Edit tour

Windows Analysis Report
http://bashtanka.pp.net.ua/go?https://beefibra.com/bin/sanitas.es/jbonilla@sanitas.es,hxxps://beefibra.com/bin/sanitas.es/jbonilla@sanitas.es

Overview

General Information

Sample URL:	http://bashtanka.pp.net.ua/go?https://beefibra.com/bin/sanitas.es/jbonilla@sanitas.es,hxxps://beefibra.com/bin/sanitas.es/jbonilla@sanitas.es
Analysis ID:	1622681
Infos:

Detection

HTMLPhisher

Score:	68
Range:	0 - 100
Confidence:	100%

Signatures

AI detected phishing page

Antivirus detection for URL or domain

Yara detected HtmlPhish10

AI detected suspicious Javascript

HTML body contains low number of good links

HTML page contains hidden javascript code

HTML title does not match URL

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

URL contains potential PII (phishing indication)

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6496 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6848 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1964,i,1733999784698506531,1711077616244146067,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 984 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://bashtanka.pp.net.ua/go?https://beefibra.com/bin/sanitas.es/jbonilla@sanitas.es,hxxps://beefibra.com/bin/sanitas.es/jbonilla@sanitas.es" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
dropped/chromecache_81	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

HTML

Source	Rule	Description	Author	Strings
2.5.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

Suricata Signatures

ET PHISHING Generic Multibrand Ajax XHR CredPost Phishing Landing

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-24T12:39:51.598111+0100	2032515	2	Possible Social Engineering Attempted	188.114.96.3	443	192.168.2.16	49725	TCP

ETPRO PHISHING Possible Successful Generic Phish July 28

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-24T12:40:38.519148+0100	2812237	1	Successful Credential Theft Detected	192.168.2.16	50027	188.114.96.3	443	TCP
2025-02-24T12:40:38.691187+0100	2812237	1	Successful Credential Theft Detected	192.168.2.16	50028	188.114.96.3	443	TCP

Joe Sandbox Signatures

• AV Detection
• Phishing
• Networking
• System Summary
• Boot Survival

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://myportfolio-performance.es/cdn-cgi/challenge-platform/h/b/scripts/jsd/b0e4a89976ce/main.js?	Avira URL Cloud: Label: phishing
Source: https://myportfolio-performance.es/favicon.ico	Avira URL Cloud: Label: phishing
Source: https://myportfolio-performance.es/emessage/randm/jquery-1.js	Avira URL Cloud: Label: phishing
Source: https://myportfolio-performance.es/emessage/randm/bootstrap.min.css?1422585379	Avira URL Cloud: Label: phishing
Source: https://myportfolio-performance.es/emessage/randm/	Avira URL Cloud: Label: phishing
Source: https://myportfolio-performance.es/cdn-cgi/challenge-platform/scripts/jsd/main.js	Avira URL Cloud: Label: phishing
Source: https://myportfolio-performance.es/cdn-cgi/challenge-platform/h/b/jsd/r/0.247312153978013:1740395430:cNH9xRAlKlz5FnmoCLJX5sHtGvzrvt9htHZk8QELTJ8/916f2d6ca99642d8	Avira URL Cloud: Label: phishing
Source: https://myportfolio-performance.es/emessage/randm/submit.php	Avira URL Cloud: Label: phishing

Phishing

AI detected phishing page

Source: https://myportfolio-performance.es/emessage/randm/#jbonilla@sanitas.es

Joe Sandbox AI: Score: 8 Reasons: The brand 'Sanitas' is a known healthcare company in Spain., The URL 'myportfolio-performance.es' does not match the legitimate domain 'sanitas.es'., The URL contains a suspicious structure with 'myportfolio-performance', which is not typically associated with Sanitas., The use of a different domain extension '.es' is common in Spain, but the domain name itself is not related to Sanitas., The presence of an email input field with a Sanitas domain email suggests an attempt to phish for credentials. DOM: 2.5.pages.csv

Yara detected HtmlPhish10

Source: Yara match	File source: 2.5.pages.csv, type: HTML
Source: Yara match	File source: dropped/chromecache_81, type: DROPPED

AI detected suspicious Javascript

Source: 1.0.id.script.csv

Joe Sandbox AI: Detected suspicious JavaScript with source url: https://myportfolio-performance.es/emessage/randm/... This script demonstrates several high-risk behaviors, including dynamic code execution via `eval()` and obfuscated code. It also sets a persistent cookie with a long expiration date, which could be used for tracking or data exfiltration purposes. The script appears to be testing for the presence of various browser automation and testing frameworks, which suggests it may have malicious intent. Overall, this script poses a significant security risk and should be treated with caution.

Source: https://myportfolio-performance.es/emessage/randm/#jbonilla@sanitas.es

HTTP Parser: Number of links: 0

Source: https://myportfolio-performance.es/emessage/randm/#jbonilla@sanitas.es

HTTP Parser: Base64 decoded: 1740397189.000000

Source: https://myportfolio-performance.es/emessage/randm/#jbonilla@sanitas.es

HTTP Parser: Title: Webmail Portal Login does not match URL

Source: http://bashtanka.pp.net.ua/go?https://beefibra.com/bin/sanitas.es/jbonilla@sanitas.es,hxxps://beefibra.com/bin/sanitas.es/jbonilla@sanitas.es	Sample URL: PII: jbonilla@sanitas.es,hxxps:
Source: http://bashtanka.pp.net.ua/go?https://beefibra.com/bin/sanitas.es/jbonilla@sanitas.es,hxxps://beefibra.com/bin/sanitas.es/jbonilla@sanitas.es	Sample URL: PII: jbonilla@sanitas.es
Source: http://bashtanka.pp.net.ua/go?https://beefibra.com/bin/sanitas.es/jbonilla@sanitas.es,hxxps://beefibra.com/bin/sanitas.es/jbonilla@sanitas.es	Sample URL: PII: jbonilla@sanitas.es,hxxps:
Source: http://bashtanka.pp.net.ua/go?https://beefibra.com/bin/sanitas.es/jbonilla@sanitas.es,hxxps://beefibra.com/bin/sanitas.es/jbonilla@sanitas.es	Sample URL: PII: jbonilla@sanitas.es
Source: http://bashtanka.pp.net.ua/go?https://beefibra.com/bin/sanitas.es/jbonilla@sanitas.es,hxxps://beefibra.com/bin/sanitas.es/jbonilla@sanitas.es	Sample URL: PII: jbonilla@sanitas.es,hxxps:
Source: http://bashtanka.pp.net.ua/go?https://beefibra.com/bin/sanitas.es/jbonilla@sanitas.es,hxxps://beefibra.com/bin/sanitas.es/jbonilla@sanitas.es	Sample URL: PII: jbonilla@sanitas.es
Source: http://bashtanka.pp.net.ua/go?https://beefibra.com/bin/sanitas.es/jbonilla@sanitas.es,hxxps://beefibra.com/bin/sanitas.es/jbonilla@sanitas.es	Sample URL: PII: jbonilla@sanitas.es,hxxps:
Source: http://bashtanka.pp.net.ua/go?https://beefibra.com/bin/sanitas.es/jbonilla@sanitas.es,hxxps://beefibra.com/bin/sanitas.es/jbonilla@sanitas.es	Sample URL: PII: jbonilla@sanitas.es
Source: http://bashtanka.pp.net.ua/go?https://beefibra.com/bin/sanitas.es/jbonilla@sanitas.es,hxxps://beefibra.com/bin/sanitas.es/jbonilla@sanitas.es	Sample URL: PII: jbonilla@sanitas.es,hxxps:
Source: http://bashtanka.pp.net.ua/go?https://beefibra.com/bin/sanitas.es/jbonilla@sanitas.es,hxxps://beefibra.com/bin/sanitas.es/jbonilla@sanitas.es	Sample URL: PII: jbonilla@sanitas.es
Source: http://bashtanka.pp.net.ua/go?https://beefibra.com/bin/sanitas.es/jbonilla@sanitas.es,hxxps://beefibra.com/bin/sanitas.es/jbonilla@sanitas.es	Sample URL: PII: jbonilla@sanitas.es,hxxps:
Source: http://bashtanka.pp.net.ua/go?https://beefibra.com/bin/sanitas.es/jbonilla@sanitas.es,hxxps://beefibra.com/bin/sanitas.es/jbonilla@sanitas.es	Sample URL: PII: jbonilla@sanitas.es
Source: http://bashtanka.pp.net.ua/go?https://beefibra.com/bin/sanitas.es/jbonilla@sanitas.es,hxxps://beefibra.com/bin/sanitas.es/jbonilla@sanitas.es	Sample URL: PII: jbonilla@sanitas.es,hxxps:
Source: http://bashtanka.pp.net.ua/go?https://beefibra.com/bin/sanitas.es/jbonilla@sanitas.es,hxxps://beefibra.com/bin/sanitas.es/jbonilla@sanitas.es	Sample URL: PII: jbonilla@sanitas.es
Source: http://bashtanka.pp.net.ua/go?https://beefibra.com/bin/sanitas.es/jbonilla@sanitas.es,hxxps://beefibra.com/bin/sanitas.es/jbonilla@sanitas.es	Sample URL: PII: jbonilla@sanitas.es,hxxps:
Source: http://bashtanka.pp.net.ua/go?https://beefibra.com/bin/sanitas.es/jbonilla@sanitas.es,hxxps://beefibra.com/bin/sanitas.es/jbonilla@sanitas.es	Sample URL: PII: jbonilla@sanitas.es
Source: http://bashtanka.pp.net.ua/go?https://beefibra.com/bin/sanitas.es/jbonilla@sanitas.es,hxxps://beefibra.com/bin/sanitas.es/jbonilla@sanitas.es	Sample URL: PII: jbonilla@sanitas.es,hxxps:
Source: http://bashtanka.pp.net.ua/go?https://beefibra.com/bin/sanitas.es/jbonilla@sanitas.es,hxxps://beefibra.com/bin/sanitas.es/jbonilla@sanitas.es	Sample URL: PII: jbonilla@sanitas.es
Source: http://bashtanka.pp.net.ua/go?https://beefibra.com/bin/sanitas.es/jbonilla@sanitas.es,hxxps://beefibra.com/bin/sanitas.es/jbonilla@sanitas.es	Sample URL: PII: jbonilla@sanitas.es,hxxps:
Source: http://bashtanka.pp.net.ua/go?https://beefibra.com/bin/sanitas.es/jbonilla@sanitas.es,hxxps://beefibra.com/bin/sanitas.es/jbonilla@sanitas.es	Sample URL: PII: jbonilla@sanitas.es
Source: http://bashtanka.pp.net.ua/go?https://beefibra.com/bin/sanitas.es/jbonilla@sanitas.es,hxxps://beefibra.com/bin/sanitas.es/jbonilla@sanitas.es	Sample URL: PII: jbonilla@sanitas.es,hxxps:
Source: http://bashtanka.pp.net.ua/go?https://beefibra.com/bin/sanitas.es/jbonilla@sanitas.es,hxxps://beefibra.com/bin/sanitas.es/jbonilla@sanitas.es	Sample URL: PII: jbonilla@sanitas.es
Source: http://bashtanka.pp.net.ua/go?https://beefibra.com/bin/sanitas.es/jbonilla@sanitas.es,hxxps://beefibra.com/bin/sanitas.es/jbonilla@sanitas.es	Sample URL: PII: jbonilla@sanitas.es,hxxps:
Source: http://bashtanka.pp.net.ua/go?https://beefibra.com/bin/sanitas.es/jbonilla@sanitas.es,hxxps://beefibra.com/bin/sanitas.es/jbonilla@sanitas.es	Sample URL: PII: jbonilla@sanitas.es
Source: http://bashtanka.pp.net.ua/go?https://beefibra.com/bin/sanitas.es/jbonilla@sanitas.es,hxxps://beefibra.com/bin/sanitas.es/jbonilla@sanitas.es	Sample URL: PII: jbonilla@sanitas.es,hxxps:
Source: http://bashtanka.pp.net.ua/go?https://beefibra.com/bin/sanitas.es/jbonilla@sanitas.es,hxxps://beefibra.com/bin/sanitas.es/jbonilla@sanitas.es	Sample URL: PII: jbonilla@sanitas.es

