic detected without corresponding DNS query: 23.56.254.164
      Source: unknownTCP traffic detected without corresponding DNS query: 23.56.254.164
      Source: unknownTCP traffic detected without corresponding DNS query: 23.56.254.164
      Source: unknownTCP traffic detected without corresponding DNS query: 23.56.254.164
      Source: unknownTCP traffic detected without corresponding DNS query: 23.56.254.164
      Source: unknownTCP traffic detected without corresponding DNS query: 23.56.254.164
      Source: unknownTCP traffic detected without corresponding DNS query: 23.56.254.164
      Source: unknownTCP traffic detected without corresponding DNS query: 23.56.254.164
      Source: unknownTCP traffic detected without corresponding DNS query: 23.56.254.164
      Source: unknownTCP traffic detected without corresponding DNS query: 23.56.254.164
      Source: unknownTCP traffic detected without corresponding DNS query: 23.56.254.164
      Source: unknownTCP traffic detected without corresponding DNS query: 23.56.254.164
      Source: unknownTCP traffic detected without corresponding DNS query: 23.56.254.164
      Source: unknownTCP traffic detected without corresponding DNS query: 23.56.254.164
      Source: unknownTCP traffic detected without corresponding DNS query: 23.56.254.164
      Source: unknownTCP traffic detected without corresponding DNS query: 23.56.254.164
      Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
      Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
      Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
      Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
      Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
      Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
      Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
      Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
      Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
      Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
      Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
      Source: global trafficDNS traffic detected: DNS query: booking.pathqerunknowns.com
      Source: global trafficDNS traffic detected: DNS query: a.nel.cloudflare.com
      Source: global trafficDNS traffic detected: DNS query: challenges.cloudflare.com
      Source: global trafficDNS traffic detected: DNS query: www.google.com
      Source: global trafficDNS traffic detected: DNS query: partner.booking.com
      Source: global trafficDNS traffic detected: DNS query: bstatic.com
      Source: global trafficDNS traffic detected: DNS query: cdn.cookielaw.org
      Source: global trafficDNS traffic detected: DNS query: munchkin.marketo.net
      Source: global trafficDNS traffic detected: DNS query: try.abtasty.com
      Source: global trafficDNS traffic detected: DNS query: code.jquery.com
      Source: global trafficDNS traffic detected: DNS query: 261-nrz-371.mktoresp.com
      Source: global trafficDNS traffic detected: DNS query: zn3eum1ldyl0aih0i-partnersatbooking.siteintercept.qualtrics.com
      Source: global trafficDNS traffic detected: DNS query: siteintercept.qualtrics.com
      Source: global trafficDNS traffic detected: DNS query: apis.google.com
      Source: global trafficDNS traffic detected: DNS query: play.google.com
      Source: global trafficDNS traffic detected: DNS query: dns-tunnel-check.googlezip.net
      Source: global trafficDNS traffic detected: DNS query: tunnel.googlezip.net
      Source: global trafficDNS traffic detected: DNS query: i.ytimg.com
      Source: global trafficDNS traffic detected: DNS query: www.youtube.com
      Source: global trafficDNS traffic detected: DNS query: googleads.g.doubleclick.net
      Source: global trafficDNS traffic detected: DNS query: static.doubleclick.net
      Source: global trafficDNS traffic detected: DNS query: antibot-check.icu
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49744
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49865
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49986
      Source: unknownNetwork traffic detected: HTTP traffic on port 49817 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49864
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49985
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49742
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49863
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49984
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49741
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49862
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49740
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49861
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49982
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49860
      Source: unknownNetwork traffic detected: HTTP traffic on port 49875 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49852 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49795 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49990 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49738
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49859
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49858
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49979
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49736
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49857
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49735
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49856
      Source: unknownNetwork traffic detected: HTTP traffic on port 49772 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49855
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49976
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49733
      Source: unknownNetwork traffic detected: HTTP traffic on port 49841 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49854
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49975
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49853
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49732
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49974
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49731
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49852
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49973
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49730
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49851
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49972
      Source: unknownNetwork traffic detected: HTTP traffic on port 50039 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49850
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49971
      Source: unknownNetwork traffic detected: HTTP traffic on port 49967 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49784 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49749 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 50107 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 50004 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49909 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49849
      Source: unknownNetwork traffic detected: HTTP traffic on port 49714 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49848
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49726
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49847
      Source: unknownNetwork traffic detected: HTTP traffic on port 49886 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49725
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49846
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49967
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49845
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49724
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49966
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49723
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49844
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49965
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49843
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49722
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49721
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49842
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49720
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49841
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49840
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49961
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49960
      Source: unknownNetwork traffic detected: HTTP traffic on port 50015 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 50040 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49966 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49989 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49748 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49760 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49828 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 50073 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49933 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 50028 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49719
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49718
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49839
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49717
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49838
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49959
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49837
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49716
      Source: unknownNetwork traffic detected: HTTP traffic on port 49715 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49958
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49715
      Source: unknownNetwork traffic detected: HTTP traffic on port 49921 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49957
