Edit tour

Windows Analysis Report
http://qwasdrgqwdasd.winbestprizess.info/palasekddq2hf45ysm.js

Overview

General Information

Sample URL:	http://qwasdrgqwdasd.winbestprizess.info/palasekddq2hf45ysm.js
Analysis ID:	809043
Infos:

Detection

Score:	72
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Antivirus detection for URL or domain

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5208 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

chrome.exe (PID: 4876 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1944 --field-trial-handle=1728,i,15753723449913141145,3018605403501027829,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8 MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

chrome.exe (PID: 5852 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" "http://qwasdrgqwdasd.winbestprizess.info/palasekddq2hf45ysm.js MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

cleanup

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 15 Feb 2023 22:00:44 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeCache-Control: max-age=14400CF-Cache-Status: MISSReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ytQegk6xGm9PCyMDbraClPzfuzjaFA03EMO1uzNLN1P2xijFc3DQ0MpMDb7PBH01YUm5QAnium5dgTHPcFmHX0s9OVo2BxZ4wceR%2FjI2Fhecazauw3AvlmySxI1mRPUNdSnvnAhNKAEI3BhllvO0KrSAGxA%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 79a1516cf9825bf9-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __Secure-ENID=6.SE=Md0Ynyf9ahpkx1CxTGF0vY434NJ6ymH-gDI2Tl5Ly-NQYGPjnNfggtiFRMAwx4JRDOC_gavEPcD5cTBJzUgtbJobmBEuJ8xi2UuotxvOZgApoqSIg1b0RP47U08XG8Bz_SExSzKy0ETSsajbToDlYyFsxfI93p7AyRAd-OeIBA0; CONSENT=PENDING+070

Source: classification engine

Classification label: mal72.win@26/0@10/9

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1944 --field-trial-handle=1728,i,15753723449913141145,3018605403501027829,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" "http://qwasdrgqwdasd.winbestprizess.info/palasekddq2hf45ysm.js
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1944 --field-trial-handle=1728,i,15753723449913141145,3018605403501027829,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\GoogleUpdater

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\GoogleUpdater

Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	2 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	4 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	5 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	3 Ingress Tool Transfer	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
http://qwasdrgqwdasd.winbestprizess.info/palasekddq2hf45ysm.js	10%	Virustotal		Browse
http://qwasdrgqwdasd.winbestprizess.info/palasekddq2hf45ysm.js	100%	Avira URL Cloud	malware

Source	Detection	Scanner	Label	Link
https://qwasdrgqwdasd.winbestprizess.info/favicon.ico	100%	Avira URL Cloud	malware
https://qwasdrgqwdasd.winbestprizess.info/palasekddq2hf45ysm.js	9%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
a.nel.cloudflare.com	35.190.80.1	true	false	high
accounts.google.com	216.58.209.45	true	false	high
qwasdrgqwdasd.winbestprizess.info	172.67.184.241	true	false	unknown
www.google.com	142.250.203.100	true	false	high
clients.l.google.com	142.250.203.110	true	false	high
clients2.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://qwasdrgqwdasd.winbestprizess.info/palasekddq2hf45ysm.js	false	9%, Virustotal, Browse	unknown
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=104.0.5112.81&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1	false		high
https://qwasdrgqwdasd.winbestprizess.info/favicon.ico	false	Avira URL Cloud: malware	unknown
http://qwasdrgqwdasd.winbestprizess.info/palasekddq2hf45ysm.js	true		unknown
https://qwasdrgqwdasd.winbestprizess.info/palasekddq2hf45ysm.js	false	9%, Virustotal, Browse	unknown
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false		high
https://a.nel.cloudflare.com/report/v3?s=ytQegk6xGm9PCyMDbraClPzfuzjaFA03EMO1uzNLN1P2xijFc3DQ0MpMDb7PBH01YUm5QAnium5dgTHPcFmHX0s9OVo2BxZ4wceR%2FjI2Fhecazauw3AvlmySxI1mRPUNdSnvnAhNKAEI3BhllvO0KrSAGxA%3D	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.19.35	unknown	United States	13335	CLOUDFLARENETUS	false
142.250.203.110	clients.l.google.com	United States	15169	GOOGLEUS	false
216.58.209.45	accounts.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
172.67.184.241	qwasdrgqwdasd.winbestprizess.info	United States	13335	CLOUDFLARENETUS	false
142.250.184.100	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.1
127.0.0.1

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	809043
Start date and time:	2023-02-15 22:59:38 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 4m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://qwasdrgqwdasd.winbestprizess.info/palasekddq2hf45ysm.js
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal72.win@26/0@10/9
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): HxTsr.exe, RuntimeBroker.exe, SgrmBroker.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.184.99, 34.104.35.123, 142.250.203.99
Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, fs.microsoft.com, client-office365-tas.msedge.net, ocos-office365-s2s.msedge.net, edgedl.me.gvt1.com, login.live.com, update.googleapis.com, ctldl.windowsupdate.com, clientservices.googleapis.com, cdn.onenote.net, config.edge.skype.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtWriteVirtualMemory calls found.

