Edit tour

Windows Analysis Report
http://www.infoleadzsalez.com

Overview

General Information

Sample URL:	http://www.infoleadzsalez.com
Analysis ID:	1523602
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found iframes

HTML title does not match URL

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64

chrome.exe (PID: 3200 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6656 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 --field-trial-handle=2204,i,666688079235395417,2684045064378826231,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3192 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://www.infoleadzsalez.com" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

HTTP traffic detected: POST /g/collect?v=2&tid=G-0JHQDSS37Y&gtm=45je49u0v9135786248za200&_p=1727807657763&_gaz=1&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101671035~101686685~101747727&cid=245393721.1727807661&ul=en-us&sr=1280x1024&ir=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&are=1&pae=1&frm=0&pscdl=noapi&_eu=EAAI&_s=1&sid=1727807661&sct=1&seg=0&dl=https%3A%2F%2Fbusinessemail.rediff.com%2Fdomain%3Fsc_cid%3Dpages-uc-domain-register%26ref%3Ddomain-registration-india&dt=Buy%20.com%2C%20.org%2C%20.in%20domains%20on%20Rediffmail%20for%20Work&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=9227 HTTP/1.1Host: analytics.google.comConnection: keep-aliveContent-Length: 0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: https://businessemail.rediff.comX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://businessemail.rediff.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: https://businessemail.rediff.com/domain?sc_cid=pages-uc-domain-register&ref=domain-registration-india	HTTP Parser: Iframe src: //metric.rediff.com/blank.html?1727807659875
Source: https://businessemail.rediff.com/domain?sc_cid=pages-uc-domain-register&ref=domain-registration-india	HTTP Parser: Iframe src: https://td.doubleclick.net/td/ga/rul?tid=G-0JHQDSS37Y&gacid=245393721.1727807661&gtm=45je49u0v9135786248za200&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=101671035~101686685~101747727&z=1228848990
Source: https://businessemail.rediff.com/domain?sc_cid=pages-uc-domain-register&ref=domain-registration-india	HTTP Parser: Iframe src: //metric.rediff.com/blank.html?1727807659875
Source: https://businessemail.rediff.com/domain?sc_cid=pages-uc-domain-register&ref=domain-registration-india	HTTP Parser: Iframe src: https://td.doubleclick.net/td/ga/rul?tid=G-0JHQDSS37Y&gacid=245393721.1727807661&gtm=45je49u0v9135786248za200&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=101671035~101686685~101747727&z=1228848990
Source: https://businessemail.rediff.com/domain?sc_cid=pages-uc-domain-register&ref=domain-registration-india	HTTP Parser: Iframe src: //metric.rediff.com/blank.html?1727807659875
Source: https://businessemail.rediff.com/domain?sc_cid=pages-uc-domain-register&ref=domain-registration-india	HTTP Parser: Iframe src: https://td.doubleclick.net/td/ga/rul?tid=G-0JHQDSS37Y&gacid=245393721.1727807661&gtm=45je49u0v9135786248za200&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=101671035~101686685~101747727&z=1228848990
Source: https://businessemail.rediff.com/contact-us?sc_cid=pages-uc-websites&ref=get-a-free-consultation	HTTP Parser: Iframe src: //metric.rediff.com/blank.html?1727807695235
Source: https://businessemail.rediff.com/contact-us?sc_cid=pages-uc-websites&ref=get-a-free-consultation	HTTP Parser: Iframe src: //metric.rediff.com/blank.html?1727807695235
Source: https://businessemail.rediff.com/contact-us?sc_cid=pages-uc-websites&ref=get-a-free-consultation	HTTP Parser: Iframe src: //metric.rediff.com/blank.html?1727807695235

Source: https://businessemail.rediff.com/domain?sc_cid=pages-uc-domain-register&ref=domain-registration-india	HTTP Parser: Title: Buy .com, .org, .in domains on Rediffmail for Work does not match URL
Source: https://businessemail.rediff.com/contact-us?sc_cid=pages-uc-websites&ref=get-a-free-consultation	HTTP Parser: Title: Contact Us - Rediffmail For Work does not match URL

Source: http://www.infoleadzsalez.com/	HTTP Parser: No favicon
Source: https://businessemail.rediff.com/?sc_cid=pages-uc-rediffmailenterprises	HTTP Parser: No favicon

Source: https://businessemail.rediff.com/domain?sc_cid=pages-uc-domain-register&ref=domain-registration-india	HTTP Parser: No <meta name="author".. found
Source: https://businessemail.rediff.com/domain?sc_cid=pages-uc-domain-register&ref=domain-registration-india	HTTP Parser: No <meta name="author".. found
Source: https://businessemail.rediff.com/domain?sc_cid=pages-uc-domain-register&ref=domain-registration-india	HTTP Parser: No <meta name="author".. found
Source: https://businessemail.rediff.com/contact-us?sc_cid=pages-uc-websites&ref=get-a-free-consultation	HTTP Parser: No <meta name="author".. found
Source: https://businessemail.rediff.com/contact-us?sc_cid=pages-uc-websites&ref=get-a-free-consultation	HTTP Parser: No <meta name="author".. found
Source: https://businessemail.rediff.com/contact-us?sc_cid=pages-uc-websites&ref=get-a-free-consultation	HTTP Parser: No <meta name="author".. found

