Edit tour

Windows Analysis Report
http://mail.elgrillo.mx/js/captcha.html#b2JkdWxpYS5zYW5jaGV6QGFuYWludGVyY29udGluZW50YWwtdG9reW8uanA=&target=_blank

Overview

General Information

Sample URL:	http://mail.elgrillo.mx/js/captcha.html#b2JkdWxpYS5zYW5jaGV6QGFuYWludGVyY29udGluZW50YWwtdG9reW8uanA=&target=_blank
Analysis ID:	664505
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Phishing site detected (based on favicon image match)

Antivirus detection for URL or domain

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5188 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "http://mail.elgrillo.mx/js/captcha.html#b2JkdWxpYS5zYW5jaGV6QGFuYWludGVyY29udGluZW50YWwtdG9reW8uanA=&target=_blank MD5: C139654B5C1438A95B321BB01AD63EF6)

chrome.exe (PID: 2292 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1508,12251894958441046289,483157162646382018,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1904 /prefetch:8 MD5: C139654B5C1438A95B321BB01AD63EF6)

cleanup

Source: https://fathomless-temple-10166.herokuapp.com/general/noRobot.html?usr=obdulia.sanchez@anaintercontinental-tokyo.jp&interceptiontype=VerifyLogin&interceptiontype=VerifyLogin&service=freemail&successURL=https%3A%2F%sharepoint%2Flogin&statistics=xRbXFc8VKmF6s%2Frp6a5qP4z%2FNdyBHKIvfVNtKKZ%2FMq1vzDMmvcNacavpkSKc0VdsoMzKeZnxxL%2Fl2FTNDJCnPcIHjxpzAgCgOro1V2sZbBxg%3D%3D&username=sdada&requestSecurityToken=9f8d7962-0d22-4c86-8ab0-862cfe04d2e9

SlashNext: Label: Credential Stealing type: Phishing & Social Engineering

Phishing

Phishing site detected (based on favicon image match)

Matcher: Template: google matched with high similarity

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic			Jump to behavior

Source: unknown	HTTPS traffic detected: 172.217.16.196:443 -> 192.168.2.3:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.208.186.182:443 -> 192.168.2.3:49767 version: TLS 1.2

Source: unknown

DNS traffic detected: queries for: clients2.google.com

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 15 Jul 2022 00:40:44 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, Keep-AliveLast-Modified: Wed, 13 Jul 2022 02:24:07 GMTETag: "2f40010-3b7-5e3a67abf7fc0-gzip"Accept-Ranges: bytesVary: Accept-Encoding,User-AgentContent-Encoding: gzipContent-Length: 633Keep-Alive: timeout=5Content-Type: text/htmlData Raw: 1f 8b 08 00 00 00 00 00 00 03 7d 53 6d 4f a3 40 10 fe 2c bf 82 70 69 85 ab 85 16 3d ae 5e 45 e3 4b 1a bd d6 6a aa 36 17 9b 5e b2 5d 06 8a 85 5d dc 5d 90 d6 f8 df 6f 68 7d b9 4b cc 25 10 96 67 5e 9e d9 99 67 0e e6 2a 4d 0e b5 03 49 45 9c 29 5d 2d 33 f0 0d 05 a5 72 1e 48 41 36 a8 71 a8 e9 ba 5e bd 8e 53 10 a1 17 52 e8 be 1e 81 ba 13 c9 98 08 69 5a 13 03 31 63 da ad 7c 3e 3c 9e 62 16 f0 27 3b e1 94 a8 98 33 7b 2e 20 b4 65 12 53 30 3f 35 21 06 e5 55 68 6e 7f d9 b6 f4 86 de b6 ba da 16 66 f2 f5 00 28 0f e0 6e 74 71 ca d3 8c 33 60 ca 44 bc 32 53 ce a4 d2 d3 e5 b1 10 64 89 94 08 db 32 4b 62 65 1a 75 c3 5a 87 7f 14 42 14 9f 99 af be 93 d6 b4 8a 77 1c 92 80 78 4f 57 d5 9e 4a 19 f9 ba 11 33 05 82 42 56 95 b7 ee ca 18 44 1c 2e 07 3c 8a 59 fd bf 46 09 a2 c0 3b fa a1 00 48 49 9c d4 65 4e 29 48 79 37 1a f8 73 a5 32 59 db 3d ae b9 bd 9a 9c 13 01 19 c7 5c f8 97 6c 42 15 b6 43 aa 98 4a bf 1c cd 7e f5 68 67 dc 4f 7b 9e 44 07 91 79 e4 db e3 f5 de 0a cf c3 60 79 72 de bf 28 c2 f1 50 f5 fb f7 88 5c 3e b6 8b d5 d9 65 5a d0 21 a1 a4 c8 16 37 7d da 1a 07 92 5f ae fa 70 cf ca 72 50 71 b8 bd db e1 d9 cf 53 76 4d 2f ce 1f ca 6c 75 1c 9d 46 57 82 b7 c7 ae bc 9f 9d 94 51 6d f7 0c 9f 7a 8e 37 60 24 05 5f 06 24 20 75 01 8f 39 48 75 03 34 17 b1 5a de f2 05 30 7f 3f ec 04 df f7 3d b7 d9 0a 5c b7 b9 47 3b 5e b3 43 66 ad 66 c7 73 69 08 ad bd c0 85 7d a3 ab 6d 44 f3 77 8f 3f 9b bc 6f ac fb f2 c3 71 42 a2 e6 3c 4d b0 5b 4d 05 69 96 40 b3 dd 6a 7b 9e 3d 07 c1 17 39 c9 32 9b f2 d4 89 80 81 20 89 c3 f8 88 cf b8 b2 2b 0d 1f e5 a8 14 a3 81 24 0d 1c 7d a3 9a 22 d2 87 39 a3 15 cd 3f 6a d5 9f ab b2 36 42 45 00 05 f2 fc d2 7d 87 32 22 94 fc 44 bd 12 88 a0 73 1b 47 96 10 54 b0 33 39 aa 4f 1b e6 e4 b7 8f 1f cb c7 43 7d fa d5 72 a2 78 47 7f 23 35 d3 9d 05 2c 77 0a 92 e4 f0 46 fa ca 22 27 68 99 56 82 ad 8c a8 bc ad b5 f5 c5 da d4 21 40 e5 82 ad 1d bb da 8b a6 1d 38 9b 4d c4 45 75 d6 0b fb 07 25 cc 0f 3b b7 03 00 00 Data Ascii: }SmO@,pi=^EKj6^]]]oh}K%g^g*MIE)]-3rHA6q^SRiZ1c|><b';3{. eS0?5!Uhnf(ntq3`D2Sd2KbeuZBwxOWJ3BVD.<YF;HIeN)Hy7s2Y=\lBCJ~hgO{Dy`yr(P\>eZ!7}_prPqSvM/luFWQmz7`$_$ u9Hu4Z0?=\G;^Cffsi}mDw?oqB<M[Mi@j{=92 +$}"9?j6BE}2"DsGT39OC}rxG#5,wF"'hV!@8MEu%;