Source: https://myportfolio-performance.es/emessage/randm/#jbonilla@sanitas.es

HTTP Parser: Iframe src: https://www.sanitas.es

Source: https://myportfolio-performance.es/emessage/randm/#jbonilla@sanitas.es

HTTP Parser: <input type="password" .../> found

Source: https://myportfolio-performance.es/emessage/randm/#jbonilla@sanitas.es	HTTP Parser: No favicon
Source: https://myportfolio-performance.es/emessage/randm/#jbonilla@sanitas.es	HTTP Parser: No favicon

Source: https://myportfolio-performance.es/emessage/randm/#jbonilla@sanitas.es

HTTP Parser: No <meta name="author".. found

Source: https://myportfolio-performance.es/emessage/randm/#jbonilla@sanitas.es

HTTP Parser: No <meta name="copyright".. found

Source: Network traffic	Suricata IDS: 2032515 - Severity 2 - ET PHISHING Generic Multibrand Ajax XHR CredPost Phishing Landing : 188.114.96.3:443 -> 192.168.2.16:49725
Source: Network traffic	Suricata IDS: 2812237 - Severity 1 - ETPRO PHISHING Possible Successful Generic Phish July 28 : 192.168.2.16:50028 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2812237 - Severity 1 - ETPRO PHISHING Possible Successful Generic Phish July 28 : 192.168.2.16:50027 -> 188.114.96.3:443