Source: https://businessemail.rediff.com/domain?sc_cid=pages-uc-domain-register&ref=domain-registration-india	HTTP Parser: No <meta name="copyright".. found
Source: https://businessemail.rediff.com/domain?sc_cid=pages-uc-domain-register&ref=domain-registration-india	HTTP Parser: No <meta name="copyright".. found
Source: https://businessemail.rediff.com/domain?sc_cid=pages-uc-domain-register&ref=domain-registration-india	HTTP Parser: No <meta name="copyright".. found
Source: https://businessemail.rediff.com/contact-us?sc_cid=pages-uc-websites&ref=get-a-free-consultation	HTTP Parser: No <meta name="copyright".. found
Source: https://businessemail.rediff.com/contact-us?sc_cid=pages-uc-websites&ref=get-a-free-consultation	HTTP Parser: No <meta name="copyright".. found
Source: https://businessemail.rediff.com/contact-us?sc_cid=pages-uc-websites&ref=get-a-free-consultation	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49722 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 01 Oct 2024 18:34:01 GMTServer: ApacheVary: Accept-Encoding,User-AgentContent-Encoding: gzipContent-Length: 733Keep-Alive: timeout=15, max=100Connection: Keep-AliveContent-Type: text/htmlData Raw: 1f 8b 08 00 00 00 00 00 00 03 bd 55 5d 6f d3 30 14 7d df af b8 64 12 82 87 c4 ed b4 0f 94 26 41 62 ec 7d 1a 5f 8f c8 89 6f 12 33 c7 8e 6c a7 5d 19 fb ef 5c 3b 5d d9 98 84 98 90 68 a5 c4 be be f5 39 e7 9e 6b b7 e8 fd a0 aa 83 a2 47 2e e8 35 a0 e7 a0 f9 80 65 62 4d 6d bc 4b a0 31 da a3 f6 65 a2 8d d4 02 6f 12 60 94 e8 a5 57 58 7d 90 1e e1 13 45 2d 9c 1b ed bc 9d 1a 2f 8d 2e d8 bc 7c 50 38 bf 55 08 7e 3b d2 86 1e 6f 3c 6b 9c 4b aa ac 35 c6 a3 bd dd 48 e1 fb fc ec ec cd 78 b3 6a 09 26 6d f9 20 d5 36 e7 56 72 35 47 9c fc 8e f9 72 49 09 03 b7 9d d4 f9 d9 82 c6 23 17 42 ea 2e 5f 86 49 6d 2c 11 48 bd 19 73 67 94 14 40 d9 70 28 4e c2 77 d5 18 65 6c 7e 78 7a 7a ba 52 52 63 da a3 ec 7a 9f 2f b3 13 1c 56 77 59 bb 3c e2 f6 f6 8f d8 47 04 71 57 b0 a8 84 14 b1 5d a5 6a 23 b6 50 77 71 ff f2 b0 8d 1f 0a 37 54 2a b4 a1 40 bc 26 e5 51 61 79 bc 58 40 83 4a ed 68 97 f3 cc 8d bc 99 67 b3 82 10 56 dc b9 32 89 ac 92 b0 89 ad 0a 2f 60 26 5d 26 cb c5 22 a9 a8 b8 22 3c ec 7e bd 2a e4 d0 81 b3 4d 99 30 26 87 8d b1 4a 64 16 85 6c db ac 31 03 d3 b8 19 79 87 6e 0e b1 51 de 30 32 d5 65 9d 6c 93 5f d8 5c c9 4e 97 36 20 55 45 5d 7d ec a5 03 17 fc a5 f7 14 2d 6e 1e 58 9c 15 b5 ad 2e 15 72 87 b0 96 94 07 bc e3 52 83 37 d0 f4 d8 5c 83 ef 11 9c e7 7e 72 59 c1 ea 0a 0a 59 f9 9e eb 6b f7 a2 60 92 00 2c b5 d1 ee f9 6c f6 91 ce 6f f4 77 95 3e 3e ba af d6 f2 24 b8 14 01 76 a6 14 38 54 05 87 de 62 5b 26 df f8 9a bb c6 ca d1 e7 a4 d4 1b bb cd 3a f3 2a 5d be 4e aa 73 25 49 40 8f 16 0b c6 ab 20 a9 33 50 f3 20 ca 44 5d a3 c5 b5 34 93 83 40 8c e4 85 7d d9 3d 48 b0 e7 60 e7 0f 8b 5d 40 03 21 d7 7b 73 63 ef 27 d5 a5 d9 10 82 80 7a 0b 7b 52 bd f7 a3 cb 19 ab 27 47 cd ea 1c 0e 5c aa 87 c5 78 eb 9a af 8d 14 65 ac 48 3a 35 e9 bc 16 d2 22 fc 68 a5 43 3a 61 57 fb 30 5c ec e3 41 cd 5c 91 cf d1 b1 ff 08 0b 5c 0b e8 d0 43 8d ce 83 40 ae 1c 18 fd 0c 06 c2 50 44 13 6e 47 66 59 1e 5a 30 a5 eb 48 f2 27 d4 1e 65 86 42 bf 8f 01 b8 7a f0 d3 40 e9 a5 ae dd b8 82 1f 30 0f fe 9e 4a 6f 36 74 d9 a4 f5 b4 4d 69 3a 72 bd 4d 63 4e 4a 9d fa 84 cd a3 5d 92 ea dd 6e 0a 17 61 fe 4f 34 a8 9a 29 4f 5b 8b 98 86 83 39 29 1f a5 3d 61 b0 c1 3a 1c 63 72 e7 cb 6e 14 fb 80 51 4b 86 0e dd 5f 58 2c dc 68 f1 82 0b ff 08 3f 01 99 cf c9 96 18 06 00 00 Data Ascii: U]o0}d&Ab}_o3l]\;]h9kG.5ebMmK1eo`WX}E-/.\|P8U~;o<kK5Hxj&m 6Vr5GrI#B._Im,Hsg@p(Nwel~xzzRRcz/VwY<GqW]j#Pwq7T@&QayX@JhgV2/`&]&""<~M0&Jdl1ynQ02el_\N6 UE]}-nX.rR7\~rYYk`,low>>$v8Tb[&:*]Ns%I@ 3P D]4@}=H`]@!{sc'z{R'
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 01 Oct 2024 18:34:02 GMTServer: ApacheVary: Accept-Encoding,User-AgentContent-Encoding: gzipContent-Length: 733Connection: closeContent-Type: text/htmlData Raw: 1f 8b 08 00 00 00 00 00 00 03 bd 55 5d 6f d3 30 14 7d df af b8 64 12 82 87 c4 ed b4 0f 94 26 41 62 ec 7d 1a 5f 8f c8 89 6f 12 33 c7 8e 6c a7 5d 19 fb ef 5c 3b 5d d9 98 84 98 90 68 a5 c4 be be f5 39 e7 9e 6b b7 e8 fd a0 aa 83 a2 47 2e e8 35 a0 e7 a0 f9 80 65 62 4d 6d bc 4b a0 31 da a3 f6 65 a2 8d d4 02 6f 12 60 94 e8 a5 57 58 7d 90 1e e1 13 45 2d 9c 1b ed bc 9d 1a 2f 8d 2e d8 bc 7c 50 38 bf 55 08 7e 3b d2 86 1e 6f 3c 6b 9c 4b aa ac 35 c6 a3 bd dd 48 e1 fb fc ec ec cd 78 b3 6a 09 26 6d f9 20 d5 36 e7 56 72 35 47 9c fc 8e f9 72 49 09 03 b7 9d d4 f9 d9 82 c6 23 17 42 ea 2e 5f 86 49 6d 2c 11 48 bd 19 73 67 94 14 40 d9 70 28 4e c2 77 d5 18 65 6c 7e 78 7a 7a ba 52 52 63 da a3 ec 7a 9f 2f b3 13 1c 56 77 59 bb 3c e2 f6 f6 8f d8 47 04 71 57 b0 a8 84 14 b1 5d a5 6a 23 b6 50 77 71 ff f2 b0 8d 1f 0a 37 54 2a b4 a1 40 bc 26 e5 51 61 79 bc 58 40 83 4a ed 68 97 f3 cc 8d bc 99 67 b3 82 10 56 dc b9 32 89 ac 92 b0 89 ad 0a 2f 60 26 5d 26 cb c5 22 a9 a8 b8 22 3c ec 7e bd 2a e4 d0 81 b3 4d 99 30 26 87 8d b1 4a 64 16 85 6c db ac 31 03 d3 b8 19 79 87 6e 0e b1 51 de 30 32 d5 65 9d 6c 93 5f d8 5c c9 4e 97 36 20 55 45 5d 7d ec a5 03 17 fc a5 f7 14 2d 6e 1e 58 9c 15 b5 ad 2e 15 72 87 b0 96 94 07 bc e3 52 83 37 d0 f4 d8 5c 83 ef 11 9c e7 7e 72 59 c1 ea 0a 0a 59 f9 9e eb 6b f7 a2 60 92 00 2c b5 d1 ee f9 6c f6 91 ce 6f f4 77 95 3e 3e ba af d6 f2 24 b8 14 01 76 a6 14 38 54 05 87 de 62 5b 26 df f8 9a bb c6 ca d1 e7 a4 d4 1b bb cd 3a f3 2a 5d be 4e aa 73 25 49 40 8f 16 0b c6 ab 20 a9 33 50 f3 20 ca 44 5d a3 c5 b5 34 93 83 40 8c e4 85 7d d9 3d 48 b0 e7 60 e7 0f 8b 5d 40 03 21 d7 7b 73 63 ef 27 d5 a5 d9 10 82 80 7a 0b 7b 52 bd f7 a3 cb 19 ab 27 47 cd ea 1c 0e 5c aa 87 c5 78 eb 9a af 8d 14 65 ac 48 3a 35 e9 bc 16 d2 22 fc 68 a5 43 3a 61 57 fb 30 5c ec e3 41 cd 5c 91 cf d1 b1 ff 08 0b 5c 0b e8 d0 43 8d ce 83 40 ae 1c 18 fd 0c 06 c2 50 44 13 6e 47 66 59 1e 5a 30 a5 eb 48 f2 27 d4 1e 65 86 42 bf 8f 01 b8 7a f0 d3 40 e9 a5 ae dd b8 82 1f 30 0f fe 9e 4a 6f 36 74 d9 a4 f5 b4 4d 69 3a 72 bd 4d 63 4e 4a 9d fa 84 cd a3 5d 92 ea dd 6e 0a 17 61 fe 4f 34 a8 9a 29 4f 5b 8b 98 86 83 39 29 1f a5 3d 61 b0 c1 3a 1c 63 72 e7 cb 6e 14 fb 80 51 4b 86 0e dd 5f 58 2c dc 68 f1 82 0b ff 08 3f 01 99 cf c9 96 18 06 00 00 Data Ascii: U]o0}d&Ab}_o3l]\;]h9kG.5ebMmK1eo`WX}E-/.\|P8U~;o<kK5Hxj&m 6Vr5GrI#B._Im,Hsg@p(Nwel~xzzRRcz/VwY<GqW]j#Pwq7T@&QayX@JhgV2/`&]&""<~M0&Jdl1ynQ02el_\N6 UE]}-nX.rR7\~rYYk`,low>>$v8Tb[&:*]Ns%I@ 3P D]4@}=H`]@!{sc'z{R'G\xeH:5"hC:aW0\A
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 01 Oct 2024 18:34:04 GMTServer: ApacheVary: Accept-Encoding,User-AgentContent-Encoding: gzipContent-Length: 733Keep-Alive: timeout=15, max=100Connection: Keep-AliveContent-Type: text/htmlData Raw: 1f 8b 08 00 00 00 00 00 00 03 bd 55 5d 6f d3 30 14 7d df af b8 64 12 82 87 c4 ed b4 0f 94 26 41 62 ec 7d 1a 5f 8f c8 89 6f 12 33 c7 8e 6c a7 5d 19 fb ef 5c 3b 5d d9 98 84 98 90 68 a5 c4 be be f5 39 e7 9e 6b b7 e8 fd a0 aa 83 a2 47 2e e8 35 a0 e7 a0 f9 80 65 62 4d 6d bc 4b a0 31 da a3 f6 65 a2 8d d4 02 6f 12 60 94 e8 a5 57 58 7d 90 1e e1 13 45 2d 9c 1b ed bc 9d 1a 2f 8d 2e d8 bc 7c 50 38 bf 55 08 7e 3b d2 86 1e 6f 3c 6b 9c 4b aa ac 35 c6 a3 bd dd 48 e1 fb fc ec ec cd 78 b3 6a 09 26 6d f9 20 d5 36 e7 56 72 35 47 9c fc 8e f9 72 49 09 03 b7 9d d4 f9 d9 82 c6 23 17 42 ea 2e 5f 86 49 6d 2c 11 48 bd 19 73 67 94 14 40 d9 70 28 4e c2 77 d5 18 65 6c 7e 78 7a 7a ba 52 52 63 da a3 ec 7a 9f 2f b3 13 1c 56 77 59 bb 3c e2 f6 f6 8f d8 47 04 71 57 b0 a8 84 14 b1 5d a5 6a 23 b6 50 77 71 ff f2 b0 8d 1f 0a 37 54 2a b4 a1 40 bc 26 e5 51 61 79 bc 58 40 83 4a ed 68 97 f3 cc 8d bc 99 67 b3 82 10 56 dc b9 32 89 ac 92 b0 89 ad 0a 2f 60 26 5d 26 cb c5 22 a9 a8 b8 22 3c ec 7e bd 2a e4 d0 81 b3 4d 99 30 26 87 8d b1 4a 64 16 85 6c db ac 31 03 d3 b8 19 79 87 6e 0e b1 51 de 30 32 d5 65 9d 6c 93 5f d8 5c c9 4e 97 36 20 55 45 5d 7d ec a5 03 17 fc a5 f7 14 2d 6e 1e 58 9c 15 b5 ad 2e 15 72 87 b0 96 94 07 bc e3 52 83 37 d0 f4 d8 5c 83 ef 11 9c e7 7e 72 59 c1 ea 0a 0a 59 f9 9e eb 6b f7 a2 60 92 00 2c b5 d1 ee f9 6c f6 91 ce 6f f4 77 95 3e 3e ba af d6 f2 24 b8 14 01 76 a6 14 38 54 05 87 de 62 5b 26 df f8 9a bb c6 ca d1 e7 a4 d4 1b bb cd 3a f3 2a 5d be 4e aa 73 25 49 40 8f 16 0b c6 ab 20 a9 33 50 f3 20 ca 44 5d a3 c5 b5 34 93 83 40 8c e4 85 7d d9 3d 48 b0 e7 60 e7 0f 8b 5d 40 03 21 d7 7b 73 63 ef 27 d5 a5 d9 10 82 80 7a 0b 7b 52 bd f7 a3 cb 19 ab 27 47 cd ea 1c 0e 5c aa 87 c5 78 eb 9a af 8d 14 65 ac 48 3a 35 e9 bc 16 d2 22 fc 68 a5 43 3a 61 57 fb 30 5c ec e3 41 cd 5c 91 cf d1 b1 ff 08 0b 5c 0b e8 d0 43 8d ce 83 40 ae 1c 18 fd 0c 06 c2 50 44 13 6e 47 66 59 1e 5a 30 a5 eb 48 f2 27 d4 1e 65 86 42 bf 8f 01 b8 7a f0 d3 40 e9 a5 ae dd b8 82 1f 30 0f fe 9e 4a 6f 36 74 d9 a4 f5 b4 4d 69 3a 72 bd 4d 63 4e 4a 9d fa 84 cd a3 5d 92 ea dd 6e 0a 17 61 fe 4f 34 a8 9a 29 4f 5b 8b 98 86 83 39 29 1f a5 3d 61 b0 c1 3a 1c 63 72 e7 cb 6e 14 fb 80 51 4b 86 0e dd 5f 58 2c dc 68 f1 82 0b ff 08 3f 01 99 cf c9 96 18 06 00 00 Data Ascii: U]o0}d&Ab}_o3l]\;]h9kG.5ebMmK1eo`WX}E-/.\|P8U~;o<kK5Hxj&m 6Vr5GrI#B._Im,Hsg@p(Nwel~xzzRRcz/VwY<GqW]j#Pwq7T@&QayX@JhgV2/`&]&""<~M0&Jdl1ynQ02el_\N6 UE]}-nX.rR7\~rYYk`,low>>$v8Tb[&:*]Ns%I@ 3P D]4@}=H`]@!{sc'z{R'