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfmX-Goog-Update-Updater: chromecrx-85.0.4183.121Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /general/noRobot.html?usr=obdulia.sanchez@anaintercontinental-tokyo.jp&interceptiontype=VerifyLogin&interceptiontype=VerifyLogin&service=freemail&successURL=https%3A%2F%sharepoint%2Flogin&statistics=xRbXFc8VKmF6s%2Frp6a5qP4z%2FNdyBHKIvfVNtKKZ%2FMq1vzDMmvcNacavpkSKc0VdsoMzKeZnxxL%2Fl2FTNDJCnPcIHjxpzAgCgOro1V2sZbBxg%3D%3D&username=sdada&requestSecurityToken=9f8d7962-0d22-4c86-8ab0-862cfe04d2e9 HTTP/1.1Host: fathomless-temple-10166.herokuapp.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: http://mail.elgrillo.mx/js/captcha.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /general/geo.js HTTP/1.1Host: fathomless-temple-10166.herokuapp.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://fathomless-temple-10166.herokuapp.com/general/noRobot.html?usr=obdulia.sanchez@anaintercontinental-tokyo.jp&interceptiontype=VerifyLogin&interceptiontype=VerifyLogin&service=freemail&successURL=https%3A%2F%sharepoint%2Flogin&statistics=xRbXFc8VKmF6s%2Frp6a5qP4z%2FNdyBHKIvfVNtKKZ%2FMq1vzDMmvcNacavpkSKc0VdsoMzKeZnxxL%2Fl2FTNDJCnPcIHjxpzAgCgOro1V2sZbBxg%3D%3D&username=sdada&requestSecurityToken=9f8d7962-0d22-4c86-8ab0-862cfe04d2e9Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /general/download.png HTTP/1.1Host: fathomless-temple-10166.herokuapp.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://fathomless-temple-10166.herokuapp.com/general/noRobot.html?usr=obdulia.sanchez@anaintercontinental-tokyo.jp&interceptiontype=VerifyLogin&interceptiontype=VerifyLogin&service=freemail&successURL=https%3A%2F%sharepoint%2Flogin&statistics=xRbXFc8VKmF6s%2Frp6a5qP4z%2FNdyBHKIvfVNtKKZ%2FMq1vzDMmvcNacavpkSKc0VdsoMzKeZnxxL%2Fl2FTNDJCnPcIHjxpzAgCgOro1V2sZbBxg%3D%3D&username=sdada&requestSecurityToken=9f8d7962-0d22-4c86-8ab0-862cfe04d2e9Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /get_html.php HTTP/1.1Host: api.hostip.infoConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Origin: https://fathomless-temple-10166.herokuapp.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://fathomless-temple-10166.herokuapp.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /%2084.17.52.14 HTTP/1.1Host: ipinfo.ioConnection: keep-aliveAccept: application/json, text/javascript, /; q=0.01User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Origin: https://fathomless-temple-10166.herokuapp.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://fathomless-temple-10166.herokuapp.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dns/valid.php?callback=jQuery33106207367861595807_1657878046190&domain=obdulia.sanchez%40anaintercontinental-tokyo.jp&loc=&_=1657878046191 HTTP/1.1Host: hancott.bizConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://fathomless-temple-10166.herokuapp.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /84.17.52.14 HTTP/1.1Host: ipinfo.ioConnection: keep-aliveAccept: application/json, text/javascript, /; q=0.01User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Origin: https://fathomless-temple-10166.herokuapp.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://fathomless-temple-10166.herokuapp.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s2/favicons?domain=google.com HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://fathomless-temple-10166.herokuapp.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: fathomless-temple-10166.herokuapp.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://fathomless-temple-10166.herokuapp.com/general/noRobot.html?usr=obdulia.sanchez@anaintercontinental-tokyo.jp&interceptiontype=VerifyLogin&interceptiontype=VerifyLogin&service=freemail&successURL=https%3A%2F%sharepoint%2Flogin&statistics=xRbXFc8VKmF6s%2Frp6a5qP4z%2FNdyBHKIvfVNtKKZ%2FMq1vzDMmvcNacavpkSKc0VdsoMzKeZnxxL%2Fl2FTNDJCnPcIHjxpzAgCgOro1V2sZbBxg%3D%3D&username=sdada&requestSecurityToken=9f8d7962-0d22-4c86-8ab0-862cfe04d2e9Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s2/favicons?domain=google.com HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: www.google.com
Source: global traffic	HTTP traffic detected: GET /general/download.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: fathomless-temple-10166.herokuapp.com
Source: global traffic	HTTP traffic detected: GET /js/captcha.html HTTP/1.1Host: mail.elgrillo.mxConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closeDate: Fri, 15 Jul 2022 00:40:48 GMTServer: ApacheContent-Length: 196Content-Type: text/html; charset=iso-8859-1Via: 1.1 vegur

Source: pnacl_public_x86_64_pnacl_sz_nexe.0.dr, pnacl_public_x86_64_pnacl_llc_nexe.0.dr	String found in binary or memory: http://llvm.org/):
Source: History Provider Cache.0.dr	String found in binary or memory: http://mail.elgrillo.mx/js/captcha.html#b2JkdWxpYS5zYW5jaGV6QGFuYWludGVyY29udGluZW50YWwtdG9reW8uanA=
Source: 5d5426a7-d248-4df7-bf03-39d7ad77a092.tmp.1.dr, e0886d92-a4c4-4443-985b-8d982c8edfe4.tmp.1.dr	String found in binary or memory: https://accounts.google.com
Source: craw_window.js.0.dr	String found in binary or memory: https://accounts.google.com/MergeSession
Source: e0886d92-a4c4-4443-985b-8d982c8edfe4.tmp.1.dr	String found in binary or memory: https://ajax.googleapis.com
Source: 5d5426a7-d248-4df7-bf03-39d7ad77a092.tmp.1.dr, e0886d92-a4c4-4443-985b-8d982c8edfe4.tmp.1.dr	String found in binary or memory: https://apis.google.com
Source: pnacl_public_x86_64_libpnacl_irt_shim_dummy_a.0.dr	String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-clang.git
Source: pnacl_public_x86_64_libpnacl_irt_shim_dummy_a.0.dr	String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-llvm.git
Source: 5d5426a7-d248-4df7-bf03-39d7ad77a092.tmp.1.dr, e0886d92-a4c4-4443-985b-8d982c8edfe4.tmp.1.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json1.0.dr, manifest.json.0.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 5d5426a7-d248-4df7-bf03-39d7ad77a092.tmp.1.dr, e0886d92-a4c4-4443-985b-8d982c8edfe4.tmp.1.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: pnacl_public_x86_64_ld_nexe.0.dr	String found in binary or memory: https://code.google.com/p/nativeclient/issues/entry
Source: pnacl_public_x86_64_ld_nexe.0.dr	String found in binary or memory: https://code.google.com/p/nativeclient/issues/entry%s:
Source: 5d5426a7-d248-4df7-bf03-39d7ad77a092.tmp.1.dr, 282e3027-6b1b-4f92-965b-a718e6e6ab7b.tmp.1.dr, 2ebf4933-24bd-49ff-9217-d357de713c59.tmp.1.dr, e0886d92-a4c4-4443-985b-8d982c8edfe4.tmp.1.dr	String found in binary or memory: https://dns.google
Source: History Provider Cache.0.dr	String found in binary or memory: https://fathomless-temple-10166.herokuapp.com/general/noRobot.html?usr=obdulia.sanchez
Source: 5d5426a7-d248-4df7-bf03-39d7ad77a092.tmp.1.dr	String found in binary or memory: https://fonts.googleapis.com
Source: 5d5426a7-d248-4df7-bf03-39d7ad77a092.tmp.1.dr, e0886d92-a4c4-4443-985b-8d982c8edfe4.tmp.1.dr	String found in binary or memory: https://fonts.gstatic.com
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p
Source: 5d5426a7-d248-4df7-bf03-39d7ad77a092.tmp.1.dr, e0886d92-a4c4-4443-985b-8d982c8edfe4.tmp.1.dr	String found in binary or memory: https://ogs.google.com
Source: craw_window.js.0.dr, manifest.json.0.dr	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: 5d5426a7-d248-4df7-bf03-39d7ad77a092.tmp.1.dr, e0886d92-a4c4-4443-985b-8d982c8edfe4.tmp.1.dr	String found in binary or memory: https://play.google.com
Source: e0886d92-a4c4-4443-985b-8d982c8edfe4.tmp.1.dr	String found in binary or memory: https://r3---sn-1gi7znes.gvt1.com
Source: e0886d92-a4c4-4443-985b-8d982c8edfe4.tmp.1.dr	String found in binary or memory: https://redirector.gvt1.com
Source: craw_window.js.0.dr, manifest.json.0.dr	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: 5d5426a7-d248-4df7-bf03-39d7ad77a092.tmp.1.dr, e0886d92-a4c4-4443-985b-8d982c8edfe4.tmp.1.dr	String found in binary or memory: https://ssl.gstatic.com
Source: e0886d92-a4c4-4443-985b-8d982c8edfe4.tmp.1.dr	String found in binary or memory: https://t2.gstatic.com
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://www-googleapis-staging.sandbox.google.com
Source: 5d5426a7-d248-4df7-bf03-39d7ad77a092.tmp.1.dr, e0886d92-a4c4-4443-985b-8d982c8edfe4.tmp.1.dr	String found in binary or memory: https://www.google.com
Source: manifest.json.0.dr	String found in binary or memory: https://www.google.com/
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/accounts/OAuthLogin?issueuberauth=1
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/cleardot.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/dot2.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/x2.gif
Source: craw_background.js.0.dr	String found in binary or memory: https://www.google.com/intl/en-US/chrome/blank.html
Source: 5d5426a7-d248-4df7-bf03-39d7ad77a092.tmp.1.dr, craw_window.js.0.dr, craw_background.js.0.dr, e0886d92-a4c4-4443-985b-8d982c8edfe4.tmp.1.dr	String found in binary or memory: https://www.googleapis.com
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: 5d5426a7-d248-4df7-bf03-39d7ad77a092.tmp.1.dr, e0886d92-a4c4-4443-985b-8d982c8edfe4.tmp.1.dr	String found in binary or memory: https://www.gstatic.com