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49714
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49956
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49713
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49834
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49955
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49712
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49833
      Source: unknownNetwork traffic detected: HTTP traffic on port 49887 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49954
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49711
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49832
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49710
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49831
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49830
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49951
      Source: unknownNetwork traffic detected: HTTP traffic on port 49839 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49864 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49950
      Source: unknownNetwork traffic detected: HTTP traffic on port 49726 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49910 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49853 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49796 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49709
      Source: unknownNetwork traffic detected: HTTP traffic on port 49955 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49708
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49829
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49828
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49827
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49826
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49825
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49824
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49945
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49823
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49702
      Source: unknownNetwork traffic detected: HTTP traffic on port 49771 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49788
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49787
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49786
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49785
      Source: unknownNetwork traffic detected: HTTP traffic on port 49922 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49784
      Source: unknownNetwork traffic detected: HTTP traffic on port 49945 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49783
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49782
      Source: unknownNetwork traffic detected: HTTP traffic on port 50017 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49781
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49780
      Source: unknownNetwork traffic detected: HTTP traffic on port 49785 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 50049 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 50026 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49807 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49713 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49736 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49759 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49779
      Source: unknownNetwork traffic detected: HTTP traffic on port 49885 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49778
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49777
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49897
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49775
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49773
      Source: unknownNetwork traffic detected: HTTP traffic on port 49862 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49894
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49772
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49893
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49771
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49770
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49890
      Source: unknownNetwork traffic detected: HTTP traffic on port 49724 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49897 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49911 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49957 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49851 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49830 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49991 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49769
      Source: unknownNetwork traffic detected: HTTP traffic on port 50084 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49768
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49889
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49767
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49766
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49887
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49765
      Source: unknownNetwork traffic detected: HTTP traffic on port 49758 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49886
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49764
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49885
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49763
      Source: unknownNetwork traffic detected: HTTP traffic on port 49863 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49884
      Source: unknownNetwork traffic detected: HTTP traffic on port 50038 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49762
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49883
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49761
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49882
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49760
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49881
      Source: unknownNetwork traffic detected: HTTP traffic on port 49840 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49880
      Source: unknownNetwork traffic detected: HTTP traffic on port 49702 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49725 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49770 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 50050 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49797 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49956 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 50005 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49979 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49759
      Source: unknownNetwork traffic detected: HTTP traffic on port 50083 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49758
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49879
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49757
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49878
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49999
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49756
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49877
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49998
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49755
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49876
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49997
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49754
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49875
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49996
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49753
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49874
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49995
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49752
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49873
      Source: unknownNetwork traffic detected: HTTP traffic on port 49923 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49751
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49872
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49993
      Source: unknownNetwork traffic detected: HTTP traffic on port 50016 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49750
      Source: unknownNetwork traffic detected: HTTP traffic on port 49818 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49871
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49992
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49870
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49991
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49990
      Source: unknownNetwork traffic detected: HTTP traffic on port 49786 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49874 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49747 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49829 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49934 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 50027 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49749
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49748
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49869
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49747
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49868
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49989
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49746
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49867
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49988
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49745
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49866
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49987