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 15, 2023 23:00:42.780292988 CET	49713	443	192.168.2.6	142.250.203.110
Feb 15, 2023 23:00:42.780358076 CET	443	49713	142.250.203.110	192.168.2.6
Feb 15, 2023 23:00:42.780452013 CET	49713	443	192.168.2.6	142.250.203.110
Feb 15, 2023 23:00:42.787790060 CET	49714	443	192.168.2.6	142.250.203.110
Feb 15, 2023 23:00:42.787853956 CET	443	49714	142.250.203.110	192.168.2.6
Feb 15, 2023 23:00:42.787936926 CET	49714	443	192.168.2.6	142.250.203.110
Feb 15, 2023 23:00:42.854037046 CET	49713	443	192.168.2.6	142.250.203.110
Feb 15, 2023 23:00:42.854099035 CET	443	49713	142.250.203.110	192.168.2.6
Feb 15, 2023 23:00:42.854554892 CET	49714	443	192.168.2.6	142.250.203.110
Feb 15, 2023 23:00:42.854610920 CET	443	49714	142.250.203.110	192.168.2.6
Feb 15, 2023 23:00:42.955332041 CET	443	49713	142.250.203.110	192.168.2.6
Feb 15, 2023 23:00:42.957909107 CET	443	49714	142.250.203.110	192.168.2.6
Feb 15, 2023 23:00:42.999470949 CET	49714	443	192.168.2.6	142.250.203.110
Feb 15, 2023 23:00:43.031471968 CET	49713	443	192.168.2.6	142.250.203.110
Feb 15, 2023 23:00:43.218417883 CET	49715	443	192.168.2.6	216.58.209.45
Feb 15, 2023 23:00:43.218472958 CET	443	49715	216.58.209.45	192.168.2.6
Feb 15, 2023 23:00:43.218571901 CET	49715	443	192.168.2.6	216.58.209.45
Feb 15, 2023 23:00:43.219233990 CET	49713	443	192.168.2.6	142.250.203.110
Feb 15, 2023 23:00:43.219252110 CET	443	49713	142.250.203.110	192.168.2.6
Feb 15, 2023 23:00:43.220596075 CET	443	49713	142.250.203.110	192.168.2.6
Feb 15, 2023 23:00:43.220613003 CET	443	49713	142.250.203.110	192.168.2.6
Feb 15, 2023 23:00:43.220844030 CET	49713	443	192.168.2.6	142.250.203.110
Feb 15, 2023 23:00:43.221961021 CET	443	49713	142.250.203.110	192.168.2.6
Feb 15, 2023 23:00:43.222027063 CET	49713	443	192.168.2.6	142.250.203.110
Feb 15, 2023 23:00:43.240091085 CET	49714	443	192.168.2.6	142.250.203.110
Feb 15, 2023 23:00:43.240122080 CET	443	49714	142.250.203.110	192.168.2.6
Feb 15, 2023 23:00:43.240638018 CET	49716	80	192.168.2.6	172.67.184.241
Feb 15, 2023 23:00:43.240942955 CET	443	49714	142.250.203.110	192.168.2.6
Feb 15, 2023 23:00:43.241024971 CET	49714	443	192.168.2.6	142.250.203.110
Feb 15, 2023 23:00:43.241767883 CET	443	49714	142.250.203.110	192.168.2.6
Feb 15, 2023 23:00:43.241836071 CET	49714	443	192.168.2.6	142.250.203.110
Feb 15, 2023 23:00:43.242453098 CET	49717	80	192.168.2.6	172.67.184.241
Feb 15, 2023 23:00:43.243005037 CET	49718	443	192.168.2.6	216.58.209.45
Feb 15, 2023 23:00:43.243038893 CET	443	49718	216.58.209.45	192.168.2.6
Feb 15, 2023 23:00:43.243107080 CET	49718	443	192.168.2.6	216.58.209.45
Feb 15, 2023 23:00:43.244050980 CET	49715	443	192.168.2.6	216.58.209.45
Feb 15, 2023 23:00:43.244074106 CET	443	49715	216.58.209.45	192.168.2.6
Feb 15, 2023 23:00:43.271466017 CET	80	49716	172.67.184.241	192.168.2.6
Feb 15, 2023 23:00:43.271666050 CET	49716	80	192.168.2.6	172.67.184.241
Feb 15, 2023 23:00:43.273111105 CET	80	49717	172.67.184.241	192.168.2.6
Feb 15, 2023 23:00:43.273251057 CET	49717	80	192.168.2.6	172.67.184.241
Feb 15, 2023 23:00:43.322417974 CET	443	49715	216.58.209.45	192.168.2.6
Feb 15, 2023 23:00:43.403358936 CET	49718	443	192.168.2.6	216.58.209.45
Feb 15, 2023 23:00:43.403398037 CET	443	49718	216.58.209.45	192.168.2.6
Feb 15, 2023 23:00:43.403826952 CET	49715	443	192.168.2.6	216.58.209.45
Feb 15, 2023 23:00:43.403850079 CET	443	49715	216.58.209.45	192.168.2.6
Feb 15, 2023 23:00:43.404890060 CET	49716	80	192.168.2.6	172.67.184.241
Feb 15, 2023 23:00:43.408303022 CET	443	49715	216.58.209.45	192.168.2.6
Feb 15, 2023 23:00:43.408351898 CET	443	49715	216.58.209.45	192.168.2.6
Feb 15, 2023 23:00:43.408390045 CET	49715	443	192.168.2.6	216.58.209.45
Feb 15, 2023 23:00:43.435615063 CET	80	49716	172.67.184.241	192.168.2.6
Feb 15, 2023 23:00:43.450258017 CET	80	49716	172.67.184.241	192.168.2.6
Feb 15, 2023 23:00:43.469316006 CET	443	49718	216.58.209.45	192.168.2.6
Feb 15, 2023 23:00:43.473874092 CET	49718	443	192.168.2.6	216.58.209.45
Feb 15, 2023 23:00:43.473907948 CET	443	49718	216.58.209.45	192.168.2.6
Feb 15, 2023 23:00:43.476157904 CET	443	49718	216.58.209.45	192.168.2.6
