Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
https://www.google.cg/url?url=https://xzebqqeqx&wjjl=vpbxjdcm&wjjl=vpbxjdcm&uxkkrka=p0&nwexrn=uxkkrka&uxkkrka=p0&&wjjl=vpbxjdcm&wjjl=vpbxjdcm&uxkkrka=p0&nwexrn=uxkkrka&uxkkrka=p0&nwexrn=uxkkrka&pmbeq=xzebqqeqx&q=amp/pfop72j.lxnhgostxaxpazjod.com/xm2z7dsyo&wjjl=vpbxjdcm&wjjl=vpbxjdcm&uxkkrka=p0&nwexr

Overview

General Information

Sample URL:https://www.google.cg/url?url=https://xzebqqeqx&wjjl=vpbxjdcm&wjjl=vpbxjdcm&uxkkrka=p0&nwexrn=uxkkrka&uxkkrka=p0&&wjjl=vpbxjdcm&wjjl=vpbxjdcm&uxkkrka=p0&nwexrn=uxkkrka&uxkkrka=p0&nwexrn=uxkkrka&pmbeq=
Analysis ID:1500053
Infos:

Detection

Score:2
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Creates files inside the system directory
Deletes files inside the Windows folder
Detected non-DNS traffic on DNS port
Detected suspicious crossdomain redirect