Source: chromecache_210.2.dr, chromecache_168.2.dr	String found in binary or memory: c?"runIfCanceled":"runIfUncanceled",[]);if(!g.length)return!0;var k=qA(a,c,e);Q(121);if(k["gtm.elementUrl"]==="https://www.facebook.com/tr/")return Q(122),!0;if(d&&f){for(var m=Kb(b,g.length),n=0;n<g.length;++n)g[n](k,m);return m.done}for(var p=0;p<g.length;++p)g[p](k,function(){});return!0},tA=function(){var a=[],b=function(c){return ob(a,function(d){return d.form===c})};return{store:function(c,d){var e=b(c);e?e.button=d:a.push({form:c,button:d})},get:function(c){var d=b(c);return d?d.button:null}}}, equals www.facebook.com (Facebook)
Source: chromecache_248.2.dr, chromecache_205.2.dr, chromecache_210.2.dr, chromecache_131.2.dr, chromecache_244.2.dr, chromecache_199.2.dr, chromecache_129.2.dr, chromecache_168.2.dr	String found in binary or memory: return b}IC.F="internal.enableAutoEventOnTimer";var gc=ja(["data-gtm-yt-inspected-"]),KC=["www.youtube.com","www.youtube-nocookie.com"],LC,MC=!1; equals www.youtube.com (Youtube)
Source: chromecache_210.2.dr, chromecache_168.2.dr	String found in binary or memory: var XB=function(a,b,c,d,e){var f=Oz("fsl",c?"nv.mwt":"mwt",0),g;g=c?Oz("fsl","nv.ids",[]):Oz("fsl","ids",[]);if(!g.length)return!0;var k=Tz(a,"gtm.formSubmit",g),m=a.action;m&&m.tagName&&(m=a.cloneNode(!1).action);Q(121);if(m==="https://www.facebook.com/tr/")return Q(122),!0;k["gtm.elementUrl"]=m;k["gtm.formCanceled"]=c;a.getAttribute("name")!=null&&(k["gtm.interactedFormName"]=a.getAttribute("name"));e&&(k["gtm.formSubmitElement"]=e,k["gtm.formSubmitElementText"]=e.value);if(d&&f){if(!By(k,Dy(b, equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: www.infoleadzsalez.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: imworld.rediff.com
Source: global traffic	DNS traffic detected: DNS query: businessemail.rediff.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: metric.rediff.com
Source: global traffic	DNS traffic detected: DNS query: hostsmetric.rediff.com
Source: global traffic	DNS traffic detected: DNS query: analytics.google.com
Source: global traffic	DNS traffic detected: DNS query: td.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: stats.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: www.rediff.com
Source: global traffic	DNS traffic detected: DNS query: chatbot.rediff.com
Source: global traffic	DNS traffic detected: DNS query: im.rediff.com
Source: global traffic	DNS traffic detected: DNS query: checkout.razorpay.com

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 --field-trial-handle=2204,i,666688079235395417,2684045064378826231,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://www.infoleadzsalez.com"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 --field-trial-handle=2204,i,666688079235395417,2684045064378826231,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Drive-by Compromise	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source: chromecache_144.2.dr, chromecache_172.2.dr	String found in binary or memory: http://beta.rediffmailpro.com/ajaxprism/forgotpwd.php
Source: chromecache_257.2.dr, chromecache_196.2.dr, chromecache_213.2.dr, chromecache_246.2.dr	String found in binary or memory: http://businessemail.rediff.com/ordererror?error=
Source: chromecache_212.2.dr, chromecache_251.2.dr	String found in binary or memory: http://davidwalsh.name/javascript-debounce-function
Source: chromecache_246.2.dr	String found in binary or memory: http://ishare.rediff.com/embed_config.php?id=
Source: chromecache_246.2.dr	String found in binary or memory: http://ishare.rediff.com/images/embed_plugin_30052011.swf&autostart=true
Source: chromecache_246.2.dr	String found in binary or memory: http://ishare.rediff.com/images/player_embed_dm_27052011.swf
Source: chromecache_212.2.dr, chromecache_251.2.dr	String found in binary or memory: http://johanhalse.mit-license.org
Source: chromecache_144.2.dr, chromecache_172.2.dr	String found in binary or memory: http://login.rediff.com/cgi-bin/subs/passwd_remind.cgi?FormName=showlogin
Source: chromecache_144.2.dr, chromecache_172.2.dr	String found in binary or memory: http://track.rediff.com/click?url=___
Source: chromecache_215.2.dr, chromecache_230.2.dr	String found in binary or memory: http://wicky.nillia.ms/headroom.js
Source: chromecache_244.2.dr	String found in binary or memory: https://ad.doubleclick.net
Source: chromecache_131.2.dr, chromecache_244.2.dr	String found in binary or memory: https://ade.googlesyndication.com
Source: chromecache_168.2.dr	String found in binary or memory: https://adservice.google.com/pagead/regclk?
Source: chromecache_217.2.dr, chromecache_181.2.dr	String found in binary or memory: https://ampcid.google.com/v1/publisher:getClientId
Source: chromecache_150.2.dr, chromecache_187.2.dr	String found in binary or memory: https://businessemail.rediff.com/clicktocall
Source: chromecache_125.2.dr, chromecache_235.2.dr	String found in binary or memory: https://businessemail.rediff.com/rediffmailpro/onlinebiz/images/down_arr.png)
Source: chromecache_125.2.dr, chromecache_235.2.dr	String found in binary or memory: https://businessemail.rediff.com/rediffmailpro/onlinebiz/images/reset_icon.png)
Source: chromecache_248.2.dr, chromecache_205.2.dr, chromecache_210.2.dr, chromecache_131.2.dr, chromecache_244.2.dr, chromecache_199.2.dr, chromecache_129.2.dr, chromecache_168.2.dr	String found in binary or memory: https://cct.google/taggy/agent.js
Source: chromecache_234.2.dr, chromecache_150.2.dr, chromecache_187.2.dr, chromecache_163.2.dr	String found in binary or memory: https://chatbot.rediff.com/?skill=rpro-sales&authenticator=open
Source: chromecache_150.2.dr, chromecache_187.2.dr	String found in binary or memory: https://chatbot.rediff.com/?skill=rpro-sales&authenticator=open&browseragent=
Source: chromecache_150.2.dr, chromecache_187.2.dr	String found in binary or memory: https://chatbot.rediff.com/?skill=rpro-sales&authenticator=open&refresh=1
Source: chromecache_159.2.dr	String found in binary or memory: https://checkout.razorpay.com/v1/checkout.js
Source: chromecache_125.2.dr, chromecache_235.2.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Nunito:300
Source: chromecache_184.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/nunito/v26/XRXV3I6Li01BKofIMeaBXso.woff2)
Source: chromecache_184.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/nunito/v26/XRXV3I6Li01BKofINeaB.woff2)
Source: chromecache_184.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/nunito/v26/XRXV3I6Li01BKofIO-aBXso.woff2)
Source: chromecache_184.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/nunito/v26/XRXV3I6Li01BKofIOOaBXso.woff2)
Source: chromecache_184.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/nunito/v26/XRXV3I6Li01BKofIOuaBXso.woff2)
Source: chromecache_212.2.dr, chromecache_251.2.dr	String found in binary or memory: https://github.com/JuhQ
Source: chromecache_212.2.dr, chromecache_251.2.dr	String found in binary or memory: https://github.com/phoebebright
Source: chromecache_168.2.dr	String found in binary or memory: https://google.com
Source: chromecache_168.2.dr	String found in binary or memory: https://googleads.g.doubleclick.net
Source: chromecache_231.2.dr	String found in binary or memory: https://hostsmetric.rediff.com/
Source: chromecache_234.2.dr, chromecache_150.2.dr, chromecache_187.2.dr, chromecache_163.2.dr	String found in binary or memory: https://hostsmetric.rediff.com/businessemail.rediff.com/chat-with-user/
Source: chromecache_250.2.dr, chromecache_231.2.dr	String found in binary or memory: https://hostsmetric.rediff.com/businessemail.rediff.com/company-email-hosting-services/
Source: chromecache_222.2.dr	String found in binary or memory: https://lineicons.com
Source: chromecache_222.2.dr	String found in binary or memory: https://lineicons.com/license
Source: chromecache_222.2.dr	String found in binary or memory: https://lineicons.com/licensehttps://lineicons.com/licenseVersion
Source: chromecache_222.2.dr	String found in binary or memory: https://lineicons.comhttps://lineicons.comFree
Source: chromecache_222.2.dr	String found in binary or memory: https://lineicons.comhttps://lineicons.comhttps://lineicons.comhttps://lineicons.comhttps://lineicon
Source: chromecache_168.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com
Source: chromecache_248.2.dr, chromecache_205.2.dr, chromecache_210.2.dr, chromecache_131.2.dr, chromecache_244.2.dr, chromecache_199.2.dr, chromecache_129.2.dr, chromecache_168.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=tcfe
Source: chromecache_207.2.dr, chromecache_216.2.dr	String found in binary or memory: https://sb.scorecardresearch.com/b2?
Source: chromecache_207.2.dr, chromecache_216.2.dr	String found in binary or memory: https://sb.scorecardresearch.com/b?
Source: chromecache_248.2.dr, chromecache_205.2.dr	String found in binary or memory: https://stats.g.doubleclick.net/g/collect
Source: chromecache_181.2.dr	String found in binary or memory: https://stats.g.doubleclick.net/j/collect
Source: chromecache_217.2.dr, chromecache_181.2.dr	String found in binary or memory: https://tagassistant.google.com/
Source: chromecache_248.2.dr, chromecache_205.2.dr, chromecache_210.2.dr, chromecache_131.2.dr, chromecache_244.2.dr, chromecache_199.2.dr, chromecache_129.2.dr, chromecache_168.2.dr	String found in binary or memory: https://td.doubleclick.net
Source: chromecache_212.2.dr, chromecache_251.2.dr	String found in binary or memory: https://twitter.com/hejsna
Source: chromecache_199.2.dr, chromecache_129.2.dr	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: chromecache_217.2.dr, chromecache_181.2.dr	String found in binary or memory: https://www.google-analytics.com/debug/bootstrap?id=
Source: chromecache_217.2.dr, chromecache_181.2.dr	String found in binary or memory: https://www.google-analytics.com/gtm/js?id=
Source: chromecache_217.2.dr, chromecache_181.2.dr	String found in binary or memory: https://www.google.%/ads/ga-audiences
Source: chromecache_168.2.dr	String found in binary or memory: https://www.google.com
Source: chromecache_217.2.dr, chromecache_181.2.dr	String found in binary or memory: https://www.google.com/ads/ga-audiences
Source: chromecache_168.2.dr	String found in binary or memory: https://www.googleadservices.com
Source: chromecache_168.2.dr	String found in binary or memory: https://www.googletagmanager.com
Source: chromecache_210.2.dr, chromecache_168.2.dr	String found in binary or memory: https://www.googletagmanager.com/a?
Source: chromecache_131.2.dr, chromecache_244.2.dr	String found in binary or memory: https://www.googletagmanager.com/dclk/ns/v1.js
Source: chromecache_217.2.dr, chromecache_181.2.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=
Source: chromecache_159.2.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=AW-600756359
Source: chromecache_159.2.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=DC-11216040
Source: chromecache_210.2.dr, chromecache_168.2.dr	String found in binary or memory: https://www.googletagmanager.com/static/service_worker/
Source: chromecache_248.2.dr, chromecache_205.2.dr	String found in binary or memory: https://www.merchant-center-analytics.goog

Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443

Source	Detection	Scanner	Label
https://stats.g.doubleclick.net/g/collect	0%	URL Reputation	safe
https://ampcid.google.com/v1/publisher:getClientId	0%	URL Reputation	safe
https://stats.g.doubleclick.net/j/collect	0%	URL Reputation	safe
https://tagassistant.google.com/	0%	URL Reputation	safe
https://cct.google/taggy/agent.js	0%	URL Reputation	safe
https://www.merchant-center-analytics.goog	0%	URL Reputation	safe

Name	IP	Active	Malicious	Reputation
analytics-alv.google.com	216.239.36.181	true	false	unknown
prod-white-ext-v2.razorpay.com	15.207.145.254	true	false	unknown
hostsmetric.rediff.com	202.137.238.21	true	false	unknown
sb.scorecardresearch.com	18.244.18.122	true	false	unknown
www.google.com	142.250.184.196	true	false	unknown
td.doubleclick.net	142.250.184.226	true	false	unknown
metric.rediff.com	202.137.238.21	true	false	unknown
www.infoleadzsalez.com	119.252.148.27	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	unknown
stats.g.doubleclick.net	142.250.110.155	true	false	unknown
chatbot.rediff.com	119.252.159.37	true	false	unknown
www.rediff.com	unknown	unknown	false	unknown
im.rediff.com	unknown	unknown	false	unknown
businessemail.rediff.com	unknown	unknown	false	unknown
imworld.rediff.com	unknown	unknown	false	unknown
analytics.google.com	unknown	unknown	false	unknown
checkout.razorpay.com	unknown	unknown	false	unknown

Name	Malicious	Reputation
https://metric.rediff.com/blank.html?1727807676224	false	unknown
https://businessemail.rediff.com/domain?sc_cid=pages-uc-domain-register&ref=domain-registration-india	false	unknown
https://chatbot.rediff.com/?skill=rpro-sales&authenticator=open&browseragent=pc	false	unknown
https://chatbot.rediff.com/public/styles-18.css	false	unknown
https://metric.rediff.com/blank.html?1727807686788	false	unknown
https://businessemail.rediff.com/contact-us?sc_cid=pages-uc-websites&ref=get-a-free-consultation	false	unknown
https://chatbot.rediff.com/public/send-chat.png	false	unknown
https://hostsmetric.rediff.com/chatbot.rediff.com/MainWindow?skill=rpro-sales&authenticator=open&browseragent=pc&sc_cid=pages-uc-websites\|rediff_com_chatbot&rkey=628581	false	unknown
http://www.infoleadzsalez.com/favicon.ico	false	unknown
https://sb.scorecardresearch.com/b?c1=2&c2=6035613&cs_it=b8&cv=4.0.0%2B2301240627&ns__t=1727807675243&ns_c=UTF-8&c7=https%3A%2F%2Fbusinessemail.rediff.com%2F%3Fsc_cid%3Dpages-uc-rediffmailenterprises&c8=Rediffmail%20for%20Work%3A%20Email%20for%20Your%20Business&c9=	false	unknown
https://sb.scorecardresearch.com/b?c1=2&c2=6035613&cs_it=b8&cv=4.0.0%2B2301240627&ns__t=1727807688653&ns_c=UTF-8&c7=https%3A%2F%2Fbusinessemail.rediff.com%2Femail-for-business%3Fsc_cid%3Dpages-uc-businessemail&c8=Email%20Hosting%20Solutions%20%26%20Collaboration%20Suite&c9=	false	unknown
https://sb.scorecardresearch.com/b?c1=2&c2=6035613&cs_it=b8&cv=4.0.0%2B2301240627&ns__t=1727807696259&ns_c=UTF-8&c7=https%3A%2F%2Fbusinessemail.rediff.com%2Fcontact-us%3Fsc_cid%3Dpages-uc-websites%26ref%3Dget-a-free-consultation&c8=Contact%20Us%20-%20Rediffmail%20For%20Work&c9=	false	unknown
https://chatbot.rediff.com/?skill=rpro-sales&authenticator=open&browseragent=pc&sc_cid=pages-uc-websites\|rediff_com_chatbot&parent=https%3A%2F%2Fbusinessemail.rediff.com%2F	false	unknown
https://sb.scorecardresearch.com/cs/6035613/beacon.js	false	unknown
https://chatbot.rediff.com/public/typing.gif	false	unknown
https://metric.rediff.com/blank.html?1727807695235	false	unknown
http://www.infoleadzsalez.com/	false	unknown
https://sb.scorecardresearch.com/b2?c1=2&c2=6035613&cs_it=b8&cv=4.0.0%2B2301240627&ns__t=1727807660236&ns_c=UTF-8&c7=https%3A%2F%2Fbusinessemail.rediff.com%2Fdomain%3Fsc_cid%3Dpages-uc-domain-register%26ref%3Ddomain-registration-india&c8=Buy%20.com%2C%20.org%2C%20.in%20domains%20on%20Rediffmail%20for%20Work&c9=	false	unknown
https://hostsmetric.rediff.com/businessemail.rediff.com/email-for-business/?sc_cid=pages-uc-businessemail&rkey=440881&device_param=pc	false	unknown
https://businessemail.rediff.com/?sc_cid=pages-uc-rediffmailenterprises	false	unknown
https://hostsmetric.rediff.com/businessemail.rediff.com/domain/?sc_cid=pages-uc-domain-register&ref=domain-registration-india&rkey=664174&device_param=pc	false	unknown
https://hostsmetric.rediff.com/businessemail.rediff.com/contact-us/?sc_cid=pages-uc-websites&ref=get-a-free-consultation&rkey=263689&device_param=pc	false	unknown
https://sb.scorecardresearch.com/b?c1=2&c2=6035613&cs_it=b8&cv=4.0.0%2B2301240627&ns__t=1727807660236&ns_c=UTF-8&c7=https%3A%2F%2Fbusinessemail.rediff.com%2Fdomain%3Fsc_cid%3Dpages-uc-domain-register%26ref%3Ddomain-registration-india&c8=Buy%20.com%2C%20.org%2C%20.in%20domains%20on%20Rediffmail%20for%20Work&c9=	false	unknown
https://chatbot.rediff.com/public/client-89.min.js	false	unknown
https://sb.scorecardresearch.com/b?c1=2&c2=6035613&cs_it=b8&cv=4.0.0%2B2301240627&ns__t=1727807714267&ns_c=UTF-8&c7=https%3A%2F%2Fbusinessemail.rediff.com%2Fpricing%3Fsc_cid%3Dpages-uc-domain-register%7Cpricing&c8=Pricing%20Plans%20-%20Rediffmail%20for%20Work&c9=	false	unknown
https://businessemail.rediff.com/pricing?sc_cid=pages-uc-domain-register\|pricing	false	unknown
https://hostsmetric.rediff.com/businessemail.rediff.com/chat-with-user/chatbot/open?rkey=836955	false	unknown
https://sb.scorecardresearch.com/internal-cs/default/beacon.js	false	unknown
https://hostsmetric.rediff.com/businessemail.rediff.com/?sc_cid=pages-uc-rediffmailenterprises&rkey=729776&device_param=pc	false	unknown
https://businessemail.rediff.com/email-for-business?sc_cid=pages-uc-businessemail	false	unknown
https://metric.rediff.com/blank.html?1727807713160	false	unknown
https://hostsmetric.rediff.com/businessemail.rediff.com/pricing/?sc_cid=pages-uc-domain-register\|pricing&rkey=300568&device_param=pc	false	unknown
https://checkout.razorpay.com/v1/checkout.js	false	unknown
https://metric.rediff.com/blank.html?1727807659875	false	unknown