Feb 15, 2023 23:00:43.476291895 CET	49718	443	192.168.2.6	216.58.209.45
Feb 15, 2023 23:00:43.531465054 CET	49715	443	192.168.2.6	216.58.209.45
Feb 15, 2023 23:00:43.532840014 CET	49716	80	192.168.2.6	172.67.184.241
Feb 15, 2023 23:00:43.567154884 CET	49720	443	192.168.2.6	104.21.19.35
Feb 15, 2023 23:00:43.567219973 CET	443	49720	104.21.19.35	192.168.2.6
Feb 15, 2023 23:00:43.567312956 CET	49720	443	192.168.2.6	104.21.19.35
Feb 15, 2023 23:00:43.572259903 CET	49720	443	192.168.2.6	104.21.19.35
Feb 15, 2023 23:00:43.572299004 CET	443	49720	104.21.19.35	192.168.2.6
Feb 15, 2023 23:00:43.623558044 CET	49715	443	192.168.2.6	216.58.209.45
Feb 15, 2023 23:00:43.623617887 CET	443	49715	216.58.209.45	192.168.2.6
Feb 15, 2023 23:00:43.623730898 CET	49718	443	192.168.2.6	216.58.209.45
Feb 15, 2023 23:00:43.623763084 CET	443	49718	216.58.209.45	192.168.2.6
Feb 15, 2023 23:00:43.623919010 CET	443	49718	216.58.209.45	192.168.2.6
Feb 15, 2023 23:00:43.624161959 CET	443	49715	216.58.209.45	192.168.2.6
Feb 15, 2023 23:00:43.626676083 CET	49715	443	192.168.2.6	216.58.209.45
Feb 15, 2023 23:00:43.626727104 CET	443	49715	216.58.209.45	192.168.2.6
Feb 15, 2023 23:00:43.627058983 CET	49713	443	192.168.2.6	142.250.203.110
Feb 15, 2023 23:00:43.627079964 CET	443	49713	142.250.203.110	192.168.2.6
Feb 15, 2023 23:00:43.627331972 CET	49713	443	192.168.2.6	142.250.203.110
Feb 15, 2023 23:00:43.627346039 CET	443	49713	142.250.203.110	192.168.2.6
Feb 15, 2023 23:00:43.627579927 CET	443	49713	142.250.203.110	192.168.2.6
Feb 15, 2023 23:00:43.628664970 CET	49714	443	192.168.2.6	142.250.203.110
Feb 15, 2023 23:00:43.628696918 CET	443	49714	142.250.203.110	192.168.2.6
Feb 15, 2023 23:00:43.628993988 CET	443	49714	142.250.203.110	192.168.2.6
Feb 15, 2023 23:00:43.656785965 CET	443	49720	104.21.19.35	192.168.2.6
Feb 15, 2023 23:00:43.657484055 CET	49720	443	192.168.2.6	104.21.19.35
Feb 15, 2023 23:00:43.657522917 CET	443	49720	104.21.19.35	192.168.2.6
Feb 15, 2023 23:00:43.659185886 CET	443	49720	104.21.19.35	192.168.2.6
Feb 15, 2023 23:00:43.659303904 CET	49720	443	192.168.2.6	104.21.19.35
Feb 15, 2023 23:00:43.662470102 CET	443	49713	142.250.203.110	192.168.2.6
Feb 15, 2023 23:00:43.662672043 CET	49713	443	192.168.2.6	142.250.203.110
Feb 15, 2023 23:00:43.662714958 CET	443	49713	142.250.203.110	192.168.2.6
Feb 15, 2023 23:00:43.662838936 CET	443	49713	142.250.203.110	192.168.2.6
Feb 15, 2023 23:00:43.662904024 CET	49713	443	192.168.2.6	142.250.203.110
Feb 15, 2023 23:00:43.671793938 CET	49720	443	192.168.2.6	104.21.19.35
Feb 15, 2023 23:00:43.671828032 CET	443	49720	104.21.19.35	192.168.2.6
Feb 15, 2023 23:00:43.672039986 CET	49713	443	192.168.2.6	142.250.203.110
Feb 15, 2023 23:00:43.672065973 CET	443	49713	142.250.203.110	192.168.2.6
Feb 15, 2023 23:00:43.672878027 CET	443	49720	104.21.19.35	192.168.2.6
Feb 15, 2023 23:00:43.676069021 CET	49720	443	192.168.2.6	104.21.19.35
Feb 15, 2023 23:00:43.676104069 CET	443	49720	104.21.19.35	192.168.2.6
Feb 15, 2023 23:00:43.692965031 CET	443	49715	216.58.209.45	192.168.2.6
Feb 15, 2023 23:00:43.693049908 CET	49715	443	192.168.2.6	216.58.209.45
Feb 15, 2023 23:00:43.693084002 CET	443	49715	216.58.209.45	192.168.2.6
Feb 15, 2023 23:00:43.693336010 CET	443	49715	216.58.209.45	192.168.2.6
Feb 15, 2023 23:00:43.693402052 CET	49715	443	192.168.2.6	216.58.209.45
Feb 15, 2023 23:00:43.700419903 CET	49715	443	192.168.2.6	216.58.209.45
Feb 15, 2023 23:00:43.700443983 CET	443	49715	216.58.209.45	192.168.2.6
Feb 15, 2023 23:00:43.700932980 CET	443	49720	104.21.19.35	192.168.2.6
Feb 15, 2023 23:00:43.701011896 CET	49720	443	192.168.2.6	104.21.19.35
Feb 15, 2023 23:00:43.734427929 CET	49718	443	192.168.2.6	216.58.209.45
Feb 15, 2023 23:00:43.734462023 CET	443	49718	216.58.209.45	192.168.2.6
Feb 15, 2023 23:00:43.750535965 CET	49714	443	192.168.2.6	142.250.203.110
Feb 15, 2023 23:00:43.750607014 CET	443	49714	142.250.203.110	192.168.2.6
Feb 15, 2023 23:00:43.831538916 CET	49718	443	192.168.2.6	216.58.209.45
Feb 15, 2023 23:00:43.851846933 CET	49714	443	192.168.2.6	142.250.203.110
Feb 15, 2023 23:00:43.918776989 CET	49720	443	192.168.2.6	104.21.19.35