      Source: unknownNetwork traffic detected: HTTP traffic on port 50013 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 50036 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 50059 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49746 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49769 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49803 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49826 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49906 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49849 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50105
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50107
      Source: unknownNetwork traffic detected: HTTP traffic on port 49837 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49711 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49975 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49929 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50100
      Source: unknownNetwork traffic detected: HTTP traffic on port 49872 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50102
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50101
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50104
      Source: unknownNetwork traffic detected: HTTP traffic on port 50025 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49700 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49798 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49861 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49735 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49999 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49712 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49918 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49873 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49787 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49930 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50113
      Source: unknownNetwork traffic detected: HTTP traffic on port 49745 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 50001 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49986 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49850 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49757 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49799
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50007
      Source: unknownNetwork traffic detected: HTTP traffic on port 50037 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49798
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50006
      Source: unknownNetwork traffic detected: HTTP traffic on port 50012 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49797
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50009
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49796
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50008
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49795
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49794
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49793
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49792
      Source: unknownNetwork traffic detected: HTTP traffic on port 49814 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49791
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49790
      Source: unknownNetwork traffic detected: HTTP traffic on port 50093 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50001
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50000
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50003
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50002
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50005
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50004
      Source: unknownNetwork traffic detected: HTTP traffic on port 49768 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49723 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 50048 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49825 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49683 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49884 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49907 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49941 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 50105 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49789
      Source: unknownNetwork traffic detected: HTTP traffic on port 49733 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49997 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49710 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49779 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49859 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49871 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49894 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 50003 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49965 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49799 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49816 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 50035 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49919 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49954 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 50014 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49788 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49988 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49767 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49721 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49827 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 50046 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49848 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49882 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49756 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49838 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49976 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49815 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 50092 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49722 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 50047 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49908 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 50024 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49883 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49860 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49778 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49755 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49998 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49673 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49931 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49804 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49744 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 50002 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49987 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49920 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49708 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49926 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50054
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50053
      Source: unknownNetwork traffic detected: HTTP traffic on port 49789 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49800 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50056
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50055
      Source: unknownNetwork traffic detected: HTTP traffic on port 49766 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50059
      Source: unknownNetwork traffic detected: HTTP traffic on port 49961 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49720 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49984 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 50022 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 50102 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 50045 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49881 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49675 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49950 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49732 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49996 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 50010 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49812 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50065
      Source: unknownNetwork traffic detected: HTTP traffic on port 49858 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50064
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50067
      Source: unknownNetwork traffic detected: HTTP traffic on port 50091 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 50113 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 50056 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50066
      Source: unknownNetwork traffic detected: HTTP traffic on port 49893 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49915 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49823 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50073
      Source: unknownNetwork traffic detected: HTTP traffic on port 49777 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49790 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49869 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49674 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49731 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 50009 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49972 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50076
      Source: unknownNetwork traffic detected: HTTP traffic on port 49834 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50075
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50078
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50083
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50084
      Source: unknownNetwork traffic detected: HTTP traffic on port 49847 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49709 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49927 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49870 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50089