Name	Source	Malicious	Antivirus Detection	Reputation
https://hostsmetric.rediff.com/	chromecache_231.2.dr	false		unknown
https://twitter.com/hejsna	chromecache_212.2.dr, chromecache_251.2.dr	false		unknown
https://stats.g.doubleclick.net/g/collect	chromecache_248.2.dr, chromecache_205.2.dr	false	URL Reputation: safe	unknown
https://github.com/phoebebright	chromecache_212.2.dr, chromecache_251.2.dr	false		unknown
https://hostsmetric.rediff.com/businessemail.rediff.com/chat-with-user/	chromecache_234.2.dr, chromecache_150.2.dr, chromecache_187.2.dr, chromecache_163.2.dr	false		unknown
https://lineicons.comhttps://lineicons.comFree	chromecache_222.2.dr	false		unknown
http://wicky.nillia.ms/headroom.js	chromecache_215.2.dr, chromecache_230.2.dr	false		unknown
http://login.rediff.com/cgi-bin/subs/passwd_remind.cgi?FormName=showlogin	chromecache_144.2.dr, chromecache_172.2.dr	false		unknown
https://ampcid.google.com/v1/publisher:getClientId	chromecache_217.2.dr, chromecache_181.2.dr	false	URL Reputation: safe	unknown
https://businessemail.rediff.com/rediffmailpro/onlinebiz/images/reset_icon.png)	chromecache_125.2.dr, chromecache_235.2.dr	false		unknown
https://github.com/JuhQ	chromecache_212.2.dr, chromecache_251.2.dr	false		unknown
https://lineicons.com	chromecache_222.2.dr	false		unknown
https://www.google.com	chromecache_168.2.dr	false		unknown
https://lineicons.com/license	chromecache_222.2.dr	false		unknown
https://sb.scorecardresearch.com/b2?	chromecache_207.2.dr, chromecache_216.2.dr	false		unknown
https://stats.g.doubleclick.net/j/collect	chromecache_181.2.dr	false	URL Reputation: safe	unknown
https://lineicons.com/licensehttps://lineicons.com/licenseVersion	chromecache_222.2.dr	false		unknown
https://businessemail.rediff.com/clicktocall	chromecache_150.2.dr, chromecache_187.2.dr	false		unknown
https://sb.scorecardresearch.com/b?	chromecache_207.2.dr, chromecache_216.2.dr	false		unknown
http://davidwalsh.name/javascript-debounce-function	chromecache_212.2.dr, chromecache_251.2.dr	false		unknown
https://googleads.g.doubleclick.net	chromecache_168.2.dr	false		unknown
https://tagassistant.google.com/	chromecache_217.2.dr, chromecache_181.2.dr	false	URL Reputation: safe	unknown
http://track.rediff.com/click?url=___	chromecache_144.2.dr, chromecache_172.2.dr	false		unknown
https://hostsmetric.rediff.com/businessemail.rediff.com/company-email-hosting-services/	chromecache_250.2.dr, chromecache_231.2.dr	false		unknown
https://cct.google/taggy/agent.js	chromecache_248.2.dr, chromecache_205.2.dr, chromecache_210.2.dr, chromecache_131.2.dr, chromecache_244.2.dr, chromecache_199.2.dr, chromecache_129.2.dr, chromecache_168.2.dr	false	URL Reputation: safe	unknown
http://ishare.rediff.com/embed_config.php?id=	chromecache_246.2.dr	false		unknown
https://chatbot.rediff.com/?skill=rpro-sales&authenticator=open	chromecache_234.2.dr, chromecache_150.2.dr, chromecache_187.2.dr, chromecache_163.2.dr	false		unknown
http://johanhalse.mit-license.org	chromecache_212.2.dr, chromecache_251.2.dr	false		unknown
https://ad.doubleclick.net	chromecache_244.2.dr	false		unknown
https://chatbot.rediff.com/?skill=rpro-sales&authenticator=open&refresh=1	chromecache_150.2.dr, chromecache_187.2.dr	false		unknown
https://chatbot.rediff.com/?skill=rpro-sales&authenticator=open&browseragent=	chromecache_150.2.dr, chromecache_187.2.dr	false		unknown
https://www.google.com/ads/ga-audiences	chromecache_217.2.dr, chromecache_181.2.dr	false		unknown
https://www.google.%/ads/ga-audiences	chromecache_217.2.dr, chromecache_181.2.dr	false		unknown
https://td.doubleclick.net	chromecache_248.2.dr, chromecache_205.2.dr, chromecache_210.2.dr, chromecache_131.2.dr, chromecache_244.2.dr, chromecache_199.2.dr, chromecache_129.2.dr, chromecache_168.2.dr	false		unknown
https://lineicons.comhttps://lineicons.comhttps://lineicons.comhttps://lineicons.comhttps://lineicon	chromecache_222.2.dr	false		unknown
https://www.merchant-center-analytics.goog	chromecache_248.2.dr, chromecache_205.2.dr	false	URL Reputation: safe	unknown
https://businessemail.rediff.com/rediffmailpro/onlinebiz/images/down_arr.png)	chromecache_125.2.dr, chromecache_235.2.dr	false		unknown
http://ishare.rediff.com/images/player_embed_dm_27052011.swf	chromecache_246.2.dr	false		unknown
https://google.com	chromecache_168.2.dr	false		unknown
http://ishare.rediff.com/images/embed_plugin_30052011.swf&autostart=true	chromecache_246.2.dr	false		unknown
http://businessemail.rediff.com/ordererror?error=	chromecache_257.2.dr, chromecache_196.2.dr, chromecache_213.2.dr, chromecache_246.2.dr	false		unknown
https://adservice.google.com/pagead/regclk?	chromecache_168.2.dr	false		unknown

IP	Domain	Country	ASN	ASN Name	Malicious
119.252.148.27	www.infoleadzsalez.com	India	38224	REDIFF-ASRediffcomIndiaLimitedIN	false
142.250.184.226	td.doubleclick.net	United States	15169	GOOGLEUS	false
18.245.60.53	unknown	United States	16509	AMAZON-02US	false
142.250.184.196	www.google.com	United States	15169	GOOGLEUS	false
216.239.36.181	analytics-alv.google.com	United States	15169	GOOGLEUS	false
18.244.18.122	sb.scorecardresearch.com	United States	16509	AMAZON-02US	false
202.137.238.21	hostsmetric.rediff.com	India	38224	REDIFF-ASRediffcomIndiaLimitedIN	false
142.250.110.155	stats.g.doubleclick.net	United States	15169	GOOGLEUS	false
15.207.145.254	prod-white-ext-v2.razorpay.com	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
119.252.159.37	chatbot.rediff.com	India	38224	REDIFF-ASRediffcomIndiaLimitedIN	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1523602
Start date and time:	2024-10-01 20:33:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://www.infoleadzsalez.com
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean1.win@22/222@44/12
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Browse: https://businessemail.rediff.com/domain-registration-india?sc_cid=pages-uc-domain-register Browse: https://businessemail.rediff.com/?sc_cid=pages-uc-rediffmailenterprises Browse: https://businessemail.rediff.com/how-to-buy-company-email-new?sc_cid=pages-uc-businessemail Browse: https://businessemail.rediff.com/get-a-free-consultation?sc_cid=pages-uc-websites Browse: https://businessemail.rediff.com/pricing?sc_cid=pages-uc-domain-register

Input	Output
URL: https://businessemail.rediff.com/domain?sc_cid=pages-uc-domain-register&ref=domain-registration-india Model: jbxai	{ "brand":["unknown"], "contains_trigger_text":false, "prominent_button_name":"unknown", "text_input_field_labels":["unknown"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://businessemail.rediff.com/domain?sc_cid=pages-uc-domain-register&ref=domain-registration-india Model: jbxai	{ "phishing_score":0, "reason":"No text found on page."}
	{ "phishing_score":0, "reason":"No text found on page."}
URL: http://www.infoleadzsalez.com/ Model: jbxai	{ "brand":[], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"Click here to go back to the previous page.", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://businessemail.rediff.com/domain?sc_cid=pages-uc-domain-register&ref=domain-registration-india Model: jbxai	{ "brand":["Rediffmail"], "contains_trigger_text":true, "trigger_text":"Rediffmail for Work", "prominent_button_name":"Search Now", "text_input_field_labels":["e.g. rajexports.in", "Enter your mobile number", "Enter your contact email ID"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://businessemail.rediff.com/email-for-business?sc_cid=pages-uc-businessemail Model: jbxai	{ "brand":["Rediffmail"], "contains_trigger_text":true, "trigger_text":"Get Started", "prominent_button_name":"Get Started", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://businessemail.rediff.com/?sc_cid=pages-uc-rediffmailenterprises Model: jbxai	{ "brand":["rediffmail"], "contains_trigger_text":true, "trigger_text":"Become our authorized channel partner. Earn commissions on new clients and on renewals. Know More", "prominent_button_name":"Login", "text_input_field_labels":["Starting@ 23/ Mo for 1GB", "Starting@ 43/ Mo for 10GB", "Starting@ 38/ Mo for 1GB", "Starting@ 399/ Yr"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://businessemail.rediff.com/domain?sc_cid=pages-uc-domain-register&ref=domain-registration-india Model: jbxai	{ "phishing_score":2, "brands":"Rediffmail", "legit_domain":"rediff.com", "classification":"known", "reasons":["The URL 'businessemail.rediff.com' is a subdomain of 'rediff.com', which is a legitimate domain associated with Rediffmail.", "Rediffmail is a known brand, particularly in India, for email services.", "The URL does not contain any suspicious elements such as misspellings, extra characters, or unusual domain extensions.", "The input fields 'Enter your mobile number' and 'Enter your contact email ID' are typical for email service providers, especially for business email services."], "brand_matches":[false], "url_match":true, "brand_input":"Rediffmail", "input_fields":"e.g. rajexports.in, Enter your mobile number, Enter your contact email ID"}