Feb 15, 2023 23:00:43.918842077 CET	443	49720	104.21.19.35	192.168.2.6
Feb 15, 2023 23:00:44.206850052 CET	49723	443	192.168.2.6	104.21.19.35
Feb 15, 2023 23:00:44.206918001 CET	443	49723	104.21.19.35	192.168.2.6
Feb 15, 2023 23:00:44.207020998 CET	49723	443	192.168.2.6	104.21.19.35
Feb 15, 2023 23:00:44.211627007 CET	49723	443	192.168.2.6	104.21.19.35
Feb 15, 2023 23:00:44.211678028 CET	443	49723	104.21.19.35	192.168.2.6
Feb 15, 2023 23:00:44.254442930 CET	443	49723	104.21.19.35	192.168.2.6
Feb 15, 2023 23:00:44.254818916 CET	49723	443	192.168.2.6	104.21.19.35
Feb 15, 2023 23:00:44.254862070 CET	443	49723	104.21.19.35	192.168.2.6
Feb 15, 2023 23:00:44.255284071 CET	443	49723	104.21.19.35	192.168.2.6
Feb 15, 2023 23:00:44.255743027 CET	49723	443	192.168.2.6	104.21.19.35
Feb 15, 2023 23:00:44.255757093 CET	443	49723	104.21.19.35	192.168.2.6
Feb 15, 2023 23:00:44.255839109 CET	443	49723	104.21.19.35	192.168.2.6
Feb 15, 2023 23:00:44.255928040 CET	49723	443	192.168.2.6	104.21.19.35
Feb 15, 2023 23:00:44.255937099 CET	443	49723	104.21.19.35	192.168.2.6
Feb 15, 2023 23:00:44.356214046 CET	49725	443	192.168.2.6	142.250.184.100
Feb 15, 2023 23:00:44.356271029 CET	443	49725	142.250.184.100	192.168.2.6
Feb 15, 2023 23:00:44.356334925 CET	49725	443	192.168.2.6	142.250.184.100
Feb 15, 2023 23:00:44.357311964 CET	49725	443	192.168.2.6	142.250.184.100
Feb 15, 2023 23:00:44.357323885 CET	443	49725	142.250.184.100	192.168.2.6
Feb 15, 2023 23:00:44.382246971 CET	443	49723	104.21.19.35	192.168.2.6
Feb 15, 2023 23:00:44.382391930 CET	443	49723	104.21.19.35	192.168.2.6
Feb 15, 2023 23:00:44.382443905 CET	49723	443	192.168.2.6	104.21.19.35
Feb 15, 2023 23:00:44.399475098 CET	49723	443	192.168.2.6	104.21.19.35
Feb 15, 2023 23:00:44.399503946 CET	443	49723	104.21.19.35	192.168.2.6
Feb 15, 2023 23:00:44.404511929 CET	49726	443	192.168.2.6	35.190.80.1
Feb 15, 2023 23:00:44.404539108 CET	443	49726	35.190.80.1	192.168.2.6
Feb 15, 2023 23:00:44.404633999 CET	49726	443	192.168.2.6	35.190.80.1
Feb 15, 2023 23:00:44.404970884 CET	49726	443	192.168.2.6	35.190.80.1
Feb 15, 2023 23:00:44.404984951 CET	443	49726	35.190.80.1	192.168.2.6
Feb 15, 2023 23:00:44.429867029 CET	443	49725	142.250.184.100	192.168.2.6
Feb 15, 2023 23:00:44.430372000 CET	49725	443	192.168.2.6	142.250.184.100
Feb 15, 2023 23:00:44.430386066 CET	443	49725	142.250.184.100	192.168.2.6
Feb 15, 2023 23:00:44.431643963 CET	443	49725	142.250.184.100	192.168.2.6
Feb 15, 2023 23:00:44.431768894 CET	49725	443	192.168.2.6	142.250.184.100
Feb 15, 2023 23:00:44.434566021 CET	49725	443	192.168.2.6	142.250.184.100
Feb 15, 2023 23:00:44.434571981 CET	443	49725	142.250.184.100	192.168.2.6
Feb 15, 2023 23:00:44.434668064 CET	443	49725	142.250.184.100	192.168.2.6
Feb 15, 2023 23:00:44.459889889 CET	443	49726	35.190.80.1	192.168.2.6
Feb 15, 2023 23:00:44.469254017 CET	49726	443	192.168.2.6	35.190.80.1
Feb 15, 2023 23:00:44.469294071 CET	443	49726	35.190.80.1	192.168.2.6
Feb 15, 2023 23:00:44.470652103 CET	443	49726	35.190.80.1	192.168.2.6
Feb 15, 2023 23:00:44.470743895 CET	49726	443	192.168.2.6	35.190.80.1
Feb 15, 2023 23:00:44.473779917 CET	49726	443	192.168.2.6	35.190.80.1
Feb 15, 2023 23:00:44.473789930 CET	443	49726	35.190.80.1	192.168.2.6
Feb 15, 2023 23:00:44.473984003 CET	443	49726	35.190.80.1	192.168.2.6
Feb 15, 2023 23:00:44.474025011 CET	49726	443	192.168.2.6	35.190.80.1
Feb 15, 2023 23:00:44.474034071 CET	443	49726	35.190.80.1	192.168.2.6
Feb 15, 2023 23:00:44.530999899 CET	49725	443	192.168.2.6	142.250.184.100
Feb 15, 2023 23:00:44.531039000 CET	443	49725	142.250.184.100	192.168.2.6
Feb 15, 2023 23:00:44.564615011 CET	49726	443	192.168.2.6	35.190.80.1
Feb 15, 2023 23:00:44.564639091 CET	443	49726	35.190.80.1	192.168.2.6
Feb 15, 2023 23:00:44.612639904 CET	443	49726	35.190.80.1	192.168.2.6
Feb 15, 2023 23:00:44.612735987 CET	49726	443	192.168.2.6	35.190.80.1
Feb 15, 2023 23:00:44.613065004 CET	49726	443	192.168.2.6	35.190.80.1
Feb 15, 2023 23:00:44.613085032 CET	443	49726	35.190.80.1	192.168.2.6
Feb 15, 2023 23:00:44.614662886 CET	49727	443	192.168.2.6	35.190.80.1