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "http://mail.elgrillo.mx/js/captcha.html#b2JkdWxpYS5zYW5jaGV6QGFuYWludGVyY29udGluZW50YWwtdG9reW8uanA=&target=_blank
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1508,12251894958441046289,483157162646382018,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1904 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1508,12251894958441046289,483157162646382018,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1904 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	3 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	5 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	6 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	4 Ingress Tool Transfer	SIM Card Swap		Carrier Billing Fraud

Source	Detection	Scanner	Label	Link
http://mail.elgrillo.mx/js/captcha.html#b2JkdWxpYS5zYW5jaGV6QGFuYWludGVyY29udGluZW50YWwtdG9reW8uanA=&target=_blank	0%	Virustotal		Browse
http://mail.elgrillo.mx/js/captcha.html#b2JkdWxpYS5zYW5jaGV6QGFuYWludGVyY29udGluZW50YWwtdG9reW8uanA=&target=_blank	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Link
C:\Users\user\AppData\Local\Temp\5188_2057967304\_platform_specific\x86_64\pnacl_public_x86_64_ld_nexe	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\5188_2057967304\_platform_specific\x86_64\pnacl_public_x86_64_ld_nexe	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\5188_2057967304\_platform_specific\x86_64\pnacl_public_x86_64_ld_nexe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\5188_2057967304\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_llc_nexe	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\5188_2057967304\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_llc_nexe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\5188_2057967304\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_sz_nexe	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\5188_2057967304\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_sz_nexe	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
https://fathomless-temple-10166.herokuapp.com/general/noRobot.html?usr=obdulia.sanchez@anaintercontinental-tokyo.jp&interceptiontype=VerifyLogin&interceptiontype=VerifyLogin&service=freemail&successURL=https%3A%2F%sharepoint%2Flogin&statistics=xRbXFc8VKmF6s%2Frp6a5qP4z%2FNdyBHKIvfVNtKKZ%2FMq1vzDMmvcNacavpkSKc0VdsoMzKeZnxxL%2Fl2FTNDJCnPcIHjxpzAgCgOro1V2sZbBxg%3D%3D&username=sdada&requestSecurityToken=9f8d7962-0d22-4c86-8ab0-862cfe04d2e9	100%	SlashNext	Credential Stealing type: Phishing & Social Engineering
https://fathomless-temple-10166.herokuapp.com/general/download.png	0%	Avira URL Cloud	safe
https://dns.google	0%	URL Reputation	safe
https://fathomless-temple-10166.herokuapp.com/general/geo.js	0%	Avira URL Cloud	safe
https://fathomless-temple-10166.herokuapp.com/general/noRobot.html?usr=obdulia.sanchez	0%	Avira URL Cloud	safe
https://api.hostip.info/get_html.php	2%	Virustotal		Browse
https://api.hostip.info/get_html.php	0%	Avira URL Cloud	safe
https://hancott.biz/dns/valid.php?callback=jQuery33106207367861595807_1657878046190&domain=obdulia.sanchez%40anaintercontinental-tokyo.jp&loc=&_=1657878046191	0%	Avira URL Cloud	safe
http://mail.elgrillo.mx/js/captcha.html	0%	Virustotal		Browse
http://mail.elgrillo.mx/js/captcha.html	0%	Avira URL Cloud	safe
https://fathomless-temple-10166.herokuapp.com/favicon.ico	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
hancott.biz	79.110.52.9	true	false	unknown
accounts.google.com	142.250.181.237	true	false	high
mail.elgrillo.mx	107.180.50.236	true	false	unknown
ipinfo.io	34.117.59.81	true	false	high
fathomless-temple-10166.herokuapp.com	54.208.186.182	true	false	unknown
www.google.com	172.217.16.196	true	false	high
clients.l.google.com	216.58.212.142	true	false	high
api.hostip.info	104.21.84.241	true	false	unknown
clients2.google.com	unknown	unknown	false	high

Name	Malicious	Antivirus Detection	Reputation
https://fathomless-temple-10166.herokuapp.com/general/download.png	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/84.17.52.14	false		high
https://fathomless-temple-10166.herokuapp.com/general/geo.js	false	Avira URL Cloud: safe	unknown
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1	false		high
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false		high
https://api.hostip.info/get_html.php	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://hancott.biz/dns/valid.php?callback=jQuery33106207367861595807_1657878046190&domain=obdulia.sanchez%40anaintercontinental-tokyo.jp&loc=&_=1657878046191	false	Avira URL Cloud: safe	unknown
https://www.google.com/s2/favicons?domain=google.com	false		high
http://mail.elgrillo.mx/js/captcha.html	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://fathomless-temple-10166.herokuapp.com/favicon.ico	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/%2084.17.52.14	false		high

Name	Source	Malicious	Antivirus Detection	Reputation
https://dns.google	5d5426a7-d248-4df7-bf03-39d7ad77a092.tmp.1.dr, 282e3027-6b1b-4f92-965b-a718e6e6ab7b.tmp.1.dr, 2ebf4933-24bd-49ff-9217-d357de713c59.tmp.1.dr, e0886d92-a4c4-4443-985b-8d982c8edfe4.tmp.1.dr	false	URL Reputation: safe	unknown
https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p	craw_window.js.0.dr, craw_background.js.0.dr	false		high
https://www.google.com/intl/en-US/chrome/blank.html	craw_background.js.0.dr	false		high
https://ogs.google.com	5d5426a7-d248-4df7-bf03-39d7ad77a092.tmp.1.dr, e0886d92-a4c4-4443-985b-8d982c8edfe4.tmp.1.dr	false		high
https://www.google.com/images/cleardot.gif	craw_window.js.0.dr	false		high
https://play.google.com	5d5426a7-d248-4df7-bf03-39d7ad77a092.tmp.1.dr, e0886d92-a4c4-4443-985b-8d982c8edfe4.tmp.1.dr	false		high
https://fathomless-temple-10166.herokuapp.com/general/noRobot.html?usr=obdulia.sanchez	History Provider Cache.0.dr	false	Avira URL Cloud: safe	unknown
https://payments.google.com/payments/v4/js/integrator.js	craw_window.js.0.dr, manifest.json.0.dr	false		high
https://chromium.googlesource.com/a/native_client/pnacl-llvm.git	pnacl_public_x86_64_libpnacl_irt_shim_dummy_a.0.dr	false		high
https://sandbox.google.com/payments/v4/js/integrator.js	craw_window.js.0.dr, manifest.json.0.dr	false		high
https://www.google.com/images/x2.gif	craw_window.js.0.dr	false		high
https://accounts.google.com/MergeSession	craw_window.js.0.dr	false		high
http://llvm.org/):	pnacl_public_x86_64_pnacl_sz_nexe.0.dr, pnacl_public_x86_64_pnacl_llc_nexe.0.dr	false		high
https://www.google.com	5d5426a7-d248-4df7-bf03-39d7ad77a092.tmp.1.dr, e0886d92-a4c4-4443-985b-8d982c8edfe4.tmp.1.dr	false		high
https://www.google.com/images/dot2.gif	craw_window.js.0.dr	false		high
https://code.google.com/p/nativeclient/issues/entry%s:	pnacl_public_x86_64_ld_nexe.0.dr	false		high
https://code.google.com/p/nativeclient/issues/entry	pnacl_public_x86_64_ld_nexe.0.dr	false		high
https://accounts.google.com	5d5426a7-d248-4df7-bf03-39d7ad77a092.tmp.1.dr, e0886d92-a4c4-4443-985b-8d982c8edfe4.tmp.1.dr	false		high
https://clients2.googleusercontent.com	5d5426a7-d248-4df7-bf03-39d7ad77a092.tmp.1.dr, e0886d92-a4c4-4443-985b-8d982c8edfe4.tmp.1.dr	false		high
https://apis.google.com	5d5426a7-d248-4df7-bf03-39d7ad77a092.tmp.1.dr, e0886d92-a4c4-4443-985b-8d982c8edfe4.tmp.1.dr	false		high
https://www.google.com/accounts/OAuthLogin?issueuberauth=1	craw_window.js.0.dr	false		high
https://www.google.com/	manifest.json.0.dr	false		high
https://www-googleapis-staging.sandbox.google.com	craw_window.js.0.dr, craw_background.js.0.dr	false		high
https://chromium.googlesource.com/a/native_client/pnacl-clang.git	pnacl_public_x86_64_libpnacl_irt_shim_dummy_a.0.dr	false		high
https://clients2.google.com	5d5426a7-d248-4df7-bf03-39d7ad77a092.tmp.1.dr, e0886d92-a4c4-4443-985b-8d982c8edfe4.tmp.1.dr	false		high
https://clients2.google.com/service/update2/crx	manifest.json1.0.dr, manifest.json.0.dr	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
216.58.212.142	clients.l.google.com	United States	15169	GOOGLEUS	false
34.117.59.81	ipinfo.io	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
54.208.186.182	fathomless-temple-10166.herokuapp.com	United States	14618	AMAZON-AESUS	false
107.180.50.236	mail.elgrillo.mx	United States	26496	AS-26496-GO-DADDY-COM-LLCUS	false
79.110.52.9	hancott.biz	Romania	60233	V4ESCROW-ASRO	false
142.250.181.237	accounts.google.com	United States	15169	GOOGLEUS	false
104.21.84.241	api.hostip.info	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.217.16.196	www.google.com	United States	15169	GOOGLEUS	false