URL: https://businessemail.rediff.com/contact-us?sc_cid=pages-uc-websites&ref=get-a-free-consultation Model: jbxai	{ "brand":["rediffmail"], "contains_trigger_text":true, "trigger_text":"Have questions about Rediffmail for Work?", "prominent_button_name":"Submit", "text_input_field_labels":["Enter your full name", "Enter your email address", "Enter your mobile number", "Enter your comments or requirements"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://businessemail.rediff.com/contact-us?sc_cid=pages-uc-websites&ref=get-a-free-consultation Model: jbxai	{ "phishing_score":2, "brands":"rediffmail", "legit_domain":"rediff.com", "classification":"known", "reasons":["The URL 'businessemail.rediff.com' is a subdomain of 'rediff.com', which is a known domain associated with Rediffmail.", "The brand 'rediffmail' is correctly associated with the domain 'rediff.com'.", "The URL does not contain any suspicious elements such as misspellings, extra characters, or unusual domain extensions.", "The input fields are typical for a legitimate business email service."], "brand_matches":[false], "url_match":true, "brand_input":"rediffmail", "input_fields":"Enter your full name, Enter your email address, Enter your mobile number, Enter your comments or requirements"}

URL: https://businessemail.rediff.com/contact-us?sc_cid=pages-uc-websites&ref=get-a-free-consultation Model: jbxai	{ "brand":["Rediffmail"], "contains_trigger_text":true, "trigger_text":"Want to see how Rediffmail for Work could help your business?", "prominent_button_name":"Submit", "text_input_field_labels":["Enter your full name", "Enter your email address", "Enter your mobile number", "Enter your comments or requirements"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://businessemail.rediff.com/pricing?sc_cid=pages-uc-domain-register\|pricing Model: jbxai	{ "brand":["rediffmail"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"Login", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://businessemail.rediff.com/contact-us?sc_cid=pages-uc-websites&ref=get-a-free-consultation Model: jbxai	{ "phishing_score":2, "brands":"Rediffmail", "legit_domain":"rediff.com", "classification":"known", "reasons":["The URL 'businessemail.rediff.com' is a subdomain of 'rediff.com', which is the legitimate domain for Rediffmail.", "Rediffmail is a known brand associated with the domain 'rediff.com'.", "The URL does not contain any suspicious elements such as misspellings, extra characters, or unusual domain extensions.", "The input fields are typical for a business email service and do not raise immediate red flags."], "brand_matches":[false], "url_match":true, "brand_input":"Rediffmail", "input_fields":"Enter your full name, Enter your email address, Enter your mobile number, Enter your comments or requirements"}

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 1 17:33:59 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.974450881918909
Encrypted:	false
SSDEEP:	48:83dXTPDDHhidAKZdA19ehwiZUklqehekJy+3:8NnH/Yy
MD5:	DFB10B961D6AAE5094BE1472D7913870
SHA1:	FB31EFC40D1A078118CD688EE5DF0CAA33AF4455
SHA-256:	BEEA6873135CA8974E6ED7091FE5FB3274249EF8C649ECCA612FBA61D2E1485A
SHA-512:	AB5453C05E7A513228EA05903E9ECD9509DD77D2C085554450A306F06D047DC88B71CD57F1C2808E6FA3F43FF3A45F2BDE58E2B9B35776B6FED72243D617A6B5
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....~.o{0...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IAY:.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VAY:.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VAY:.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VAY:............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VAY@............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://www.infoleadzsalez.com

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 125

Chrome Cache Entry: 126

Chrome Cache Entry: 127

Chrome Cache Entry: 128

Chrome Cache Entry: 129

Chrome Cache Entry: 130

Chrome Cache Entry: 131

Chrome Cache Entry: 132

Chrome Cache Entry: 133

Chrome Cache Entry: 134

Chrome Cache Entry: 135

Chrome Cache Entry: 136

Chrome Cache Entry: 137

Chrome Cache Entry: 138

Chrome Cache Entry: 139

Chrome Cache Entry: 140

Chrome Cache Entry: 141

Chrome Cache Entry: 142

Chrome Cache Entry: 143

Chrome Cache Entry: 144

Chrome Cache Entry: 145

Windows Analysis Report
http://www.infoleadzsalez.com

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 1, 2024 20:33:58.462214947 CEST	53	54129	1.1.1.1	192.168.2.5
Oct 1, 2024 20:34:00.324177027 CEST	53	57438	1.1.1.1	192.168.2.5
Oct 1, 2024 20:34:00.405850887 CEST	53	61983	1.1.1.1	192.168.2.5
Oct 1, 2024 20:34:00.461661100 CEST	61163	53	192.168.2.5	1.1.1.1
Oct 1, 2024 20:34:00.461899996 CEST	55170	53	192.168.2.5	1.1.1.1
Oct 1, 2024 20:34:00.801168919 CEST	53	55170	1.1.1.1	192.168.2.5
Oct 1, 2024 20:34:00.803905964 CEST	53	61163	1.1.1.1	192.168.2.5
Oct 1, 2024 20:34:01.411252975 CEST	62049	53	192.168.2.5	1.1.1.1
Oct 1, 2024 20:34:01.411514997 CEST	62498	53	192.168.2.5	1.1.1.1
Oct 1, 2024 20:34:01.419169903 CEST	53	62049	1.1.1.1	192.168.2.5
Oct 1, 2024 20:34:01.420185089 CEST	53	62498	1.1.1.1	192.168.2.5
Oct 1, 2024 20:34:01.467664957 CEST	53	57408	1.1.1.1	192.168.2.5
Oct 1, 2024 20:34:01.845957041 CEST	59598	53	192.168.2.5	1.1.1.1
Oct 1, 2024 20:34:01.846105099 CEST	64519	53	192.168.2.5	1.1.1.1
Oct 1, 2024 20:34:02.599864006 CEST	64311	53	192.168.2.5	1.1.1.1
Oct 1, 2024 20:34:02.600023031 CEST	58116	53	192.168.2.5	1.1.1.1
Oct 1, 2024 20:34:03.001149893 CEST	61643	53	192.168.2.5	1.1.1.1
Oct 1, 2024 20:34:03.001317024 CEST	50456	53	192.168.2.5	1.1.1.1
Oct 1, 2024 20:34:03.334923983 CEST	53	50456	1.1.1.1	192.168.2.5
Oct 1, 2024 20:34:03.340512991 CEST	53	61643	1.1.1.1	192.168.2.5
Oct 1, 2024 20:34:12.922966003 CEST	49202	53	192.168.2.5	1.1.1.1
Oct 1, 2024 20:34:12.923255920 CEST	53422	53	192.168.2.5	1.1.1.1
Oct 1, 2024 20:34:17.484908104 CEST	61582	53	192.168.2.5	1.1.1.1
Oct 1, 2024 20:34:17.485584974 CEST	65280	53	192.168.2.5	1.1.1.1
Oct 1, 2024 20:34:17.567080975 CEST	53	63011	1.1.1.1	192.168.2.5
Oct 1, 2024 20:34:18.527539968 CEST	53	62251	1.1.1.1	192.168.2.5
Oct 1, 2024 20:34:18.653877020 CEST	56288	53	192.168.2.5	1.1.1.1
Oct 1, 2024 20:34:18.654122114 CEST	55397	53	192.168.2.5	1.1.1.1
Oct 1, 2024 20:34:18.882859945 CEST	53	55571	1.1.1.1	192.168.2.5
Oct 1, 2024 20:34:18.882875919 CEST	53	55397	1.1.1.1	192.168.2.5
Oct 1, 2024 20:34:18.882888079 CEST	53	56288	1.1.1.1	192.168.2.5
Oct 1, 2024 20:34:20.199541092 CEST	53	54914	1.1.1.1	192.168.2.5
Oct 1, 2024 20:34:20.660789013 CEST	50962	53	192.168.2.5	1.1.1.1
Oct 1, 2024 20:34:20.661022902 CEST	54465	53	192.168.2.5	1.1.1.1
Oct 1, 2024 20:34:20.671143055 CEST	53	50962	1.1.1.1	192.168.2.5
Oct 1, 2024 20:34:20.675740957 CEST	53	54465	1.1.1.1	192.168.2.5
Oct 1, 2024 20:34:21.017194033 CEST	59499	53	192.168.2.5	1.1.1.1
Oct 1, 2024 20:34:21.017342091 CEST	62868	53	192.168.2.5	1.1.1.1
Oct 1, 2024 20:34:21.023756981 CEST	53	58481	1.1.1.1	192.168.2.5
Oct 1, 2024 20:34:21.027194977 CEST	53	62868	1.1.1.1	192.168.2.5
Oct 1, 2024 20:34:21.027381897 CEST	53	59499	1.1.1.1	192.168.2.5
Oct 1, 2024 20:34:22.010759115 CEST	56575	53	192.168.2.5	1.1.1.1
Oct 1, 2024 20:34:22.012499094 CEST	57379	53	192.168.2.5	1.1.1.1
Oct 1, 2024 20:34:22.021847963 CEST	53	57379	1.1.1.1	192.168.2.5
Oct 1, 2024 20:34:22.026046991 CEST	53	56575	1.1.1.1	192.168.2.5
Oct 1, 2024 20:34:22.136359930 CEST	56977	53	192.168.2.5	1.1.1.1
Oct 1, 2024 20:34:22.137583017 CEST	51919	53	192.168.2.5	1.1.1.1
Oct 1, 2024 20:34:22.144026995 CEST	53	56977	1.1.1.1	192.168.2.5
Oct 1, 2024 20:34:22.144973040 CEST	53	51919	1.1.1.1	192.168.2.5
Oct 1, 2024 20:34:22.169223070 CEST	63604	53	192.168.2.5	1.1.1.1
Oct 1, 2024 20:34:22.169449091 CEST	55696	53	192.168.2.5	1.1.1.1
Oct 1, 2024 20:34:22.177006960 CEST	53	63604	1.1.1.1	192.168.2.5
Oct 1, 2024 20:34:22.177056074 CEST	53	55696	1.1.1.1	192.168.2.5
Oct 1, 2024 20:34:22.280709982 CEST	53	54750	1.1.1.1	192.168.2.5
Oct 1, 2024 20:34:22.453510046 CEST	53	50888	1.1.1.1	192.168.2.5
Oct 1, 2024 20:34:22.896406889 CEST	54180	53	192.168.2.5	1.1.1.1
Oct 1, 2024 20:34:22.897260904 CEST	64208	53	192.168.2.5	1.1.1.1
Oct 1, 2024 20:34:22.907532930 CEST	53	54180	1.1.1.1	192.168.2.5
Oct 1, 2024 20:34:22.908179045 CEST	53	64208	1.1.1.1	192.168.2.5
Oct 1, 2024 20:34:26.473608971 CEST	52253	53	192.168.2.5	1.1.1.1
Oct 1, 2024 20:34:26.473941088 CEST	51721	53	192.168.2.5	1.1.1.1
Oct 1, 2024 20:34:27.699749947 CEST	52931	53	192.168.2.5	1.1.1.1
Oct 1, 2024 20:34:27.700404882 CEST	49384	53	192.168.2.5	1.1.1.1
Oct 1, 2024 20:34:27.716639042 CEST	53	49384	1.1.1.1	192.168.2.5
Oct 1, 2024 20:34:27.716918945 CEST	53	52931	1.1.1.1	192.168.2.5
Oct 1, 2024 20:34:28.594753027 CEST	64769	53	192.168.2.5	1.1.1.1
Oct 1, 2024 20:34:28.594935894 CEST	50082	53	192.168.2.5	1.1.1.1
Oct 1, 2024 20:34:37.948216915 CEST	53	50833	1.1.1.1	192.168.2.5
Oct 1, 2024 20:34:52.105529070 CEST	65438	53	192.168.2.5	1.1.1.1
Oct 1, 2024 20:34:52.106089115 CEST	58431	53	192.168.2.5	1.1.1.1
Oct 1, 2024 20:34:52.120927095 CEST	53	65438	1.1.1.1	192.168.2.5
Oct 1, 2024 20:34:52.123250008 CEST	53	58431	1.1.1.1	192.168.2.5
Oct 1, 2024 20:34:53.845094919 CEST	62182	53	192.168.2.5	1.1.1.1
Oct 1, 2024 20:34:53.845417976 CEST	54751	53	192.168.2.5	1.1.1.1
Oct 1, 2024 20:34:53.848802090 CEST	64630	53	192.168.2.5	1.1.1.1
Oct 1, 2024 20:34:53.849322081 CEST	58095	53	192.168.2.5	1.1.1.1
Oct 1, 2024 20:34:53.857198954 CEST	53	64630	1.1.1.1	192.168.2.5
Oct 1, 2024 20:34:53.888936043 CEST	53	58095	1.1.1.1	192.168.2.5
Oct 1, 2024 20:34:55.443093061 CEST	64766	53	192.168.2.5	1.1.1.1
Oct 1, 2024 20:34:55.443336964 CEST	57595	53	192.168.2.5	1.1.1.1
Oct 1, 2024 20:34:56.918454885 CEST	53	60266	1.1.1.1	192.168.2.5
Oct 1, 2024 20:34:58.241983891 CEST	56081	53	192.168.2.5	1.1.1.1
Oct 1, 2024 20:34:58.242383957 CEST	61686	53	192.168.2.5	1.1.1.1
Oct 1, 2024 20:34:58.257584095 CEST	53	56081	1.1.1.1	192.168.2.5
Oct 1, 2024 20:34:58.259521961 CEST	53	61686	1.1.1.1	192.168.2.5
Oct 1, 2024 20:35:01.271811962 CEST	53	60692	1.1.1.1	192.168.2.5
Oct 1, 2024 20:35:27.723156929 CEST	53	56361	1.1.1.1	192.168.2.5