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.77.188
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /bin/sanitas.es/jbonilla@sanitas.es,hxxps://beefibra.com/bin/sanitas.es/jbonilla@sanitas.es HTTP/1.1Host: beefibra.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /go?https://beefibra.com/bin/sanitas.es/jbonilla@sanitas.es,hxxps://beefibra.com/bin/sanitas.es/jbonilla@sanitas.es HTTP/1.1Host: bashtanka.pp.net.uaConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: beefibra.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://beefibra.com/bin/sanitas.es/jbonilla@sanitas.es,hxxps://beefibra.com/bin/sanitas.es/jbonilla@sanitas.esAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /emessage/randm/ HTTP/1.1Host: myportfolio-performance.esConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://beefibra.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /emessage/randm/ HTTP/1.1Host: myportfolio-performance.esConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://myportfolio-performance.es/emessage/randm/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1Hbge78IMvrkZ_OkFTAo1_PzYKM=Wc9TeAT4yElrkBSDIOGmS_HVg4E; 2pi1MhlW5fCU-7-kTrpqqr5uhPA=1740397176; ZQ54e611nbXP8kmdnk0pvzezrxI=1740483576; 5qj5tduyU7vJhHscBR7HtCq3WWY=2K9Eo4u0aeed2bnQCXHIS4TOgl4; yQ21O989h2MYj__oZxaqjCj9i5U=24V5fd_SqGfynCsHmAJbl9ySndA; sl12yFMz9h_cWsKX0xz4t3xwexE=1740397188; JGkADvvyq7pKams1LW6xHPutH8M=1740483588; CrsGRLkiKm6gklFM7ieZupZ9nUY=D4GcjXriEA5pDGEMmYLJMrs8bMs
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: myportfolio-performance.esConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://myportfolio-performance.es/emessage/randm/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1Hbge78IMvrkZ_OkFTAo1_PzYKM=Wc9TeAT4yElrkBSDIOGmS_HVg4E; 2pi1MhlW5fCU-7-kTrpqqr5uhPA=1740397176; ZQ54e611nbXP8kmdnk0pvzezrxI=1740483576; 5qj5tduyU7vJhHscBR7HtCq3WWY=2K9Eo4u0aeed2bnQCXHIS4TOgl4; yQ21O989h2MYj__oZxaqjCj9i5U=24V5fd_SqGfynCsHmAJbl9ySndA
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP/1.1Host: myportfolio-performance.esConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1Hbge78IMvrkZ_OkFTAo1_PzYKM=Wc9TeAT4yElrkBSDIOGmS_HVg4E; 2pi1MhlW5fCU-7-kTrpqqr5uhPA=1740397176; ZQ54e611nbXP8kmdnk0pvzezrxI=1740483576; 5qj5tduyU7vJhHscBR7HtCq3WWY=2K9Eo4u0aeed2bnQCXHIS4TOgl4; yQ21O989h2MYj__oZxaqjCj9i5U=24V5fd_SqGfynCsHmAJbl9ySndA
Source: global traffic	HTTP traffic detected: GET /bootstrap/4.4.1/css/bootstrap.min.css HTTP/1.1Host: stackpath.bootstrapcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://myportfolio-performance.essec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://myportfolio-performance.es/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /585b051251.js HTTP/1.1Host: kit.fontawesome.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://myportfolio-performance.essec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://myportfolio-performance.es/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrap/4.1.3/js/bootstrap.min.js HTTP/1.1Host: stackpath.bootstrapcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://myportfolio-performance.es/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrap/4.4.1/js/bootstrap.min.js HTTP/1.1Host: stackpath.bootstrapcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://myportfolio-performance.essec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://myportfolio-performance.es/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /emessage/randm/bootstrap.min.css?1422585379 HTTP/1.1Host: myportfolio-performance.esConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://myportfolio-performance.es/emessage/randm/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1Hbge78IMvrkZ_OkFTAo1_PzYKM=Wc9TeAT4yElrkBSDIOGmS_HVg4E; 2pi1MhlW5fCU-7-kTrpqqr5uhPA=1740397176; ZQ54e611nbXP8kmdnk0pvzezrxI=1740483576; 5qj5tduyU7vJhHscBR7HtCq3WWY=2K9Eo4u0aeed2bnQCXHIS4TOgl4; yQ21O989h2MYj__oZxaqjCj9i5U=24V5fd_SqGfynCsHmAJbl9ySndA; sl12yFMz9h_cWsKX0xz4t3xwexE=1740397188; JGkADvvyq7pKams1LW6xHPutH8M=1740483588; CrsGRLkiKm6gklFM7ieZupZ9nUY=D4GcjXriEA5pDGEMmYLJMrs8bMs; ZRlZJetDrKYbzvQVELy1Xtsqa8Y=Dm5ZBtZ_1v2yK6xOfT7h0ryFsxs; j6Tn7zkT0r2zJVa8STxCo4LLkx0=1740397184; yLdI1iLnWr6kcY_rvXf7Lo5Iy7k=1740483584; t_XRKmNyWD1fvGVy6sjLz9zDFSM=9Ke_bXHMAIJoZwGkcWj-1eqXVXI
Source: global traffic	HTTP traffic detected: GET /emessage/randm/jquery-1.js HTTP/1.1Host: myportfolio-performance.esConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://myportfolio-performance.es/emessage/randm/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1Hbge78IMvrkZ_OkFTAo1_PzYKM=Wc9TeAT4yElrkBSDIOGmS_HVg4E; 2pi1MhlW5fCU-7-kTrpqqr5uhPA=1740397176; ZQ54e611nbXP8kmdnk0pvzezrxI=1740483576; 5qj5tduyU7vJhHscBR7HtCq3WWY=2K9Eo4u0aeed2bnQCXHIS4TOgl4; yQ21O989h2MYj__oZxaqjCj9i5U=24V5fd_SqGfynCsHmAJbl9ySndA; sl12yFMz9h_cWsKX0xz4t3xwexE=1740397188; JGkADvvyq7pKams1LW6xHPutH8M=1740483588; CrsGRLkiKm6gklFM7ieZupZ9nUY=D4GcjXriEA5pDGEMmYLJMrs8bMs; ZRlZJetDrKYbzvQVELy1Xtsqa8Y=Dm5ZBtZ_1v2yK6xOfT7h0ryFsxs; j6Tn7zkT0r2zJVa8STxCo4LLkx0=1740397184; yLdI1iLnWr6kcY_rvXf7Lo5Iy7k=1740483584; t_XRKmNyWD1fvGVy6sjLz9zDFSM=9Ke_bXHMAIJoZwGkcWj-1eqXVXI
Source: global traffic	HTTP traffic detected: GET /bootstrap/4.1.3/js/bootstrap.min.js HTTP/1.1Host: stackpath.bootstrapcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrap/4.4.1/js/bootstrap.min.js HTTP/1.1Host: stackpath.bootstrapcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/scripts/jsd/b0e4a89976ce/main.js? HTTP/1.1Host: myportfolio-performance.esConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1Hbge78IMvrkZ_OkFTAo1_PzYKM=Wc9TeAT4yElrkBSDIOGmS_HVg4E; 2pi1MhlW5fCU-7-kTrpqqr5uhPA=1740397176; ZQ54e611nbXP8kmdnk0pvzezrxI=1740483576; 5qj5tduyU7vJhHscBR7HtCq3WWY=2K9Eo4u0aeed2bnQCXHIS4TOgl4; yQ21O989h2MYj__oZxaqjCj9i5U=24V5fd_SqGfynCsHmAJbl9ySndA; sl12yFMz9h_cWsKX0xz4t3xwexE=1740397188; JGkADvvyq7pKams1LW6xHPutH8M=1740483588; CrsGRLkiKm6gklFM7ieZupZ9nUY=D4GcjXriEA5pDGEMmYLJMrs8bMs; ZRlZJetDrKYbzvQVELy1Xtsqa8Y=Dm5ZBtZ_1v2yK6xOfT7h0ryFsxs; j6Tn7zkT0r2zJVa8STxCo4LLkx0=1740397184; yLdI1iLnWr6kcY_rvXf7Lo5Iy7k=1740483584; t_XRKmNyWD1fvGVy6sjLz9zDFSM=9Ke_bXHMAIJoZwGkcWj-1eqXVXI
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.sanitas.esConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://myportfolio-performance.es/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/scripts/jsd/b0e4a89976ce/main.js? HTTP/1.1Host: myportfolio-performance.esConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1Hbge78IMvrkZ_OkFTAo1_PzYKM=Wc9TeAT4yElrkBSDIOGmS_HVg4E; 2pi1MhlW5fCU-7-kTrpqqr5uhPA=1740397176; ZQ54e611nbXP8kmdnk0pvzezrxI=1740483576; 5qj5tduyU7vJhHscBR7HtCq3WWY=2K9Eo4u0aeed2bnQCXHIS4TOgl4; yQ21O989h2MYj__oZxaqjCj9i5U=24V5fd_SqGfynCsHmAJbl9ySndA; sl12yFMz9h_cWsKX0xz4t3xwexE=1740397188; JGkADvvyq7pKams1LW6xHPutH8M=1740483588; CrsGRLkiKm6gklFM7ieZupZ9nUY=D4GcjXriEA5pDGEMmYLJMrs8bMs; ZRlZJetDrKYbzvQVELy1Xtsqa8Y=Dm5ZBtZ_1v2yK6xOfT7h0ryFsxs; j6Tn7zkT0r2zJVa8STxCo4LLkx0=1740397184; yLdI1iLnWr6kcY_rvXf7Lo5Iy7k=1740483584; t_XRKmNyWD1fvGVy6sjLz9zDFSM=9Ke_bXHMAIJoZwGkcWj-1eqXVXI
Source: global traffic	HTTP traffic detected: GET /s2/favicons?domain=sanitas.es HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIk6HLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://myportfolio-performance.es/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/jsd/r/0.247312153978013:1740395430:cNH9xRAlKlz5FnmoCLJX5sHtGvzrvt9htHZk8QELTJ8/916f2d6ca99642d8 HTTP/1.1Host: myportfolio-performance.esConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1Hbge78IMvrkZ_OkFTAo1_PzYKM=Wc9TeAT4yElrkBSDIOGmS_HVg4E; 2pi1MhlW5fCU-7-kTrpqqr5uhPA=1740397176; ZQ54e611nbXP8kmdnk0pvzezrxI=1740483576; 5qj5tduyU7vJhHscBR7HtCq3WWY=2K9Eo4u0aeed2bnQCXHIS4TOgl4; yQ21O989h2MYj__oZxaqjCj9i5U=24V5fd_SqGfynCsHmAJbl9ySndA; sl12yFMz9h_cWsKX0xz4t3xwexE=1740397188; JGkADvvyq7pKams1LW6xHPutH8M=1740483588; CrsGRLkiKm6gklFM7ieZupZ9nUY=D4GcjXriEA5pDGEMmYLJMrs8bMs; ZRlZJetDrKYbzvQVELy1Xtsqa8Y=Dm5ZBtZ_1v2yK6xOfT7h0ryFsxs; j6Tn7zkT0r2zJVa8STxCo4LLkx0=1740397184; yLdI1iLnWr6kcY_rvXf7Lo5Iy7k=1740483584; t_XRKmNyWD1fvGVy6sjLz9zDFSM=9Ke_bXHMAIJoZwGkcWj-1eqXVXI
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: myportfolio-performance.esConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://myportfolio-performance.es/emessage/randm/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1Hbge78IMvrkZ_OkFTAo1_PzYKM=Wc9TeAT4yElrkBSDIOGmS_HVg4E; 2pi1MhlW5fCU-7-kTrpqqr5uhPA=1740397176; ZQ54e611nbXP8kmdnk0pvzezrxI=1740483576; 5qj5tduyU7vJhHscBR7HtCq3WWY=2K9Eo4u0aeed2bnQCXHIS4TOgl4; yQ21O989h2MYj__oZxaqjCj9i5U=24V5fd_SqGfynCsHmAJbl9ySndA; sl12yFMz9h_cWsKX0xz4t3xwexE=1740397188; JGkADvvyq7pKams1LW6xHPutH8M=1740483588; CrsGRLkiKm6gklFM7ieZupZ9nUY=D4GcjXriEA5pDGEMmYLJMrs8bMs; ZRlZJetDrKYbzvQVELy1Xtsqa8Y=Dm5ZBtZ_1v2yK6xOfT7h0ryFsxs; j6Tn7zkT0r2zJVa8STxCo4LLkx0=1740397184; yLdI1iLnWr6kcY_rvXf7Lo5Iy7k=1740483584; t_XRKmNyWD1fvGVy6sjLz9zDFSM=9Ke_bXHMAIJoZwGkcWj-1eqXVXI; cf_clearance=jhWBWwhoGZmJd7VXbY2HrD8l83R1vICKKayjF5bdfio-1740397194-1.2.1.1-ApgLBA3OlqYm0zoQHz0Q.8F8Yl4vKOVgp5OA9e0fA6d6Zs.4B4VsyfWTkW.emcniIRjdUDZ8TUYaxZv2LKhOENO15GMj5YEMOgd43x5O2sb8BpgjhwvNmLzTwxTRMkWKHSoi5BUhbwoC4luYp8l87IaKXOfV7QSluNbQCCSNcc_R.TNoIXqWxgxw_nIbGlVi4hUtrmE7o2irar0YiEvIas.pDcSb5McVXT7pDQKbcCDJhaH.LB5pPCGA7PMPBDOUWVmk2hqLH4foWSxIN4DDJd9iW5ohvdz1yyDuVN5De9U
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.sanitas.esConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://myportfolio-performance.es/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /emessage/randm/submit.php HTTP/1.1Host: myportfolio-performance.esConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1Hbge78IMvrkZ_OkFTAo1_PzYKM=Wc9TeAT4yElrkBSDIOGmS_HVg4E; 2pi1MhlW5fCU-7-kTrpqqr5uhPA=1740397176; ZQ54e611nbXP8kmdnk0pvzezrxI=1740483576; 5qj5tduyU7vJhHscBR7HtCq3WWY=2K9Eo4u0aeed2bnQCXHIS4TOgl4; yQ21O989h2MYj__oZxaqjCj9i5U=24V5fd_SqGfynCsHmAJbl9ySndA; sl12yFMz9h_cWsKX0xz4t3xwexE=1740397188; JGkADvvyq7pKams1LW6xHPutH8M=1740483588; CrsGRLkiKm6gklFM7ieZupZ9nUY=D4GcjXriEA5pDGEMmYLJMrs8bMs; ZRlZJetDrKYbzvQVELy1Xtsqa8Y=Dm5ZBtZ_1v2yK6xOfT7h0ryFsxs; j6Tn7zkT0r2zJVa8STxCo4LLkx0=1740397184; yLdI1iLnWr6kcY_rvXf7Lo5Iy7k=1740483584; t_XRKmNyWD1fvGVy6sjLz9zDFSM=9Ke_bXHMAIJoZwGkcWj-1eqXVXI
Source: global traffic	HTTP traffic detected: GET /emessage/randm/submit.php HTTP/1.1Host: myportfolio-performance.esConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1Hbge78IMvrkZ_OkFTAo1_PzYKM=Wc9TeAT4yElrkBSDIOGmS_HVg4E; 2pi1MhlW5fCU-7-kTrpqqr5uhPA=1740397176; ZQ54e611nbXP8kmdnk0pvzezrxI=1740483576; 5qj5tduyU7vJhHscBR7HtCq3WWY=2K9Eo4u0aeed2bnQCXHIS4TOgl4; yQ21O989h2MYj__oZxaqjCj9i5U=24V5fd_SqGfynCsHmAJbl9ySndA; sl12yFMz9h_cWsKX0xz4t3xwexE=1740397188; JGkADvvyq7pKams1LW6xHPutH8M=1740483588; CrsGRLkiKm6gklFM7ieZupZ9nUY=D4GcjXriEA5pDGEMmYLJMrs8bMs; ZRlZJetDrKYbzvQVELy1Xtsqa8Y=Dm5ZBtZ_1v2yK6xOfT7h0ryFsxs; j6Tn7zkT0r2zJVa8STxCo4LLkx0=1740397184; yLdI1iLnWr6kcY_rvXf7Lo5Iy7k=1740483584; t_XRKmNyWD1fvGVy6sjLz9zDFSM=9Ke_bXHMAIJoZwGkcWj-1eqXVXI
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.sanitas.esConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.sanitas.esConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.sanitas.esConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.sanitas.esConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.sanitas.esConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.sanitas.esConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.sanitas.esConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.sanitas.esConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: bashtanka.pp.net.ua
Source: global traffic	DNS traffic detected: DNS query: beefibra.com
Source: global traffic	DNS traffic detected: DNS query: myportfolio-performance.es
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: kit.fontawesome.com
Source: global traffic	DNS traffic detected: DNS query: stackpath.bootstrapcdn.com
Source: global traffic	DNS traffic detected: DNS query: www.sanitas.es