Joe Sandbox Version:	35.0.0 Citrine
Analysis ID:	664505
Start date and time: 15/07/202202:39:20	2022-07-15 02:39:20 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://mail.elgrillo.mx/js/captcha.html#b2JkdWxpYS5zYW5jaGV6QGFuYWludGVyY29udGluZW50YWwtdG9reW8uanA=&target=_blank
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	26
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal56.phis.win@29/117@10/11
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI

IP
192.168.2.1
127.0.0.1

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	451603
Entropy (8bit):	5.009711072558331
Encrypted:	false
SSDEEP:	12288:ZHfRTyGZ6lup8Cfrvq4JBPKh+FBlESBw4p6:NfOCzvRKhGvwJ
MD5:	A78AD14E77147E7DE3647E61964C0335
SHA1:	CECC3DD41F4CEA0192B24300C71E1911BD4FCE45
SHA-256:	0D6803758FF8F87081FAFD62E90F0950DFB2DD7991E9607FE76A8F92D0E893FA
SHA-512:	DDE24D5AD50D68FC91E9E325D31E66EF8F624B6BB3A07D14FFED1104D3AB5F4EF1D7969A5CDE0DFBB19CB31C506F7DE97AF67C2F244F7E7E8E10648EA8321101
Malicious:	false
Reputation:	low
Preview:	BDic.... ....6...."..Z..4g....6.2...{/...3...5....AF 1363.AF nm.AF pt.AF n1.AF p.AF tc.AF SM.AF M.AF S.AF MS.AF MNR.AF GDS.AF MNT.AF MH.AF MR.AF SZMR.AF MJ.AF MT.AF MY.AF MRZ.AF MN.AF MG.AF RM.AF N.AF MV.AF XM.AF DSM.AF SD.AF G.AF R.AF MNX.AF MRS.AF MD.AF MNRB.AF B.AF ZSMR.AF PM.AF SMNGJ.AF SMN.AF ZMR.AF SMGB.AF MZR.AF GM.AF SMR.AF SMDG.AF RMZ.AF ZM.AF MDG.AF MDT.AF SMNXT.AF SDY.AF LSDG.AF LGDS.AF GLDS.AF UY.AF U.AF DSGNX.AF GNDSX.AF DSG.AF Y.AF GS.AF IEMS.AF YP.AF ZGDRS.AF XGNVDS.AF UT.AF GNDS.AF GVDS.AF MYPS.AF XGNDS.AF TPRY.AF MDSG.AF ZGSDR.AF DYSG.AF PMYTNS.AF AGDS.AF DRZGS.AF PY.AF GSPMDY.AF EGVDS.AF SL.AF GNXDS.AF DSBG.AF IM.AF I.AF MDGS.AF SMY.AF DSGN.AF DSLG.AF GMDS.AF MDSBG.AF SGD.AF IY.AF P.AF DSMG.AF BLZGDRS.AF TR.AF AGSD.AF ZGBDRSL.AF PTRY.AF ASDGV.AF ASM.AF ICANGSD.AF ICAM.AF IKY.AF AMS.AF PMYTRS.AF BZGVDRS.AF SDRBZG.AF GVMDS.AF PSM.AF DGLS.AF GNVXDS.AF AGDSL.AF DGS.AF XDSGNV.AF BZGDRS.AF AM.AF AS.AF A.AF LDSG.AF AGVDS.AF SDG.AF LDSMG.AF EDSMG.AF EY.AF DRSMZG.AF PRYT.AF LZ

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	215243
Entropy (8bit):	6.071092032576886
Encrypted:	false
SSDEEP:	6144:EzpMpw3nP3OEwkqhGtA/UNm9maqfIlUOoSiuRT:Euw3/ejGtArVoI
MD5:	73D09F80B11E5E928CAA247F908A341F
SHA1:	ECA27039BD0A340430CED26005CC1234E229CEAF
SHA-256:	9FCD0438FA410F1E95938F348A3C68DA0648BFAF3C46E8D3790CEEBEEE59A8A4
SHA-512:	5E72240A807F801FB8A8A6D888B005AF750036573BDC36434CD9D6CC852A7C5BB808EFD18B5B076765EEDE8B8A8539C4B045E03BC8F93D7E6906B63501E4A28F
Malicious:	false
Reputation:	low
Preview:	{"browser":{"last_redirect_origin":"","shortcut_migration_version":"85.0.4183.121"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en"},"legacy":{"profile":{"name":{"migrated":true}}},"network_time":{"network_time_mapping":{"local":1.657878043479368e+12,"network":1.657845645e+12,"ticks":135478411.0,"uncertainty":4226351.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABL95WKt94zTZq03WydzHLcAAAAAAIAAAAAABBmAAAAAQAAIAAAABAL2tyan+lsWtxhoUVdUYrYiwg8iJkppNr2ZbBFie9UAAAAAA6AAAAAAgAAIAAAABDv4gjLq1dOS7lkRG21YVXojnHhsRhNbP8/D1zs78mXMAAAAB045Od5v4BxiFP4bdRYJjDXn4W2fxYqQj2xfYeAnS1vCL4JXAsdfljw4oXIE4R7l0AAAABlt36FqChftM9b7EtaPw98XRX5Y944rq1WsGWcOPFyXOajfBL3GXBUhMXghJbDGb5WCu+JEdxaxLLxaYPp4zeP"},"password_manager":{"os_password_blank":true,"os_password_last_changed":"13245951016607996"},"plugins":{"metadata":{"adobe-flash-player":{"disp