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Oct 1, 2024 20:34:12.951966047 CEST	192.168.2.5	1.1.1.1	c26f	(Port unreachable)	Destination Unreachable
Oct 1, 2024 20:34:53.889028072 CEST	192.168.2.5	1.1.1.1	c283	(Port unreachable)	Destination Unreachable

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 20:34:00.809763908 CEST	437	OUT	GET / HTTP/1.1 Host: www.infoleadzsalez.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Oct 1, 2024 20:34:01.821863890 CEST	966	IN	HTTP/1.1 200 OK Date: Tue, 01 Oct 2024 18:34:01 GMT Server: Apache Vary: Accept-Encoding,User-Agent Content-Encoding: gzip Content-Length: 733 Keep-Alive: timeout=15, max=100 Connection: Keep-Alive Content-Type: text/html Data Raw: 1f 8b 08 00 00 00 00 00 00 03 bd 55 5d 6f d3 30 14 7d df af b8 64 12 82 87 c4 ed b4 0f 94 26 41 62 ec 7d 1a 5f 8f c8 89 6f 12 33 c7 8e 6c a7 5d 19 fb ef 5c 3b 5d d9 98 84 98 90 68 a5 c4 be be f5 39 e7 9e 6b b7 e8 fd a0 aa 83 a2 47 2e e8 35 a0 e7 a0 f9 80 65 62 4d 6d bc 4b a0 31 da a3 f6 65 a2 8d d4 02 6f 12 60 94 e8 a5 57 58 7d 90 1e e1 13 45 2d 9c 1b ed bc 9d 1a 2f 8d 2e d8 bc 7c 50 38 bf 55 08 7e 3b d2 86 1e 6f 3c 6b 9c 4b aa ac 35 c6 a3 bd dd 48 e1 fb fc ec ec cd 78 b3 6a 09 26 6d f9 20 d5 36 e7 56 72 35 47 9c fc 8e f9 72 49 09 03 b7 9d d4 f9 d9 82 c6 23 17 42 ea 2e 5f 86 49 6d 2c 11 48 bd 19 73 67 94 14 40 d9 70 28 4e c2 77 d5 18 65 6c 7e 78 7a 7a ba 52 52 63 da a3 ec 7a 9f 2f b3 13 1c 56 77 59 bb 3c e2 f6 f6 8f d8 47 04 71 57 b0 a8 84 14 b1 5d a5 6a 23 b6 50 77 71 ff f2 b0 8d 1f 0a 37 54 2a b4 a1 40 bc 26 e5 51 61 79 bc 58 40 83 4a ed 68 97 f3 cc 8d bc 99 67 b3 82 10 56 dc b9 32 89 ac 92 b0 89 ad 0a 2f 60 26 5d 26 cb c5 22 a9 a8 b8 22 3c ec 7e bd 2a e4 d0 81 b3 4d 99 30 26 87 8d b1 4a 64 16 85 [TRUNCATED] Data Ascii: U]o0}d&Ab}_o3l]\;]h9kG.5ebMmK1eo`WX}E-/.\|P8U~;o<kK5Hxj&m 6Vr5GrI#B._Im,Hsg@p(Nwel~xzzRRcz/VwY<GqW]j#Pwq7T@&QayX@JhgV2/`&]&""<~M0&Jdl1ynQ02el_\N6 UE]}-nX.rR7\~rYYk`,low>>$v8Tb[&:*]Ns%I@ 3P D]4@}=H`]@!{sc'z{R'G\xeH:5"hC:aW0\A\\C@PDnGfYZ0H'eBz@0Jo6tMi:rMcNJ]naO4)O[9)=a:crnQK_X,h?
Oct 1, 2024 20:34:02.597454071 CEST	388	OUT	GET /favicon.ico HTTP/1.1 Host: www.infoleadzsalez.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://www.infoleadzsalez.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Oct 1, 2024 20:34:02.996562958 CEST	928	IN	HTTP/1.1 200 OK Date: Tue, 01 Oct 2024 18:34:02 GMT Server: Apache Vary: Accept-Encoding,User-Agent Content-Encoding: gzip Content-Length: 733 Connection: close Content-Type: text/html Data Raw: 1f 8b 08 00 00 00 00 00 00 03 bd 55 5d 6f d3 30 14 7d df af b8 64 12 82 87 c4 ed b4 0f 94 26 41 62 ec 7d 1a 5f 8f c8 89 6f 12 33 c7 8e 6c a7 5d 19 fb ef 5c 3b 5d d9 98 84 98 90 68 a5 c4 be be f5 39 e7 9e 6b b7 e8 fd a0 aa 83 a2 47 2e e8 35 a0 e7 a0 f9 80 65 62 4d 6d bc 4b a0 31 da a3 f6 65 a2 8d d4 02 6f 12 60 94 e8 a5 57 58 7d 90 1e e1 13 45 2d 9c 1b ed bc 9d 1a 2f 8d 2e d8 bc 7c 50 38 bf 55 08 7e 3b d2 86 1e 6f 3c 6b 9c 4b aa ac 35 c6 a3 bd dd 48 e1 fb fc ec ec cd 78 b3 6a 09 26 6d f9 20 d5 36 e7 56 72 35 47 9c fc 8e f9 72 49 09 03 b7 9d d4 f9 d9 82 c6 23 17 42 ea 2e 5f 86 49 6d 2c 11 48 bd 19 73 67 94 14 40 d9 70 28 4e c2 77 d5 18 65 6c 7e 78 7a 7a ba 52 52 63 da a3 ec 7a 9f 2f b3 13 1c 56 77 59 bb 3c e2 f6 f6 8f d8 47 04 71 57 b0 a8 84 14 b1 5d a5 6a 23 b6 50 77 71 ff f2 b0 8d 1f 0a 37 54 2a b4 a1 40 bc 26 e5 51 61 79 bc 58 40 83 4a ed 68 97 f3 cc 8d bc 99 67 b3 82 10 56 dc b9 32 89 ac 92 b0 89 ad 0a 2f 60 26 5d 26 cb c5 22 a9 a8 b8 22 3c ec 7e bd 2a e4 d0 81 b3 4d 99 30 26 87 8d b1 4a 64 16 85 [TRUNCATED] Data Ascii: U]o0}d&Ab}_o3l]\;]h9kG.5ebMmK1eo`WX}E-/.\|P8U~;o<kK5Hxj&m 6Vr5GrI#B._Im,Hsg@p(Nwel~xzzRRcz/VwY<GqW]j#Pwq7T@&QayX@JhgV2/`&]&""<~M0&Jdl1ynQ02el_\N6 UE]}-nX.rR7\~rYYk`,low>>$v8Tb[&:*]Ns%I@ 3P D]4@}=H`]@!{sc'z{R'G\xeH:5"hC:aW0\A\\C@PDnGfYZ0H'eBz@0Jo6tMi:rMcNJ]naO4)O[9)=a:crnQK_X,h?