      Source: unknownNetwork traffic detected: HTTP traffic on port 49765 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50090
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50092
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50091
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50093
      Source: unknownNetwork traffic detected: HTTP traffic on port 50023 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49811 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49754 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50018
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50017
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50019
      Source: unknownNetwork traffic detected: HTTP traffic on port 49813 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49951 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49974 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 50032 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50010
      Source: unknownNetwork traffic detected: HTTP traffic on port 49916 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50012
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50011
      Source: unknownNetwork traffic detected: HTTP traffic on port 50055 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50014
      Source: unknownNetwork traffic detected: HTTP traffic on port 50090 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50013
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50016
      Source: unknownNetwork traffic detected: HTTP traffic on port 50078 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50015
      Source: unknownNetwork traffic detected: HTTP traffic on port 49845 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49791 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49868 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49753 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50029
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50028
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50021
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50020
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50023
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50022
      Source: unknownNetwork traffic detected: HTTP traffic on port 49742 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50025
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50024
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50027
      Source: unknownNetwork traffic detected: HTTP traffic on port 49780 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49879 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50026
      Source: unknownNetwork traffic detected: HTTP traffic on port 49985 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 50000 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49802 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 50021 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50030
      Source: unknownNetwork traffic detected: HTTP traffic on port 50067 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49905 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49718 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50039
      Source: unknownNetwork traffic detected: HTTP traffic on port 49995 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 50011 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49928 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50032
      Source: unknownNetwork traffic detected: HTTP traffic on port 49741 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49857 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50033
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50036
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50035
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50038
      Source: unknownNetwork traffic detected: HTTP traffic on port 49764 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50037
      Source: unknownNetwork traffic detected: HTTP traffic on port 49719 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49801 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49824 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50040
      Source: unknownNetwork traffic detected: HTTP traffic on port 50066 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 50104 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 50089 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49973 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49730 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 50033 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49917 -> 443
      Source: unknownHTTPS traffic detected: 23.56.254.164:443 -> 192.168.2.16:49750 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 23.56.254.164:443 -> 192.168.2.16:49752 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49753 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49905 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 204.79.197.200:443 -> 192.168.2.16:49906 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 204.79.197.200:443 -> 192.168.2.16:49907 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 40.126.31.73:443 -> 192.168.2.16:49908 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 23.1.33.206:443 -> 192.168.2.16:49909 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 204.79.197.222:443 -> 192.168.2.16:49914 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 2.23.227.209:443 -> 192.168.2.16:49923 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 23.1.33.206:443 -> 192.168.2.16:49926 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 150.171.73.254:443 -> 192.168.2.16:49928 version: TLS 1.2
      Source: classification engineClassification label: mal72.phis.win@32/6@83/398
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
      Source: C:\Windows\System32\notepad.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
      Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2000 --field-trial-handle=1912,i,11319810455549900542,12744410090218734110,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
      Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://booking.pathqerunknowns.com"
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2000 --field-trial-handle=1912,i,11319810455549900542,12744410090218734110,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: unknownProcess created: C:\Windows\System32\notepad.exe "C:\Windows\system32\notepad.exe"
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Windows\System32\notepad.exeSection loaded: kernel.appcore.dll
      Source: C:\Windows\System32\notepad.exeSection loaded: uxtheme.dll
      Source: C:\Windows\System32\notepad.exeSection loaded: mrmcorer.dll
      Source: C:\Windows\System32\notepad.exeSection loaded: windows.storage.dll
      Source: C:\Windows\System32\notepad.exeSection loaded: wldp.dll
      Source: C:\Windows\System32\notepad.exeSection loaded: textshaping.dll
      Source: C:\Windows\System32\notepad.exeSection loaded: efswrt.dll
      Source: C:\Windows\System32\notepad.exeSection loaded: mpr.dll
      Source: C:\Windows\System32\notepad.exeSection loaded: wintypes.dll
      Source: C:\Windows\System32\notepad.exeSection loaded: twinapi.appcore.dll
      Source: C:\Windows\System32\notepad.exeSection loaded: oleacc.dll
      Source: C:\Windows\System32\notepad.exeSection loaded: textinputframework.dll
      Source: C:\Windows\System32\notepad.exeSection loaded: coreuicomponents.dll
      Source: C:\Windows\System32\notepad.exeSection loaded: coremessaging.dll
      Source: C:\Windows\System32\notepad.exeSection loaded: ntmarta.dll
      Source: C:\Windows\System32\notepad.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\InProcServer32
      Source: Window RecorderWindow detected: More than 3 window changes detected

      Persistence and Installation Behavior

      barindex
      Source: Chrome DOM: 4.6OCR Text: Booking.com Robot or human ? Check the box to confirm that you're human. Thank You! I'm not a robot reCAPTCHA Privacy Terms Verification Steps 1 Press Windows Button 2 Press CTRL + V 3. Press Enter
      Source: screenshotOCR Text: x e about:blank X Booking.cam - Partner Hub X booking.pathqerunknowns.cam/sign-in?op_token -zxj81 EgVvYXVOaCKyAQaUN103Mm91T2QzNkSuN3prM38pcmgSCWF1dGhvcm16ZRoaaHROcHM6L... Booking.com Robot or human ? Check the box to confirm that you're human, Thank You! robot reCAPTCHA Privycy Terms Verification Steps 1. Press Windows Button 2. Press CTRL + V 3. Press Enter 05:30 ENG p Type here to search SG WOI/2025
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
      ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
      Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation3
      Browser Extensions
      1
      Process Injection
      1
      Masquerading
      OS Credential Dumping1
      System Information Discovery
      Remote ServicesData from Local System2
      Encrypted Channel
      Exfiltration Over Other Network MediumAbuse Accessibility Features
      CredentialsDomainsDefault AccountsScheduled Task/Job1
      DLL Side-Loading
      1
      DLL Side-Loading
      1
      Process Injection
      LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
      Non-Application Layer Protocol
      Exfiltration Over BluetoothNetwork Denial of Service
      Email AddressesDNS ServerDomain AccountsAt1
      Registry Run Keys / Startup Folder
      1
      Registry Run Keys / Startup Folder
      1
      DLL Side-Loading
      Security Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive2
      Application Layer Protocol
      Automated ExfiltrationData Encrypted for Impact

      This section contains all screenshots as thumbnails, including those not shown in the slideshow.