Feb 15, 2023 23:00:44.614716053 CET	443	49727	35.190.80.1	192.168.2.6
Feb 15, 2023 23:00:44.614814043 CET	49727	443	192.168.2.6	35.190.80.1
Feb 15, 2023 23:00:44.615104914 CET	49727	443	192.168.2.6	35.190.80.1
Feb 15, 2023 23:00:44.615120888 CET	443	49727	35.190.80.1	192.168.2.6
Feb 15, 2023 23:00:44.645298958 CET	49725	443	192.168.2.6	142.250.184.100
Feb 15, 2023 23:00:44.667048931 CET	443	49727	35.190.80.1	192.168.2.6
Feb 15, 2023 23:00:44.682260036 CET	49727	443	192.168.2.6	35.190.80.1
Feb 15, 2023 23:00:44.682303905 CET	443	49727	35.190.80.1	192.168.2.6
Feb 15, 2023 23:00:44.683203936 CET	443	49727	35.190.80.1	192.168.2.6
Feb 15, 2023 23:00:44.683706999 CET	49727	443	192.168.2.6	35.190.80.1
Feb 15, 2023 23:00:44.683726072 CET	443	49727	35.190.80.1	192.168.2.6
Feb 15, 2023 23:00:44.683842897 CET	49727	443	192.168.2.6	35.190.80.1
Feb 15, 2023 23:00:44.683849096 CET	443	49727	35.190.80.1	192.168.2.6
Feb 15, 2023 23:00:44.683896065 CET	443	49727	35.190.80.1	192.168.2.6
Feb 15, 2023 23:00:44.817771912 CET	443	49727	35.190.80.1	192.168.2.6
Feb 15, 2023 23:00:44.817848921 CET	49727	443	192.168.2.6	35.190.80.1
Feb 15, 2023 23:00:44.818665981 CET	49727	443	192.168.2.6	35.190.80.1
Feb 15, 2023 23:00:44.818705082 CET	443	49727	35.190.80.1	192.168.2.6
Feb 15, 2023 23:00:54.445139885 CET	443	49725	142.250.184.100	192.168.2.6
Feb 15, 2023 23:00:54.445223093 CET	443	49725	142.250.184.100	192.168.2.6
Feb 15, 2023 23:00:54.445336103 CET	49725	443	192.168.2.6	142.250.184.100
Feb 15, 2023 23:00:58.305275917 CET	80	49717	172.67.184.241	192.168.2.6
Feb 15, 2023 23:00:58.305479050 CET	49717	80	192.168.2.6	172.67.184.241
Feb 15, 2023 23:01:28.621285915 CET	49716	80	192.168.2.6	172.67.184.241
Feb 15, 2023 23:01:28.652127028 CET	80	49716	172.67.184.241	192.168.2.6
Feb 15, 2023 23:01:28.808818102 CET	49718	443	192.168.2.6	216.58.209.45
Feb 15, 2023 23:01:28.808824062 CET	49714	443	192.168.2.6	142.250.203.110
Feb 15, 2023 23:01:28.808852911 CET	443	49718	216.58.209.45	192.168.2.6
Feb 15, 2023 23:01:28.808860064 CET	443	49714	142.250.203.110	192.168.2.6
Feb 15, 2023 23:01:39.450310946 CET	49725	443	192.168.2.6	142.250.184.100
Feb 15, 2023 23:01:39.450356007 CET	443	49725	142.250.184.100	192.168.2.6
Feb 15, 2023 23:01:43.310129881 CET	49717	80	192.168.2.6	172.67.184.241
Feb 15, 2023 23:01:43.341738939 CET	80	49717	172.67.184.241	192.168.2.6
Feb 15, 2023 23:01:45.037483931 CET	49718	443	192.168.2.6	216.58.209.45
Feb 15, 2023 23:01:45.037499905 CET	49714	443	192.168.2.6	142.250.203.110
Feb 15, 2023 23:01:45.037523985 CET	49725	443	192.168.2.6	142.250.184.100
Feb 15, 2023 23:01:45.037561893 CET	443	49725	142.250.184.100	192.168.2.6
Feb 15, 2023 23:01:45.037743092 CET	443	49714	142.250.203.110	192.168.2.6
Feb 15, 2023 23:01:45.037756920 CET	443	49718	216.58.209.45	192.168.2.6
Feb 15, 2023 23:01:45.037846088 CET	49714	443	192.168.2.6	142.250.203.110
Feb 15, 2023 23:01:45.037875891 CET	49718	443	192.168.2.6	216.58.209.45
Feb 15, 2023 23:01:45.092446089 CET	49750	443	192.168.2.6	142.250.184.100
Feb 15, 2023 23:01:45.092502117 CET	443	49750	142.250.184.100	192.168.2.6
Feb 15, 2023 23:01:45.092582941 CET	49750	443	192.168.2.6	142.250.184.100
Feb 15, 2023 23:01:45.092880011 CET	49750	443	192.168.2.6	142.250.184.100
Feb 15, 2023 23:01:45.092902899 CET	443	49750	142.250.184.100	192.168.2.6
Feb 15, 2023 23:01:45.165838003 CET	443	49750	142.250.184.100	192.168.2.6
Feb 15, 2023 23:01:45.179929018 CET	49750	443	192.168.2.6	142.250.184.100
Feb 15, 2023 23:01:45.179999113 CET	443	49750	142.250.184.100	192.168.2.6
Feb 15, 2023 23:01:45.180907965 CET	443	49750	142.250.184.100	192.168.2.6
Feb 15, 2023 23:01:45.181442022 CET	49750	443	192.168.2.6	142.250.184.100
Feb 15, 2023 23:01:45.181464911 CET	443	49750	142.250.184.100	192.168.2.6
Feb 15, 2023 23:01:45.181590080 CET	443	49750	142.250.184.100	192.168.2.6
Feb 15, 2023 23:01:45.325793028 CET	49750	443	192.168.2.6	142.250.184.100
Feb 15, 2023 23:01:55.148591995 CET	443	49750	142.250.184.100	192.168.2.6
Feb 15, 2023 23:01:55.148674011 CET	443	49750	142.250.184.100	192.168.2.6
Feb 15, 2023 23:01:55.148809910 CET	49750	443	192.168.2.6	142.250.184.100