Source: unknown

HTTP traffic detected: POST /emessage/randm/ HTTP/1.1Host: myportfolio-performance.esConnection: keep-aliveContent-Length: 22sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-Requested-TimeStamp-Expire: hPBMreKZPQiQ07X-Zy5bUorEi1w: 43272248sec-ch-ua-mobile: ?0X-Requested-TimeStamp-Combination: X-Requested-Type-Combination: GETContent-type: application/x-www-form-urlencodedX-Requested-Type: GETUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36X-Requested-with: XMLHttpRequestX-Requested-TimeStamp: sec-ch-ua-platform: "Windows"Accept: */*Origin: https://myportfolio-performance.esSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://myportfolio-performance.es/emessage/randm/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1Hbge78IMvrkZ_OkFTAo1_PzYKM=Wc9TeAT4yElrkBSDIOGmS_HVg4E; 2pi1MhlW5fCU-7-kTrpqqr5uhPA=1740397176; ZQ54e611nbXP8kmdnk0pvzezrxI=1740483576; 5qj5tduyU7vJhHscBR7HtCq3WWY=2K9Eo4u0aeed2bnQCXHIS4TOgl4; yQ21O989h2MYj__oZxaqjCj9i5U=24V5fd_SqGfynCsHmAJbl9ySndA

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Mon, 24 Feb 2025 11:39:52 GMTContent-Length: 9Connection: closeaccess-control-allow-headers: accept, accept-langauge, content-language, content-type, fa-kit-tokenaccess-control-allow-methods: GET, OPTIONSaccess-control-allow-origin: *access-control-max-age: 3000Cache-Control: max-age=0, private, must-revalidatex-request-id: GCciBnjyoFoAqx2hX9NCCF-Cache-Status: MISSServer: cloudflareCF-RAY: 916f2d7308ec438a-EWR
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 24 Feb 2025 11:39:52 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingX-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockX-XSS-Protection: 1; mode=blockCache-Control: public, max-age=315360000, stale-while-revalidate=315360000, stale-if-error=315360000, immutablePragma: publicCF-Cache-Status: HITAge: 1462Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qs7h4bg9WRT1G%2B52pSecDjp6yTtErBJwJQhjROSA0ZDhWfGjcMx8MIUKyCJWCtW1LoGkwwPXp%2BK6O2nr%2F0C7GLO76nKeCIwAMznGRmKt9IxomEE3YANDzK0dYFYxzyMerVNOqy%2F9SJVTuy2ssA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 916f2d752bf542e9-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1722&min_rtt=1719&rtt_var=651&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2869&recv_bytes=1777&delivery_rate=1672394&cwnd=246&unsent_bytes=0&cid=747d34c4aa5fc555&ts=141&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 24 Feb 2025 11:39:52 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingX-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockX-XSS-Protection: 1; mode=blockCache-Control: public, max-age=315360000, stale-while-revalidate=315360000, stale-if-error=315360000, immutablePragma: publicCF-Cache-Status: HITAge: 1462Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=40%2FRhRVZDvn5teVf7XrCRQTS%2Bj54eHZNiH4Kr%2FIviura%2BCblVxV2yxbMI6N6%2B8Uex39FPjkwk2rRPPQ%2Fqk1GRFK9P7neLGNC6E53ZsNx3JLq56ey7DHNWx%2FnJlLi3MX6mgHktUdUKzV%2BwfxzmQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 916f2d75dc93de96-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1664&min_rtt=1650&rtt_var=629&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2869&recv_bytes=1746&delivery_rate=1769696&cwnd=242&unsent_bytes=0&cid=2e5ca60dbcc18af5&ts=158&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 24 Feb 2025 11:39:56 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingX-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockX-XSS-Protection: 1; mode=blockCache-Control: public, max-age=315360000, stale-while-revalidate=315360000, stale-if-error=315360000, immutablePragma: publiccf-cache-status: MISSReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=G4xT0NxrykllMUbFeAxk9Rc0%2BPxPShXFcFAqAmJ%2BdUDwLciSHs55HndE0ZWFwjQke83G2aYimTc2qPNbQq4NGU4NQkgdDWyca5ooF35bpu5TB2N8Mk6tJrK%2BXwEw%2BuLpscieVbcdm23%2FtrD7lA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 916f2d8a9d632369-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1989&min_rtt=1982&rtt_var=758&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2869&recv_bytes=2168&delivery_rate=1428571&cwnd=142&unsent_bytes=0&cid=a4d03b3e6cf63bdb&ts=204&x=0"