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SysEx File -
Category:	dropped
Size (bytes):	94708
Entropy (8bit):	3.7452017632887276
Encrypted:	false
SSDEEP:	384:t3e1dD4CbgjLVkq54NZryvdn3GJHiHzeGq9rIbx9xW3vTurs9mc/43JJh2OjDJNh:Na2BlabCawerhXboH7GjKFbBpkS
MD5:	B2A5CF1FD11D12716D610545E80025F5
SHA1:	DFC187239AB5DD54676648AEB706FFF1A38C1E86
SHA-256:	4BCB39773E243897155087B42C56078AF75D9E1DC1514484C60139020E63C195
SHA-512:	E948F5E99383C5F69371C6969DAC196764BC08ED934A80D991C59F2F186A4A80FC0E16E36172F3F06AA26115A5A28E1E20503DF0A00401E17A1C12F530070E84
Malicious:	false
Reputation:	low
Preview:	.q.................C.:.\.P.R.O.G.R.A.~.1.\.M.I.C.R.O.S.~.1.\.O.f.f.i.c.e.1.6.\.G.R.O.O.V.E.E.X...D.L.L..P!...[)...%.p.r.o.g.r.a.m.f.i.l.e.s.%.\.m.i.c.r.o.s.o.f.t. .o.f.f.i.c.e.\.o.f.f.i.c.e.1.6.\.......g.r.o.o.v.e.e.x...d.l.l.....M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e. .2.0.1.6......M.i.c.r.o.s.o.f.t. .O.n.e.D.r.i.v.e. .f.o.r. .B.u.s.i.n.e.s.s. .E.x.t.e.n.s.i.o.n.s.....1.6...0...4.7.1.1...1.0.0.0.....*...C.:.\.P.R.O.G.R.A.~.1.\.M.I.C.R.O.S.~.1.\.O.f.f.i.c.e.1.6.\.G.R.O.O.V.E.E.X...D.L.L.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n....a8.D...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.o.m.m.o.n. .F.i.l.e.s.\.M.i.c.r.o.s.o.f.t. .S.h.a.r.e.d.\.O.F.F.I.C.E.1.6.\.m.s.o.s.h.e.x.t...d.l.l..@.....U/...%.c.o.m.m.o.n.p.r.o.g.r.a.m.f.i.l.e.s.%.\.m.i.c.r.o.s.o.f.t. .s.h.a.r.e.d.\.o.f.f.i.c.e.1.6.\.......m.s.o.s.h.e.x.t...d.l.l.....M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e.)...M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e. .S.h.e.l.l. .E.x.t.e.n.s.i.o.n. .H.a.n.d.l.e.r.s.......1.6...0...4.2.6.6...1.0.0.1.....D...C.:.\.P.r.o.g.r.a.m.

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 15, 2022 02:40:44.560722113 CEST	57723	53	192.168.2.3	8.8.8.8
Jul 15, 2022 02:40:44.567754984 CEST	58116	53	192.168.2.3	8.8.8.8
Jul 15, 2022 02:40:44.570807934 CEST	65358	53	192.168.2.3	8.8.8.8
Jul 15, 2022 02:40:44.586594105 CEST	53	57723	8.8.8.8	192.168.2.3
Jul 15, 2022 02:40:44.590300083 CEST	53	65358	8.8.8.8	192.168.2.3
Jul 15, 2022 02:40:44.599474907 CEST	53	58116	8.8.8.8	192.168.2.3
Jul 15, 2022 02:40:45.113816023 CEST	49873	53	192.168.2.3	8.8.8.8
Jul 15, 2022 02:40:45.133795977 CEST	53	49873	8.8.8.8	192.168.2.3
Jul 15, 2022 02:40:46.727035999 CEST	63548	53	192.168.2.3	8.8.8.8
Jul 15, 2022 02:40:46.749530077 CEST	53	63548	8.8.8.8	192.168.2.3
Jul 15, 2022 02:40:47.066873074 CEST	49327	53	192.168.2.3	8.8.8.8
Jul 15, 2022 02:40:47.069693089 CEST	51391	53	192.168.2.3	8.8.8.8
Jul 15, 2022 02:40:47.088598967 CEST	53	51391	8.8.8.8	192.168.2.3
Jul 15, 2022 02:40:47.255953074 CEST	53	49327	8.8.8.8	192.168.2.3
Jul 15, 2022 02:40:48.129369020 CEST	58981	53	192.168.2.3	8.8.8.8
Jul 15, 2022 02:40:48.150901079 CEST	53	58981	8.8.8.8	192.168.2.3
Jul 15, 2022 02:40:48.949892044 CEST	58625	53	192.168.2.3	8.8.8.8
Jul 15, 2022 02:40:48.969393015 CEST	53	58625	8.8.8.8	192.168.2.3
Jul 15, 2022 02:40:49.251768112 CEST	50778	53	192.168.2.3	8.8.8.8
Jul 15, 2022 02:40:49.273602009 CEST	53	50778	8.8.8.8	192.168.2.3
Jul 15, 2022 02:40:54.676496029 CEST	55153	443	192.168.2.3	216.58.212.142
Jul 15, 2022 02:40:54.702049017 CEST	443	55153	216.58.212.142	192.168.2.3
Jul 15, 2022 02:40:54.874366999 CEST	55153	443	192.168.2.3	216.58.212.142
Jul 15, 2022 02:40:54.898427963 CEST	443	55153	216.58.212.142	192.168.2.3
Jul 15, 2022 02:40:54.898464918 CEST	443	55153	216.58.212.142	192.168.2.3
Jul 15, 2022 02:40:54.898480892 CEST	443	55153	216.58.212.142	192.168.2.3
Jul 15, 2022 02:40:54.898499012 CEST	443	55153	216.58.212.142	192.168.2.3
Jul 15, 2022 02:40:55.013627052 CEST	55153	443	192.168.2.3	216.58.212.142
Jul 15, 2022 02:40:55.015625000 CEST	55153	443	192.168.2.3	216.58.212.142
Jul 15, 2022 02:40:56.633136034 CEST	55153	443	192.168.2.3	216.58.212.142
Jul 15, 2022 02:40:56.634079933 CEST	55153	443	192.168.2.3	216.58.212.142
Jul 15, 2022 02:40:56.663939953 CEST	443	55153	216.58.212.142	192.168.2.3
Jul 15, 2022 02:40:56.665153027 CEST	55153	443	192.168.2.3	216.58.212.142
Jul 15, 2022 02:40:56.676825047 CEST	443	55153	216.58.212.142	192.168.2.3
Jul 15, 2022 02:40:56.676862955 CEST	443	55153	216.58.212.142	192.168.2.3
Jul 15, 2022 02:40:56.676882029 CEST	443	55153	216.58.212.142	192.168.2.3
Jul 15, 2022 02:40:56.678281069 CEST	55153	443	192.168.2.3	216.58.212.142
Jul 15, 2022 02:40:56.705163956 CEST	55153	443	192.168.2.3	216.58.212.142