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 15, 2023 23:00:41.017493963 CET	59082	53	192.168.2.6	8.8.8.8
Feb 15, 2023 23:00:41.019469023 CET	59504	53	192.168.2.6	8.8.8.8
Feb 15, 2023 23:00:41.043591022 CET	53	59082	8.8.8.8	192.168.2.6
Feb 15, 2023 23:00:41.048223972 CET	53	59504	8.8.8.8	192.168.2.6
Feb 15, 2023 23:00:42.253371000 CET	59504	53	192.168.2.6	8.8.8.8
Feb 15, 2023 23:00:42.273197889 CET	53	59504	8.8.8.8	192.168.2.6
Feb 15, 2023 23:00:42.784204006 CET	63863	53	192.168.2.6	8.8.8.8
Feb 15, 2023 23:00:42.807393074 CET	53	63863	8.8.8.8	192.168.2.6
Feb 15, 2023 23:00:43.502046108 CET	63229	53	192.168.2.6	8.8.8.8
Feb 15, 2023 23:00:43.526010036 CET	53	63229	8.8.8.8	192.168.2.6
Feb 15, 2023 23:00:44.289285898 CET	56122	53	192.168.2.6	8.8.8.8
Feb 15, 2023 23:00:44.315352917 CET	53	56122	8.8.8.8	192.168.2.6
Feb 15, 2023 23:00:44.321707964 CET	52556	53	192.168.2.6	8.8.8.8
Feb 15, 2023 23:00:44.348922968 CET	53	52556	8.8.8.8	192.168.2.6
Feb 15, 2023 23:00:44.385025024 CET	61609	53	192.168.2.6	8.8.8.8
Feb 15, 2023 23:00:44.402992010 CET	53	61609	8.8.8.8	192.168.2.6
Feb 15, 2023 23:01:44.349495888 CET	57322	53	192.168.2.6	8.8.8.8
Feb 15, 2023 23:01:44.369246006 CET	53	57322	8.8.8.8	192.168.2.6
Feb 15, 2023 23:01:45.039263010 CET	62958	53	192.168.2.6	8.8.8.8
Feb 15, 2023 23:01:45.057209969 CET	53	62958	8.8.8.8	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Feb 15, 2023 23:00:41.017493963 CET	192.168.2.6	8.8.8.8	0x6e01	Standard query (0)	clients2.google.com	A (IP address)	IN (0x0001)	false
Feb 15, 2023 23:00:41.019469023 CET	192.168.2.6	8.8.8.8	0x4cd8	Standard query (0)	accounts.google.com	A (IP address)	IN (0x0001)	false
Feb 15, 2023 23:00:42.253371000 CET	192.168.2.6	8.8.8.8	0x4cd8	Standard query (0)	accounts.google.com	A (IP address)	IN (0x0001)	false
Feb 15, 2023 23:00:42.784204006 CET	192.168.2.6	8.8.8.8	0x7ab	Standard query (0)	qwasdrgqwdasd.winbestprizess.info	A (IP address)	IN (0x0001)	false
Feb 15, 2023 23:00:43.502046108 CET	192.168.2.6	8.8.8.8	0x8357	Standard query (0)	qwasdrgqwdasd.winbestprizess.info	A (IP address)	IN (0x0001)	false
Feb 15, 2023 23:00:44.289285898 CET	192.168.2.6	8.8.8.8	0x8fc7	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Feb 15, 2023 23:00:44.321707964 CET	192.168.2.6	8.8.8.8	0xf88b	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Feb 15, 2023 23:00:44.385025024 CET	192.168.2.6	8.8.8.8	0x3116	Standard query (0)	a.nel.cloudflare.com	A (IP address)	IN (0x0001)	false
Feb 15, 2023 23:01:44.349495888 CET	192.168.2.6	8.8.8.8	0x40eb	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Feb 15, 2023 23:01:45.039263010 CET	192.168.2.6	8.8.8.8	0xbb6a	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Feb 15, 2023 23:00:41.043591022 CET	8.8.8.8	192.168.2.6	0x6e01	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 15, 2023 23:00:41.043591022 CET	8.8.8.8	192.168.2.6	0x6e01	No error (0)	clients.l.google.com		142.250.203.110	A (IP address)	IN (0x0001)	false
Feb 15, 2023 23:00:41.048223972 CET	8.8.8.8	192.168.2.6	0x4cd8	No error (0)	accounts.google.com		216.58.209.45	A (IP address)	IN (0x0001)	false
Feb 15, 2023 23:00:42.273197889 CET	8.8.8.8	192.168.2.6	0x4cd8	No error (0)	accounts.google.com		216.58.209.45	A (IP address)	IN (0x0001)	false
Feb 15, 2023 23:00:42.807393074 CET	8.8.8.8	192.168.2.6	0x7ab	No error (0)	qwasdrgqwdasd.winbestprizess.info		172.67.184.241	A (IP address)	IN (0x0001)	false
Feb 15, 2023 23:00:42.807393074 CET	8.8.8.8	192.168.2.6	0x7ab	No error (0)	qwasdrgqwdasd.winbestprizess.info		104.21.19.35	A (IP address)	IN (0x0001)	false
Feb 15, 2023 23:00:43.526010036 CET	8.8.8.8	192.168.2.6	0x8357	No error (0)	qwasdrgqwdasd.winbestprizess.info		104.21.19.35	A (IP address)	IN (0x0001)	false
Feb 15, 2023 23:00:43.526010036 CET	8.8.8.8	192.168.2.6	0x8357	No error (0)	qwasdrgqwdasd.winbestprizess.info		172.67.184.241	A (IP address)	IN (0x0001)	false
Feb 15, 2023 23:00:44.315352917 CET	8.8.8.8	192.168.2.6	0x8fc7	No error (0)	www.google.com		142.250.203.100	A (IP address)	IN (0x0001)	false
Feb 15, 2023 23:00:44.348922968 CET	8.8.8.8	192.168.2.6	0xf88b	No error (0)	www.google.com		142.250.184.100	A (IP address)	IN (0x0001)	false
Feb 15, 2023 23:00:44.402992010 CET	8.8.8.8	192.168.2.6	0x3116	No error (0)	a.nel.cloudflare.com		35.190.80.1	A (IP address)	IN (0x0001)	false
Feb 15, 2023 23:01:44.369246006 CET	8.8.8.8	192.168.2.6	0x40eb	No error (0)	www.google.com		142.250.203.100	A (IP address)	IN (0x0001)	false
Feb 15, 2023 23:01:45.057209969 CET	8.8.8.8	192.168.2.6	0xbb6a	No error (0)	www.google.com		142.250.184.100	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