      windows-stand
      SourceDetectionScannerLabelLink
      https://booking.pathqerunknowns.com0%Avira URL Cloudsafe
      No Antivirus matches
      No Antivirus matches
      No Antivirus matches
      No Antivirus matches
      NameIPActiveMaliciousAntivirus DetectionReputation
      a.nel.cloudflare.com
      35.190.80.1
      truefalse
        high
        bstatic.com
        18.245.31.18
        truefalse
          high
          plus.l.google.com
          172.217.18.14
          truefalse
            high
            i.ytimg.com
            142.250.185.86
            truefalse
              high
              partner.booking.com
              18.66.147.77
              truefalse
                high
                static.doubleclick.net
                142.250.185.198
                truefalse
                  high
                  261-nrz-371.mktoresp.com
                  134.213.193.62
                  truefalse
                    high
                    youtube-ui.l.google.com
                    172.217.23.110
                    truefalse
                      high
                      code.jquery.com
                      151.101.130.137
                      truefalse
                        high
                        play.google.com
                        142.250.184.238
                        truefalse
                          high
                          googleads.g.doubleclick.net
                          142.250.184.194
                          truefalse
                            high
                            antibot-check.icu
                            172.67.190.47
                            truefalse
                              high
                              dns-tunnel-check.googlezip.net
                              216.239.34.159
                              truefalse
                                high
                                tunnel.googlezip.net
                                216.239.34.157
                                truefalse
                                  high
                                  challenges.cloudflare.com
                                  104.18.94.41
                                  truefalse
                                    high
                                    www.google.com
                                    142.250.186.164
                                    truefalse
                                      high
                                      cdn.cookielaw.org
                                      104.18.87.42
                                      truefalse
                                        high
                                        try-cloudfront.abtasty.com
                                        18.172.112.60
                                        truefalse
                                          unknown
                                          booking.pathqerunknowns.com
                                          172.67.187.83
                                          truetrue
                                            unknown
                                            siteintercept.qualtrics.com
                                            unknown
                                            unknownfalse
                                              high
                                              try.abtasty.com
                                              unknown
                                              unknownfalse
                                                high
                                                munchkin.marketo.net
                                                unknown
                                                unknownfalse
                                                  high
                                                  zn3eum1ldyl0aih0i-partnersatbooking.siteintercept.qualtrics.com
                                                  unknown
                                                  unknownfalse
                                                    high
                                                    www.youtube.com
                                                    unknown
                                                    unknownfalse
                                                      high
                                                      apis.google.com
                                                      unknown
                                                      unknownfalse
                                                        high
                                                        NameMaliciousAntivirus DetectionReputation
                                                        https://www.google.com/search?q=mshta+https%3A%2F%2Fantibot-check.icu%2FCapcha.html+%23+%E2%9C%85+%27%27I+am+not+a+robot+-+reCAPTCHA+Verification+ID%3A+3781%27%27&rlz=1C1ONGR_enUS1144&oq=mshta+https%3A%2F%2Fantibot-check.icu%2FCapcha.html+%23+%E2%9C%85+%27%27I+am+not+a+robot+-+reCAPTCHA+Verification+ID%3A+3781%27%27&gs_lcrp=EgZjaHJvbWUyBggAEEUYOdIBCDEyMDdqMGo3qAIAsAIA&sourceid=chrome&ie=UTF-8true
                                                          unknown
                                                          https://booking.pathqerunknowns.com/true
                                                            unknown
                                                            https://booking.pathqerunknowns.com/?__cf_chl_tk=yQipogDIg0oHR1tvmIEyJzuSc2pBA31d17NdCFMV1SY-1736418631-1.0.1.1-aiU2oJeOeer7ox3OF4KXSBYicQjdMzI0K1lkCbduS3Efalse
                                                              unknown
                                                              https://antibot-check.icu/Capcha.htmlfalse
                                                                unknown
                                                                • No. of IPs < 25%
                                                                • 25% < No. of IPs < 50%
                                                                • 50% < No. of IPs < 75%
                                                                • 75% < No. of IPs
                                                                IPDomainCountryFlagASNASN NameMalicious
                                                                142.250.186.67
                                                                unknownUnited States
                                                                15169GOOGLEUSfalse
                                                                142.250.185.226
                                                                unknownUnited States
                                                                15169GOOGLEUSfalse
                                                                151.101.130.137
                                                                code.jquery.comUnited States
                                                                54113FASTLYUSfalse
                                                                142.250.185.104
                                                                unknownUnited States
                                                                15169GOOGLEUSfalse
                                                                18.172.112.60
                                                                try-cloudfront.abtasty.comUnited States
                                                                3MIT-GATEWAYSUSfalse
                                                                142.250.185.142
                                                                unknownUnited States
                                                                15169GOOGLEUSfalse
                                                                18.66.147.79
                                                                unknownUnited States
                                                                3MIT-GATEWAYSUSfalse
                                                                142.250.184.226
                                                                unknownUnited States
                                                                15169GOOGLEUSfalse
                                                                35.190.80.1