Classification

Process Tree

  • System is w10x64
  • chrome.exe (PID: 2872 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • chrome.exe (PID: 4960 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=1896,i,1184218221580559842,4154976847397048763,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • chrome.exe (PID: 6468 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.google.cg/url?url=https://xzebqqeqx&wjjl=vpbxjdcm&wjjl=vpbxjdcm&uxkkrka=p0&nwexrn=uxkkrka&uxkkrka=p0&&wjjl=vpbxjdcm&wjjl=vpbxjdcm&uxkkrka=p0&nwexrn=uxkkrka&uxkkrka=p0&nwexrn=uxkkrka&pmbeq=xzebqqeqx&q=amp/pfop72j.lxnhgostxaxpazjod.com/xm2z7dsyo&wjjl=vpbxjdcm&wjjl=vpbxjdcm&uxkkrka=p0&nwexrn=uxkkrka&pmbeq=xzebqqeqx&wjjl=vpbxjdcm&wjjl=vpbxjdcm&uxkkrka=p0" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: global trafficTCP traffic: 192.168.2.4:60459 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.4:57827 -> 162.159.36.2:53
Source: C:\Program Files\Google\Chrome\Application\chrome.exeHTTP traffic: Redirect from: www.google.cg to http://pfop72j.lxnhgostxaxpazjod.com/xm2z7dsyo
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknownTCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknownTCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknownTCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknownTCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknownTCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknownTCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknownTCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficHTTP traffic detected: GET /url?url=https://xzebqqeqx&wjjl=vpbxjdcm&wjjl=vpbxjdcm&uxkkrka=p0&nwexrn=uxkkrka&uxkkrka=p0&&wjjl=vpbxjdcm&wjjl=vpbxjdcm&uxkkrka=p0&nwexrn=uxkkrka&uxkkrka=p0&nwexrn=uxkkrka&pmbeq=xzebqqeqx&q=amp/pfop72j.lxnhgostxaxpazjod.com/xm2z7dsyo&wjjl=vpbxjdcm&wjjl=vpbxjdcm&uxkkrka=p0&nwexrn=uxkkrka&pmbeq=xzebqqeqx&wjjl=vpbxjdcm&wjjl=vpbxjdcm&uxkkrka=p0 HTTP/1.1Host: www.google.cgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCI/KzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /amp/pfop72j.lxnhgostxaxpazjod.com/xm2z7dsyo HTTP/1.1Host: www.google.cgConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCI/KzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=517=gTSJieVeGtmHxGTN9DAtEWFrPSvlcRbmQ9L-dsFLWWSnsbgGJXTfxNbvX7QWgjXCgNMlLnZbGDXZUildBx1idoFJAHLURalbmeYiW4j2DJUSx6l5_BIU_XSxeaYdIHU5CTFpIxfWQaIYxuOhtulyPWUVOaP53H6DtN889B3RH7YWR8MJd2fS
Source: global trafficHTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global trafficHTTP traffic detected: GET /xm2z7dsyo HTTP/1.1Host: pfop72j.lxnhgostxaxpazjod.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /xm2z7dsyo HTTP/1.1Host: pfop72j.lxnhgostxaxpazjod.comConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /xm2z7dsyo HTTP/1.1Host: pfop72j.lxnhgostxaxpazjod.comConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /xm2z7dsyo HTTP/1.1Host: pfop72j.lxnhgostxaxpazjod.comConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /xm2z7dsyo HTTP/1.1Host: pfop72j.lxnhgostxaxpazjod.comConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /xm2z7dsyo HTTP/1.1Host: pfop72j.lxnhgostxaxpazjod.comConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /xm2z7dsyo HTTP/1.1Host: pfop72j.lxnhgostxaxpazjod.comConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /xm2z7dsyo HTTP/1.1Host: pfop72j.lxnhgostxaxpazjod.comConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /xm2z7dsyo HTTP/1.1Host: pfop72j.lxnhgostxaxpazjod.comConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global trafficDNS traffic detected: DNS query: www.google.cg
Source: global trafficDNS traffic detected: DNS query: pfop72j.lxnhgostxaxpazjod.com
Source: global trafficDNS traffic detected: DNS query: www.google.com
Source: global trafficDNS traffic detected: DNS query: 198.187.3.20.in-addr.arpa
Source: sets.json.0.drString found in binary or memory: https://07c225f3.online
Source: sets.json.0.drString found in binary or memory: https://24.hu
Source: sets.json.0.drString found in binary or memory: https://aajtak.in
Source: sets.json.0.drString found in binary or memory: https://abczdrowie.pl
Source: sets.json.0.drString found in binary or memory: https://alice.tw
Source: sets.json.0.drString found in binary or memory: https://ambitionbox.com
Source: sets.json.0.drString found in binary or memory: https://autobild.de
Source: sets.json.0.drString found in binary or memory: https://baomoi.com
Source: sets.json.0.drString found in binary or memory: https://bild.de
Source: sets.json.0.drString found in binary or memory: https://blackrock.com
Source: sets.json.0.drString found in binary or memory: https://blackrockadvisorelite.it
Source: sets.json.0.drString found in binary or memory: https://bluradio.com
Source: sets.json.0.drString found in binary or memory: https://bolasport.com
Source: sets.json.0.drString found in binary or memory: https://bonvivir.com
Source: sets.json.0.drString found in binary or memory: https://bumbox.com
Source: sets.json.0.drString found in binary or memory: https://businessinsider.com.pl
Source: sets.json.0.drString found in binary or memory: https://businesstoday.in
Source: sets.json.0.drString found in binary or memory: https://cachematrix.com
Source: sets.json.0.drString found in binary or memory: https://cafemedia.com
Source: sets.json.0.drString found in binary or memory: https://caracoltv.com
Source: sets.json.0.drString found in binary or memory: https://carcostadvisor.be
Source: sets.json.0.drString found in binary or memory: https://carcostadvisor.com
Source: sets.json.0.drString found in binary or memory: https://carcostadvisor.fr
Source: sets.json.0.drString found in binary or memory: https://cardsayings.net
Source: sets.json.0.drString found in binary or memory: https://chatbot.com
Source: sets.json.0.drString found in binary or memory: https://chennien.com
Source: sets.json.0.drString found in binary or memory: https://citybibleforum.org
Source: sets.json.0.drString found in binary or memory: https://clarosports.com
Source: sets.json.0.drString found in binary or memory: https://clmbtech.com
Source: sets.json.0.drString found in binary or memory: https://closeronline.co.uk
Source: sets.json.0.drString found in binary or memory: https://clubelpais.com.uy
Source: sets.json.0.drString found in binary or memory: https://cmxd.com.mx
Source: sets.json.0.drString found in binary or memory: https://cognitive-ai.ru
Source: sets.json.0.drString found in binary or memory: https://cognitiveai.ru
Source: sets.json.0.drString found in binary or memory: https://commentcamarche.com
Source: sets.json.0.drString found in binary or memory: https://commentcamarche.net
Source: sets.json.0.drString found in binary or memory: https://computerbild.de
Source: sets.json.0.drString found in binary or memory: https://content-loader.com
Source: sets.json.0.drString found in binary or memory: https://cookreactor.com
Source: sets.json.0.drString found in binary or memory: https://cricbuzz.com
Source: sets.json.0.drString found in binary or memory: https://css-load.com
Source: sets.json.0.drString found in binary or memory: https://deccoria.pl
Source: sets.json.0.drString found in binary or memory: https://deere.com
Source: sets.json.0.drString found in binary or memory: https://desimartini.com
Source: sets.json.0.drString found in binary or memory: https://dewarmsteweek.be
Source: sets.json.0.drString found in binary or memory: https://drimer.io
Source: sets.json.0.drString found in binary or memory: https://drimer.travel
Source: sets.json.0.drString found in binary or memory: https://economictimes.com
Source: sets.json.0.drString found in binary or memory: https://een.be
Source: sets.json.0.drString found in binary or memory: https://efront.com
Source: sets.json.0.drString found in binary or memory: https://eleconomista.net
Source: sets.json.0.drString found in binary or memory: https://elfinancierocr.com
Source: sets.json.0.drString found in binary or memory: https://elgrafico.com
Source: sets.json.0.drString found in binary or memory: https://ella.sv
Source: sets.json.0.drString found in binary or memory: https://elpais.com.uy
Source: sets.json.0.drString found in binary or memory: https://elpais.uy
Source: sets.json.0.drString found in binary or memory: https://etfacademy.it
Source: sets.json.0.drString found in binary or memory: https://eworkbookcloud.com
Source: sets.json.0.drString found in binary or memory: https://eworkbookrequest.com
Source: sets.json.0.drString found in binary or memory: https://fakt.pl
Source: sets.json.0.drString found in binary or memory: https://finn.no
Source: sets.json.0.drString found in binary or memory: https://firstlook.biz
Source: sets.json.0.drString found in binary or memory: https://gallito.com.uy
Source: sets.json.0.drString found in binary or memory: https://geforcenow.com
Source: sets.json.0.drString found in binary or memory: https://gettalkdesk.com
Source: sets.json.0.drString found in binary or memory: https://gliadomain.com
Source: sets.json.0.drString found in binary or memory: https://gnttv.com
Source: sets.json.0.drString found in binary or memory: https://graziadaily.co.uk
Source: sets.json.0.drString found in binary or memory: https://grid.id
Source: sets.json.0.drString found in binary or memory: https://gridgames.app
Source: sets.json.0.drString found in binary or memory: https://growthrx.in
Source: sets.json.0.drString found in binary or memory: https://grupolpg.sv
Source: sets.json.0.drString found in binary or memory: https://gujaratijagran.com
Source: sets.json.0.drString found in binary or memory: https://hapara.com
Source: sets.json.0.drString found in binary or memory: https://hazipatika.com
Source: sets.json.0.drString found in binary or memory: https://hc1.com
Source: sets.json.0.drString found in binary or memory: https://hc1.global
Source: sets.json.0.drString found in binary or memory: https://hc1cas.com
Source: sets.json.0.drString found in binary or memory: https://hc1cas.global
Source: sets.json.0.drString found in binary or memory: https://healthshots.com
Source: sets.json.0.drString found in binary or memory: https://hearty.app
Source: sets.json.0.drString found in binary or memory: https://hearty.gift
Source: sets.json.0.drString found in binary or memory: https://hearty.me
Source: sets.json.0.drString found in binary or memory: https://heartymail.com
Source: sets.json.0.drString found in binary or memory: https://heatworld.com
Source: sets.json.0.drString found in binary or memory: https://helpdesk.com
Source: sets.json.0.drString found in binary or memory: https://hindustantimes.com
Source: sets.json.0.drString found in binary or memory: https://hj.rs
Source: sets.json.0.drString found in binary or memory: https://hjck.com
Source: sets.json.0.drString found in binary or memory: https://html-load.cc
Source: sets.json.0.drString found in binary or memory: https://html-load.com
Source: sets.json.0.drString found in binary or memory: https://human-talk.org
Source: sets.json.0.drString found in binary or memory: https://idbs-cloud.com
Source: sets.json.0.drString found in binary or memory: https://idbs-dev.com
Source: sets.json.0.drString found in binary or memory: https://idbs-eworkbook.com
Source: sets.json.0.drString found in binary or memory: https://idbs-staging.com
Source: sets.json.0.drString found in binary or memory: https://img-load.com
Source: sets.json.0.drString found in binary or memory: https://indiatimes.com
Source: sets.json.0.drString found in binary or memory: https://indiatoday.in
Source: sets.json.0.drString found in binary or memory: https://indiatodayne.in
Source: sets.json.0.drString found in binary or memory: https://infoedgeindia.com
Source: sets.json.0.drString found in binary or memory: https://interia.pl
Source: sets.json.0.drString found in binary or memory: https://intoday.in
Source: sets.json.0.drString found in binary or memory: https://iolam.it
Source: sets.json.0.drString found in binary or memory: https://ishares.com
Source: sets.json.0.drString found in binary or memory: https://jagran.com
Source: sets.json.0.drString found in binary or memory: https://johndeere.com
Source: sets.json.0.drString found in binary or memory: https://journaldesfemmes.com
Source: sets.json.0.drString found in binary or memory: https://journaldesfemmes.fr
Source: sets.json.0.drString found in binary or memory: https://journaldunet.com
Source: sets.json.0.drString found in binary or memory: https://journaldunet.fr
Source: sets.json.0.drString found in binary or memory: https://joyreactor.cc
Source: sets.json.0.drString found in binary or memory: https://joyreactor.com
Source: sets.json.0.drString found in binary or memory: https://kaksya.in
Source: sets.json.0.drString found in binary or memory: https://knowledgebase.com
Source: sets.json.0.drString found in binary or memory: https://kompas.com
Source: sets.json.0.drString found in binary or memory: https://kompas.tv
Source: sets.json.0.drString found in binary or memory: https://kompasiana.com
Source: sets.json.0.drString found in binary or memory: https://lanacion.com.ar
Source: sets.json.0.drString found in binary or memory: https://landyrev.com
Source: sets.json.0.drString found in binary or memory: https://landyrev.ru
Source: sets.json.0.drString found in binary or memory: https://laprensagrafica.com
Source: sets.json.0.drString found in binary or memory: https://lateja.cr
Source: sets.json.0.drString found in binary or memory: https://libero.it
Source: sets.json.0.drString found in binary or memory: https://linternaute.com
Source: sets.json.0.drString found in binary or memory: https://linternaute.fr
Source: sets.json.0.drString found in binary or memory: https://livechat.com
Source: sets.json.0.drString found in binary or memory: https://livechatinc.com
Source: sets.json.0.drString found in binary or memory: https://livehindustan.com
Source: sets.json.0.drString found in binary or memory: https://livemint.com
Source: sets.json.0.drString found in binary or memory: https://max.auto
Source: sets.json.0.drString found in binary or memory: https://medonet.pl
Source: sets.json.0.drString found in binary or memory: https://meo.pt
Source: sets.json.0.drString found in binary or memory: https://mercadolibre.cl
Source: sets.json.0.drString found in binary or memory: https://mercadolibre.co.cr
Source: sets.json.0.drString found in binary or memory: https://mercadolibre.com
Source: sets.json.0.drString found in binary or memory: https://mercadolibre.com.ar
Source: sets.json.0.drString found in binary or memory: https://mercadolibre.com.bo
Source: sets.json.0.drString found in binary or memory: https://mercadolibre.com.co
Source: sets.json.0.drString found in binary or memory: https://mercadolibre.com.do
Source: sets.json.0.drString found in binary or memory: https://mercadolibre.com.ec
Source: sets.json.0.drString found in binary or memory: https://mercadolibre.com.gt
Source: sets.json.0.drString found in binary or memory: https://mercadolibre.com.hn
Source: sets.json.0.drString found in binary or memory: https://mercadolibre.com.mx
Source: sets.json.0.drString found in binary or memory: https://mercadolibre.com.ni
Source: sets.json.0.drString found in binary or memory: https://mercadolibre.com.pa
Source: sets.json.0.drString found in binary or memory: https://mercadolibre.com.pe
Source: sets.json.0.drString found in binary or memory: https://mercadolibre.com.py
Source: sets.json.0.drString found in binary or memory: https://mercadolibre.com.sv
Source: sets.json.0.drString found in binary or memory: https://mercadolibre.com.uy
Source: sets.json.0.drString found in binary or memory: https://mercadolibre.com.ve
Source: sets.json.0.drString found in binary or memory: https://mercadolivre.com
Source: sets.json.0.drString found in binary or memory: https://mercadolivre.com.br
Source: sets.json.0.drString found in binary or memory: https://mercadopago.cl
Source: sets.json.0.drString found in binary or memory: https://mercadopago.com
Source: sets.json.0.drString found in binary or memory: https://mercadopago.com.ar
Source: sets.json.0.drString found in binary or memory: https://mercadopago.com.br
Source: sets.json.0.drString found in binary or memory: https://mercadopago.com.co
Source: sets.json.0.drString found in binary or memory: https://mercadopago.com.ec
Source: sets.json.0.drString found in binary or memory: https://mercadopago.com.mx
Source: sets.json.0.drString found in binary or memory: https://mercadopago.com.pe
Source: sets.json.0.drString found in binary or memory: https://mercadopago.com.uy
Source: sets.json.0.drString found in binary or memory: https://mercadopago.com.ve
Source: sets.json.0.drString found in binary or memory: https://mercadoshops.cl
Source: sets.json.0.drString found in binary or memory: https://mercadoshops.com
Source: sets.json.0.drString found in binary or memory: https://mercadoshops.com.ar
Source: sets.json.0.drString found in binary or memory: https://mercadoshops.com.br
Source: sets.json.0.drString found in binary or memory: https://mercadoshops.com.co
Source: sets.json.0.drString found in binary or memory: https://mercadoshops.com.mx
Source: sets.json.0.drString found in binary or memory: https://mighty-app.appspot.com
Source: sets.json.0.drString found in binary or memory: https://mightytext.net
Source: sets.json.0.drString found in binary or memory: https://mittanbud.no
Source: sets.json.0.drString found in binary or memory: https://money.pl
Source: sets.json.0.drString found in binary or memory: https://motherandbaby.com
Source: sets.json.0.drString found in binary or memory: https://mystudentdashboard.com
Source: sets.json.0.drString found in binary or memory: https://nacion.com
Source: sets.json.0.drString found in binary or memory: https://naukri.com
Source: sets.json.0.drString found in binary or memory: https://nidhiacademyonline.com
Source: sets.json.0.drString found in binary or memory: https://nien.co
Source: sets.json.0.drString found in binary or memory: https://nien.com
Source: sets.json.0.drString found in binary or memory: https://nien.org
Source: sets.json.0.drString found in binary or memory: https://nlc.hu
Source: sets.json.0.drString found in binary or memory: https://nosalty.hu
Source: sets.json.0.drString found in binary or memory: https://noticiascaracol.com
Source: sets.json.0.drString found in binary or memory: https://nourishingpursuits.com
Source: sets.json.0.drString found in binary or memory: https://nvidia.com
Source: sets.json.0.drString found in binary or memory: https://o2.pl
Source: sets.json.0.drString found in binary or memory: https://ocdn.eu
Source: sets.json.0.drString found in binary or memory: https://onet.pl
Source: sets.json.0.drString found in binary or memory: https://ottplay.com
Source: sets.json.0.drString found in binary or memory: https://p106.net
Source: sets.json.0.drString found in binary or memory: https://p24.hu
Source: sets.json.0.drString found in binary or memory: https://paula.com.uy
Source: sets.json.0.drString found in binary or memory: https://pdmp-apis.no
Source: sets.json.0.drString found in binary or memory: https://phonandroid.com
Source: sets.json.0.drString found in binary or memory: https://player.pl
Source: sets.json.0.drString found in binary or memory: https://plejada.pl
Source: sets.json.0.drString found in binary or memory: https://poalim.site
Source: sets.json.0.drString found in binary or memory: https://poalim.xyz
Source: sets.json.0.drString found in binary or memory: https://pomponik.pl
Source: sets.json.0.drString found in binary or memory: https://portalinmobiliario.com
Source: sets.json.0.drString found in binary or memory: https://prisjakt.no
Source: sets.json.0.drString found in binary or memory: https://pudelek.pl
Source: sets.json.0.drString found in binary or memory: https://punjabijagran.com
Source: sets.json.0.drString found in binary or memory: https://radio1.be
Source: sets.json.0.drString found in binary or memory: https://radio2.be
Source: sets.json.0.drString found in binary or memory: https://reactor.cc
Source: sets.json.0.drString found in binary or memory: https://repid.org
Source: sets.json.0.drString found in binary or memory: https://reshim.org
Source: sets.json.0.drString found in binary or memory: https://rws1nvtvt.com
Source: sets.json.0.drString found in binary or memory: https://rws2nvtvt.com
Source: sets.json.0.drString found in binary or memory: https://rws3nvtvt.com
Source: sets.json.0.drString found in binary or memory: https://sackrace.ai
Source: sets.json.0.drString found in binary or memory: https://salemoveadvisor.com
Source: sets.json.0.drString found in binary or memory: https://salemovefinancial.com
Source: sets.json.0.drString found in binary or memory: https://salemovetravel.com
Source: sets.json.0.drString found in binary or memory: https://samayam.com
Source: sets.json.0.drString found in binary or memory: https://sapo.io
Source: sets.json.0.drString found in binary or memory: https://sapo.pt
Source: sets.json.0.drString found in binary or memory: https://shock.co
Source: sets.json.0.drString found in binary or memory: https://smaker.pl
Source: sets.json.0.drString found in binary or memory: https://smoney.vn
Source: sets.json.0.drString found in binary or memory: https://smpn106jkt.sch.id
Source: sets.json.0.drString found in binary or memory: https://socket-to-me.vip
Source: sets.json.0.drString found in binary or memory: https://songshare.com
Source: sets.json.0.drString found in binary or memory: https://songstats.com
Source: sets.json.0.drString found in binary or memory: https://sporza.be
Source: sets.json.0.drString found in binary or memory: https://standardsandpraiserepurpose.com
Source: sets.json.0.drString found in binary or memory: https://startlap.hu
Source: sets.json.0.drString found in binary or memory: https://startupislandtaiwan.com
Source: sets.json.0.drString found in binary or memory: https://startupislandtaiwan.net
Source: sets.json.0.drString found in binary or memory: https://startupislandtaiwan.org
Source: sets.json.0.drString found in binary or memory: https://stripe.com
Source: sets.json.0.drString found in binary or memory: https://stripe.network
Source: sets.json.0.drString found in binary or memory: https://stripecdn.com
Source: sets.json.0.drString found in binary or memory: https://supereva.it
Source: sets.json.0.drString found in binary or memory: https://takeabreak.co.uk
Source: sets.json.0.drString found in binary or memory: https://talkdeskqaid.com
Source: sets.json.0.drString found in binary or memory: https://talkdeskstgid.com
Source: sets.json.0.drString found in binary or memory: https://teacherdashboard.com
Source: sets.json.0.drString found in binary or memory: https://technology-revealed.com
Source: sets.json.0.drString found in binary or memory: https://terazgotuje.pl
Source: sets.json.0.drString found in binary or memory: https://text.com
Source: sets.json.0.drString found in binary or memory: https://textyserver.appspot.com
Source: sets.json.0.drString found in binary or memory: https://the42.ie
Source: sets.json.0.drString found in binary or memory: https://thejournal.ie
Source: sets.json.0.drString found in binary or memory: https://thirdspace.org.au
Source: sets.json.0.drString found in binary or memory: https://timesinternet.in
Source: sets.json.0.drString found in binary or memory: https://timesofindia.com
Source: sets.json.0.drString found in binary or memory: https://tolteck.app
Source: sets.json.0.drString found in binary or memory: https://tolteck.com
Source: sets.json.0.drString found in binary or memory: https://top.pl
Source: sets.json.0.drString found in binary or memory: https://tribunnews.com
Source: sets.json.0.drString found in binary or memory: https://trytalkdesk.com
Source: sets.json.0.drString found in binary or memory: https://tucarro.com
Source: sets.json.0.drString found in binary or memory: https://tucarro.com.co
Source: sets.json.0.drString found in binary or memory: https://tucarro.com.ve
Source: sets.json.0.drString found in binary or memory: https://tvid.in
Source: sets.json.0.drString found in binary or memory: https://tvn.pl
Source: sets.json.0.drString found in binary or memory: https://tvn24.pl
Source: sets.json.0.drString found in binary or memory: https://unotv.com
Source: sets.json.0.drString found in binary or memory: https://victorymedium.com
Source: sets.json.0.drString found in binary or memory: https://vrt.be
Source: sets.json.0.drString found in binary or memory: https://vwo.com
Source: sets.json.0.drString found in binary or memory: https://welt.de
Source: sets.json.0.drString found in binary or memory: https://wieistmeineip.de
Source: sets.json.0.drString found in binary or memory: https://wildix.com
Source: sets.json.0.drString found in binary or memory: https://wildixin.com
Source: sets.json.0.drString found in binary or memory: https://wingify.com
Source: sets.json.0.drString found in binary or memory: https://wordle.at
Source: sets.json.0.drString found in binary or memory: https://wp.pl
Source: sets.json.0.drString found in binary or memory: https://wpext.pl
Source: sets.json.0.drString found in binary or memory: https://www.asadcdn.com
Source: sets.json.0.drString found in binary or memory: https://ya.ru
Source: sets.json.0.drString found in binary or memory: https://yours.co.uk
Source: sets.json.0.drString found in binary or memory: https://zalo.me
Source: sets.json.0.drString found in binary or memory: https://zdrowietvn.pl
Source: sets.json.0.drString found in binary or memory: https://zingmp3.vn
Source: unknownNetwork traffic detected: HTTP traffic on port 49675 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49742
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49741
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49740
Source: unknownNetwork traffic detected: HTTP traffic on port 49741 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49740 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 60463 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49742 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60463
Source: unknownNetwork traffic detected: HTTP traffic on port 49736 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49735 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49736
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49735
Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping2872_1617094001Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping2872_1617094001\sets.jsonJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping2872_1617094001\manifest.jsonJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping2872_1617094001\LICENSEJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping2872_1617094001\_metadata\Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping2872_1617094001\_metadata\verified_contents.jsonJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping2872_1617094001\manifest.fingerprintJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile deleted: C:\Windows\SystemTemp\chrome_BITS_2872_904141495Jump to behavior
Source: classification engineClassification label: clean2.win@26/5@9/6
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=1896,i,1184218221580559842,4154976847397048763,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.google.cg/url?url=https://xzebqqeqx&wjjl=vpbxjdcm&wjjl=vpbxjdcm&uxkkrka=p0&nwexrn=uxkkrka&uxkkrka=p0&&wjjl=vpbxjdcm&wjjl=vpbxjdcm&uxkkrka=p0&nwexrn=uxkkrka&uxkkrka=p0&nwexrn=uxkkrka&pmbeq=xzebqqeqx&q=amp/pfop72j.lxnhgostxaxpazjod.com/xm2z7dsyo&wjjl=vpbxjdcm&wjjl=vpbxjdcm&uxkkrka=p0&nwexrn=uxkkrka&pmbeq=xzebqqeqx&wjjl=vpbxjdcm&wjjl=vpbxjdcm&uxkkrka=p0"
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=1896,i,1184218221580559842,4154976847397048763,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath Interception1
Process Injection		1
Masquerading		OS Credential DumpingSystem Service DiscoveryRemote ServicesData from Local System1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
Process Injection		LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media2
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)1
File Deletion		Security Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive3
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture1
Ingress Tool Transfer		Traffic DuplicationData Destruction

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
https://www.google.cg/url?url=https://xzebqqeqx&wjjl=vpbxjdcm&wjjl=vpbxjdcm&uxkkrka=p0&nwexrn=uxkkrka&uxkkrka=p0&&wjjl=vpbxjdcm&wjjl=vpbxjdcm&uxkkrka=p0&nwexrn=uxkkrka&uxkkrka=p0&nwexrn=uxkkrka&pmbeq=xzebqqeqx&q=amp/pfop72j.lxnhgostxaxpazjod.com/xm2z7dsyo&wjjl=vpbxjdcm&wjjl=vpbxjdcm&uxkkrka=p0&nwexrn=uxkkrka&pmbeq=xzebqqeqx&wjjl=vpbxjdcm&wjjl=vpbxjdcm&uxkkrka=p00%Avira URL Cloudsafe

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
https://wieistmeineip.de0%URL Reputationsafe
https://gliadomain.com0%URL Reputationsafe
https://nourishingpursuits.com0%URL Reputationsafe
https://johndeere.com0%URL Reputationsafe
https://songstats.com0%URL Reputationsafe
https://p106.net0%URL Reputationsafe
https://mystudentdashboard.com0%URL Reputationsafe
https://songshare.com0%URL Reputationsafe
https://smaker.pl0%URL Reputationsafe
https://p24.hu0%URL Reputationsafe
https://cardsayings.net0%URL Reputationsafe
https://text.com0%URL Reputationsafe
https://hazipatika.com0%URL Reputationsafe
https://cognitiveai.ru0%URL Reputationsafe
https://drimer.travel0%URL Reputationsafe
https://deccoria.pl0%URL Reputationsafe
https://salemovetravel.com0%URL Reputationsafe
https://welt.de0%URL Reputationsafe
https://drimer.io0%URL Reputationsafe
https://infoedgeindia.com0%URL Reputationsafe
https://cognitive-ai.ru0%URL Reputationsafe
https://cafemedia.com0%URL Reputationsafe
https://graziadaily.co.uk0%URL Reputationsafe
https://thirdspace.org.au0%URL Reputationsafe
https://smpn106jkt.sch.id0%URL Reputationsafe
https://landyrev.com0%URL Reputationsafe
https://the42.ie0%URL Reputationsafe
https://helpdesk.com0%URL Reputationsafe
https://salemovefinancial.com0%URL Reputationsafe
https://mercadoshops.com.br0%Avira URL Cloudsafe
https://medonet.pl0%Avira URL Cloudsafe
https://mercadolivre.com0%Avira URL Cloudsafe
https://indiatodayne.in0%URL Reputationsafe
https://joyreactor.cc0%Avira URL Cloudsafe
https://poalim.xyz0%Avira URL Cloudsafe
https://motherandbaby.com0%URL Reputationsafe
https://unotv.com0%Avira URL Cloudsafe
https://baomoi.com0%Avira URL Cloudsafe
https://mercadoshops.com.co0%Avira URL Cloudsafe
https://reshim.org0%Avira URL Cloudsafe
https://zdrowietvn.pl0%Avira URL Cloudsafe
https://supereva.it0%Avira URL Cloudsafe
https://rws1nvtvt.com0%Avira URL Cloudsafe
https://mercadoshops.com0%Avira URL Cloudsafe
https://bolasport.com0%Avira URL Cloudsafe
https://elfinancierocr.com0%Avira URL Cloudsafe
https://desimartini.com0%Avira URL Cloudsafe
https://nlc.hu0%Avira URL Cloudsafe
https://hearty.app0%Avira URL Cloudsafe
https://hearty.gift0%Avira URL Cloudsafe
https://heartymail.com0%Avira URL Cloudsafe
https://radio2.be0%Avira URL Cloudsafe
https://finn.no0%Avira URL Cloudsafe
https://kompas.tv0%Avira URL Cloudsafe
https://mercadopago.com.mx0%Avira URL Cloudsafe
https://hc1.com0%Avira URL Cloudsafe
https://mercadopago.com.pe0%Avira URL Cloudsafe
https://24.hu0%Avira URL Cloudsafe
https://talkdeskqaid.com0%Avira URL Cloudsafe
https://mightytext.net0%Avira URL Cloudsafe
https://pudelek.pl0%Avira URL Cloudsafe
https://joyreactor.com0%Avira URL Cloudsafe
https://wildixin.com0%Avira URL Cloudsafe
https://nacion.com0%Avira URL Cloudsafe
https://chennien.com0%Avira URL Cloudsafe
https://mercadopago.cl0%Avira URL Cloudsafe
https://cookreactor.com0%Avira URL Cloudsafe
https://eworkbookcloud.com0%Avira URL Cloudsafe
https://naukri.com0%Avira URL Cloudsafe
https://interia.pl0%Avira URL Cloudsafe
https://talkdeskstgid.com0%Avira URL Cloudsafe
https://bonvivir.com0%Avira URL Cloudsafe
https://carcostadvisor.be0%Avira URL Cloudsafe
https://sapo.io0%Avira URL Cloudsafe
https://wpext.pl0%Avira URL Cloudsafe
https://poalim.site0%Avira URL Cloudsafe
https://blackrockadvisorelite.it0%Avira URL Cloudsafe
https://commentcamarche.com0%Avira URL Cloudsafe
https://mercadoshops.com.ar0%Avira URL Cloudsafe
https://elpais.uy0%Avira URL Cloudsafe
https://tucarro.com.ve0%Avira URL Cloudsafe
https://rws3nvtvt.com0%Avira URL Cloudsafe
https://standardsandpraiserepurpose.com0%Avira URL Cloudsafe
https://mercadolivre.com.br0%Avira URL Cloudsafe
https://clmbtech.com0%Avira URL Cloudsafe
https://eleconomista.net0%Avira URL Cloudsafe
https://07c225f3.online0%Avira URL Cloudsafe
https://etfacademy.it0%Avira URL Cloudsafe
https://mercadopago.com.br0%Avira URL Cloudsafe
https://commentcamarche.net0%Avira URL Cloudsafe
https://mighty-app.appspot.com0%Avira URL Cloudsafe
https://hj.rs0%Avira URL Cloudsafe
https://hearty.me0%Avira URL Cloudsafe
https://idbs-staging.com0%Avira URL Cloudsafe
https://mercadolibre.com.gt0%Avira URL Cloudsafe
https://mercadolibre.co.cr0%Avira URL Cloudsafe
https://timesinternet.in0%Avira URL Cloudsafe
https://blackrock.com0%Avira URL Cloudsafe
https://idbs-eworkbook.com0%Avira URL Cloudsafe
https://hjck.com0%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
bg.microsoft.map.fastly.net
199.232.214.172
truefalse
    		unknown
    pfop72j.lxnhgostxaxpazjod.com
    		94.156.65.137
    		truefalse
      		unknown
      www.google.com
      		108.177.122.104
      		truefalse
        		unknown
        www.google.cg
        		216.58.206.35
        		truefalse
          		unknown
          fp2e7a.wpc.phicdn.net
          		192.229.221.95
          		truefalse
            		unknown
            198.187.3.20.in-addr.arpa
            		unknown
            		unknownfalse
              		unknown

              URLs from Memory and Binaries

              NameSourceMaliciousAntivirus DetectionReputation
              https://wieistmeineip.desets.json.0.drfalse
              • URL Reputation: safe
              		unknown
              https://mercadoshops.com.cosets.json.0.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://gliadomain.comsets.json.0.drfalse
              • URL Reputation: safe
              		unknown
              https://poalim.xyzsets.json.0.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://mercadolivre.comsets.json.0.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://reshim.orgsets.json.0.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://nourishingpursuits.comsets.json.0.drfalse
              • URL Reputation: safe
              		unknown
              https://medonet.plsets.json.0.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://unotv.comsets.json.0.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://mercadoshops.com.brsets.json.0.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://joyreactor.ccsets.json.0.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://zdrowietvn.plsets.json.0.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://johndeere.comsets.json.0.drfalse
              • URL Reputation: safe
              		unknown
              https://songstats.comsets.json.0.drfalse
              • URL Reputation: safe
              		unknown
              https://baomoi.comsets.json.0.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://supereva.itsets.json.0.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://elfinancierocr.comsets.json.0.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://bolasport.comsets.json.0.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://rws1nvtvt.comsets.json.0.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://desimartini.comsets.json.0.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://hearty.appsets.json.0.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://hearty.giftsets.json.0.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://mercadoshops.comsets.json.0.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://heartymail.comsets.json.0.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://nlc.husets.json.0.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://p106.netsets.json.0.drfalse
              • URL Reputation: safe
              		unknown
              https://radio2.besets.json.0.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://finn.nosets.json.0.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://hc1.comsets.json.0.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://kompas.tvsets.json.0.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://mystudentdashboard.comsets.json.0.drfalse
              • URL Reputation: safe
              		unknown
              https://songshare.comsets.json.0.drfalse
              • URL Reputation: safe
              		unknown
              https://smaker.plsets.json.0.drfalse
              • URL Reputation: safe
              		unknown
              https://mercadopago.com.mxsets.json.0.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://p24.husets.json.0.drfalse
              • URL Reputation: safe
              		unknown
              https://talkdeskqaid.comsets.json.0.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://24.husets.json.0.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://mercadopago.com.pesets.json.0.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://cardsayings.netsets.json.0.drfalse
              • URL Reputation: safe
              		unknown
              https://text.comsets.json.0.drfalse
              • URL Reputation: safe
              		unknown
              https://mightytext.netsets.json.0.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://pudelek.plsets.json.0.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://hazipatika.comsets.json.0.drfalse
              • URL Reputation: safe
              		unknown
              https://joyreactor.comsets.json.0.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://cookreactor.comsets.json.0.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://wildixin.comsets.json.0.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://eworkbookcloud.comsets.json.0.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://cognitiveai.rusets.json.0.drfalse
              • URL Reputation: safe
              		unknown
              https://nacion.comsets.json.0.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://chennien.comsets.json.0.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://drimer.travelsets.json.0.drfalse
              • URL Reputation: safe
              		unknown
              https://deccoria.plsets.json.0.drfalse
              • URL Reputation: safe
              		unknown
              https://mercadopago.clsets.json.0.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://talkdeskstgid.comsets.json.0.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://naukri.comsets.json.0.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://interia.plsets.json.0.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://bonvivir.comsets.json.0.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://carcostadvisor.besets.json.0.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://salemovetravel.comsets.json.0.drfalse
              • URL Reputation: safe
              		unknown
              https://sapo.iosets.json.0.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://wpext.plsets.json.0.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://welt.desets.json.0.drfalse
              • URL Reputation: safe
              		unknown
              https://poalim.sitesets.json.0.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://drimer.iosets.json.0.drfalse
              • URL Reputation: safe
              		unknown
              https://infoedgeindia.comsets.json.0.drfalse
              • URL Reputation: safe
              		unknown
              https://blackrockadvisorelite.itsets.json.0.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://cognitive-ai.rusets.json.0.drfalse
              • URL Reputation: safe
              		unknown
              https://cafemedia.comsets.json.0.drfalse
              • URL Reputation: safe
              		unknown
              https://graziadaily.co.uksets.json.0.drfalse
              • URL Reputation: safe
              		unknown
              https://thirdspace.org.ausets.json.0.drfalse
              • URL Reputation: safe
              		unknown
              https://mercadoshops.com.arsets.json.0.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://smpn106jkt.sch.idsets.json.0.drfalse
              • URL Reputation: safe
              		unknown
              https://elpais.uysets.json.0.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://landyrev.comsets.json.0.drfalse
              • URL Reputation: safe
              		unknown
              https://the42.iesets.json.0.drfalse
              • URL Reputation: safe
              		unknown
              https://commentcamarche.comsets.json.0.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://tucarro.com.vesets.json.0.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://rws3nvtvt.comsets.json.0.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://eleconomista.netsets.json.0.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://helpdesk.comsets.json.0.drfalse
              • URL Reputation: safe
              		unknown
              https://mercadolivre.com.brsets.json.0.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://clmbtech.comsets.json.0.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://standardsandpraiserepurpose.comsets.json.0.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://07c225f3.onlinesets.json.0.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://salemovefinancial.comsets.json.0.drfalse
              • URL Reputation: safe
              		unknown
              https://mercadopago.com.brsets.json.0.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://commentcamarche.netsets.json.0.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://etfacademy.itsets.json.0.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://mighty-app.appspot.comsets.json.0.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://hj.rssets.json.0.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://hearty.mesets.json.0.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://mercadolibre.com.gtsets.json.0.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://timesinternet.insets.json.0.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://indiatodayne.insets.json.0.drfalse
              • URL Reputation: safe
              		unknown
              https://idbs-staging.comsets.json.0.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://blackrock.comsets.json.0.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://idbs-eworkbook.comsets.json.0.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://motherandbaby.comsets.json.0.drfalse
              • URL Reputation: safe
              		unknown
              https://mercadolibre.co.crsets.json.0.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://hjck.comsets.json.0.drfalse
              • Avira URL Cloud: safe
              		unknown

              World Map of Contacted IPs

              • No. of IPs < 25%
              • 25% < No. of IPs < 50%
              • 50% < No. of IPs < 75%
              • 75% < No. of IPs

              Public IPs

              IPDomainCountryFlagASNASN NameMalicious
              239.255.255.250
              		unknownReserved
              		unknownunknownfalse
              142.250.186.164
              		unknownUnited States
              		15169GOOGLEUSfalse
              94.156.65.137
              		pfop72j.lxnhgostxaxpazjod.comBulgaria
              		31420TERASYST-ASBGfalse
              108.177.122.104
              		www.google.comUnited States
              		15169GOOGLEUSfalse
              216.58.206.35
              		www.google.cgUnited States
              		15169GOOGLEUSfalse

              Private

              IP
              192.168.2.4

              General Information

              Joe Sandbox version:40.0.0 Tourmaline
              Analysis ID:1500053
              Start date and time:2024-08-27 20:19:24 +02:00
              Joe Sandbox product:CloudBasic
              Overall analysis duration:0h 2m 57s
              Hypervisor based Inspection enabled:false
              Report type:full
              Cookbook file name:browseurl.jbs
              Sample URL:https://www.google.cg/url?url=https://xzebqqeqx&wjjl=vpbxjdcm&wjjl=vpbxjdcm&uxkkrka=p0&nwexrn=uxkkrka&uxkkrka=p0&&wjjl=vpbxjdcm&wjjl=vpbxjdcm&uxkkrka=p0&nwexrn=uxkkrka&uxkkrka=p0&nwexrn=uxkkrka&pmbeq=xzebqqeqx&q=amp/pfop72j.lxnhgostxaxpazjod.com/xm2z7dsyo&wjjl=vpbxjdcm&wjjl=vpbxjdcm&uxkkrka=p0&nwexrn=uxkkrka&pmbeq=xzebqqeqx&wjjl=vpbxjdcm&wjjl=vpbxjdcm&uxkkrka=p0
              Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
              Number of analysed new started processes analysed:7
              Number of new started drivers analysed:0
              Number of existing processes analysed:0
              Number of existing drivers analysed:0
              Number of injected processes analysed:0
              Technologies:
              • HCA enabled
              • EGA enabled
              • AMSI enabled
              Analysis Mode:default
              Analysis stop reason:Timeout
              Detection:CLEAN
              Classification:clean2.win@26/5@9/6
              EGA Information:Failed
              HCA Information:
              • Successful, ratio: 100%
              • Number of executed functions: 0
              • Number of non-executed functions: 0

              Warnings

              • Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe, svchost.exe
              • Excluded IPs from analysis (whitelisted): 108.177.15.84, 142.250.9.102, 142.250.9.138, 142.250.9.139, 142.250.9.113, 142.250.9.101, 142.250.9.100, 172.217.16.195, 34.104.35.123, 40.68.123.157, 199.232.214.172, 192.229.221.95, 52.165.164.15, 13.95.31.18, 20.3.187.198, 13.85.23.86, 52.165.165.26, 142.250.186.163
              • Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, clientservices.googleapis.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, ocsp.digicert.com, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, update.googleapis.com, clients.l.google.com, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
              • Not all processes where analyzed, report is missing behavior information
              • Report size getting too big, too many NtSetInformationFile calls found.
              • VT rate limit hit for: https://www.google.cg/url?url=https://xzebqqeqx&wjjl=vpbxjdcm&wjjl=vpbxjdcm&uxkkrka=p0&nwexrn=uxkkrka&uxkkrka=p0&&wjjl=vpbxjdcm&wjjl=vpbxjdcm&uxkkrka=p0&nwexrn=uxkkrka&uxkkrka=p0&nwexrn=uxkkrka&pmbeq=xzebqqeqx&q=amp/pfop72j.lxnhgostxaxpazjod.com/xm2z7dsyo&wjjl=vpbxjdcm&wjjl=vpbxjdcm&uxkkrka=p0&nwexrn=uxkkrka&pmbeq=xzebqqeqx&wjjl=vpbxjdcm&wjjl=vpbxjdcm&uxkkrka=p0

              Simulations

              Behavior and APIs

              ⊘No simulations

              Joe Sandbox View / Context

              IPs

              ⊘No context

              Domains

              ⊘No context

              ASNs

              ⊘No context

              JA3 Fingerprints

              ⊘No context

              Dropped Files

              ⊘No context

              Created / dropped Files

              C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping2872_1617094001\LICENSE

              Download File
              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
              File Type:ASCII text
              Category:dropped
              Size (bytes):1558
              Entropy (8bit):5.11458514637545
              Encrypted:false
              SSDEEP:48:OBOCrYJ4rYJVwUCLHDy43HV713XEyMmZ3teTHn:LCrYJ4rYJVwUCHZ3Z13XtdUTH
              MD5:EE002CB9E51BB8DFA89640A406A1090A
              SHA1:49EE3AD535947D8821FFDEB67FFC9BC37D1EBBB2
              SHA-256:3DBD2C90050B652D63656481C3E5871C52261575292DB77D4EA63419F187A55B
              SHA-512:D1FDCC436B8CA8C68D4DC7077F84F803A535BF2CE31D9EB5D0C466B62D6567B2C59974995060403ED757E92245DB07E70C6BDDBF1C3519FED300CC5B9BF9177C
              Malicious:false
              Reputation:low
              Preview:// Copyright 2015 The Chromium Authors. All rights reserved..//.// Redistribution and use in source and binary forms, with or without.// modification, are permitted provided that the following conditions are.// met:.//.// * Redistributions of source code must retain the above copyright.// notice, this list of conditions and the following disclaimer..// * Redistributions in binary form must reproduce the above.// copyright notice, this list of conditions and the following disclaimer.// in the documentation and/or other materials provided with the.// distribution..// * Neither the name of Google Inc. nor the names of its.// contributors may be used to endorse or promote products derived from.// this software without specific prior written permission..//.// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS.// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT.// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR.// A PARTICULAR

              C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping2872_1617094001\_metadata\verified_contents.json

              Download File
              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):1864
              Entropy (8bit):6.021127689065198
              Encrypted:false
              SSDEEP:48:p/hUI1atAdI567akUmYWEFw/3+ovGJ4F3jkZUbvzk98g5m7:RnYQI47avYUwvVGJ41jkZIzxgA7
              MD5:68E6B5733E04AB7BF19699A84D8ABBC2
              SHA1:1C11F06CA1AD3ED8116D356AB9164FD1D52B5CF0
              SHA-256:F095F969D6711F53F97747371C83D5D634EAEF21C54CB1A6A1CC5B816D633709
              SHA-512:9DC5D824A55C969820D5D1FBB0CA7773361F044AE0C255E7C48D994E16CE169FCEAC3DE180A3A544EBEF32337EA535683115584D592370E5FE7D85C68B86C891
              Malicious:false
              Reputation:low
              Preview:[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJMSUNFTlNFIiwicm9vdF9oYXNoIjoiUGIwc2tBVUxaUzFqWldTQnctV0hIRkltRlhVcExiZDlUcVkwR2ZHSHBWcyJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiIyNXB3SWdtQWU2QTVoeDVVTG9OV0laODBLbzJjbktOTHpacUdjbjlLT2c4In0seyJwYXRoIjoic2V0cy5qc29uIiwicm9vdF9oYXNoIjoiOWVza0FuRlBsM3VCQzkwUmFWakxNaVI3NXZIQi0wQUVmMmg0RzU3ZXNpcyJ9XSwiZm9ybWF0IjoidHJlZWhhc2giLCJoYXNoX2Jsb2NrX3NpemUiOjQwOTZ9XSwiaXRlbV9pZCI6ImdvbnBlbWRna2pjZWNkZ2JuYWFiaXBwcGJtZ2ZnZ2JlIiwiaXRlbV92ZXJzaW9uIjoiMjAyNC44LjEwLjAiLCJwcm90b2NvbF92ZXJzaW9uIjoxfQ","signatures":[{"header":{"kid":"publisher"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"dU2MmRUQSugaJAJvEN4uaQHx-KXdOkjj0yK8_aH4Afr3kN7DPOZRt6yLTS3UchBE5M-dgPPPBuKADj4KEK4B22SO6WQquL5J27AUPqQBGgr44-iFGVJdOLLlfirFlJmcYv6DUFRYiPsQFGMr1JFqInj19jgkOxzR6qqcNuTCB0wGEMeTU80r-igCjeQG6TIzPro7yKd_-UxsxO6OGAySmlIJIoU54X0p0ATNoZyAfkhb8kb0oN8unOU

              C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping2872_1617094001\manifest.fingerprint

              Download File
              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
              File Type:ASCII text, with no line terminators
              Category:dropped
              Size (bytes):66
              Entropy (8bit):3.9159446964030753
              Encrypted:false
              SSDEEP:3:Sq5TQRaELVHecsUDBAeHD5k:Sq5gJ+csHej5k
              MD5:CFB54589424206D0AE6437B5673F498D
              SHA1:D1EF6314F0F68EFDD0BA8F6CA9E59BFF863B1609
              SHA-256:285AC183C35350B4B77332172413902F83726CA8F53D63859B5DA082FD425A1C
              SHA-512:70FDCA4A1E6B7A5FFED3414E2DB74FECA7E0FD17482B8CB30393DFEE20AB9AD2B0B00FF0C590DD0E8D744D0EAD876CE8844519AF66618ED14666BCA56DF2DA21
              Malicious:false
              Reputation:low
              Preview:1.dbf288588465463a914bdfc5e86d465fb3592b2f1261dc0e40fcc5c1adc8e7e4

              C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping2872_1617094001\manifest.json

              Download File
              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):85
              Entropy (8bit):4.4533115571544695
              Encrypted:false
              SSDEEP:3:rR6TAulhFphifFCmMARWHJqS1tean:F6VlM8aRWpqS1ln
              MD5:C3419069A1C30140B77045ABA38F12CF
              SHA1:11920F0C1E55CADC7D2893D1EEBB268B3459762A
              SHA-256:DB9A702209807BA039871E542E8356219F342A8D9C9CA34BCD9A86727F4A3A0F
              SHA-512:C5E95A4E9F5919CB14F4127539C4353A55C5F68062BF6F95E1843B6690CEBED3C93170BADB2412B7FB9F109A620385B0AE74783227D6813F26FF8C29074758A1
              Malicious:false
              Reputation:low
              Preview:{. "manifest_version": 2,. "name": "First Party Sets",. "version": "2024.8.10.0".}

              C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping2872_1617094001\sets.json

              Download File
              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):9748
              Entropy (8bit):4.629326694042306
              Encrypted:false
              SSDEEP:96:Mon4mvC4qX19s1blbw/BNKLcxbdmf56MFJtRTGXvcxN43uP+8qJq:v5C4ql7BkIVmtRTGXvcxBsq
              MD5:EEA4913A6625BEB838B3E4E79999B627
              SHA1:1B4966850F1B117041407413B70BFA925FD83703
              SHA-256:20EF4DE871ECE3C5F14867C4AE8465999C7A2CC1633525E752320E61F78A373C
              SHA-512:31B1429A5FACD6787F6BB45216A4AB1C724C79438C18EBFA8C19CED83149C17783FD492A03197110A75AAF38486A9F58828CA30B58D41E0FE89DFE8BDFC8A004
              Malicious:false
              Reputation:low
              Preview:{"primary":"https://bild.de","associatedSites":["https://welt.de","https://autobild.de","https://computerbild.de","https://wieistmeineip.de"],"serviceSites":["https://www.asadcdn.com"]}.{"primary":"https://blackrock.com","associatedSites":["https://blackrockadvisorelite.it","https://cachematrix.com","https://efront.com","https://etfacademy.it","https://ishares.com"]}.{"primary":"https://cafemedia.com","associatedSites":["https://cardsayings.net","https://nourishingpursuits.com"]}.{"primary":"https://caracoltv.com","associatedSites":["https://noticiascaracol.com","https://bluradio.com","https://shock.co","https://bumbox.com","https://hjck.com"]}.{"primary":"https://carcostadvisor.com","ccTLDs":{"https://carcostadvisor.com":["https://carcostadvisor.be","https://carcostadvisor.fr"]}}.{"primary":"https://citybibleforum.org","associatedSites":["https://thirdspace.org.au"]}.{"primary":"https://cognitiveai.ru","associatedSites":["https://cognitive-ai.ru"]}.{"primary":"https://drimer.io","asso

              Static File Info

              ⊘No static file info

              Network Behavior

              Network Port Distribution

              TCP Packets

              TimestampSource PortDest PortSource IPDest IP
              Aug 27, 2024 20:20:08.952959061 CEST49675443192.168.2.4173.222.162.32
              Aug 27, 2024 20:20:18.561289072 CEST49675443192.168.2.4173.222.162.32
              Aug 27, 2024 20:20:19.307543039 CEST49735443192.168.2.4216.58.206.35
              Aug 27, 2024 20:20:19.307590008 CEST44349735216.58.206.35192.168.2.4
              Aug 27, 2024 20:20:19.307717085 CEST49735443192.168.2.4216.58.206.35
              Aug 27, 2024 20:20:19.308041096 CEST49736443192.168.2.4216.58.206.35
              Aug 27, 2024 20:20:19.308048010 CEST44349736216.58.206.35192.168.2.4
              Aug 27, 2024 20:20:19.308199883 CEST49736443192.168.2.4216.58.206.35
              Aug 27, 2024 20:20:19.308273077 CEST49735443192.168.2.4216.58.206.35
              Aug 27, 2024 20:20:19.308286905 CEST44349735216.58.206.35192.168.2.4
              Aug 27, 2024 20:20:19.308510065 CEST49736443192.168.2.4216.58.206.35
              Aug 27, 2024 20:20:19.308525085 CEST44349736216.58.206.35192.168.2.4
              Aug 27, 2024 20:20:19.975734949 CEST44349736216.58.206.35192.168.2.4
              Aug 27, 2024 20:20:19.976031065 CEST49736443192.168.2.4216.58.206.35
              Aug 27, 2024 20:20:19.976061106 CEST44349736216.58.206.35192.168.2.4
              Aug 27, 2024 20:20:19.977502108 CEST44349736216.58.206.35192.168.2.4
              Aug 27, 2024 20:20:19.977565050 CEST49736443192.168.2.4216.58.206.35
              Aug 27, 2024 20:20:19.978961945 CEST49736443192.168.2.4216.58.206.35
              Aug 27, 2024 20:20:19.979032993 CEST44349736216.58.206.35192.168.2.4
              Aug 27, 2024 20:20:19.979155064 CEST49736443192.168.2.4216.58.206.35
              Aug 27, 2024 20:20:19.979170084 CEST44349736216.58.206.35192.168.2.4
              Aug 27, 2024 20:20:19.980288982 CEST44349735216.58.206.35192.168.2.4
              Aug 27, 2024 20:20:19.980545044 CEST49735443192.168.2.4216.58.206.35
              Aug 27, 2024 20:20:19.980570078 CEST44349735216.58.206.35192.168.2.4
              Aug 27, 2024 20:20:19.981596947 CEST44349735216.58.206.35192.168.2.4
              Aug 27, 2024 20:20:19.981659889 CEST49735443192.168.2.4216.58.206.35
              Aug 27, 2024 20:20:19.982116938 CEST49735443192.168.2.4216.58.206.35
              Aug 27, 2024 20:20:19.982187986 CEST44349735216.58.206.35192.168.2.4
              Aug 27, 2024 20:20:20.031713963 CEST49736443192.168.2.4216.58.206.35
              Aug 27, 2024 20:20:20.035729885 CEST49735443192.168.2.4216.58.206.35
              Aug 27, 2024 20:20:20.035759926 CEST44349735216.58.206.35192.168.2.4
              Aug 27, 2024 20:20:20.077265024 CEST49735443192.168.2.4216.58.206.35
              Aug 27, 2024 20:20:20.277497053 CEST44349736216.58.206.35192.168.2.4
              Aug 27, 2024 20:20:20.277564049 CEST44349736216.58.206.35192.168.2.4
              Aug 27, 2024 20:20:20.277642965 CEST49736443192.168.2.4216.58.206.35
              Aug 27, 2024 20:20:20.278404951 CEST49736443192.168.2.4216.58.206.35
              Aug 27, 2024 20:20:20.278429031 CEST44349736216.58.206.35192.168.2.4
              Aug 27, 2024 20:20:20.282319069 CEST49735443192.168.2.4216.58.206.35
              Aug 27, 2024 20:20:20.324497938 CEST44349735216.58.206.35192.168.2.4
              Aug 27, 2024 20:20:20.526138067 CEST44349735216.58.206.35192.168.2.4
              Aug 27, 2024 20:20:20.526815891 CEST49735443192.168.2.4216.58.206.35
              Aug 27, 2024 20:20:20.526853085 CEST44349735216.58.206.35192.168.2.4
              Aug 27, 2024 20:20:20.526896000 CEST44349735216.58.206.35192.168.2.4
              Aug 27, 2024 20:20:20.527010918 CEST49735443192.168.2.4216.58.206.35
              Aug 27, 2024 20:20:20.527010918 CEST49735443192.168.2.4216.58.206.35
              Aug 27, 2024 20:20:20.569684982 CEST4973980192.168.2.494.156.65.137
              Aug 27, 2024 20:20:20.575287104 CEST804973994.156.65.137192.168.2.4
              Aug 27, 2024 20:20:20.575400114 CEST4973980192.168.2.494.156.65.137
              Aug 27, 2024 20:20:20.575588942 CEST4973980192.168.2.494.156.65.137
              Aug 27, 2024 20:20:20.581198931 CEST804973994.156.65.137192.168.2.4
              Aug 27, 2024 20:20:21.248249054 CEST49740443192.168.2.4108.177.122.104
              Aug 27, 2024 20:20:21.248282909 CEST44349740108.177.122.104192.168.2.4
              Aug 27, 2024 20:20:21.248348951 CEST49740443192.168.2.4108.177.122.104
              Aug 27, 2024 20:20:21.249222994 CEST49740443192.168.2.4108.177.122.104
              Aug 27, 2024 20:20:21.249233961 CEST44349740108.177.122.104192.168.2.4
              Aug 27, 2024 20:20:21.756347895 CEST44349740108.177.122.104192.168.2.4
              Aug 27, 2024 20:20:21.793008089 CEST49740443192.168.2.4108.177.122.104
              Aug 27, 2024 20:20:21.793029070 CEST44349740108.177.122.104192.168.2.4
              Aug 27, 2024 20:20:21.793998003 CEST44349740108.177.122.104192.168.2.4
              Aug 27, 2024 20:20:21.794059992 CEST49740443192.168.2.4108.177.122.104
              Aug 27, 2024 20:20:21.801922083 CEST49740443192.168.2.4108.177.122.104
              Aug 27, 2024 20:20:21.801986933 CEST44349740108.177.122.104192.168.2.4
              Aug 27, 2024 20:20:21.843256950 CEST49740443192.168.2.4108.177.122.104
              Aug 27, 2024 20:20:21.843266964 CEST44349740108.177.122.104192.168.2.4
              Aug 27, 2024 20:20:21.889806032 CEST49740443192.168.2.4108.177.122.104
              Aug 27, 2024 20:20:22.184643984 CEST804973994.156.65.137192.168.2.4
              Aug 27, 2024 20:20:22.184710979 CEST4973980192.168.2.494.156.65.137
              Aug 27, 2024 20:20:22.186237097 CEST4973980192.168.2.494.156.65.137
              Aug 27, 2024 20:20:22.191404104 CEST804973994.156.65.137192.168.2.4
              Aug 27, 2024 20:20:22.215775013 CEST49741443192.168.2.4184.28.90.27
              Aug 27, 2024 20:20:22.215828896 CEST44349741184.28.90.27192.168.2.4
              Aug 27, 2024 20:20:22.215905905 CEST49741443192.168.2.4184.28.90.27
              Aug 27, 2024 20:20:22.218408108 CEST49741443192.168.2.4184.28.90.27
              Aug 27, 2024 20:20:22.218430996 CEST44349741184.28.90.27192.168.2.4
              Aug 27, 2024 20:20:22.908088923 CEST44349741184.28.90.27192.168.2.4
              Aug 27, 2024 20:20:22.908198118 CEST49741443192.168.2.4184.28.90.27
              Aug 27, 2024 20:20:22.911789894 CEST49741443192.168.2.4184.28.90.27
              Aug 27, 2024 20:20:22.911819935 CEST44349741184.28.90.27192.168.2.4
              Aug 27, 2024 20:20:22.912048101 CEST44349741184.28.90.27192.168.2.4
              Aug 27, 2024 20:20:22.953324080 CEST49741443192.168.2.4184.28.90.27
              Aug 27, 2024 20:20:22.985383987 CEST49741443192.168.2.4184.28.90.27
              Aug 27, 2024 20:20:23.032496929 CEST44349741184.28.90.27192.168.2.4
              Aug 27, 2024 20:20:23.213377953 CEST44349741184.28.90.27192.168.2.4
              Aug 27, 2024 20:20:23.213416100 CEST44349741184.28.90.27192.168.2.4
              Aug 27, 2024 20:20:23.213510990 CEST49741443192.168.2.4184.28.90.27
              Aug 27, 2024 20:20:23.213707924 CEST49741443192.168.2.4184.28.90.27
              Aug 27, 2024 20:20:23.213707924 CEST49741443192.168.2.4184.28.90.27
              Aug 27, 2024 20:20:23.213733912 CEST44349741184.28.90.27192.168.2.4
              Aug 27, 2024 20:20:23.213747978 CEST44349741184.28.90.27192.168.2.4
              Aug 27, 2024 20:20:23.420730114 CEST49742443192.168.2.4184.28.90.27
              Aug 27, 2024 20:20:23.420778036 CEST44349742184.28.90.27192.168.2.4
              Aug 27, 2024 20:20:23.420849085 CEST49742443192.168.2.4184.28.90.27
              Aug 27, 2024 20:20:23.421797991 CEST49742443192.168.2.4184.28.90.27
              Aug 27, 2024 20:20:23.421821117 CEST44349742184.28.90.27192.168.2.4
              Aug 27, 2024 20:20:24.077311039 CEST4974380192.168.2.494.156.65.137
              Aug 27, 2024 20:20:24.077717066 CEST4974480192.168.2.494.156.65.137
              Aug 27, 2024 20:20:24.082493067 CEST804974394.156.65.137192.168.2.4
              Aug 27, 2024 20:20:24.082564116 CEST4974380192.168.2.494.156.65.137
              Aug 27, 2024 20:20:24.082766056 CEST804974494.156.65.137192.168.2.4
              Aug 27, 2024 20:20:24.082814932 CEST4974480192.168.2.494.156.65.137
              Aug 27, 2024 20:20:24.097882986 CEST4974380192.168.2.494.156.65.137
              Aug 27, 2024 20:20:24.404512882 CEST4974380192.168.2.494.156.65.137
              Aug 27, 2024 20:20:25.015485048 CEST4974380192.168.2.494.156.65.137
              Aug 27, 2024 20:20:25.144088030 CEST44349742184.28.90.27192.168.2.4
              Aug 27, 2024 20:20:25.144222975 CEST49742443192.168.2.4184.28.90.27
              Aug 27, 2024 20:20:25.146836042 CEST804974394.156.65.137192.168.2.4
              Aug 27, 2024 20:20:25.147087097 CEST804974394.156.65.137192.168.2.4
              Aug 27, 2024 20:20:25.147162914 CEST804974394.156.65.137192.168.2.4
              Aug 27, 2024 20:20:25.147581100 CEST49742443192.168.2.4184.28.90.27
              Aug 27, 2024 20:20:25.147597075 CEST44349742184.28.90.27192.168.2.4
              Aug 27, 2024 20:20:25.147838116 CEST44349742184.28.90.27192.168.2.4
              Aug 27, 2024 20:20:25.149921894 CEST49742443192.168.2.4184.28.90.27
              Aug 27, 2024 20:20:25.192512989 CEST44349742184.28.90.27192.168.2.4
              Aug 27, 2024 20:20:25.692743063 CEST44349742184.28.90.27192.168.2.4
              Aug 27, 2024 20:20:25.692807913 CEST44349742184.28.90.27192.168.2.4
              Aug 27, 2024 20:20:25.692900896 CEST49742443192.168.2.4184.28.90.27
              Aug 27, 2024 20:20:25.697344065 CEST49742443192.168.2.4184.28.90.27
              Aug 27, 2024 20:20:25.697370052 CEST44349742184.28.90.27192.168.2.4
              Aug 27, 2024 20:20:25.697382927 CEST49742443192.168.2.4184.28.90.27
              Aug 27, 2024 20:20:25.697391033 CEST44349742184.28.90.27192.168.2.4
              Aug 27, 2024 20:20:25.701802969 CEST804974394.156.65.137192.168.2.4
              Aug 27, 2024 20:20:25.701868057 CEST4974380192.168.2.494.156.65.137
              Aug 27, 2024 20:20:25.705285072 CEST804974494.156.65.137192.168.2.4
              Aug 27, 2024 20:20:25.705363989 CEST4974480192.168.2.494.156.65.137
              Aug 27, 2024 20:20:25.705516100 CEST4974380192.168.2.494.156.65.137
              Aug 27, 2024 20:20:25.705861092 CEST4974480192.168.2.494.156.65.137
              Aug 27, 2024 20:20:25.709650993 CEST4974580192.168.2.494.156.65.137
              Aug 27, 2024 20:20:25.710388899 CEST804974394.156.65.137192.168.2.4
              Aug 27, 2024 20:20:25.710882902 CEST804974494.156.65.137192.168.2.4
              Aug 27, 2024 20:20:25.714663982 CEST804974594.156.65.137192.168.2.4
              Aug 27, 2024 20:20:25.714750051 CEST4974580192.168.2.494.156.65.137
              Aug 27, 2024 20:20:25.714962006 CEST4974580192.168.2.494.156.65.137
              Aug 27, 2024 20:20:25.720778942 CEST804974594.156.65.137192.168.2.4
              Aug 27, 2024 20:20:27.337168932 CEST804974594.156.65.137192.168.2.4
              Aug 27, 2024 20:20:27.337254047 CEST4974580192.168.2.494.156.65.137
              Aug 27, 2024 20:20:27.337765932 CEST4974580192.168.2.494.156.65.137
              Aug 27, 2024 20:20:27.343293905 CEST804974594.156.65.137192.168.2.4
              Aug 27, 2024 20:20:31.679033995 CEST44349740108.177.122.104192.168.2.4
              Aug 27, 2024 20:20:31.679088116 CEST44349740108.177.122.104192.168.2.4
              Aug 27, 2024 20:20:31.679199934 CEST49740443192.168.2.4108.177.122.104
              Aug 27, 2024 20:20:31.825057983 CEST49740443192.168.2.4108.177.122.104
              Aug 27, 2024 20:20:31.825076103 CEST44349740108.177.122.104192.168.2.4
              Aug 27, 2024 20:20:32.380781889 CEST4974780192.168.2.494.156.65.137
              Aug 27, 2024 20:20:32.381202936 CEST4974880192.168.2.494.156.65.137
              Aug 27, 2024 20:20:32.386749029 CEST804974794.156.65.137192.168.2.4
              Aug 27, 2024 20:20:32.386888027 CEST804974894.156.65.137192.168.2.4
              Aug 27, 2024 20:20:32.386981964 CEST4974780192.168.2.494.156.65.137
              Aug 27, 2024 20:20:32.389180899 CEST4974880192.168.2.494.156.65.137
              Aug 27, 2024 20:20:32.469939947 CEST4974880192.168.2.494.156.65.137
              Aug 27, 2024 20:20:32.475212097 CEST804974894.156.65.137192.168.2.4
              Aug 27, 2024 20:20:34.003243923 CEST804974894.156.65.137192.168.2.4
              Aug 27, 2024 20:20:34.003350973 CEST4974880192.168.2.494.156.65.137
              Aug 27, 2024 20:20:34.003460884 CEST4974880192.168.2.494.156.65.137
              Aug 27, 2024 20:20:34.004146099 CEST4974780192.168.2.494.156.65.137
              Aug 27, 2024 20:20:34.008431911 CEST804974894.156.65.137192.168.2.4
              Aug 27, 2024 20:20:34.009331942 CEST804974794.156.65.137192.168.2.4
              Aug 27, 2024 20:20:36.412379980 CEST804974794.156.65.137192.168.2.4
              Aug 27, 2024 20:20:36.412440062 CEST4974780192.168.2.494.156.65.137
              Aug 27, 2024 20:20:36.412549019 CEST4974780192.168.2.494.156.65.137
              Aug 27, 2024 20:20:36.413094997 CEST4975480192.168.2.494.156.65.137
              Aug 27, 2024 20:20:36.421308994 CEST804974794.156.65.137192.168.2.4
              Aug 27, 2024 20:20:36.421533108 CEST804975494.156.65.137192.168.2.4
              Aug 27, 2024 20:20:36.421691895 CEST4975480192.168.2.494.156.65.137
              Aug 27, 2024 20:20:36.421880960 CEST4975480192.168.2.494.156.65.137
              Aug 27, 2024 20:20:36.427010059 CEST804975494.156.65.137192.168.2.4
              Aug 27, 2024 20:20:38.045851946 CEST804975494.156.65.137192.168.2.4
              Aug 27, 2024 20:20:38.045969009 CEST4975480192.168.2.494.156.65.137
              Aug 27, 2024 20:20:38.046468973 CEST4975480192.168.2.494.156.65.137
              Aug 27, 2024 20:20:38.051834106 CEST804975494.156.65.137192.168.2.4
              Aug 27, 2024 20:20:48.445940018 CEST5782753192.168.2.4162.159.36.2
              Aug 27, 2024 20:20:48.450818062 CEST5357827162.159.36.2192.168.2.4
              Aug 27, 2024 20:20:48.450894117 CEST5782753192.168.2.4162.159.36.2
              Aug 27, 2024 20:20:48.451021910 CEST5782753192.168.2.4162.159.36.2
              Aug 27, 2024 20:20:48.456080914 CEST5357827162.159.36.2192.168.2.4
              Aug 27, 2024 20:20:48.896939993 CEST5357827162.159.36.2192.168.2.4
              Aug 27, 2024 20:20:48.897634983 CEST5782753192.168.2.4162.159.36.2
              Aug 27, 2024 20:20:48.903048992 CEST5357827162.159.36.2192.168.2.4
              Aug 27, 2024 20:20:48.903112888 CEST5782753192.168.2.4162.159.36.2
              Aug 27, 2024 20:21:08.166378021 CEST5783280192.168.2.494.156.65.137
              Aug 27, 2024 20:21:08.167990923 CEST5783380192.168.2.494.156.65.137
              Aug 27, 2024 20:21:08.171336889 CEST805783294.156.65.137192.168.2.4
              Aug 27, 2024 20:21:08.171442986 CEST5783280192.168.2.494.156.65.137
              Aug 27, 2024 20:21:08.171705008 CEST5783280192.168.2.494.156.65.137
              Aug 27, 2024 20:21:08.172909021 CEST805783394.156.65.137192.168.2.4
              Aug 27, 2024 20:21:08.172972918 CEST5783380192.168.2.494.156.65.137
              Aug 27, 2024 20:21:08.176637888 CEST805783294.156.65.137192.168.2.4
              Aug 27, 2024 20:21:09.778796911 CEST805783294.156.65.137192.168.2.4
              Aug 27, 2024 20:21:09.778862000 CEST5783280192.168.2.494.156.65.137
              Aug 27, 2024 20:21:09.779458046 CEST5783280192.168.2.494.156.65.137
              Aug 27, 2024 20:21:09.783061981 CEST805783394.156.65.137192.168.2.4
              Aug 27, 2024 20:21:09.783121109 CEST5783380192.168.2.494.156.65.137
              Aug 27, 2024 20:21:09.784296989 CEST805783294.156.65.137192.168.2.4
              Aug 27, 2024 20:21:09.828902960 CEST5783380192.168.2.494.156.65.137
              Aug 27, 2024 20:21:09.836976051 CEST805783394.156.65.137192.168.2.4
              Aug 27, 2024 20:21:16.139041901 CEST6045953192.168.2.41.1.1.1
              Aug 27, 2024 20:21:16.143882036 CEST53604591.1.1.1192.168.2.4
              Aug 27, 2024 20:21:16.143971920 CEST6045953192.168.2.41.1.1.1
              Aug 27, 2024 20:21:16.144094944 CEST6045953192.168.2.41.1.1.1
              Aug 27, 2024 20:21:16.148849964 CEST53604591.1.1.1192.168.2.4
              Aug 27, 2024 20:21:16.590037107 CEST53604591.1.1.1192.168.2.4
              Aug 27, 2024 20:21:16.639166117 CEST6045953192.168.2.41.1.1.1
              Aug 27, 2024 20:21:16.688225031 CEST6045953192.168.2.41.1.1.1
              Aug 27, 2024 20:21:16.693948030 CEST53604591.1.1.1192.168.2.4
              Aug 27, 2024 20:21:16.694004059 CEST6045953192.168.2.41.1.1.1
              Aug 27, 2024 20:21:21.423058033 CEST60463443192.168.2.4142.250.186.164
              Aug 27, 2024 20:21:21.423094034 CEST44360463142.250.186.164192.168.2.4
              Aug 27, 2024 20:21:21.423165083 CEST60463443192.168.2.4142.250.186.164
              Aug 27, 2024 20:21:21.423841000 CEST60463443192.168.2.4142.250.186.164
              Aug 27, 2024 20:21:21.423862934 CEST44360463142.250.186.164192.168.2.4
              Aug 27, 2024 20:21:22.053312063 CEST44360463142.250.186.164192.168.2.4
              Aug 27, 2024 20:21:22.056967974 CEST60463443192.168.2.4142.250.186.164
              Aug 27, 2024 20:21:22.056991100 CEST44360463142.250.186.164192.168.2.4
              Aug 27, 2024 20:21:22.057320118 CEST44360463142.250.186.164192.168.2.4
              Aug 27, 2024 20:21:22.060318947 CEST60463443192.168.2.4142.250.186.164
              Aug 27, 2024 20:21:22.060384989 CEST44360463142.250.186.164192.168.2.4
              Aug 27, 2024 20:21:22.108814955 CEST60463443192.168.2.4142.250.186.164
              Aug 27, 2024 20:21:26.187231064 CEST4972380192.168.2.493.184.221.240
              Aug 27, 2024 20:21:26.187294006 CEST4972480192.168.2.493.184.221.240
              Aug 27, 2024 20:21:26.192588091 CEST804972393.184.221.240192.168.2.4
              Aug 27, 2024 20:21:26.192727089 CEST4972380192.168.2.493.184.221.240
              Aug 27, 2024 20:21:26.192961931 CEST804972493.184.221.240192.168.2.4
              Aug 27, 2024 20:21:26.193030119 CEST4972480192.168.2.493.184.221.240
              Aug 27, 2024 20:21:31.962146044 CEST44360463142.250.186.164192.168.2.4
              Aug 27, 2024 20:21:31.962212086 CEST44360463142.250.186.164192.168.2.4
              Aug 27, 2024 20:21:31.962697029 CEST60463443192.168.2.4142.250.186.164
              Aug 27, 2024 20:21:33.829809904 CEST60463443192.168.2.4142.250.186.164
              Aug 27, 2024 20:21:33.829842091 CEST44360463142.250.186.164192.168.2.4

              UDP Packets

              TimestampSource PortDest PortSource IPDest IP
              Aug 27, 2024 20:20:17.400525093 CEST53548441.1.1.1192.168.2.4
              Aug 27, 2024 20:20:17.401545048 CEST53568701.1.1.1192.168.2.4
              Aug 27, 2024 20:20:18.210197926 CEST53554841.1.1.1192.168.2.4
              Aug 27, 2024 20:20:19.283781052 CEST6217753192.168.2.41.1.1.1
              Aug 27, 2024 20:20:19.284061909 CEST5819453192.168.2.41.1.1.1
              Aug 27, 2024 20:20:19.291322947 CEST53621771.1.1.1192.168.2.4
              Aug 27, 2024 20:20:19.319842100 CEST53581941.1.1.1192.168.2.4
              Aug 27, 2024 20:20:20.529851913 CEST6198653192.168.2.41.1.1.1
              Aug 27, 2024 20:20:20.530014038 CEST5616153192.168.2.41.1.1.1
              Aug 27, 2024 20:20:20.564673901 CEST53619861.1.1.1192.168.2.4
              Aug 27, 2024 20:20:20.569160938 CEST53561611.1.1.1192.168.2.4
              Aug 27, 2024 20:20:21.237150908 CEST6263353192.168.2.41.1.1.1
              Aug 27, 2024 20:20:21.237962961 CEST5681753192.168.2.41.1.1.1
              Aug 27, 2024 20:20:21.245944977 CEST53626331.1.1.1192.168.2.4
              Aug 27, 2024 20:20:21.246407986 CEST53568171.1.1.1192.168.2.4
              Aug 27, 2024 20:20:35.387202024 CEST53598751.1.1.1192.168.2.4
              Aug 27, 2024 20:20:37.764655113 CEST138138192.168.2.4192.168.2.255
              Aug 27, 2024 20:20:48.445151091 CEST5352884162.159.36.2192.168.2.4
              Aug 27, 2024 20:20:48.914464951 CEST5456353192.168.2.41.1.1.1
              Aug 27, 2024 20:20:48.925254107 CEST53545631.1.1.1192.168.2.4
              Aug 27, 2024 20:21:08.145757914 CEST4995253192.168.2.41.1.1.1
              Aug 27, 2024 20:21:08.162491083 CEST53499521.1.1.1192.168.2.4
              Aug 27, 2024 20:21:16.137593985 CEST53568361.1.1.1192.168.2.4
              Aug 27, 2024 20:21:21.412997007 CEST5364353192.168.2.41.1.1.1
              Aug 27, 2024 20:21:21.420794010 CEST53536431.1.1.1192.168.2.4

              ICMP Packets

              TimestampSource IPDest IPChecksumCodeType
              Aug 27, 2024 20:20:19.319927931 CEST192.168.2.41.1.1.1c21f(Port unreachable)Destination Unreachable

              DNS Queries

              TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
              Aug 27, 2024 20:20:19.283781052 CEST192.168.2.41.1.1.10x38f9Standard query (0)www.google.cgA (IP address)IN (0x0001)false
              Aug 27, 2024 20:20:19.284061909 CEST192.168.2.41.1.1.10x1685Standard query (0)www.google.cg65IN (0x0001)false
              Aug 27, 2024 20:20:20.529851913 CEST192.168.2.41.1.1.10x3293Standard query (0)pfop72j.lxnhgostxaxpazjod.comA (IP address)IN (0x0001)false
              Aug 27, 2024 20:20:20.530014038 CEST192.168.2.41.1.1.10xd43aStandard query (0)pfop72j.lxnhgostxaxpazjod.com65IN (0x0001)false
              Aug 27, 2024 20:20:21.237150908 CEST192.168.2.41.1.1.10xf3f3Standard query (0)www.google.comA (IP address)IN (0x0001)false
              Aug 27, 2024 20:20:21.237962961 CEST192.168.2.41.1.1.10x3cfeStandard query (0)www.google.com65IN (0x0001)false
              Aug 27, 2024 20:20:48.914464951 CEST192.168.2.41.1.1.10x9997Standard query (0)198.187.3.20.in-addr.arpaPTR (Pointer record)IN (0x0001)false
              Aug 27, 2024 20:21:08.145757914 CEST192.168.2.41.1.1.10xe70Standard query (0)pfop72j.lxnhgostxaxpazjod.comA (IP address)IN (0x0001)false
              Aug 27, 2024 20:21:21.412997007 CEST192.168.2.41.1.1.10x16a4Standard query (0)www.google.comA (IP address)IN (0x0001)false

              DNS Answers

              TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
              Aug 27, 2024 20:20:19.291322947 CEST1.1.1.1192.168.2.40x38f9No error (0)www.google.cg216.58.206.35A (IP address)IN (0x0001)false
              Aug 27, 2024 20:20:20.564673901 CEST1.1.1.1192.168.2.40x3293No error (0)pfop72j.lxnhgostxaxpazjod.com94.156.65.137A (IP address)IN (0x0001)false
              Aug 27, 2024 20:20:21.245944977 CEST1.1.1.1192.168.2.40xf3f3No error (0)www.google.com108.177.122.104A (IP address)IN (0x0001)false
              Aug 27, 2024 20:20:21.245944977 CEST1.1.1.1192.168.2.40xf3f3No error (0)www.google.com108.177.122.99A (IP address)IN (0x0001)false
              Aug 27, 2024 20:20:21.245944977 CEST1.1.1.1192.168.2.40xf3f3No error (0)www.google.com108.177.122.106A (IP address)IN (0x0001)false
              Aug 27, 2024 20:20:21.245944977 CEST1.1.1.1192.168.2.40xf3f3No error (0)www.google.com108.177.122.103A (IP address)IN (0x0001)false
              Aug 27, 2024 20:20:21.245944977 CEST1.1.1.1192.168.2.40xf3f3No error (0)www.google.com108.177.122.147A (IP address)IN (0x0001)false
              Aug 27, 2024 20:20:21.245944977 CEST1.1.1.1192.168.2.40xf3f3No error (0)www.google.com108.177.122.105A (IP address)IN (0x0001)false
              Aug 27, 2024 20:20:21.246407986 CEST1.1.1.1192.168.2.40x3cfeNo error (0)www.google.com65IN (0x0001)false
              Aug 27, 2024 20:20:32.508398056 CEST1.1.1.1192.168.2.40xeca0No error (0)bg.microsoft.map.fastly.net199.232.214.172A (IP address)IN (0x0001)false
              Aug 27, 2024 20:20:32.508398056 CEST1.1.1.1192.168.2.40xeca0No error (0)bg.microsoft.map.fastly.net199.232.210.172A (IP address)IN (0x0001)false
              Aug 27, 2024 20:20:33.051317930 CEST1.1.1.1192.168.2.40x37b4No error (0)fp2e7a.wpc.2be4.phicdn.netfp2e7a.wpc.phicdn.netCNAME (Canonical name)IN (0x0001)false
              Aug 27, 2024 20:20:33.051317930 CEST1.1.1.1192.168.2.40x37b4No error (0)fp2e7a.wpc.phicdn.net192.229.221.95A (IP address)IN (0x0001)false
              Aug 27, 2024 20:20:46.428828955 CEST1.1.1.1192.168.2.40xb687No error (0)fp2e7a.wpc.2be4.phicdn.netfp2e7a.wpc.phicdn.netCNAME (Canonical name)IN (0x0001)false
              Aug 27, 2024 20:20:46.428828955 CEST1.1.1.1192.168.2.40xb687No error (0)fp2e7a.wpc.phicdn.net192.229.221.95A (IP address)IN (0x0001)false
              Aug 27, 2024 20:20:48.925254107 CEST1.1.1.1192.168.2.40x9997Name error (3)198.187.3.20.in-addr.arpanonenonePTR (Pointer record)IN (0x0001)false
              Aug 27, 2024 20:21:08.162491083 CEST1.1.1.1192.168.2.40xe70No error (0)pfop72j.lxnhgostxaxpazjod.com94.156.65.137A (IP address)IN (0x0001)false
              Aug 27, 2024 20:21:21.420794010 CEST1.1.1.1192.168.2.40x16a4No error (0)www.google.com142.250.186.164A (IP address)IN (0x0001)false

              HTTP Request Dependency Graph

              • www.google.cg
              • fs.microsoft.com
              • pfop72j.lxnhgostxaxpazjod.com

              HTTP Packets

              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
              0192.168.2.44973994.156.65.137804960C:\Program Files\Google\Chrome\Application\chrome.exe
              TimestampBytes transferredDirectionData
              Aug 27, 2024 20:20:20.575588942 CEST453OUTGET /xm2z7dsyo HTTP/1.1
              Host: pfop72j.lxnhgostxaxpazjod.com
              Connection: keep-alive
              Upgrade-Insecure-Requests: 1
              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
              Accept-Encoding: gzip, deflate
              Accept-Language: en-US,en;q=0.9


              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
              1192.168.2.44974394.156.65.137804960C:\Program Files\Google\Chrome\Application\chrome.exe
              TimestampBytes transferredDirectionData
              Aug 27, 2024 20:20:24.097882986 CEST479OUTGET /xm2z7dsyo HTTP/1.1
              Host: pfop72j.lxnhgostxaxpazjod.com
              Connection: keep-alive
              Cache-Control: max-age=0
              Upgrade-Insecure-Requests: 1
              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
              Accept-Encoding: gzip, deflate
              Accept-Language: en-US,en;q=0.9
              Aug 27, 2024 20:20:24.404512882 CEST479OUTGET /xm2z7dsyo HTTP/1.1
              Host: pfop72j.lxnhgostxaxpazjod.com
              Connection: keep-alive
              Cache-Control: max-age=0
              Upgrade-Insecure-Requests: 1
              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
              Accept-Encoding: gzip, deflate
              Accept-Language: en-US,en;q=0.9
              Aug 27, 2024 20:20:25.015485048 CEST479OUTGET /xm2z7dsyo HTTP/1.1
              Host: pfop72j.lxnhgostxaxpazjod.com
              Connection: keep-alive
              Cache-Control: max-age=0
              Upgrade-Insecure-Requests: 1
              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
              Accept-Encoding: gzip, deflate
              Accept-Language: en-US,en;q=0.9


              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
              2192.168.2.44974594.156.65.137804960C:\Program Files\Google\Chrome\Application\chrome.exe
              TimestampBytes transferredDirectionData
              Aug 27, 2024 20:20:25.714962006 CEST479OUTGET /xm2z7dsyo HTTP/1.1
              Host: pfop72j.lxnhgostxaxpazjod.com
              Connection: keep-alive
              Cache-Control: max-age=0
              Upgrade-Insecure-Requests: 1
              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
              Accept-Encoding: gzip, deflate
              Accept-Language: en-US,en;q=0.9


              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
              3192.168.2.44974894.156.65.137804960C:\Program Files\Google\Chrome\Application\chrome.exe
              TimestampBytes transferredDirectionData
              Aug 27, 2024 20:20:32.469939947 CEST479OUTGET /xm2z7dsyo HTTP/1.1
              Host: pfop72j.lxnhgostxaxpazjod.com
              Connection: keep-alive
              Cache-Control: max-age=0
              Upgrade-Insecure-Requests: 1
              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
              Accept-Encoding: gzip, deflate
              Accept-Language: en-US,en;q=0.9


              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
              4192.168.2.44974794.156.65.137804960C:\Program Files\Google\Chrome\Application\chrome.exe
              TimestampBytes transferredDirectionData
              Aug 27, 2024 20:20:34.004146099 CEST479OUTGET /xm2z7dsyo HTTP/1.1
              Host: pfop72j.lxnhgostxaxpazjod.com
              Connection: keep-alive
              Cache-Control: max-age=0
              Upgrade-Insecure-Requests: 1
              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
              Accept-Encoding: gzip, deflate
              Accept-Language: en-US,en;q=0.9


              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
              5192.168.2.44975494.156.65.137804960C:\Program Files\Google\Chrome\Application\chrome.exe
              TimestampBytes transferredDirectionData
              Aug 27, 2024 20:20:36.421880960 CEST479OUTGET /xm2z7dsyo HTTP/1.1
              Host: pfop72j.lxnhgostxaxpazjod.com
              Connection: keep-alive
              Cache-Control: max-age=0
              Upgrade-Insecure-Requests: 1
              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
              Accept-Encoding: gzip, deflate
              Accept-Language: en-US,en;q=0.9


              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
              6192.168.2.45783294.156.65.137804960C:\Program Files\Google\Chrome\Application\chrome.exe
              TimestampBytes transferredDirectionData
              Aug 27, 2024 20:21:08.171705008 CEST479OUTGET /xm2z7dsyo HTTP/1.1
              Host: pfop72j.lxnhgostxaxpazjod.com
              Connection: keep-alive
              Cache-Control: max-age=0
              Upgrade-Insecure-Requests: 1
              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
              Accept-Encoding: gzip, deflate
              Accept-Language: en-US,en;q=0.9


              HTTPS Proxied Packets

              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
              0192.168.2.449736216.58.206.354434960C:\Program Files\Google\Chrome\Application\chrome.exe
              TimestampBytes transferredDirectionData
              2024-08-27 18:20:19 UTC1143OUTGET /url?url=https://xzebqqeqx&wjjl=vpbxjdcm&wjjl=vpbxjdcm&uxkkrka=p0&nwexrn=uxkkrka&uxkkrka=p0&&wjjl=vpbxjdcm&wjjl=vpbxjdcm&uxkkrka=p0&nwexrn=uxkkrka&uxkkrka=p0&nwexrn=uxkkrka&pmbeq=xzebqqeqx&q=amp/pfop72j.lxnhgostxaxpazjod.com/xm2z7dsyo&wjjl=vpbxjdcm&wjjl=vpbxjdcm&uxkkrka=p0&nwexrn=uxkkrka&pmbeq=xzebqqeqx&wjjl=vpbxjdcm&wjjl=vpbxjdcm&uxkkrka=p0 HTTP/1.1
              Host: www.google.cg
              Connection: keep-alive
              sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
              sec-ch-ua-mobile: ?0
              sec-ch-ua-platform: "Windows"
              Upgrade-Insecure-Requests: 1
              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
              X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCI/KzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc=
              Sec-Fetch-Site: none
              Sec-Fetch-Mode: navigate
              Sec-Fetch-User: ?1
              Sec-Fetch-Dest: document
              Accept-Encoding: gzip, deflate, br
              Accept-Language: en-US,en;q=0.9
              2024-08-27 18:20:20 UTC1007INHTTP/1.1 302 Found
              Location: https://www.google.cg/amp/pfop72j.lxnhgostxaxpazjod.com/xm2z7dsyo
              Cache-Control: private
              Content-Type: text/html; charset=UTF-8
              Strict-Transport-Security: max-age=31536000
              Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-nJklz_cCkbzatGelcFjQVA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other
              Permissions-Policy: unload=()
              P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."
              Date: Tue, 27 Aug 2024 18:20:20 GMT
              Server: gws
              Content-Length: 262
              X-XSS-Protection: 0
              Set-Cookie: NID=517=gTSJieVeGtmHxGTN9DAtEWFrPSvlcRbmQ9L-dsFLWWSnsbgGJXTfxNbvX7QWgjXCgNMlLnZbGDXZUildBx1idoFJAHLURalbmeYiW4j2DJUSx6l5_BIU_XSxeaYdIHU5CTFpIxfWQaIYxuOhtulyPWUVOaP53H6DtN889B3RH7YWR8MJd2fS; expires=Wed, 26-Feb-2025 18:20:20 GMT; path=/; domain=.google.cg; Secure; HttpOnly; SameSite=none
              Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
              Connection: close
              2024-08-27 18:20:20 UTC262INData Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 67 2f 61 6d 70 2f 70 66 6f 70 37 32 6a 2e 6c 78 6e 68 67 6f 73 74 78 61 78 70 61 7a 6a 6f 64 2e 63 6f 6d 2f 78 6d 32 7a 37 64 73 79 6f 22 3e 68 65 72 65 3c 2f 41 3e 2e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f
              Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>302 Moved</TITLE></HEAD><BODY><H1>302 Moved</H1>The document has moved<A HREF="https://www.google.cg/amp/pfop72j.lxnhgostxaxpazjod.com/xm2z7dsyo">here</A>.</BODY></


              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
              1192.168.2.449735216.58.206.354434960C:\Program Files\Google\Chrome\Application\chrome.exe
              TimestampBytes transferredDirectionData
              2024-08-27 18:20:20 UTC1042OUTGET /amp/pfop72j.lxnhgostxaxpazjod.com/xm2z7dsyo HTTP/1.1
              Host: www.google.cg
              Connection: keep-alive
              Upgrade-Insecure-Requests: 1
              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
              X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCI/KzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc=
              Sec-Fetch-Site: none
              Sec-Fetch-Mode: navigate
              Sec-Fetch-User: ?1
              Sec-Fetch-Dest: document
              sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
              sec-ch-ua-mobile: ?0
              sec-ch-ua-platform: "Windows"
              Accept-Encoding: gzip, deflate, br
              Accept-Language: en-US,en;q=0.9
              Cookie: NID=517=gTSJieVeGtmHxGTN9DAtEWFrPSvlcRbmQ9L-dsFLWWSnsbgGJXTfxNbvX7QWgjXCgNMlLnZbGDXZUildBx1idoFJAHLURalbmeYiW4j2DJUSx6l5_BIU_XSxeaYdIHU5CTFpIxfWQaIYxuOhtulyPWUVOaP53H6DtN889B3RH7YWR8MJd2fS
              2024-08-27 18:20:20 UTC815INHTTP/1.1 302 Found
              Location: http://pfop72j.lxnhgostxaxpazjod.com/xm2z7dsyo
              Cache-Control: private
              X-Robots-Tag: noindex
              Content-Type: text/html; charset=UTF-8
              Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-6ztKABqCj1kRBlPHOwghCg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1
              Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws"
              Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]}
              Permissions-Policy: unload=()
              Date: Tue, 27 Aug 2024 18:20:20 GMT
              Server: gws
              Content-Length: 243
              X-XSS-Protection: 0
              X-Frame-Options: SAMEORIGIN
              Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
              Connection: close
              2024-08-27 18:20:20 UTC243INData Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 3a 2f 2f 70 66 6f 70 37 32 6a 2e 6c 78 6e 68 67 6f 73 74 78 61 78 70 61 7a 6a 6f 64 2e 63 6f 6d 2f 78 6d 32 7a 37 64 73 79 6f 22 3e 68 65 72 65 3c 2f 41 3e 2e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a
              Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>302 Moved</TITLE></HEAD><BODY><H1>302 Moved</H1>The document has moved<A HREF="http://pfop72j.lxnhgostxaxpazjod.com/xm2z7dsyo">here</A>.</BODY></HTML>


              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
              2192.168.2.449741184.28.90.27443
              TimestampBytes transferredDirectionData
              2024-08-27 18:20:22 UTC161OUTHEAD /fs/windows/config.json HTTP/1.1
              Connection: Keep-Alive
              Accept: */*
              Accept-Encoding: identity
              User-Agent: Microsoft BITS/7.8
              Host: fs.microsoft.com
              2024-08-27 18:20:23 UTC466INHTTP/1.1 200 OK
              Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json
              Content-Type: application/octet-stream
              ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7"
              Last-Modified: Tue, 16 May 2017 22:58:00 GMT
              Server: ECAcc (lpl/EF17)
              X-CID: 11
              X-Ms-ApiVersion: Distribute 1.2
              X-Ms-Region: prod-weu-z1
              Cache-Control: public, max-age=76803
              Date: Tue, 27 Aug 2024 18:20:23 GMT
              Connection: close
              X-CID: 2


              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
              3192.168.2.449742184.28.90.27443
              TimestampBytes transferredDirectionData
              2024-08-27 18:20:25 UTC239OUTGET /fs/windows/config.json HTTP/1.1
              Connection: Keep-Alive
              Accept: */*
              Accept-Encoding: identity
              If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT
              Range: bytes=0-2147483646
              User-Agent: Microsoft BITS/7.8
              Host: fs.microsoft.com
              2024-08-27 18:20:25 UTC514INHTTP/1.1 200 OK
              ApiVersion: Distribute 1.1
              Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json
              Content-Type: application/octet-stream
              ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7"
              Last-Modified: Tue, 16 May 2017 22:58:00 GMT
              Server: ECAcc (lpl/EF06)
              X-CID: 11
              X-Ms-ApiVersion: Distribute 1.2
              X-Ms-Region: prod-weu-z1
              Cache-Control: public, max-age=80715
              Date: Tue, 27 Aug 2024 18:20:25 GMT
              Content-Length: 55
              Connection: close
              X-CID: 2
              2024-08-27 18:20:25 UTC55INData Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d
              Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}


              Statistics

              CPU Usage

              Click to jump to process

              Memory Usage

              Click to jump to process

              Behavior

              Click to jump to process

              System Behavior

              General

              Target ID:0
              Start time:14:20:13
              Start date:27/08/2024
              Path:C:\Program Files\Google\Chrome\Application\chrome.exe
              Wow64 process (32bit):false
              Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
              Imagebase:0x7ff76e190000
              File size:3'242'272 bytes
              MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:C, C++ or other language
              Reputation:low
              Has exited:false

              General

              Target ID:1
              Start time:14:20:15
              Start date:27/08/2024
              Path:C:\Program Files\Google\Chrome\Application\chrome.exe
              Wow64 process (32bit):false
              Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=1896,i,1184218221580559842,4154976847397048763,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
              Imagebase:0x7ff76e190000
              File size:3'242'272 bytes
              MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:C, C++ or other language
              Reputation:low
              Has exited:false

              General

              Target ID:3
              Start time:14:20:18
              Start date:27/08/2024
              Path:C:\Program Files\Google\Chrome\Application\chrome.exe
              Wow64 process (32bit):false
              Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.google.cg/url?url=https://xzebqqeqx&wjjl=vpbxjdcm&wjjl=vpbxjdcm&uxkkrka=p0&nwexrn=uxkkrka&uxkkrka=p0&&wjjl=vpbxjdcm&wjjl=vpbxjdcm&uxkkrka=p0&nwexrn=uxkkrka&uxkkrka=p0&nwexrn=uxkkrka&pmbeq=xzebqqeqx&q=amp/pfop72j.lxnhgostxaxpazjod.com/xm2z7dsyo&wjjl=vpbxjdcm&wjjl=vpbxjdcm&uxkkrka=p0&nwexrn=uxkkrka&pmbeq=xzebqqeqx&wjjl=vpbxjdcm&wjjl=vpbxjdcm&uxkkrka=p0"
              Imagebase:0x7ff76e190000
              File size:3'242'272 bytes
              MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:C, C++ or other language
              Reputation:low
              Has exited:true

              Disassembly

              ⊘No disassembly