Timestamp	kBytes transferred	Direction	Data
Jul 15, 2022 02:40:44.709619999 CEST	1025	OUT	GET /js/captcha.html HTTP/1.1 Host: mail.elgrillo.mx Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jul 15, 2022 02:40:44.819574118 CEST	1027	IN	HTTP/1.1 200 OK Date: Fri, 15 Jul 2022 00:40:44 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, Keep-Alive Last-Modified: Wed, 13 Jul 2022 02:24:07 GMT ETag: "2f40010-3b7-5e3a67abf7fc0-gzip" Accept-Ranges: bytes Vary: Accept-Encoding,User-Agent Content-Encoding: gzip Content-Length: 633 Keep-Alive: timeout=5 Content-Type: text/html Data Raw: 1f 8b 08 00 00 00 00 00 00 03 7d 53 6d 4f a3 40 10 fe 2c bf 82 70 69 85 ab 85 16 3d ae 5e 45 e3 4b 1a bd d6 6a aa 36 17 9b 5e b2 5d 06 8a 85 5d dc 5d 90 d6 f8 df 6f 68 7d b9 4b cc 25 10 96 67 5e 9e d9 99 67 0e e6 2a 4d 0e b5 03 49 45 9c 29 5d 2d 33 f0 0d 05 a5 72 1e 48 41 36 a8 71 a8 e9 ba 5e bd 8e 53 10 a1 17 52 e8 be 1e 81 ba 13 c9 98 08 69 5a 13 03 31 63 da ad 7c 3e 3c 9e 62 16 f0 27 3b e1 94 a8 98 33 7b 2e 20 b4 65 12 53 30 3f 35 21 06 e5 55 68 6e 7f d9 b6 f4 86 de b6 ba da 16 66 f2 f5 00 28 0f e0 6e 74 71 ca d3 8c 33 60 ca 44 bc 32 53 ce a4 d2 d3 e5 b1 10 64 89 94 08 db 32 4b 62 65 1a 75 c3 5a 87 7f 14 42 14 9f 99 af be 93 d6 b4 8a 77 1c 92 80 78 4f 57 d5 9e 4a 19 f9 ba 11 33 05 82 42 56 95 b7 ee ca 18 44 1c 2e 07 3c 8a 59 fd bf 46 09 a2 c0 3b fa a1 00 48 49 9c d4 65 4e 29 48 79 37 1a f8 73 a5 32 59 db 3d ae b9 bd 9a 9c 13 01 19 c7 5c f8 97 6c 42 15 b6 43 aa 98 4a bf 1c cd 7e f5 68 67 dc 4f 7b 9e 44 07 91 79 e4 db e3 f5 de 0a cf c3 60 79 72 de bf 28 c2 f1 50 f5 fb f7 88 5c 3e b6 8b d5 d9 65 5a d0 21 a1 a4 c8 16 37 7d da 1a 07 92 5f ae fa 70 cf ca 72 50 71 b8 bd db e1 d9 cf 53 76 4d 2f ce 1f ca 6c 75 1c 9d 46 57 82 b7 c7 ae bc 9f 9d 94 51 6d f7 0c 9f 7a 8e 37 60 24 05 5f 06 24 20 75 01 8f 39 48 75 03 34 17 b1 5a de f2 05 30 7f 3f ec 04 df f7 3d b7 d9 0a 5c b7 b9 47 3b 5e b3 43 66 ad 66 c7 73 69 08 ad bd c0 85 7d a3 ab 6d 44 f3 77 8f 3f 9b bc 6f ac fb f2 c3 71 42 a2 e6 3c 4d b0 5b 4d 05 69 96 40 b3 dd 6a 7b 9e 3d 07 c1 17 39 c9 32 9b f2 d4 89 80 81 20 89 c3 f8 88 cf b8 b2 2b 0d 1f e5 a8 14 a3 81 24 0d 1c 7d a3 9a 22 d2 87 39 a3 15 cd 3f 6a d5 9f ab b2 36 42 45 00 05 f2 fc d2 7d 87 32 22 94 fc 44 bd 12 88 a0 73 1b 47 96 10 54 b0 33 39 aa 4f 1b e6 e4 b7 8f 1f cb c7 43 7d fa d5 72 a2 78 47 7f 23 35 d3 9d 05 2c 77 0a 92 e4 f0 46 fa ca 22 27 68 99 56 82 ad 8c a8 bc ad b5 f5 c5 da d4 21 40 e5 82 ad 1d bb da 8b a6 1d 38 9b 4d c4 45 75 d6 0b fb 07 25 cc 0f 3b b7 03 00 00 Data Ascii: }SmO@,pi=^EKj6^]]]oh}K%g^g*MIE)]-3rHA6q^SRiZ1c\|><b';3{. eS0?5!Uhnf(ntq3`D2Sd2KbeuZBwxOWJ3BVD.<YF;HIeN)Hy7s2Y=\lBCJ~hgO{Dy`yr(P\>eZ!7}_prPqSvM/luFWQmz7`$_$ u9Hu4Z0?=\G;^Cffsi}mDw?oqB<M[Mi@j{=92 +$}"9?j6BE}2"DsGT39OC}rxG#5,wF"'hV!@8MEu%;

Timestamp	kBytes transferred	Direction	Data
2022-07-15 00:40:45 UTC	0	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-07-15 00:40:45 UTC	0	OUT	Data Raw: 20 Data Ascii:
2022-07-15 00:40:45 UTC	2	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Jul 2022 00:40:45 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin; report-to="IdentityListAccountsHttp" Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Report-To: {"group":"IdentityListAccountsHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/IdentityListAccountsHttp/external"}]} Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-HnMISuWEJCcE-UEHrXVzog' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'nonce-HnMISuWEJCcE-UEHrXVzog' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-07-15 00:40:45 UTC	4	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2022-07-15 00:40:45 UTC	4	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-07-15 00:40:45 UTC	0	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfm X-Goog-Update-Updater: chromecrx-85.0.4183.121 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-07-15 00:40:45 UTC	1	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-xyi6LClMsn3vg6ilK6jcoQ' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 15 Jul 2022 00:40:45 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 5673 X-Daystart: 63645 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-07-15 00:40:45 UTC	2	IN	Data Raw: 33 31 61 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 35 36 37 33 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 36 33 36 34 35 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 31a<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="5673" elapsed_seconds="63645"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2022-07-15 00:40:45 UTC	2	IN	Data Raw: 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 2e 63 72 78 22 20 66 70 3d 22 31 2e 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 61 70 Data Ascii: mhkkegccagdldgiimedpiccmgmieda.crx" fp="1.81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app><ap
2022-07-15 00:40:45 UTC	2	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-07-15 00:40:48 UTC	24	OUT	GET /favicon.ico HTTP/1.1 Host: fathomless-temple-10166.herokuapp.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://fathomless-temple-10166.herokuapp.com/general/noRobot.html?usr=obdulia.sanchez@anaintercontinental-tokyo.jp&interceptiontype=VerifyLogin&interceptiontype=VerifyLogin&service=freemail&successURL=https%3A%2F%sharepoint%2Flogin&statistics=xRbXFc8VKmF6s%2Frp6a5qP4z%2FNdyBHKIvfVNtKKZ%2FMq1vzDMmvcNacavpkSKc0VdsoMzKeZnxxL%2Fl2FTNDJCnPcIHjxpzAgCgOro1V2sZbBxg%3D%3D&username=sdada&requestSecurityToken=9f8d7962-0d22-4c86-8ab0-862cfe04d2e9 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-07-15 00:40:48 UTC	25	IN	HTTP/1.1 404 Not Found Connection: close Date: Fri, 15 Jul 2022 00:40:48 GMT Server: Apache Content-Length: 196 Content-Type: text/html; charset=iso-8859-1 Via: 1.1 vegur
2022-07-15 00:40:48 UTC	26	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>

Timestamp	kBytes transferred	Direction	Data
2022-07-15 00:40:49 UTC	26	OUT	GET /s2/favicons?domain=google.com HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36 Host: www.google.com
2022-07-15 00:40:49 UTC	26	IN	HTTP/1.1 301 Moved Permanently Location: https://t2.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&url=http://google.com&size=16 X-Content-Type-Options: nosniff Server: sffe Content-Length: 330 X-XSS-Protection: 0 Date: Fri, 15 Jul 2022 00:19:16 GMT Expires: Fri, 15 Jul 2022 00:49:16 GMT Cache-Control: public, max-age=1800 Content-Type: text/html; charset=UTF-8 Age: 1293 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2022-07-15 00:40:49 UTC	26	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 31 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 31 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 74 32 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 66 61 76 69 63 6f 6e 56 32 3f 63 6c 69 65 6e 74 3d 53 4f 43 49 41 4c 26 61 6d 70 3b 74 79 70 65 3d 46 41 56 49 43 4f 4e 26 61 6d 70 3b 66 61 6c 6c 62 61 63 6b 5f 6f 70 74 73 3d 54 59 50 45 2c Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>301 Moved</TITLE></HEAD><BODY><H1>301 Moved</H1>The document has moved<A HREF="https://t2.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,

Timestamp	kBytes transferred	Direction	Data
2022-07-15 00:40:49 UTC	27	OUT	GET /general/download.png HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36 Host: fathomless-temple-10166.herokuapp.com
2022-07-15 00:40:49 UTC	27	IN	HTTP/1.1 200 OK Connection: close Date: Fri, 15 Jul 2022 00:40:49 GMT Server: Apache Last-Modified: Mon, 11 Jul 2022 02:41:39 GMT Etag: "ad2-5e37e7dc4fec0" Accept-Ranges: bytes Content-Length: 2770 Content-Type: image/png Via: 1.1 vegur
2022-07-15 00:40:49 UTC	27	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 c8 00 00 00 c8 08 03 00 00 00 9a 86 5e ac 00 00 00 b1 50 4c 54 45 ff ff ff ab ab ab 42 85 f4 1c 3a a9 a6 a6 a6 10 2f a4 3a 80 f4 a9 b4 de cf cf cf ae ae ae b5 b5 b5 d4 d4 d4 ca ca ca e9 e9 e9 f2 f2 f2 c5 c5 c5 61 99 f6 bd bd bd e0 e0 e0 dd e2 f2 b1 ad a7 7a a9 f7 85 9d c7 1e 42 b3 f9 f9 f9 33 4e b2 e0 eb fd de de de ba ba ba 0e 2e a4 ec ec ec 15 34 a7 50 67 bd 43 5b b8 c4 cc e9 6c 7f c7 85 96 d1 f5 f8 fe 95 bb f9 36 7a ef 6d a1 f7 5f 74 c2 9d c0 f9 76 88 cb cb dd fc d9 e7 fd 26 43 ad 9c a9 d9 aa c8 fa bf d6 fb 04 25 a0 8a b3 f8 d2 d8 ee 91 9f d5 e9 ec f6 50 8e f5 b7 c1 e4 c3 d9 fb 8c a1 c4 e8 5f 95 b7 00 00 09 dc 49 44 41 54 78 9c ed 9c 7b 7b a3 28 14 87 63 43 ac 57 1c ed ce 0e ad d6 f4 36 f7 4e 67 Data Ascii: PNGIHDR^PLTEB:/:azB3N.4PgC[l6zm_tv&C%P_IDATx{{(cCW6Ng