                                                                a.nel.cloudflare.comUnited States
                                                                15169GOOGLEUSfalse
                                                                18.66.147.77
                                                                partner.booking.comUnited States
                                                                3MIT-GATEWAYSUSfalse
                                                                142.250.184.227
                                                                unknownUnited States
                                                                15169GOOGLEUSfalse
                                                                142.250.186.74
                                                                unknownUnited States
                                                                15169GOOGLEUSfalse
                                                                142.250.184.195
                                                                unknownUnited States
                                                                15169GOOGLEUSfalse
                                                                142.250.185.67
                                                                unknownUnited States
                                                                15169GOOGLEUSfalse
                                                                104.18.87.42
                                                                cdn.cookielaw.orgUnited States
                                                                13335CLOUDFLARENETUSfalse
                                                                142.250.185.118
                                                                unknownUnited States
                                                                15169GOOGLEUSfalse
                                                                1.1.1.1
                                                                unknownAustralia
                                                                13335CLOUDFLARENETUSfalse
                                                                142.250.184.194
                                                                googleads.g.doubleclick.netUnited States
                                                                15169GOOGLEUSfalse
                                                                172.217.18.3
                                                                unknownUnited States
                                                                15169GOOGLEUSfalse
                                                                142.250.185.234
                                                                unknownUnited States
                                                                15169GOOGLEUSfalse
                                                                142.250.185.110
                                                                unknownUnited States
                                                                15169GOOGLEUSfalse
                                                                142.250.185.198
                                                                static.doubleclick.netUnited States
                                                                15169GOOGLEUSfalse
                                                                104.18.95.41
                                                                unknownUnited States
                                                                13335CLOUDFLARENETUSfalse
                                                                239.255.255.250
                                                                unknownReserved
                                                                unknownunknownfalse
                                                                134.213.193.62
                                                                261-nrz-371.mktoresp.comIreland
                                                                15395RACKSPACE-LONGBfalse
                                                                172.217.23.100
                                                                unknownUnited States
                                                                15169GOOGLEUSfalse
                                                                142.250.184.238
                                                                play.google.comUnited States
                                                                15169GOOGLEUSfalse
                                                                216.58.212.163
                                                                unknownUnited States
                                                                15169GOOGLEUSfalse
                                                                104.17.208.240
                                                                unknownUnited States
                                                                13335CLOUDFLARENETUSfalse
                                                                142.250.184.234
                                                                unknownUnited States
                                                                15169GOOGLEUSfalse
                                                                142.250.186.46
                                                                unknownUnited States
                                                                15169GOOGLEUSfalse
                                                                142.250.185.78
                                                                unknownUnited States
                                                                15169GOOGLEUSfalse
                                                                142.250.186.170
                                                                unknownUnited States
                                                                15169GOOGLEUSfalse
                                                                172.217.18.14
                                                                plus.l.google.comUnited States
                                                                15169GOOGLEUSfalse
                                                                104.18.94.41
                                                                challenges.cloudflare.comUnited States
                                                                13335CLOUDFLARENETUSfalse
                                                                104.17.209.240
                                                                unknownUnited States
                                                                13335CLOUDFLARENETUSfalse
                                                                142.250.185.168
                                                                unknownUnited States
                                                                15169GOOGLEUSfalse
                                                                216.58.206.35
                                                                unknownUnited States
                                                                15169GOOGLEUSfalse
                                                                172.217.23.110
                                                                youtube-ui.l.google.comUnited States
                                                                15169GOOGLEUSfalse
                                                                142.250.181.238
                                                                unknownUnited States
                                                                15169GOOGLEUSfalse
                                                                18.245.31.18
                                                                bstatic.comUnited States
                                                                16509AMAZON-02USfalse
                                                                142.250.184.206
                                                                unknownUnited States