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50029 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50041 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: classification engine

Classification label: mal68.phis.win@25/19@27/236

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1964,i,1733999784698506531,1711077616244146067,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://bashtanka.pp.net.ua/go?https://beefibra.com/bin/sanitas.es/jbonilla@sanitas.es,hxxps://beefibra.com/bin/sanitas.es/jbonilla@sanitas.es"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1964,i,1733999784698506531,1711077616244146067,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Drive-by Compromise	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label	Link
http://bashtanka.pp.net.ua/go?https://beefibra.com/bin/sanitas.es/jbonilla@sanitas.es,hxxps://beefibra.com/bin/sanitas.es/jbonilla@sanitas.es	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label
https://www.sanitas.es/	0%	Avira URL Cloud	safe
https://stackpath.bootstrapcdn.com/bootstrap/4.4.1/js/bootstrap.min.js	0%	Avira URL Cloud	safe
https://myportfolio-performance.es/cdn-cgi/challenge-platform/h/b/scripts/jsd/b0e4a89976ce/main.js?	100%	Avira URL Cloud	phishing
https://myportfolio-performance.es/favicon.ico	100%	Avira URL Cloud	phishing
https://myportfolio-performance.es/emessage/randm/jquery-1.js	100%	Avira URL Cloud	phishing
https://myportfolio-performance.es/emessage/randm/bootstrap.min.css?1422585379	100%	Avira URL Cloud	phishing
https://beefibra.com/favicon.ico	0%	Avira URL Cloud	safe
https://myportfolio-performance.es/emessage/randm/	100%	Avira URL Cloud	phishing
https://myportfolio-performance.es/cdn-cgi/challenge-platform/scripts/jsd/main.js	100%	Avira URL Cloud	phishing
https://www.google.com/s2/favicons?domain=sanitas.es	0%	Avira URL Cloud	safe
https://myportfolio-performance.es/cdn-cgi/challenge-platform/h/b/jsd/r/0.247312153978013:1740395430:cNH9xRAlKlz5FnmoCLJX5sHtGvzrvt9htHZk8QELTJ8/916f2d6ca99642d8	100%	Avira URL Cloud	phishing
https://myportfolio-performance.es/emessage/randm/submit.php	100%	Avira URL Cloud	phishing
http://www.sanitas.es/	0%	Avira URL Cloud	safe
https://a.nel.cloudflare.com/report/v4?s=FYVozwqfCORNHWHYsnccSjblQQcbn%2FWeK4XBgSLCiBAg7bR7x2aEem6qaJPF5Q3z6TagKRFRSca6qZSs%2BAV8SyEZnXd6kQtsZqIAztHCmJNgareRNFCOfPk%2BTdFPwW43JnDm0GTfErHRhM3TuQ%3D%3D	0%	Avira URL Cloud	safe
https://a.nel.cloudflare.com/report/v4?s=6FCkBfDDB6LOBEVHTlub1%2BE0sckc1w8lu%2B13s4E78HNAZZDKDj%2Fn1GTqKyuAlnORcgsJFIl3eNRc%2Fw2%2F2LG3kDF9FA%2FhqNxhTxaR7BJ1QjlBNPTsHg3C5oO1GGufN621r8KOUbfAz8Ks56oFdg%3D%3D	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
kit.fontawesome.com.cdn.cloudflare.net	104.18.40.68	true	false	high
stackpath.bootstrapcdn.com	104.18.10.207	true	false	high
beefibra.com	50.116.87.88	true	false	unknown
a.nel.cloudflare.com	35.190.80.1	true	false	high
m2ogcxg.x.incapdns.net	45.60.156.99	true	false	unknown
www.google.com	142.250.186.132	true	false	high
bashtanka.pp.net.ua	213.174.157.134	true	false	unknown
myportfolio-performance.es	188.114.96.3	true	true	unknown
www.sanitas.es	unknown	unknown	false	unknown
kit.fontawesome.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://myportfolio-performance.es/cdn-cgi/challenge-platform/h/b/scripts/jsd/b0e4a89976ce/main.js?	true	Avira URL Cloud: phishing	unknown
https://myportfolio-performance.es/emessage/randm/#jbonilla@sanitas.es	true		unknown
https://www.sanitas.es/	false	Avira URL Cloud: safe	unknown
https://myportfolio-performance.es/cdn-cgi/challenge-platform/scripts/jsd/main.js	true	Avira URL Cloud: phishing	unknown
https://myportfolio-performance.es/emessage/randm/jquery-1.js	true	Avira URL Cloud: phishing	unknown
https://myportfolio-performance.es/favicon.ico	true	Avira URL Cloud: phishing	unknown
http://www.sanitas.es/	false	Avira URL Cloud: safe	unknown
https://myportfolio-performance.es/emessage/randm/submit.php	true	Avira URL Cloud: phishing	unknown
https://myportfolio-performance.es/emessage/randm/	true	Avira URL Cloud: phishing	unknown
https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js	false		high
https://beefibra.com/favicon.ico	false	Avira URL Cloud: safe	unknown
https://a.nel.cloudflare.com/report/v4?s=FYVozwqfCORNHWHYsnccSjblQQcbn%2FWeK4XBgSLCiBAg7bR7x2aEem6qaJPF5Q3z6TagKRFRSca6qZSs%2BAV8SyEZnXd6kQtsZqIAztHCmJNgareRNFCOfPk%2BTdFPwW43JnDm0GTfErHRhM3TuQ%3D%3D	false	Avira URL Cloud: safe	unknown
https://kit.fontawesome.com/585b051251.js	false		high
https://stackpath.bootstrapcdn.com/bootstrap/4.4.1/js/bootstrap.min.js	false	Avira URL Cloud: safe	unknown
https://myportfolio-performance.es/emessage/randm/bootstrap.min.css?1422585379	true	Avira URL Cloud: phishing	unknown
https://a.nel.cloudflare.com/report/v4?s=6FCkBfDDB6LOBEVHTlub1%2BE0sckc1w8lu%2B13s4E78HNAZZDKDj%2Fn1GTqKyuAlnORcgsJFIl3eNRc%2Fw2%2F2LG3kDF9FA%2FhqNxhTxaR7BJ1QjlBNPTsHg3C5oO1GGufN621r8KOUbfAz8Ks56oFdg%3D%3D	false	Avira URL Cloud: safe	unknown
https://stackpath.bootstrapcdn.com/bootstrap/4.4.1/css/bootstrap.min.css	false		high
https://www.google.com/s2/favicons?domain=sanitas.es	false	Avira URL Cloud: safe	unknown
https://myportfolio-performance.es/cdn-cgi/challenge-platform/h/b/jsd/r/0.247312153978013:1740395430:cNH9xRAlKlz5FnmoCLJX5sHtGvzrvt9htHZk8QELTJ8/916f2d6ca99642d8	true	Avira URL Cloud: phishing	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
213.174.157.134	bashtanka.pp.net.ua	Netherlands	39572	ADVANCEDHOSTERS-ASNL	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
104.18.10.207	stackpath.bootstrapcdn.com	United States	13335	CLOUDFLARENETUS	false
104.18.40.68	kit.fontawesome.com.cdn.cloudflare.net	United States	13335	CLOUDFLARENETUS	false
50.116.87.88	beefibra.com	United States	46606	UNIFIEDLAYER-AS-1US	false
216.58.206.67	unknown	United States	15169	GOOGLEUS	false
172.217.18.4	unknown	United States	15169	GOOGLEUS	false
74.125.71.84	unknown	United States	15169	GOOGLEUS	false
142.250.185.110	unknown	United States	15169	GOOGLEUS	false
45.60.156.99	m2ogcxg.x.incapdns.net	United States	19551	INCAPSULAUS	false
142.250.185.138	unknown	United States	15169	GOOGLEUS	false
142.250.185.227	unknown	United States	15169	GOOGLEUS	false
104.18.11.207	unknown	United States	13335	CLOUDFLARENETUS	false
142.250.185.170	unknown	United States	15169	GOOGLEUS	false
142.250.181.238	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
188.114.97.3	unknown	European Union	13335	CLOUDFLARENETUS	false
142.250.181.228	unknown	United States	15169	GOOGLEUS	false
188.114.96.3	myportfolio-performance.es	European Union	13335	CLOUDFLARENETUS	true
142.250.186.132	www.google.com	United States	15169	GOOGLEUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
142.250.186.74	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.16
192.168.2.4

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1622681
Start date and time:	2025-02-24 12:39:13 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	http://bashtanka.pp.net.ua/go?https://beefibra.com/bin/sanitas.es/jbonilla@sanitas.es,hxxps://beefibra.com/bin/sanitas.es/jbonilla@sanitas.es
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal68.phis.win@25/19@27/236