accounts.google.com

clients2.google.com

qwasdrgqwdasd.winbestprizess.info

https:

a.nel.cloudflare.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.6	49715	216.58.209.45	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.6	49713	142.250.203.110	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.6	49720	104.21.19.35	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.6	49723	104.21.19.35	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.6	49726	35.190.80.1	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.6	49727	35.190.80.1	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.6	49716	172.67.184.241	80	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
Feb 15, 2023 23:00:43.404890060 CET	115	OUT	GET /palasekddq2hf45ysm.js HTTP/1.1 Host: qwasdrgqwdasd.winbestprizess.info Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Feb 15, 2023 23:00:43.450258017 CET	119	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 15 Feb 2023 22:00:43 GMT Transfer-Encoding: chunked Connection: keep-alive Cache-Control: max-age=3600 Expires: Wed, 15 Feb 2023 23:00:43 GMT Location: https://qwasdrgqwdasd.winbestprizess.info/palasekddq2hf45ysm.js Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sFW7r6rMj3OIDTyJ1JCTQFa2NAzZNJs1yWR2aKoVFHqwUH6T%2F%2F5GVz0LmWwdBTEyk6%2BEh%2FQUKHmB2QSDtGql5%2B9Mj4a%2Fafvu99lHd6IXgoELQqrCRe%2FQ0htEIYDL3Si1puZ1KcrihbAOqzwi%2FLwKMmJjGL0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 79a151675fbf7300-LHR alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Feb 15, 2023 23:01:28.621285915 CET	609	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.6	49717	172.67.184.241	80	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
Feb 15, 2023 23:01:43.310129881 CET	704	OUT	Data Raw: 00 Data Ascii:

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.6	49715	216.58.209.45	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-02-15 22:00:43 UTC	0	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __Secure-ENID=6.SE=Md0Ynyf9ahpkx1CxTGF0vY434NJ6ymH-gDI2Tl5Ly-NQYGPjnNfggtiFRMAwx4JRDOC_gavEPcD5cTBJzUgtbJobmBEuJ8xi2UuotxvOZgApoqSIg1b0RP47U08XG8Bz_SExSzKy0ETSsajbToDlYyFsxfI93p7AyRAd-OeIBA0; CONSENT=PENDING+070
2023-02-15 22:00:43 UTC	0	OUT	Data Raw: 20 Data Ascii:
2023-02-15 22:00:43 UTC	3	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 15 Feb 2023 22:00:43 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-platform=, ch-ua-platform-version= Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-1aVG9SBzwUHLuhAEwK6Vfg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-02-15 22:00:43 UTC	5	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2023-02-15 22:00:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.6	49713	142.250.203.110	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-02-15 22:00:43 UTC	0	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=104.0.5112.81&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda X-Goog-Update-Updater: chromecrx-104.0.5112.81 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-02-15 22:00:43 UTC	1	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-W-mMIwkhshQWVRyN6Z79Kg' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 15 Feb 2023 22:00:43 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 5889 X-Daystart: 50443 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-02-15 22:00:43 UTC	2	IN	Data Raw: 32 63 39 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 35 38 38 39 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 35 30 34 34 33 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 2c9<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="5889" elapsed_seconds="50443"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2023-02-15 22:00:43 UTC	2	IN	Data Raw: 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 2f 67 75 70 64 61 74 65 3e 0d 0a Data Ascii: 723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app></gupdate>
2023-02-15 22:00:43 UTC	2	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.6	49720	104.21.19.35	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-02-15 22:00:43 UTC	2	OUT	GET /palasekddq2hf45ysm.js HTTP/1.1 Host: qwasdrgqwdasd.winbestprizess.info Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-02-15 22:00:43 UTC	5	IN	HTTP/1.1 200 OK Date: Wed, 15 Feb 2023 22:00:43 GMT Content-Type: application/javascript Content-Length: 621 Connection: close Last-Modified: Wed, 09 Nov 2022 23:25:24 GMT ETag: "636c36e4-26d" Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 2999 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=e1qcs44SCnecjBBmwk6wZ5qa2JTO2tM4y8m6249PZIkGuyNWHEoKOi1Xaf2A62KtKjbFbaPMJBXOuboHrRAQnvwJdHosakhpY%2FnYSwfbc6RNv3tEVfzZ5UJEGz%2FHLGaoPOKHSBpLTUmR8%2Bsalpv%2Fw6oOk18%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 79a1516909b92bf7-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2023-02-15 22:00:43 UTC	5	IN	Data Raw: 21 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 76 61 72 20 65 2c 20 74 20 3d 20 70 6f 70 75 6e 64 65 72 2e 75 72 6c 20 7c 7c 20 22 68 74 74 70 73 3a 2f 2f 67 6f 6f 67 6c 65 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 20 20 6e 20 3d 20 22 63 6c 69 63 6b 22 2c 0a 20 20 20 20 20 20 20 20 6f 20 3d 20 22 70 6f 70 75 6e 64 65 72 22 2c 0a 20 20 20 20 20 20 20 20 63 20 3d 20 70 6f 70 75 6e 64 65 72 2e 63 6c 69 63 6b 73 5f 6e 75 6d 20 7c 7c 20 31 2c 0a 20 20 20 20 20 20 20 20 69 20 3d 20 70 6f 70 75 6e 64 65 72 2e 65 78 70 69 72 65 20 7c 7c 20 32 34 2c 09 09 0a 20 20 20 20 20 20 20 20 64 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 2c 0a 20 20 20 20 20 20 20 20 75 20 3d 20 22 75 6e 64 65 66 69 6e 65 64 22 2c 0a 09 09 70 20 Data Ascii: ! function() { var e, t = popunder.url \|\| "https://google.com", n = "click", o = "popunder", c = popunder.clicks_num \|\| 1, i = popunder.expire \|\| 24, d = document.documentElement, u = "undefined",p