                                                                15169GOOGLEUSfalse
                                                                142.250.185.86
                                                                i.ytimg.comUnited States
                                                                15169GOOGLEUSfalse
                                                                66.102.1.84
                                                                unknownUnited States
                                                                15169GOOGLEUSfalse
                                                                142.250.184.202
                                                                unknownUnited States
                                                                15169GOOGLEUSfalse
                                                                142.250.186.163
                                                                unknownUnited States
                                                                15169GOOGLEUSfalse
                                                                151.101.2.137
                                                                unknownUnited States
                                                                54113FASTLYUSfalse
                                                                172.67.187.83
                                                                booking.pathqerunknowns.comUnited States
                                                                13335CLOUDFLARENETUStrue
                                                                104.102.43.106
                                                                unknownUnited States
                                                                16625AKAMAI-ASUSfalse
                                                                142.250.185.174
                                                                unknownUnited States
                                                                15169GOOGLEUSfalse
                                                                172.67.190.47
                                                                antibot-check.icuUnited States
                                                                13335CLOUDFLARENETUSfalse
                                                                142.250.185.131
                                                                unknownUnited States
                                                                15169GOOGLEUSfalse
                                                                142.250.186.164
                                                                www.google.comUnited States
                                                                15169GOOGLEUSfalse
                                                                142.250.184.214
                                                                unknownUnited States
                                                                15169GOOGLEUSfalse
                                                                142.250.186.166
                                                                unknownUnited States
                                                                15169GOOGLEUSfalse
                                                                216.239.34.157
                                                                tunnel.googlezip.netUnited States
                                                                15169GOOGLEUSfalse
                                                                IP
                                                                192.168.2.16
                                                                Joe Sandbox version:41.0.0 Charoite
                                                                Analysis ID:1586595
                                                                Start date and time:2025-01-09 11:29:58 +01:00
                                                                Joe Sandbox product:CloudBasic
                                                                Overall analysis duration:
                                                                Hypervisor based Inspection enabled:false
                                                                Report type:full
                                                                Cookbook file name:defaultwindowsinteractivecookbook.jbs
                                                                Sample URL:https://booking.pathqerunknowns.com
                                                                Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                Number of analysed new started processes analysed:15
                                                                Number of new started drivers analysed:0
                                                                Number of existing processes analysed:0
                                                                Number of existing drivers analysed:0
                                                                Number of injected processes analysed:0
                                                                Technologies:
                                                                • EGA enabled
                                                                Analysis Mode:stream
                                                                Analysis stop reason:Timeout
                                                                Detection:MAL
                                                                Classification:mal72.phis.win@32/6@83/398
                                                                • Exclude process from analysis (whitelisted): svchost.exe
                                                                • Excluded IPs from analysis (whitelisted): 172.217.18.3, 66.102.1.84, 142.250.185.110, 142.250.186.142
                                                                • Excluded domains from analysis (whitelisted): clients2.google.com, accounts.google.com, redirector.gvt1.com, clientservices.googleapis.com, clients.l.google.com
                                                                • Not all processes where analyzed, report is missing behavior information
                                                                • VT rate limit hit for: https://booking.pathqerunknowns.com
                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Jan 9 09:30:31 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                                                Category:dropped
                                                                Size (bytes):2673
                                                                Entropy (8bit):3.987736011819795
                                                                Encrypted:false
                                                                SSDEEP:
                                                                MD5:5866A2E2BE349BBA0E053F9F5B45CFD6
                                                                SHA1:9E957AD42022A191D91542DC24C7F7A6FB69CC0A
                                                                SHA-256:6706B5938A737865B71948F6A991B96B8741B9F5F2DE7A61A0CC750309A189C7
                                                                SHA-512:719F6AE5B54D303C3BFBDE3A3259DB764838875C8CE87179835679B0820DA93509AAE4233DF409C001935175917D332F4492D3BA8E9747C61317CDF7F055C601
                                                                Malicious:false
                                                                Reputation:unknown
                                                                Preview:L..................F.@.. ...$+.,.....8r..b..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I)Z.S....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V)Z.S....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V)Z.S....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V)Z.S..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V)Z.S...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............y|......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Jan 9 09:30:31 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                                                Category:dropped