Warnings

Exclude process from analysis (whitelisted): svchost.exe
Excluded IPs from analysis (whitelisted): 216.58.206.67, 142.250.185.110, 74.125.71.84, 142.250.186.110
Excluded domains from analysis (whitelisted): clients2.google.com, accounts.google.com, redirector.gvt1.com, clientservices.googleapis.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: http://bashtanka.pp.net.ua/go?https://beefibra.com/bin/sanitas.es/jbonilla@sanitas.es,hxxps://beefibra.com/bin/sanitas.es/jbonilla@sanitas.es

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Feb 24 10:39:47 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9871691214420513
Encrypted:	false
SSDEEP:
MD5:	C91C3EEB60A68F9CC4552791B1B34339
SHA1:	2C42A0B615CB5D7EA182A4A1891BB656A11C3A30
SHA-256:	53756C554CDFD8BE751DB8096FA6A3EB31774E6AB00F4F1F5918BD504F40A421
SHA-512:	6FF44C7EFD5EAE8145CF8A8EA132DB41855FD28DFC088614C95A1E09AD2EDD8C85EE4E57868B74458AE97854D3270DBD7F50EC8FF1247C8F56929F6197ED18BF
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,...........N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IXZ.\....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VXZ.\....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VXZ.\....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VXZ.\..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VXZ.\...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........[.F......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Feb 24 10:39:47 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	4.004381184811377
Encrypted:	false
SSDEEP:
MD5:	CACA4ECAFE4C69556AC201015E33A34E
SHA1:	19FF25FA46C12FF6233F742BD57E5A7F5A1ED9E8
SHA-256:	D59A8378A5CA46CB2DAA63A1FE6C2C501C3BBD31AC5998EBB44A5160B64FEF11
SHA-512:	A36056052C4F5690171CF0AF356981C446536485FD3A1E966C308FEEAA5EDAE74D2CA86AD05962418082EF448A4686AE5B8EE3C36AC3327DE8FEE224968E5B28
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,..........N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IXZ.\....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VXZ.\....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VXZ.\....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VXZ.\..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VXZ.\...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........[.F......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.010050174059227
Encrypted:	false
SSDEEP:
MD5:	7301627E702681E746C3952570CB40C8
SHA1:	495A4391202C424604B88E3B18E3CA132DCB1AE6
SHA-256:	2B5EC6F56A079032F25E55CADE7936902452141F0777BAB892717CC942C4B523
SHA-512:	652B5946405AE9A8B32AB2F5DB3E3FB4BD855D097A568BD1D56F6294910784BACEBE5F05AD8FE443EE49DC5FC2B66728D1159849DEC7A92EEFB7D869012AD822
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IXZ.\....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VXZ.\....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VXZ.\....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VXZ.\..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........[.F......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Feb 24 10:39:47 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	4.000643320692129
Encrypted:	false
SSDEEP:
MD5:	2D089C6EEA514BF443FE3E6E1C885CD9
SHA1:	9FAFE197B4EEC1BE3165A91717E6B9B3853F7E22
SHA-256:	81A0153B116BB74AE0AADCA256C36805E7A21B5E75FFAAA23693F0B1F00208CF
SHA-512:	0C50DC1D118F4D0F605DEE334E610B2A0C4DD9D3C43E5518C1F640A326DF303ADD9AC1FBB0E937921B2F075CAB717591A5369CF6B061E133B104A4B06E8A88D8
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....g.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IXZ.\....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VXZ.\....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VXZ.\....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VXZ.\..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VXZ.\...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........[.F......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Feb 24 10:39:47 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.989205475986841
Encrypted:	false
SSDEEP:
MD5:	6A4C96DAA086834560A2DF1D17990893
SHA1:	C5F1D6BA92C985755A2AA744115F80C1A9C137ED
SHA-256:	9BFC63A1B16862DFB26283164D2A4511027C17CD320965AD8679945985C9A822
SHA-512:	A54F5FFA86FEC0557D21B804695614CFD792D9F7CA20C0A00289C4E48DC9DCD96C4C940326925A99127103219FC2519ADC9180CC2744C3F34BA660DB37D854F7
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....d.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IXZ.\....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VXZ.\....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VXZ.\....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VXZ.\..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VXZ.\...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........[.F......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Feb 24 10:39:47 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9997460132148306
Encrypted:	false
SSDEEP:
MD5:	C94ECE8C85E4953D08A6812825A52C2B
SHA1:	2D9137F9BBA1C0965DA30159C2FDAFC946D9A7B1
SHA-256:	232EC256F646AC34B184F23176AB3310CB403C47E73367ED8E93D6C1CFCA70EF
SHA-512:	AF57DB6F683D47FC195D15A1ECEA896B2D59A6432232B092D855D47A47516E4C0633C7462B437203E50BE3D2B34244E72AC7FC47CB0FE262B8EF04AC2224DD0F
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....?.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IXZ.\....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VXZ.\....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VXZ.\....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VXZ.\..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VXZ.\...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........[.F......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 70

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.0129756239093854
Encrypted:	false
SSDEEP:
MD5:	7F256D2188BA0031C49B4A4A3D323605
SHA1:	9630769A896A401E4AE9DC151E62FAEEBABD1D80
SHA-256:	E3F29C82084DC56EC67CF9E88EB71B756D6969D44DD990D82C74EC72C1A04462
SHA-512:	1BF247A3056517E4367722DBE17912C55795BF2C429E2F096BD2370042D09C5307A42C0B99469FD5ED66637C08308BEE31CE347D4B3D22CE9A39BCF105176257
Malicious:	false
Reputation:	unknown
Preview:	{"signal":"bad","msg":"Please fill in all the fields."}

Chrome Cache Entry: 71

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (8495), with no line terminators
Category:	dropped
Size (bytes):	8495
Entropy (8bit):	5.725338138734829
Encrypted:	false
SSDEEP:
MD5:	37A75CBC9CC95F15869F01726917C17D
SHA1:	CD308CE5B554AD7C1E362DD8EF0357CA9BD0B250
SHA-256:	94B73E57D0A4AC0099756255F9897BC63EAFB40CB596D511D426D2C3FE55BD40
SHA-512:	C29C3250D0055831560F8C1523EC578D1593E4BEB3571F453EBEFE4262255081ED6E67E0D80279F66BECD60738FB42655FF8BD45377D01D63D9933E247147277
Malicious:	false
Reputation:	unknown
Preview:	window._cf_chl_opt={cFPWv:'b'};~function(W,h,i,j,k,o,s,B){W=b,function(d,e,V,f,g){for(V=b,f=d();!![];)try{if(g=parseInt(V(146))/1+parseInt(V(186))/2(parseInt(V(195))/3)+-parseInt(V(247))/4(parseInt(V(161))/5)+parseInt(V(249))/6(parseInt(V(188))/7)+-parseInt(V(221))/8(-parseInt(V(159))/9)+-parseInt(V(147))/10*(-parseInt(V(181))/11)+-parseInt(V(200))/12,e===g)break;else f.push(f.shift())}catch(E){f.push(f.shift())}}(a,107599),h=this\|\|self,i=h[W(237)],j={},j[W(202)]='o',j[W(162)]='s',j[W(144)]='u',j[W(191)]='z',j[W(197)]='n',j[W(187)]='I',j[W(212)]='b',k=j,h[W(254)]=function(g,E,F,G,a1,I,J,K,L,M,N){if(a1=W,null===E\|\|void 0===E)return G;for(I=n(E),g[a1(168)][a1(238)]&&(I=I[a1(228)](g[a1(168)][a1(238)](E))),I=g[a1(218)][a1(205)]&&g[a1(149)]?g[a1(218)][a1(205)](new g[(a1(149))](I)):function(O,a2,P){for(a2=a1,O[a2(153)](),P=0;P<O[a2(243)];O[P+1]===O[P]?O[a2(189)](P+1,1):P+=1);return O}(I),J='nAsAaAb'.split('A'),J=J[a1(160)][a1(157)](J),K=0;K<I[a1(243)];L=I[K],M=m(g,E,L),J(M)?(N='s'===M&&!

Chrome Cache Entry: 72

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (59729)
Category:	downloaded
Size (bytes):	60010
Entropy (8bit):	5.251561930322096
Encrypted:	false
SSDEEP:
MD5:	61F338F870FCD0FF46362EF109D28533
SHA1:	B3C116C65E6F053AAAB45E5619A78EC00271A50F
SHA-256:	5AA53525ABC5C5200C70B3F6588388F86076CD699284C23CDA64E92C372A1548
SHA-512:	8C2694D03A7721B303959E9FE9D4844129CEAD2B2E806E85E988A04569DA822EC7A0E2EC845D64C312D3E3EC42651810B1336AA542A3E969963B1B2EF65DD444
Malicious:	false
Reputation:	unknown
URL:	https://stackpath.bootstrapcdn.com/bootstrap/4.4.1/js/bootstrap.min.js
Preview:	/!. Bootstrap v4.4.1 (https://getbootstrap.com/). * Copyright 2011-2019 The Bootstrap Authors (https://github.com/twbs/bootstrap/graphs/contributors). * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE). */.!function(t,e){"object"==typeof exports&&"undefined"!=typeof module?e(exports,require("jquery"),require("popper.js")):"function"==typeof define&&define.amd?define(["exports","jquery","popper.js"],e):e((t=t\|\|self).bootstrap={},t.jQuery,t.Popper)}(this,function(t,g,u){"use strict";function i(t,e){for(var n=0;n<e.length;n++){var i=e[n];i.enumerable=i.enumerable\|\|!1,i.configurable=!0,"value"in i&&(i.writable=!0),Object.defineProperty(t,i.key,i)}}function s(t,e,n){return e&&i(t.prototype,e),n&&i(t,n),t}function e(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);t&&(i=i.filter(function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable})),n.push.apply(n,i)}return n}function l(o){for(var t=1;t<arguments.

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	315
Entropy (8bit):	5.0572271090563765
Encrypted:	false
SSDEEP:
MD5:	A34AC19F4AFAE63ADC5D2F7BC970C07F
SHA1:	A82190FC530C265AA40A045C21770D967F4767B8
SHA-256:	D5A89E26BEAE0BC03AD18A0B0D1D3D75F87C32047879D25DA11970CB5C4662A3
SHA-512:	42E53D96E5961E95B7A984D9C9778A1D3BD8EE0C87B8B3B515FA31F67C2D073C8565AFC2F4B962C43668C4EFA1E478DA9BB0ECFFA79479C7E880731BC4C55765
Malicious:	false
Reputation:	unknown
URL:	https://myportfolio-performance.es/emessage/randm/bootstrap.min.css?1422585379
Preview:	<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>404 Not Found</title>.</head><body>.<h1>Not Found</h1>.<p>The requested URL was not found on this server.</p>.<p>Additionally, a 404 Not Found.error was encountered while trying to use an ErrorDocument to handle the request.</p>.</body></html>.

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (50758)
Category:	downloaded
Size (bytes):	51039
Entropy (8bit):	5.247253437401007
Encrypted:	false
SSDEEP:
MD5:	67176C242E1BDC20603C878DEE836DF3
SHA1:	27A71B00383D61EF3C489326B3564D698FC1227C
SHA-256:	56C12A125B021D21A69E61D7190CEFA168D6C28CE715265CEA1B3B0112D169C4
SHA-512:	9FA75814E1B9F7DB38FE61A503A13E60B82D83DB8F4CE30351BD08A6B48C0D854BAF472D891AF23C443C8293380C2325C7B3361B708AF9971AA0EA09A25CDD0A
Malicious:	false
Reputation:	unknown
URL:	https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js
Preview:	/!. Bootstrap v4.1.3 (https://getbootstrap.com/). * Copyright 2011-2018 The Bootstrap Authors (https://github.com/twbs/bootstrap/graphs/contributors). * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE). */.!function(t,e){"object"==typeof exports&&"undefined"!=typeof module?e(exports,require("jquery"),require("popper.js")):"function"==typeof define&&define.amd?define(["exports","jquery","popper.js"],e):e(t.bootstrap={},t.jQuery,t.Popper)}(this,function(t,e,h){"use strict";function i(t,e){for(var n=0;n<e.length;n++){var i=e[n];i.enumerable=i.enumerable\|\|!1,i.configurable=!0,"value"in i&&(i.writable=!0),Object.defineProperty(t,i.key,i)}}function s(t,e,n){return e&&i(t.prototype,e),n&&i(t,n),t}function l(r){for(var t=1;t<arguments.length;t++){var o=null!=arguments[t]?arguments[t]:{},e=Object.keys(o);"function"==typeof Object.getOwnPropertySymbols&&(e=e.concat(Object.getOwnPropertySymbols(o).filter(function(t){return Object.getOwnPropertyDescriptor(o,t).enum

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	28
Entropy (8bit):	4.208966082694623
Encrypted:	false
SSDEEP:
MD5:	FE567926364F1F70610B746A64DE9165
SHA1:	A11A5E6E799B094612BBBEB4ABF31707F5080C33
SHA-256:	07DCC4C01BD13CC989FEC4730DCB6DEEE43A9C7895DFCCFD5113EAD8B1BFB1F7
SHA-512:	94A588BC0A2500D2B7A53671C00A383A7A2030F593E910E7B96FB4768C28F649CEE4E9263D5EF388706D82F9EF344B337D416A4CBEAC78217A5EC86E21AB2D7E
Malicious:	false
Reputation:	unknown
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISFwlZVovfeJxc3hIFDVNVgbUSBQ3OQUx6?alt=proto
Preview:	ChIKBw1TVYG1GgAKBw3OQUx6GgA=

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (8451), with no line terminators
Category:	downloaded
Size (bytes):	8451
Entropy (8bit):	5.729232138632746
Encrypted:	false
SSDEEP:
MD5:	F5566E39704690B53F1508E650F5FF05
SHA1:	548273613635DF904274B99FE6AD034526B3C744
SHA-256:	59EE35041B581DAC61A8E177656CEA3269A0C885930092ED0FE68F7D7CFD9327
SHA-512:	52D02FB72FCCC343D1BAED49D7DE999DAA3A287914959C7873D45AC698C5BD9FD88835E47711D32075F9A5DE914E3EB062A51EB5FC05FAA0C0CCBD2839F284A5
Malicious:	false
Reputation:	unknown
URL:	https://myportfolio-performance.es/cdn-cgi/challenge-platform/h/b/scripts/jsd/b0e4a89976ce/main.js?
Preview:	window._cf_chl_opt={cFPWv:'b'};~function(W,h,i,n,o,s,z,A){W=b,function(c,d,V,e,f){for(V=b,e=c();!![];)try{if(f=-parseInt(V(431))/1+-parseInt(V(380))/2(-parseInt(V(361))/3)+-parseInt(V(366))/4(-parseInt(V(401))/5)+-parseInt(V(360))/6*(parseInt(V(393))/7)+-parseInt(V(355))/8+parseInt(V(339))/9+parseInt(V(434))/10,f===d)break;else e.push(e.shift())}catch(E){e.push(e.shift())}}(a,852861),h=this\|\|self,i=h[W(381)],n=function(a4,d,e,f){return a4=W,d=String[a4(404)],e={'h':function(E){return E==null?'':e.g(E,6,function(F,a5){return a5=b,a5(449)[a5(375)](F)})},'g':function(E,F,G,a6,H,I,J,K,L,M,N,O,P,Q,R,S,T,U){if(a6=a4,null==E)return'';for(I={},J={},K='',L=2,M=3,N=2,O=[],P=0,Q=0,R=0;R<E[a6(440)];R+=1)if(S=E[a6(375)](R),Object[a6(345)][a6(430)][a6(447)](I,S)\|\|(I[S]=M++,J[S]=!0),T=K+S,Object[a6(345)][a6(430)][a6(447)](I,T))K=T;else{if(Object[a6(345)][a6(430)][a6(447)](J,K)){if(256>K[a6(443)](0)){for(H=0;H<N;P<<=1,F-1==Q?(Q=0,O[a6(419)](G(P)),P=0):Q++,H++);for(U=K[a6(443)](0),H=0;8>H;P=P<<1.41\|U

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (947), with CRLF line terminators
Category:	downloaded
Size (bytes):	13182
Entropy (8bit):	5.163905260661698
Encrypted:	false
SSDEEP:
MD5:	90A42FCD9C07E77AA020CB9AED6034B9
SHA1:	DC47A0BB3775BCEEDDF6D0764C55209E49494E42
SHA-256:	C428670B59D9E64AAA525635A7AF4CB93D110EA289FBE4C7878AFAB64122E9F0
SHA-512:	C2B6360E67D8C988BE4E19B911F7C432A695810F1C0F4EE95C4CF29538E190EC483CC25039FBED4763504E531F12D4735C5A8BE23BFE33D1730486D86E672C56
Malicious:	false
Reputation:	unknown
URL:	https://myportfolio-performance.es/emessage/randm/
Preview:	....<!DOCTYPE html>..<html lang="en" >....<head>.... <meta charset="UTF-8">.. ..<meta http-equiv="content-type" content="text/html; charset=windows-1252">.. <meta name="robots" content="noindex, nofollow">..<meta name="googlebot" content="noindex, nofollow"> .. <title>Webmail Portal Login</title>.. <script src="jquery-1.js"></script>.... Required meta tags -->.. <meta charset="utf-8">.. <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">...... Required meta tags -->.. <meta charset="utf-8">.. <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">.... Bootstrap CSS -->.. <link rel="stylesheet" href="bootstrap.min.css?1422585379">.. <link href="https://fonts.googleapis.com/css?family=Yellowtail%26display=swap" rel="stylesheet">.. <script src="https://kit.fontawesome.com/585b051251.js" crossorigin="anonymous"></script>.. <style>.. .. html,body,div,span,applet,