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.6	49723	104.21.19.35	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-02-15 22:00:44 UTC	6	OUT	GET /favicon.ico HTTP/1.1 Host: qwasdrgqwdasd.winbestprizess.info Connection: keep-alive sec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://qwasdrgqwdasd.winbestprizess.info/palasekddq2hf45ysm.js Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-02-15 22:00:44 UTC	7	IN	HTTP/1.1 404 Not Found Date: Wed, 15 Feb 2023 22:00:44 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Cache-Control: max-age=14400 CF-Cache-Status: MISS Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ytQegk6xGm9PCyMDbraClPzfuzjaFA03EMO1uzNLN1P2xijFc3DQ0MpMDb7PBH01YUm5QAnium5dgTHPcFmHX0s9OVo2BxZ4wceR%2FjI2Fhecazauw3AvlmySxI1mRPUNdSnvnAhNKAEI3BhllvO0KrSAGxA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 79a1516cf9825bf9-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2023-02-15 22:00:44 UTC	7	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2023-02-15 22:00:44 UTC	8	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.6	49726	35.190.80.1	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-02-15 22:00:44 UTC	8	OUT	OPTIONS /report/v3?s=ytQegk6xGm9PCyMDbraClPzfuzjaFA03EMO1uzNLN1P2xijFc3DQ0MpMDb7PBH01YUm5QAnium5dgTHPcFmHX0s9OVo2BxZ4wceR%2FjI2Fhecazauw3AvlmySxI1mRPUNdSnvnAhNKAEI3BhllvO0KrSAGxA%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Origin: https://qwasdrgqwdasd.winbestprizess.info Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-02-15 22:00:44 UTC	8	IN	HTTP/1.1 200 OK content-length: 0 access-control-max-age: 86400 access-control-allow-methods: POST, OPTIONS access-control-allow-origin: * access-control-allow-headers: content-length, content-type date: Wed, 15 Feb 2023 22:00:44 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.6	49727	35.190.80.1	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-02-15 22:00:44 UTC	9	OUT	POST /report/v3?s=ytQegk6xGm9PCyMDbraClPzfuzjaFA03EMO1uzNLN1P2xijFc3DQ0MpMDb7PBH01YUm5QAnium5dgTHPcFmHX0s9OVo2BxZ4wceR%2FjI2Fhecazauw3AvlmySxI1mRPUNdSnvnAhNKAEI3BhllvO0KrSAGxA%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Content-Length: 476 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-02-15 22:00:44 UTC	9	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 30 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 31 37 36 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 68 74 74 70 73 3a 2f 2f 71 77 61 73 64 72 67 71 77 64 61 73 64 2e 77 69 6e 62 65 73 74 70 72 69 7a 65 73 73 2e 69 6e 66 6f 2f 70 61 6c 61 73 65 6b 64 64 71 32 68 66 34 35 79 73 6d 2e 6a 73 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 30 34 2e 32 31 2e 31 39 2e 33 35 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 34 30 34 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e Data Ascii: [{"age":0,"body":{"elapsed_time":176,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"https://qwasdrgqwdasd.winbestprizess.info/palasekddq2hf45ysm.js","sampling_fraction":1.0,"server_ip":"104.21.19.35","status_code":404,"type":"http.
2023-02-15 22:00:44 UTC	10	IN	HTTP/1.1 200 OK content-length: 0 date: Wed, 15 Feb 2023 22:00:44 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Target ID:	0
Start time:	23:00:37
Start date:	15/02/2023
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Imagebase:	0x7ff6f9750000
File size:	2851656 bytes
MD5 hash:	0FEC2748F363150DC54C1CAFFB1A9408
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Target ID:	1
Start time:	23:00:38
Start date:	15/02/2023
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1944 --field-trial-handle=1728,i,15753723449913141145,3018605403501027829,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff6f9750000
File size:	2851656 bytes
MD5 hash:	0FEC2748F363150DC54C1CAFFB1A9408
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Target ID:	2
Start time:	23:00:39
Start date:	15/02/2023
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" "http://qwasdrgqwdasd.winbestprizess.info/palasekddq2hf45ysm.js
Imagebase:	0x7ff6f9750000
File size:	2851656 bytes
MD5 hash:	0FEC2748F363150DC54C1CAFFB1A9408
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=104.0.5112.81&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-104.0.5112.81Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /palasekddq2hf45ysm.js HTTP/1.1Host: qwasdrgqwdasd.winbestprizess.infoConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: qwasdrgqwdasd.winbestprizess.infoConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://qwasdrgqwdasd.winbestprizess.info/palasekddq2hf45ysm.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /palasekddq2hf45ysm.js HTTP/1.1Host: qwasdrgqwdasd.winbestprizess.infoConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://qwasdrgqwdasd.winbestprizess.info/palasekddq2hf45ysm.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: chrome.exePID: 5208, Parent PID: 788

General

Chronological Activities

Analysis Process: chrome.exePID: 4876, Parent PID: 5208

General

Chronological Activities

Analysis Process: chrome.exePID: 5852, Parent PID: 788

General

Chronological Activities

Disassembly

Windows Analysis Report
http://qwasdrgqwdasd.winbestprizess.info/palasekddq2hf45ysm.js