                                                                Size (bytes):2675
                                                                Entropy (8bit):4.003582279477915
                                                                Encrypted:false
                                                                SSDEEP:
                                                                MD5:26259B5B6AAE7BE65A7F94DD41A5762A
                                                                SHA1:70DF0A8B692E39CC90051D088731D29BE8B49C37
                                                                SHA-256:F996C7BE068338E69D1F9A36AA2D0816F72F8175963525B671AFC101A893F7BA
                                                                SHA-512:50CD45FB5C9C189BC78B792E0E58F0CA16D6C85D88ECDED3711FDAC37946533FFC4CEB849293DF9982F5CAB094240D3FC809DDAE7F00E259053780A37F5A0D49
                                                                Malicious:false
                                                                Reputation:unknown
                                                                Preview:L..................F.@.. ...$+.,......f..b..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I)Z.S....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V)Z.S....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V)Z.S....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V)Z.S..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V)Z.S...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............y|......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                                                Category:dropped
                                                                Size (bytes):2689
                                                                Entropy (8bit):4.013697368672779
                                                                Encrypted:false
                                                                SSDEEP:
                                                                MD5:AEBBDA15849C41A4E2EDE828AE6E1B97
                                                                SHA1:85652DE35DB9BCF1EE66C7E30F0F40C41D047789
                                                                SHA-256:FC24F498A81867A09592F2561E1C955B9CE3E4E3595B03237FAE9BADDB5018AD
                                                                SHA-512:2747D057871A6D3E400BDBF43FB63486BD879AEABE51EC7C0DFA530DD3654FD90EFB46D65974716ABCCBA28B9003C486FFCD860754FF4A4DEF1F3F9291C39F6F
                                                                Malicious:false
                                                                Reputation:unknown
                                                                Preview:L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I)Z.S....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V)Z.S....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V)Z.S....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V)Z.S..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............y|......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Jan 9 09:30:31 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                                                Category:dropped
                                                                Size (bytes):2677
                                                                Entropy (8bit):4.001941251942684
                                                                Encrypted:false
                                                                SSDEEP:
                                                                MD5:692106AB744BEF448CFA892AF31539DA
                                                                SHA1:1F3CE20B044226148F2A36E69141D9D472904EB9
                                                                SHA-256:A451C6161692567A96EF80D4A5152C7191338EDB5E27ACBF6E7349BD4A8573B6
                                                                SHA-512:AA990EA7BFAFF147473949BEB16555EEB7296557FCEBA68337D05AC5D543C9880D85BB0ED63D86293E216E187F2B90F4B6D9F6F8E42683191D0F58C7444B60BC
                                                                Malicious:false
                                                                Reputation:unknown
                                                                Preview:L..................F.@.. ...$+.,.....!a..b..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I)Z.S....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V)Z.S....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V)Z.S....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V)Z.S..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V)Z.S...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............y|......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Jan 9 09:30:31 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                                                Category:dropped
                                                                Size (bytes):2677
                                                                Entropy (8bit):3.9912135582770167
                                                                Encrypted:false
                                                                SSDEEP:
                                                                MD5:CCAF4FDEAB43C81EEFD6F74E815432B1
                                                                SHA1:4891D6E076E4D4F1B7AC0CC31A50834960E8D59F
                                                                SHA-256:20BEA5255BBEDCCEEDAD9BE253A602A79029845EC7379DACC79B613BC90D6362
                                                                SHA-512:4F8BFC1C6717B0881273C33E3272DAC5052F4502BDB56608017E7501500E4BFAF5035B3E232190DCA765B3BCC80B91E04AD8807BD4A6B051DDF3423C572EAA45
                                                                Malicious:false
                                                                Reputation:unknown
                                                                Preview:L..................F.@.. ...$+.,....{.l..b..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I)Z.S....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V)Z.S....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V)Z.S....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V)Z.S..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V)Z.S...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............y|......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Jan 9 09:30:31 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                                                Category:dropped
                                                                Size (bytes):2679
                                                                Entropy (8bit):3.999720169738161
                                                                Encrypted:false
                                                                SSDEEP:
                                                                MD5:AF6DB72045D95E408392FBBEB4AE4FEF
                                                                SHA1:EF50CAA66B3C6A09CA5C8BA34EA9DAADEADB9F2B
                                                                SHA-256:C4A48C4FF878949D63D2ABE6A255D42B6EA285AF5F3356CBAAFCB38FB5B3FDAC
                                                                SHA-512:7C148127A63E64B98888237E583683DE133088406BD0D980FB70B704C24FFC09F9A78CBD92FA11F7D5551DE62DD5EC00007FB8420AEF525A552550BDF11B4129
                                                                Malicious:false
                                                                Reputation:unknown
                                                                Preview:L..................F.@.. ...$+.,.....fS..b..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I)Z.S....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V)Z.S....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V)Z.S....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V)Z.S..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V)Z.S...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............y|......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                                                No static file info