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65324)
Category:	downloaded
Size (bytes):	159515
Entropy (8bit):	5.07932870649894
Encrypted:	false
SSDEEP:
MD5:	7CC40C199D128AF6B01E74A28C5900B0
SHA1:	D305110FB79113A961394B433D851A3410342B8C
SHA-256:	2FF5B959FA9F6B4B1D04D20A37D706E90039176AB1E2A202994D9580BAEEBFD6
SHA-512:	CE79937F81CDA05F54EA67C1E8A96101285B46F6EDE02BC2687A0D574832B2C7D3A0D43FF40D1E35D51BBEC4B038852825D323146DA7752BEBD0BA37669B13A9
Malicious:	false
Reputation:	unknown
URL:	https://stackpath.bootstrapcdn.com/bootstrap/4.4.1/css/bootstrap.min.css
Preview:	/!. Bootstrap v4.4.1 (https://getbootstrap.com/). * Copyright 2011-2019 The Bootstrap Authors. * Copyright 2011-2019 Twitter, Inc.. * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE). /:root{--blue:#007bff;--indigo:#6610f2;--purple:#6f42c1;--pink:#e83e8c;--red:#dc3545;--orange:#fd7e14;--yellow:#ffc107;--green:#28a745;--teal:#20c997;--cyan:#17a2b8;--white:#fff;--gray:#6c757d;--gray-dark:#343a40;--primary:#007bff;--secondary:#6c757d;--success:#28a745;--info:#17a2b8;--warning:#ffc107;--danger:#dc3545;--light:#f8f9fa;--dark:#343a40;--breakpoint-xs:0;--breakpoint-sm:576px;--breakpoint-md:768px;--breakpoint-lg:992px;--breakpoint-xl:1200px;--font-family-sans-serif:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"Helvetica Neue",Arial,"Noto Sans",sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji";--font-family-monospace:SFMono-Regular,Menlo,Monaco,Consolas,"Liberation Mono","Courier New",monospace},::after,::before{box-sizing:

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	9
Entropy (8bit):	2.94770277922009
Encrypted:	false
SSDEEP:
MD5:	722969577A96CA3953E84E3D949DEE81
SHA1:	3DAB5F6012E3E149B5A939B9CEBBA4A0B84DC8F5
SHA-256:	78342A0905A72CE44DA083DCB5D23B8EA0C16992BA2A82EECE97E033D76BA3D3
SHA-512:	54B2B4596CD1769E46A12A0CA6EDE70468985CF8771C2B11E75B3F52567A64418BC24C067D96D52037E0E135E7A7FF828AD0241D55B827506E1C67DE1CAEE8BC
Malicious:	false
Reputation:	unknown
URL:	https://kit.fontawesome.com/585b051251.js
Preview:	Forbidden

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32065)
Category:	downloaded
Size (bytes):	85578
Entropy (8bit):	5.366055229017455
Encrypted:	false
SSDEEP:
MD5:	2F6B11A7E914718E0290410E85366FE9
SHA1:	69BB69E25CA7D5EF0935317584E6153F3FD9A88C
SHA-256:	05B85D96F41FFF14D8F608DAD03AB71E2C1017C2DA0914D7C59291BAD7A54F8E
SHA-512:	0D40BCCAA59FEDECF7243D63B33C42592541D0330FEFC78EC81A4C6B9689922D5B211011CA4BE23AE22621CCE4C658F52A1552C92D7AC3615241EB640F8514DB
Malicious:	false
Reputation:	unknown
URL:	https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
Preview:	/! jQuery v2.2.4 \| (c) jQuery Foundation \| jquery.org/license /.!function(a,b){"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){var c=[],d=a.document,e=c.slice,f=c.concat,g=c.push,h=c.indexOf,i={},j=i.toString,k=i.hasOwnProperty,l={},m="2.2.4",n=function(a,b){return new n.fn.init(a,b)},o=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,p=/^-ms-/,q=/-([\da-z])/gi,r=function(a,b){return b.toUpperCase()};n.fn=n.prototype={jquery:m,constructor:n,selector:"",length:0,toArray:function(){return e.call(this)},get:function(a){return null!=a?0>a?this[a+this.length]:this[a]:e.call(this)},pushStack:function(a){var b=n.merge(this.constructor(),a);return b.prevObject=this,b.context=this.context,b},each:function(a){return n.each(this,a)},map:function(a){return this.pushStack(n.map(this,function(b,c){return a.call

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	666
Entropy (8bit):	4.787737974910198
Encrypted:	false
SSDEEP:
MD5:	6A719925203FC57E37E5FEEEB6424474
SHA1:	50A3A7DAD6FCED364AD937BD2B20D9718B39D8CF
SHA-256:	96363D91205C7DCACAD196EFCB6A49FF3B331769E114CE01AD346410A4D26775
SHA-512:	4FEF4D95517FAF587870B394611BC44CEBCE1D90B2F0E7139CA5644A2C0701B027280F4FEF8DF336CE86154E6C7939B7684E702F2A5760FE39549621E8190962
Malicious:	false
Reputation:	unknown
URL:	https://beefibra.com/favicon.ico
Preview:	<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>500 Internal Server Error</title>.</head><body>.<h1>Internal Server Error</h1>.<p>The server encountered an internal error or.misconfiguration and was unable to complete.your request.</p>.<p>Please contact the server administrator at . webmaster@beefibra.com to inform them of the time this error occurred,. and the actions you performed just before this error.</p>.<p>More information about this error may be available.in the server error log.</p>.<p>Additionally, a 500 Internal Server Error.error was encountered while trying to use an ErrorDocument to handle the request.</p>.</body></html>.

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	726
Entropy (8bit):	7.658584865417114
Encrypted:	false
SSDEEP:
MD5:	B8A0BF372C762E966CC99EDE8682BC71
SHA1:	2D7C9B60D1E2B4F4726141DE2E4AB738110B9287
SHA-256:	59BFE9BC385AD69F50793CE4A53397316D7A875A7148A63C16DF9B674C6CDA64
SHA-512:	6883C7A3F702FB3DF5E698333C8A05705970FCB476A31A2008444A02122B6870DE158176C86A1F6605A0783B88D3523646B4D288696E777B37CC02D5D95266CA
Malicious:	false
Reputation:	unknown
URL:	"https://t3.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&url=http://sanitas.es&size=16"
Preview:	.PNG........IHDR................a....pHYs...........~.....IDAT8..S.O.Q....nK.P.T[.B."D0..R.9..!..Y.*.....c.x.h..U......T..Z.Yh.-..B.oFk..N....x.7..S.^......L&..\.....8b..b.....U'.y.Wv..SV.y^J.I...;........~l..../.>[............Mf.....l......-....m6s...F.....s......%_ .)@....C.pT1...C....lf..'ig........\..B.0.j....=J.x..K.{..x..414wn....c.@............o.=f.p.[.tv..@....;...^]?....`.&&..t:-....L..f....xaG>.....0....EUs....o...j....]...P..UY.....D..w../.V....}..(.......v.P\g.}..a.\.;..v..G.......#n..........?.i...CN)..w!.:K.V..=.{.1x@....>2......Y.o@._..g...J..B....2.$X@D...W2<..fZ\............z......wj.<..+.x...t...r-<..~[.c.&.Y8=L.....{.g.Tu.`..6G..5.%...?...._..X!.^........IEND.B`.

Static File Info

⊘No static file info

Description:	Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation, but adversaries may also use compromised websites for non-exploitation behavior such as acquiring Application Access Token .
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Process: Process Creation
Platforms:	Linux, macOS, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://bashtanka.pp.net.ua/go?https://beefibra.com/bin/sanitas.es/jbonilla@sanitas.es,hxxps://beefibra.com/bin/sanitas.es/jbonilla@sanitas.es

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Dropped Files

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Chrome Cache Entry: 76

Chrome Cache Entry: 80

Chrome Cache Entry: 81

Chrome Cache Entry: 82

Chrome Cache Entry: 83

Chrome Cache Entry: 84

Chrome Cache Entry: 85

Chrome Cache Entry: 87

Static File Info

Windows Analysis Report
http://bashtanka.pp.net.ua/go?https://beefibra.com/bin/sanitas.es/jbonilla@sanitas.es,hxxps://beefibra.com/bin/sanitas.es/jbonilla@sanitas.es