Timestamp	kBytes transferred	Direction	Data
2022-07-15 00:40:45 UTC	4	OUT	GET /general/noRobot.html?usr=obdulia.sanchez@anaintercontinental-tokyo.jp&interceptiontype=VerifyLogin&interceptiontype=VerifyLogin&service=freemail&successURL=https%3A%2F%sharepoint%2Flogin&statistics=xRbXFc8VKmF6s%2Frp6a5qP4z%2FNdyBHKIvfVNtKKZ%2FMq1vzDMmvcNacavpkSKc0VdsoMzKeZnxxL%2Fl2FTNDJCnPcIHjxpzAgCgOro1V2sZbBxg%3D%3D&username=sdada&requestSecurityToken=9f8d7962-0d22-4c86-8ab0-862cfe04d2e9 HTTP/1.1 Host: fathomless-temple-10166.herokuapp.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: http://mail.elgrillo.mx/js/captcha.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-07-15 00:40:45 UTC	5	IN	HTTP/1.1 200 OK Connection: close Date: Fri, 15 Jul 2022 00:40:45 GMT Server: Apache Last-Modified: Mon, 11 Jul 2022 02:41:39 GMT Etag: "1917-5e37e7dc4fec0" Accept-Ranges: bytes Content-Length: 6423 Content-Type: text/html Via: 1.1 vegur
2022-07-15 00:40:45 UTC	5	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 69 64 3d 22 53 74 65 6e 63 69 6c 22 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 30 22 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 0a 20 20 20 20 20 20 20 20 3c Data Ascii: <!DOCTYPE html><html id="Stencil" class="no-js"> <head> <meta charset="utf-8"> <meta name="viewport" content="initial-scale=1, maximum-scale=1, user-scalable=0"/> <meta name="format-detection" content="telephone=no"> <

Timestamp	kBytes transferred	Direction	Data
2022-07-15 00:40:46 UTC	12	OUT	GET /general/geo.js HTTP/1.1 Host: fathomless-temple-10166.herokuapp.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://fathomless-temple-10166.herokuapp.com/general/noRobot.html?usr=obdulia.sanchez@anaintercontinental-tokyo.jp&interceptiontype=VerifyLogin&interceptiontype=VerifyLogin&service=freemail&successURL=https%3A%2F%sharepoint%2Flogin&statistics=xRbXFc8VKmF6s%2Frp6a5qP4z%2FNdyBHKIvfVNtKKZ%2FMq1vzDMmvcNacavpkSKc0VdsoMzKeZnxxL%2Fl2FTNDJCnPcIHjxpzAgCgOro1V2sZbBxg%3D%3D&username=sdada&requestSecurityToken=9f8d7962-0d22-4c86-8ab0-862cfe04d2e9 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-07-15 00:40:46 UTC	13	IN	HTTP/1.1 200 OK Connection: close Date: Fri, 15 Jul 2022 00:40:46 GMT Server: Apache Last-Modified: Mon, 11 Jul 2022 02:41:39 GMT Etag: "6e6-5e37e7dc4fec0" Accept-Ranges: bytes Content-Length: 1766 Content-Type: application/javascript Via: 1.1 vegur
2022-07-15 00:40:46 UTC	13	IN	Data Raw: 2f 2f 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 61 6a 61 78 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6a 71 75 65 72 79 2f 33 2e 33 2e 31 2f 6a 71 75 65 72 79 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 0a 0a 0a 0a 0a 66 75 6e 63 74 69 6f 6e 20 67 65 74 43 6f 75 6e 74 72 79 28 29 7b 0a 09 76 61 72 20 49 50 61 64 64 72 65 73 73 20 3d 20 6d 79 49 50 28 29 3b 0a 24 2e 67 65 74 4a 53 4f 4e 28 22 68 74 74 70 73 3a 2f 2f 69 70 69 6e 66 6f 2e 69 6f 2f 22 2b 49 50 61 64 64 72 65 73 73 2c 20 66 75 6e 63 74 69 6f 6e 28 64 61 74 61 29 20 7b 0a 20 20 20 20 76 61 72 20 6c 6f 63 20 3d 20 64 61 74 61 2e 63 6f 75 6e 74 72 79 3b 0a 09 24 28 22 23 6c 6f 63 22 29 2e 76 61 6c 28 6c 6f 63 29 3b 0a 09 67 65 Data Ascii: //<script src="https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js"></script>function getCountry(){var IPaddress = myIP();$.getJSON("https://ipinfo.io/"+IPaddress, function(data) { var loc = data.country;$("#loc").val(loc);ge

Timestamp	kBytes transferred	Direction	Data
2022-07-15 00:40:46 UTC	15	OUT	GET /general/download.png HTTP/1.1 Host: fathomless-temple-10166.herokuapp.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://fathomless-temple-10166.herokuapp.com/general/noRobot.html?usr=obdulia.sanchez@anaintercontinental-tokyo.jp&interceptiontype=VerifyLogin&interceptiontype=VerifyLogin&service=freemail&successURL=https%3A%2F%sharepoint%2Flogin&statistics=xRbXFc8VKmF6s%2Frp6a5qP4z%2FNdyBHKIvfVNtKKZ%2FMq1vzDMmvcNacavpkSKc0VdsoMzKeZnxxL%2Fl2FTNDJCnPcIHjxpzAgCgOro1V2sZbBxg%3D%3D&username=sdada&requestSecurityToken=9f8d7962-0d22-4c86-8ab0-862cfe04d2e9 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-07-15 00:40:46 UTC	15	IN	HTTP/1.1 200 OK Connection: close Date: Fri, 15 Jul 2022 00:40:46 GMT Server: Apache Last-Modified: Mon, 11 Jul 2022 02:41:39 GMT Etag: "ad2-5e37e7dc4fec0" Accept-Ranges: bytes Content-Length: 2770 Content-Type: image/png Via: 1.1 vegur
2022-07-15 00:40:46 UTC	16	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 c8 00 00 00 c8 08 03 00 00 00 9a 86 5e ac 00 00 00 b1 50 4c 54 45 ff ff ff ab ab ab 42 85 f4 1c 3a a9 a6 a6 a6 10 2f a4 3a 80 f4 a9 b4 de cf cf cf ae ae ae b5 b5 b5 d4 d4 d4 ca ca ca e9 e9 e9 f2 f2 f2 c5 c5 c5 61 99 f6 bd bd bd e0 e0 e0 dd e2 f2 b1 ad a7 7a a9 f7 85 9d c7 1e 42 b3 f9 f9 f9 33 4e b2 e0 eb fd de de de ba ba ba 0e 2e a4 ec ec ec 15 34 a7 50 67 bd 43 5b b8 c4 cc e9 6c 7f c7 85 96 d1 f5 f8 fe 95 bb f9 36 7a ef 6d a1 f7 5f 74 c2 9d c0 f9 76 88 cb cb dd fc d9 e7 fd 26 43 ad 9c a9 d9 aa c8 fa bf d6 fb 04 25 a0 8a b3 f8 d2 d8 ee 91 9f d5 e9 ec f6 50 8e f5 b7 c1 e4 c3 d9 fb 8c a1 c4 e8 5f 95 b7 00 00 09 dc 49 44 41 54 78 9c ed 9c 7b 7b a3 28 14 87 63 43 ac 57 1c ed ce 0e ad d6 f4 36 f7 4e 67 Data Ascii: PNGIHDR^PLTEB:/:azB3N.4PgC[l6zm_tv&C%P_IDATx{{(cCW6Ng

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://mail.elgrillo.mx/js/captcha.html#b2JkdWxpYS5zYW5jaGV6QGFuYWludGVyY29udGluZW50YWwtdG9reW8uanA=&target=_blank