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 20:34:03.346759081 CEST	286	OUT	GET /favicon.ico HTTP/1.1 Host: www.infoleadzsalez.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Oct 1, 2024 20:34:04.343108892 CEST	966	IN	HTTP/1.1 200 OK Date: Tue, 01 Oct 2024 18:34:04 GMT Server: Apache Vary: Accept-Encoding,User-Agent Content-Encoding: gzip Content-Length: 733 Keep-Alive: timeout=15, max=100 Connection: Keep-Alive Content-Type: text/html Data Raw: 1f 8b 08 00 00 00 00 00 00 03 bd 55 5d 6f d3 30 14 7d df af b8 64 12 82 87 c4 ed b4 0f 94 26 41 62 ec 7d 1a 5f 8f c8 89 6f 12 33 c7 8e 6c a7 5d 19 fb ef 5c 3b 5d d9 98 84 98 90 68 a5 c4 be be f5 39 e7 9e 6b b7 e8 fd a0 aa 83 a2 47 2e e8 35 a0 e7 a0 f9 80 65 62 4d 6d bc 4b a0 31 da a3 f6 65 a2 8d d4 02 6f 12 60 94 e8 a5 57 58 7d 90 1e e1 13 45 2d 9c 1b ed bc 9d 1a 2f 8d 2e d8 bc 7c 50 38 bf 55 08 7e 3b d2 86 1e 6f 3c 6b 9c 4b aa ac 35 c6 a3 bd dd 48 e1 fb fc ec ec cd 78 b3 6a 09 26 6d f9 20 d5 36 e7 56 72 35 47 9c fc 8e f9 72 49 09 03 b7 9d d4 f9 d9 82 c6 23 17 42 ea 2e 5f 86 49 6d 2c 11 48 bd 19 73 67 94 14 40 d9 70 28 4e c2 77 d5 18 65 6c 7e 78 7a 7a ba 52 52 63 da a3 ec 7a 9f 2f b3 13 1c 56 77 59 bb 3c e2 f6 f6 8f d8 47 04 71 57 b0 a8 84 14 b1 5d a5 6a 23 b6 50 77 71 ff f2 b0 8d 1f 0a 37 54 2a b4 a1 40 bc 26 e5 51 61 79 bc 58 40 83 4a ed 68 97 f3 cc 8d bc 99 67 b3 82 10 56 dc b9 32 89 ac 92 b0 89 ad 0a 2f 60 26 5d 26 cb c5 22 a9 a8 b8 22 3c ec 7e bd 2a e4 d0 81 b3 4d 99 30 26 87 8d b1 4a 64 16 85 [TRUNCATED] Data Ascii: U]o0}d&Ab}_o3l]\;]h9kG.5ebMmK1eo`WX}E-/.\|P8U~;o<kK5Hxj&m 6Vr5GrI#B._Im,Hsg@p(Nwel~xzzRRcz/VwY<GqW]j#Pwq7T@&QayX@JhgV2/`&]&""<~M0&Jdl1ynQ02el_\N6 UE]}-nX.rR7\~rYYk`,low>>$v8Tb[&:*]Ns%I@ 3P D]4@}=H`]@!{sc'z{R'G\xeH:5"hC:aW0\A\\C@PDnGfYZ0H'eBz@0Jo6tMi:rMcNJ]naO4)O[9)=a:crnQK_X,h?

Timestamp	Bytes transferred	Direction	Data
2024-10-01 18:34:06 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-01 18:34:06 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=166304 Date: Tue, 01 Oct 2024 18:34:06 GMT Connection: close X-CID: 2

Timestamp	Bytes transferred	Direction	Data
2024-10-01 18:34:07 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-01 18:34:07 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=166247 Date: Tue, 01 Oct 2024 18:34:07 GMT Content-Length: 55 Connection: close X-CID: 2
2024-10-01 18:34:07 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Timestamp	Bytes transferred	Direction	Data
2024-10-01 18:34:19 UTC	552	OUT	GET /cs/6035613/beacon.js HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://businessemail.rediff.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-01 18:34:19 UTC	383	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Tue, 01 Oct 2024 18:34:19 GMT Location: /internal-cs/default/beacon.js Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 d025091c574ce1bcf1fefea59ac34f2c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P11 X-Amz-Cf-Id: 3PhnBgUKaibdwW7YT32TWEXjVxFLr8LiHOxcQLtvwMcsSgGO0C7xBQ==

Timestamp	Bytes transferred	Direction	Data
2024-10-01 18:34:20 UTC	561	OUT	GET /internal-cs/default/beacon.js HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://businessemail.rediff.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-01 18:34:21 UTC	563	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 4321 Connection: close Last-Modified: Thu, 07 Dec 2023 12:02:23 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Tue, 01 Oct 2024 10:00:39 GMT Cache-Control: max-age=86400 ETag: "77ff4ede4693897337a38594321529a3" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 1f5c750c03b26301631398b45f61e262.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P11 X-Amz-Cf-Id: vX8Ysq0Qm--cTxGptq3E00KoTQkUrkyaqTG2SsRFWjqQ2HDpfH2Axg== Age: 30822
2024-10-01 18:34:21 UTC	4321	IN	Data Raw: 76 61 72 20 43 4f 4d 53 43 4f 52 45 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 75 6e 63 74 69 6f 6e 20 6e 28 65 2c 6e 2c 72 29 7b 2d 31 3d 3d 65 2e 69 6e 64 65 78 4f 66 28 22 3f 22 29 26 26 28 65 2b 3d 22 3f 22 29 3b 76 61 72 20 74 3d 21 31 3b 28 2d 31 21 3d 65 2e 69 6e 64 65 78 4f 66 28 22 26 22 29 7c 7c 65 2e 6c 65 6e 67 74 68 2d 31 3e 65 2e 69 6e 64 65 78 4f 66 28 22 3f 22 29 29 26 26 28 74 3d 21 30 29 3b 66 6f 72 28 76 61 72 20 61 3d 30 3b 61 3c 6e 2e 6c 65 6e 67 74 68 3b 2b 2b 61 29 7b 76 61 72 20 69 3d 6e 5b 61 5d 3b 66 6f 72 28 76 61 72 20 63 20 69 6e 20 69 29 74 26 26 28 65 2b 3d 22 26 22 29 2c 74 3d 21 30 2c 65 2b 3d 63 2b 22 3d 22 2b 6f 28 69 5b 63 5d 2b 22 22 29 7d 72 65 74 75 72 6e 20 65 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 69 66 28 65 Data Ascii: var COMSCORE=function(e){function n(e,n,r){-1==e.indexOf("?")&&(e+="?");var t=!1;(-1!=e.indexOf("&")\|\|e.length-1>e.indexOf("?"))&&(t=!0);for(var a=0;a<n.length;++a){var i=n[a];for(var c in i)t&&(e+="&"),t=!0,e+=c+"="+o(i[c]+"")}return e=function(e,n){if(e

Timestamp	Bytes transferred	Direction	Data
2024-10-01 18:34:21 UTC	377	OUT	GET /internal-cs/default/beacon.js HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-01 18:34:22 UTC	562	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 4321 Connection: close Last-Modified: Thu, 07 Dec 2023 12:02:23 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Tue, 01 Oct 2024 10:00:39 GMT Cache-Control: max-age=86400 ETag: "77ff4ede4693897337a38594321529a3" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 69a82a9746d3a7343dca651e0829f000.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA60-P5 X-Amz-Cf-Id: 52KYB7MusZq6tmiAXVdf7tv6eegAfwwIr6pXy1rYzpTuAgZZ8gZ8lg== Age: 30823
2024-10-01 18:34:22 UTC	4321	IN	Data Raw: 76 61 72 20 43 4f 4d 53 43 4f 52 45 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 75 6e 63 74 69 6f 6e 20 6e 28 65 2c 6e 2c 72 29 7b 2d 31 3d 3d 65 2e 69 6e 64 65 78 4f 66 28 22 3f 22 29 26 26 28 65 2b 3d 22 3f 22 29 3b 76 61 72 20 74 3d 21 31 3b 28 2d 31 21 3d 65 2e 69 6e 64 65 78 4f 66 28 22 26 22 29 7c 7c 65 2e 6c 65 6e 67 74 68 2d 31 3e 65 2e 69 6e 64 65 78 4f 66 28 22 3f 22 29 29 26 26 28 74 3d 21 30 29 3b 66 6f 72 28 76 61 72 20 61 3d 30 3b 61 3c 6e 2e 6c 65 6e 67 74 68 3b 2b 2b 61 29 7b 76 61 72 20 69 3d 6e 5b 61 5d 3b 66 6f 72 28 76 61 72 20 63 20 69 6e 20 69 29 74 26 26 28 65 2b 3d 22 26 22 29 2c 74 3d 21 30 2c 65 2b 3d 63 2b 22 3d 22 2b 6f 28 69 5b 63 5d 2b 22 22 29 7d 72 65 74 75 72 6e 20 65 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 69 66 28 65 Data Ascii: var COMSCORE=function(e){function n(e,n,r){-1==e.indexOf("?")&&(e+="?");var t=!1;(-1!=e.indexOf("&")\|\|e.length-1>e.indexOf("?"))&&(t=!0);for(var a=0;a<n.length;++a){var i=n[a];for(var c in i)t&&(e+="&"),t=!0,e+=c+"="+o(i[c]+"")}return e=function(e,n){if(e

Timestamp	Bytes transferred	Direction	Data
2024-10-01 18:34:22 UTC	1353	OUT	POST /g/collect?v=2&tid=G-0JHQDSS37Y&gtm=45je49u0v9135786248za200&_p=1727807657763&_gaz=1&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101671035~101686685~101747727&cid=245393721.1727807661&ul=en-us&sr=1280x1024&ir=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&are=1&pae=1&frm=0&pscdl=noapi&_eu=EAAI&_s=1&sid=1727807661&sct=1&seg=0&dl=https%3A%2F%2Fbusinessemail.rediff.com%2Fdomain%3Fsc_cid%3Dpages-uc-domain-register%26ref%3Ddomain-registration-india&dt=Buy%20.com%2C%20.org%2C%20.in%20domains%20on%20Rediffmail%20for%20Work&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=9227 HTTP/1.1 Host: analytics.google.com Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://businessemail.rediff.com X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://businessemail.rediff.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-01 18:34:22 UTC	855	IN	HTTP/1.1 204 No Content Access-Control-Allow-Origin: https://businessemail.rediff.com Date: Tue, 01 Oct 2024 18:34:22 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Access-Control-Allow-Credentials: true Content-Type: text/plain Cross-Origin-Resource-Policy: cross-origin Content-Security-Policy-Report-Only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0 Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to=coop_reporting Report-To: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:136:0"}],} Server: Golfe2 Content-Length: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close