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic

C:\Users\user\AppData\Local\Google\Chrome\User Data\28344bb9-a282-4f82-ad72-302f153cc63c.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\2b639049-9dc4-4d3f-a3a7-55d0e476b91e.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\52d2786c-c71f-46f3-8e8f-3ad7a6875dc5.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\156abafd-8875-4eb0-8617-69f9b6e5be49.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\3b0b7642-534e-4e4d-82db-1421b2ae42bc.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\5d5426a7-d248-4df7-bf03-39d7ad77a092.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\7cfe258b-2df0-4fbb-a8a5-1f47bfa5fa1a.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\88091b98-0b4f-47b7-8237-ae7744bdbdda.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata\computed_hashes.json

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\000003.log

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG.old (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Provider Cache

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network Persistent State (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Preferences (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\2ebf4933-24bd-49ff-9217-d357de713c59.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\GPUCache\data_1

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Network Persistent State (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\282e3027-6b1b-4f92-965b-a718e6e6ab7b.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network Persistent State (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\a73521ee-021c-4d4d-b74a-92273ce1dc39.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\cccd4c41-60e9-4509-902b-e5f3b07cdb4d.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\cd1c4ef5-ed5a-4ffd-a573-2a5342413426.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000004.dbtmp

Windows Analysis Report
http://mail.elgrillo.mx/js/captcha.html#b2JkdWxpYS5zYW5jaGV6QGFuYWludGVyY29udGluZW50YWwtdG9reW8uanA=&target=_blank

Timestamp	kBytes transferred	Direction	Data
2022-07-15 00:40:46 UTC	18	OUT	GET /get_html.php HTTP/1.1 Host: api.hostip.info Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: / Origin: https://fathomless-temple-10166.herokuapp.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://fathomless-temple-10166.herokuapp.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-07-15 00:40:47 UTC	19	IN	HTTP/1.1 200 OK Date: Fri, 15 Jul 2022 00:40:46 GMT Content-Type: text/plain; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close Expires: Sat, 16 Jul 2022 00:40:46 GMT Last-Modified: Fri, 15 Jul 2022 00:40:46 GMT Cache-Control: public, max-age=86400 Pragma: !invalid Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31536000 CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9ydwmPr2ng%2Biv%2FTJqAWFGvvyEfmmChWtqZTUHLhMSIuDXlKntgK0NWQG5J7IbLSVZ9nid1amTEYTdn8h82xBoqnYDD57BZUUw%2F7nMVZg5K6U8HZEoIndIHWr5uVb09Sd2PM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 72ae72dced277474-LHR alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2022-07-15 00:40:47 UTC	20	IN	Data Raw: 33 39 0d 0a 43 6f 75 6e 74 72 79 3a 20 49 54 41 4c 59 20 28 49 54 29 0a 43 69 74 79 3a 20 28 55 6e 6b 6e 6f 77 6e 20 63 69 74 79 29 0a 49 50 3a 20 38 34 2e 31 37 2e 35 32 2e 31 34 0a 0d 0a Data Ascii: 39Country: ITALY (IT)City: (Unknown city)IP: 84.17.52.14
2022-07-15 00:40:47 UTC	20	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-07-15 00:40:47 UTC	20	OUT	GET /%2084.17.52.14 HTTP/1.1 Host: ipinfo.io Connection: keep-alive Accept: application/json, text/javascript, /; q=0.01 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Origin: https://fathomless-temple-10166.herokuapp.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://fathomless-temple-10166.herokuapp.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-07-15 00:40:47 UTC	20	IN	HTTP/1.1 302 Found access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin location: /84.17.52.14 vary: Accept, Accept-Encoding content-type: text/plain; charset=utf-8 content-length: 34 date: Fri, 15 Jul 2022 00:40:47 GMT x-envoy-upstream-service-time: 3 strict-transport-security: max-age=2592000; includeSubDomains Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2022-07-15 00:40:47 UTC	21	IN	Data Raw: 46 6f 75 6e 64 2e 20 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 2f 38 34 2e 31 37 2e 35 32 2e 31 34 Data Ascii: Found. Redirecting to /84.17.52.14

Timestamp	kBytes transferred	Direction	Data
2022-07-15 00:40:47 UTC	21	OUT	GET /dns/valid.php?callback=jQuery33106207367861595807_1657878046190&domain=obdulia.sanchez%40anaintercontinental-tokyo.jp&loc=&_=1657878046191 HTTP/1.1 Host: hancott.biz Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://fathomless-temple-10166.herokuapp.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-07-15 00:40:47 UTC	23	IN	HTTP/1.1 200 OK Date: Fri, 15 Jul 2022 00:40:47 GMT Server: Apache Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Set-Cookie: PHPSESSID=00271e627b8ad9e9a524b033e3bdb20d; path=/ Content-Length: 84 Connection: close Content-Type: text/html; charset=UTF-8
2022-07-15 00:40:47 UTC	23	IN	Data Raw: 6a 51 75 65 72 79 33 33 31 30 36 32 30 37 33 36 37 38 36 31 35 39 35 38 30 37 5f 31 36 35 37 38 37 38 30 34 36 31 39 30 28 7b 22 6d 65 73 73 61 67 65 22 3a 22 61 6e 61 69 6e 74 65 72 63 6f 6e 74 69 6e 65 6e 74 61 6c 2d 74 6f 6b 79 6f 2e 6a 70 22 7d 29 Data Ascii: jQuery33106207367861595807_1657878046190({"message":"anaintercontinental-tokyo.jp"})

Timestamp	kBytes transferred	Direction	Data
2022-07-15 00:40:47 UTC	21	OUT	GET /84.17.52.14 HTTP/1.1 Host: ipinfo.io Connection: keep-alive Accept: application/json, text/javascript, /; q=0.01 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Origin: https://fathomless-temple-10166.herokuapp.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://fathomless-temple-10166.herokuapp.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-07-15 00:40:47 UTC	22	IN	HTTP/1.1 200 OK access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin content-type: application/json; charset=utf-8 content-length: 291 date: Fri, 15 Jul 2022 00:40:47 GMT x-envoy-upstream-service-time: 1 strict-transport-security: max-age=2592000; includeSubDomains vary: Accept-Encoding Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2022-07-15 00:40:47 UTC	22	IN	Data Raw: 7b 0a 20 20 22 69 70 22 3a 20 22 38 34 2e 31 37 2e 35 32 2e 31 34 22 2c 0a 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 75 6e 6e 2d 38 34 2d 31 37 2d 35 32 2d 31 34 2e 63 64 6e 37 37 2e 63 6f 6d 22 2c 0a 20 20 22 63 69 74 79 22 3a 20 22 5a c3 bc 72 69 63 68 22 2c 0a 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 5a 75 72 69 63 68 22 2c 0a 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 43 48 22 2c 0a 20 20 22 6c 6f 63 22 3a 20 22 34 37 2e 33 38 37 36 2c 38 2e 35 32 30 37 22 2c 0a 20 20 22 6f 72 67 22 3a 20 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 0a 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 38 30 30 35 22 2c 0a 20 20 22 74 69 6d 65 7a 6f 6e 65 22 3a 20 22 45 75 72 6f 70 65 2f 5a 75 72 69 63 68 22 2c 0a 20 20 22 72 65 61 64 6d 65 Data Ascii: { "ip": "84.17.52.14", "hostname": "unn-84-17-52-14.cdn77.com", "city": "Zrich", "region": "Zurich", "country": "CH", "loc": "47.3876,8.5207", "org": "AS212238 Datacamp Limited", "postal": "8005", "timezone": "Europe/Zurich", "readme

Target ID:	0
Start time:	02:40:37
Start date:	15/07/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "http://mail.elgrillo.mx/js/captcha.html#b2JkdWxpYS5zYW5jaGV6QGFuYWludGVyY29udGluZW50YWwtdG9reW8uanA=&target=_blank
Imagebase:	0x7ff7f6290000
File size:	2150896 bytes
MD5 hash:	C139654B5C1438A95B321BB01AD63EF6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Target ID:	1
Start time:	02:40:40
Start date:	15/07/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1508,12251894958441046289,483157162646382018,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1904 /prefetch:8
Imagebase:	0x7ff7f6290000
File size:	2150896 bytes
MD5 hash:	C139654B5C1438A95B321BB01AD63EF6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre