Windows Analysis Report
https://t.dripemail3.com/c/eyJhbGciOiJIUzI1NiJ9.eyJhdWQiOiJkZXRvdXIiLCJpc3MiOiJtb25vbGl0aCIsInN1YiI6ImRldG91cl9saW5rIiwiaWF0IjoxNzI4MzEwODA2LCJuYmYiOjE3MjgzMTA4MDYsImFjY291bnRfaWQiOiIyNzYyNjA5IiwiZGVsaXZlcnlfaWQiOiJwODJtNGNzMzB4cXl2Zmh0NzQxaSIsInRva2VuIjoicDgybTRjczMweHF5dmZodDc0MWkiLCJzZW5kX2F0Ijox

Overview

General Information

Sample URL:	https://t.dripemail3.com/c/eyJhbGciOiJIUzI1NiJ9.eyJhdWQiOiJkZXRvdXIiLCJpc3MiOiJtb25vbGl0aCIsInN1YiI6ImRldG91cl9saW5rIiwiaWF0IjoxNzI4MzEwODA2LCJuYmYiOjE3MjgzMTA4MDYsImFjY291bnRfaWQiOiIyNzYyNjA5IiwiZGVs
Analysis ID:	1528259
Infos:

Detection

HtmlDropper

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Antivirus / Scanner detection for submitted sample

Yara detected Html Dropper

Phishing site detected (based on favicon image match)

Phishing site detected (based on image similarity)

Phishing site detected (based on logo match)

Phishing site or detected (based on various text indicators)

HTML body contains low number of good links

HTML page contains hidden javascript code

HTML title does not match URL

Invalid 'sign-in options' or 'sign-up' link found

Invalid T&C link found

Stores files to the Windows start menu directory

Classification

Signatures

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://t.dripemail3.com/c/eyJhbGciOiJIUzI1NiJ9.eyJhdWQiOiJkZXRvdXIiLCJpc3MiOiJtb25vbGl0aCIsInN1YiI6ImRldG91cl9saW5rIiwiaWF0IjoxNzI4MzEwODA2LCJuYmYiOjE3MjgzMTA4MDYsImFjY291bnRfaWQiOiIyNzYyNjA5IiwiZGVsaXZlcnlfaWQiOiJwODJtNGNzMzB4cXl2Zmh0NzQxaSIsInRva2VuIjoicDgybTRjczMweHF5dmZodDc0MWkiLCJzZW5kX2F0IjoxNzI4MzA5NzMyLCJlbWFpbF9pZCI6OTk2NDE4NiwiZW1haWxhYmxlX3R5cGUiOiJCcm9hZGNhc3QiLCJlbWFpbGFibGVfaWQiOjM5NTQwMTYsInVybCI6Imh0dHBzOi8vZGFpbHlhbGFza2EuY29tL25ld3M_X19zPWw5bzljOTZzbG8xZjF3aGFiODZrJnV0bV9zb3VyY2U9ZHJpcCZ1dG1fbWVkaXVtPWVtYWlsJnV0bV9jYW1wYWlnbj0lRjAlOUYlOTElOEMrV2UrTWFkZStJdCtFYXN5K0ZvcitZb3UrJUYwJTlGJTkxJThDIn0.MNRoosOspCCWwx3VuYY41W-crcEzfjjfIELlO_QMAdM

SlashNext: detection malicious, Label: Credential Stealing type: Phishing & Social Engineering

Phishing

AI detected phishing page

Source: https://harmesmg.com/&redirect=467dbb71ea415b9eb4af299f337a08a557ae6ee7main&uid=f253efe302d32ab264a76e0ce65be769670404c116662

LLM: Score: 9 Reasons: The brand 'Microsoft' is a well-known global technology company., The legitimate domain for Microsoft is 'microsoft.com'., The provided URL 'harmesmg.com' does not match the legitimate domain for Microsoft., The URL 'harmesmg.com' does not contain any recognizable association with Microsoft., The presence of input fields for 'Email or phone' is typical for phishing attempts targeting Microsoft accounts., The domain 'harmesmg.com' appears unrelated to Microsoft and could be a potential phishing site. DOM: 0.3.pages.csv

Phishing site detected (based on favicon image match)

Source: https://harmesmg.com/	Matcher: Template: microsoft matched with high similarity
Source: https://harmesmg.com/&redirect=467dbb71ea415b9eb4af299f337a08a557ae6ee7main&uid=f253efe302d32ab264a76e0ce65be769670404c116662	Matcher: Template: microsoft matched with high similarity

Phishing site detected (based on image similarity)

Source: https://harmesmg.com/&redirect=467dbb71ea415b9eb4af299f337a08a557ae6ee7main&uid=f253efe302d32ab264a76e0ce65be769670404c116662

Matcher: Found strong image similarity, brand: MICROSOFT

Phishing site detected (based on logo match)

Source: https://harmesmg.com/&redirect=467dbb71ea415b9eb4af299f337a08a557ae6ee7main&uid=f253efe302d32ab264a76e0ce65be769670404c116662	Matcher: Template: microsoft matched
Source: https://harmesmg.com/&redirect=467dbb71ea415b9eb4af299f337a08a557ae6ee7main&uid=f253efe302d32ab264a76e0ce65be769670404c116662	Matcher: Template: microsoft matched

Phishing site or detected (based on various text indicators)

Source: Chrome DOM: 0.1	OCR Text: Verifying... CLOUDFLARE Ten-rs Microsoft
Source: Chrome DOM: 0.0	OCR Text: Verifying... CLOUDFLARE Ten-rs Microsoft

HTML body contains low number of good links

Source: https://harmesmg.com/&redirect=467dbb71ea415b9eb4af299f337a08a557ae6ee7main&uid=f253efe302d32ab264a76e0ce65be769670404c116662

HTTP Parser: Number of links: 0

HTML page contains hidden javascript code

Source: https://harmesmg.com/

HTTP Parser: Base64 decoded: {"version":3,"sources":["/cfsetup_build/src/orchestrator/turnstile/templates/turnstile.scss","%3Cinput%20css%20qtFLbZ%3E"],"names":[],"mappings":"AAmCA,gBACI,GACI,uBClCN,CACF,CDqCA,kBACI,GACI,mBCnCN,CACF,CDsCA,iBACI,MAEI,cCrCN,CDwCE,IACI,mBCtCN,CACF,CDyCA...

HTML title does not match URL

Source: https://harmesmg.com/&redirect=467dbb71ea415b9eb4af299f337a08a557ae6ee7main&uid=f253efe302d32ab264a76e0ce65be769670404c116662

HTTP Parser: Title: bce28becd7c63e8e2ec9b99d34f008d8670404c11662d does not match URL

Invalid 'sign-in options' or 'sign-up' link found

Source: https://harmesmg.com/&redirect=467dbb71ea415b9eb4af299f337a08a557ae6ee7main&uid=f253efe302d32ab264a76e0ce65be769670404c116662

HTTP Parser: Invalid link: get a new Microsoft account

Invalid T&C link found

Source: https://harmesmg.com/&redirect=467dbb71ea415b9eb4af299f337a08a557ae6ee7main&uid=f253efe302d32ab264a76e0ce65be769670404c116662	HTTP Parser: Invalid link: Terms of use
Source: https://harmesmg.com/&redirect=467dbb71ea415b9eb4af299f337a08a557ae6ee7main&uid=f253efe302d32ab264a76e0ce65be769670404c116662	HTTP Parser: Invalid link: Privacy & cookies
Source: https://harmesmg.com/&redirect=467dbb71ea415b9eb4af299f337a08a557ae6ee7main&uid=f253efe302d32ab264a76e0ce65be769670404c116662	HTTP Parser: Invalid link: Terms of use
Source: https://harmesmg.com/&redirect=467dbb71ea415b9eb4af299f337a08a557ae6ee7main&uid=f253efe302d32ab264a76e0ce65be769670404c116662	HTTP Parser: Invalid link: Privacy & cookies

Source: https://harmesmg.com/&redirect=467dbb71ea415b9eb4af299f337a08a557ae6ee7main&uid=f253efe302d32ab264a76e0ce65be769670404c116662	HTTP Parser: No <meta name="author".. found
Source: https://harmesmg.com/&redirect=467dbb71ea415b9eb4af299f337a08a557ae6ee7main&uid=f253efe302d32ab264a76e0ce65be769670404c116662	HTTP Parser: No <meta name="author".. found

Source: https://harmesmg.com/&redirect=467dbb71ea415b9eb4af299f337a08a557ae6ee7main&uid=f253efe302d32ab264a76e0ce65be769670404c116662	HTTP Parser: No <meta name="copyright".. found
Source: https://harmesmg.com/&redirect=467dbb71ea415b9eb4af299f337a08a557ae6ee7main&uid=f253efe302d32ab264a76e0ce65be769670404c116662	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49796 version: TLS 1.2

Source: chrome.exe

Memory has grown: Private usage: 26MB later: 36MB

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /c/eyJhbGciOiJIUzI1NiJ9.eyJhdWQiOiJkZXRvdXIiLCJpc3MiOiJtb25vbGl0aCIsInN1YiI6ImRldG91cl9saW5rIiwiaWF0IjoxNzI4MzEwODA2LCJuYmYiOjE3MjgzMTA4MDYsImFjY291bnRfaWQiOiIyNzYyNjA5IiwiZGVsaXZlcnlfaWQiOiJwODJtNGNzMzB4cXl2Zmh0NzQxaSIsInRva2VuIjoicDgybTRjczMweHF5dmZodDc0MWkiLCJzZW5kX2F0IjoxNzI4MzA5NzMyLCJlbWFpbF9pZCI6OTk2NDE4NiwiZW1haWxhYmxlX3R5cGUiOiJCcm9hZGNhc3QiLCJlbWFpbGFibGVfaWQiOjM5NTQwMTYsInVybCI6Imh0dHBzOi8vZGFpbHlhbGFza2EuY29tL25ld3M_X19zPWw5bzljOTZzbG8xZjF3aGFiODZrJnV0bV9zb3VyY2U9ZHJpcCZ1dG1fbWVkaXVtPWVtYWlsJnV0bV9jYW1wYWlnbj0lRjAlOUYlOTElOEMrV2UrTWFkZStJdCtFYXN5K0ZvcitZb3UrJUYwJTlGJTkxJThDIn0.MNRoosOspCCWwx3VuYY41W-crcEzfjjfIELlO_QMAdM HTTP/1.1Host: t.dripemail3.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /news?__s=l9o9c96slo1f1whab86k&utm_source=drip&utm_medium=email&utm_campaign=%F0%9F%91%8C+We+Made+It+Easy+For+You+%F0%9F%91%8C HTTP/1.1Host: dailyalaska.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /news/?__s=l9o9c96slo1f1whab86k&utm_source=drip&utm_medium=email&utm_campaign=%F0%9F%91%8C+We+Made+It+Easy+For+You+%F0%9F%91%8C HTTP/1.1Host: dailyalaska.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: harmesmg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://dailyalaska.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /captcha/style.css HTTP/1.1Host: harmesmg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://harmesmg.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=3799c4d50f12ef500b796d3f6ccc3ffa
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/api.js?render=explicit HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://harmesmg.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.6.0.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://harmesmg.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /captcha/logo.svg HTTP/1.1Host: harmesmg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://harmesmg.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=3799c4d50f12ef500b796d3f6ccc3ffa
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/g/ec4b873d446c/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://harmesmg.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.6.0.min.js HTTP/1.1Host: code.jquery.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /captcha/logo.svg HTTP/1.1Host: harmesmg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=3799c4d50f12ef500b796d3f6ccc3ffa
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=TeuEZyGPM7SSppK&MD=F5PkWHhV HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/c4rds/0x4AAAAAAAwkfvalCr0Ft9wJ/auto/fbE/normal/auto/ HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://harmesmg.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/g/ec4b873d446c/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=8cef14ec2b888c29&lang=auto HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/c4rds/0x4AAAAAAAwkfvalCr0Ft9wJ/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/cmg/1/wh0E0SXYnx6pTBdJW%2Fl926I%2BPRUplRdtQz3K9lHXs%2Fs%3D HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/c4rds/0x4AAAAAAAwkfvalCr0Ft9wJ/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/cmg/1/wh0E0SXYnx6pTBdJW%2Fl926I%2BPRUplRdtQz3K9lHXs%2Fs%3D HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=8cef14ec2b888c29&lang=auto HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/flow/ov1/593885740:1728315463:QEvZ1HiOoBQogM0yRR2m-igmMF_DCUtjMQMpy3zrY7g/8cef14ec2b888c29/ac3f70574c87d9b HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/pat/8cef14ec2b888c29/1728316593724/565d402329806b0e0b1bb81f496f43867780d73d369807fad6a60f01d771e0cb/F-bN9h4xjeTkyvK HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/c4rds/0x4AAAAAAAwkfvalCr0Ft9wJ/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/i/8cef14ec2b888c29/1728316593729/L9YnqAj51e-zh63 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/c4rds/0x4AAAAAAAwkfvalCr0Ft9wJ/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/i/8cef14ec2b888c29/1728316593729/L9YnqAj51e-zh63 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/flow/ov1/593885740:1728315463:QEvZ1HiOoBQogM0yRR2m-igmMF_DCUtjMQMpy3zrY7g/8cef14ec2b888c29/ac3f70574c87d9b HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/flow/ov1/593885740:1728315463:QEvZ1HiOoBQogM0yRR2m-igmMF_DCUtjMQMpy3zrY7g/8cef14ec2b888c29/ac3f70574c87d9b HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/rc/8cef14ec2b888c29 HTTP/1.1Host: harmesmg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=3799c4d50f12ef500b796d3f6ccc3ffa
Source: global traffic	HTTP traffic detected: GET /VkZ6ZVFsa1A0REpranpmrobotVkZ6ZVFsa1A0REpranpm HTTP/1.1Host: harmesmg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=3799c4d50f12ef500b796d3f6ccc3ffa
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: harmesmg.comConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://harmesmg.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=3799c4d50f12ef500b796d3f6ccc3ffa; cf_clearance=4phD4d0nAz2cvuMhVTqfRjZplh5XgKm6ImXH14CzkOQ-1728316605-1.2.1.1-O.PvMpDW6Wd_J2BKHwMR3czuZCsB7KPvODQx4sG1cc8i5XokNul7mRE2ifDtDFlr0slbx0tWrljT_uT1jHxHlz_0bZwGUKIiPZLKKZWAWfE.qFmEk25SpbNzL5CBcn5JiakkZyMlXcZIbLQoCrwHcTlj3k_INxUrunrh5jO_TQSykzK34rPAgB7eGQiPultpOsLm9Uhv843waRJvBsHx046_.UID701tD4TP7v_ucTvovLRk7Cgm984.592Mqa.BytbneMbvpA6PtCqCqjNylKnZDPOHQ0f9zhxU_ZSfOA4Wzg8mKUqTVA61DlHFlJ4CgND.F3OznLFfZGV4WDLFVY7Qo8StYxbUvEeYJWDKvE8nFm1CeL8Gx9OZo3HzedMtgnGoQv_282Ak.BLNcTWwugpM6x9T3F11gcfXJ_GhKYjw6TO7cZHYVVhLUU7Ycn9X
Source: global traffic	HTTP traffic detected: GET /&redirect=467dbb71ea415b9eb4af299f337a08a557ae6ee7main&uid=f253efe302d32ab264a76e0ce65be769670404c116662 HTTP/1.1Host: harmesmg.comConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://harmesmg.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=3799c4d50f12ef500b796d3f6ccc3ffa; cf_clearance=4phD4d0nAz2cvuMhVTqfRjZplh5XgKm6ImXH14CzkOQ-1728316605-1.2.1.1-O.PvMpDW6Wd_J2BKHwMR3czuZCsB7KPvODQx4sG1cc8i5XokNul7mRE2ifDtDFlr0slbx0tWrljT_uT1jHxHlz_0bZwGUKIiPZLKKZWAWfE.qFmEk25SpbNzL5CBcn5JiakkZyMlXcZIbLQoCrwHcTlj3k_INxUrunrh5jO_TQSykzK34rPAgB7eGQiPultpOsLm9Uhv843waRJvBsHx046_.UID701tD4TP7v_ucTvovLRk7Cgm984.592Mqa.BytbneMbvpA6PtCqCqjNylKnZDPOHQ0f9zhxU_ZSfOA4Wzg8mKUqTVA61DlHFlJ4CgND.F3OznLFfZGV4WDLFVY7Qo8StYxbUvEeYJWDKvE8nFm1CeL8Gx9OZo3HzedMtgnGoQv_282Ak.BLNcTWwugpM6x9T3F11gcfXJ_GhKYjw6TO7cZHYVVhLUU7Ycn9X
Source: global traffic	HTTP traffic detected: GET /js___/670404c158f86-62ba4cbda984ea2df3057eb8390e0d8c HTTP/1.1Host: harmesmg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://harmesmg.com/&redirect=467dbb71ea415b9eb4af299f337a08a557ae6ee7main&uid=f253efe302d32ab264a76e0ce65be769670404c116662Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=3799c4d50f12ef500b796d3f6ccc3ffa; cf_clearance=4phD4d0nAz2cvuMhVTqfRjZplh5XgKm6ImXH14CzkOQ-1728316605-1.2.1.1-O.PvMpDW6Wd_J2BKHwMR3czuZCsB7KPvODQx4sG1cc8i5XokNul7mRE2ifDtDFlr0slbx0tWrljT_uT1jHxHlz_0bZwGUKIiPZLKKZWAWfE.qFmEk25SpbNzL5CBcn5JiakkZyMlXcZIbLQoCrwHcTlj3k_INxUrunrh5jO_TQSykzK34rPAgB7eGQiPultpOsLm9Uhv843waRJvBsHx046_.UID701tD4TP7v_ucTvovLRk7Cgm984.592Mqa.BytbneMbvpA6PtCqCqjNylKnZDPOHQ0f9zhxU_ZSfOA4Wzg8mKUqTVA61DlHFlJ4CgND.F3OznLFfZGV4WDLFVY7Qo8StYxbUvEeYJWDKvE8nFm1CeL8Gx9OZo3HzedMtgnGoQv_282Ak.BLNcTWwugpM6x9T3F11gcfXJ_GhKYjw6TO7cZHYVVhLUU7Ycn9X
Source: global traffic	HTTP traffic detected: GET /b_/670404c158f8d-62ba4cbda984ea2df3057eb8390e0d8c HTTP/1.1Host: harmesmg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://harmesmg.com/&redirect=467dbb71ea415b9eb4af299f337a08a557ae6ee7main&uid=f253efe302d32ab264a76e0ce65be769670404c116662Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=3799c4d50f12ef500b796d3f6ccc3ffa; cf_clearance=4phD4d0nAz2cvuMhVTqfRjZplh5XgKm6ImXH14CzkOQ-1728316605-1.2.1.1-O.PvMpDW6Wd_J2BKHwMR3czuZCsB7KPvODQx4sG1cc8i5XokNul7mRE2ifDtDFlr0slbx0tWrljT_uT1jHxHlz_0bZwGUKIiPZLKKZWAWfE.qFmEk25SpbNzL5CBcn5JiakkZyMlXcZIbLQoCrwHcTlj3k_INxUrunrh5jO_TQSykzK34rPAgB7eGQiPultpOsLm9Uhv843waRJvBsHx046_.UID701tD4TP7v_ucTvovLRk7Cgm984.592Mqa.BytbneMbvpA6PtCqCqjNylKnZDPOHQ0f9zhxU_ZSfOA4Wzg8mKUqTVA61DlHFlJ4CgND.F3OznLFfZGV4WDLFVY7Qo8StYxbUvEeYJWDKvE8nFm1CeL8Gx9OZo3HzedMtgnGoQv_282Ak.BLNcTWwugpM6x9T3F11gcfXJ_GhKYjw6TO7cZHYVVhLUU7Ycn9X
Source: global traffic	HTTP traffic detected: GET /js_/670404c158f8e-62ba4cbda984ea2df3057eb8390e0d8c HTTP/1.1Host: harmesmg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://harmesmg.com/&redirect=467dbb71ea415b9eb4af299f337a08a557ae6ee7main&uid=f253efe302d32ab264a76e0ce65be769670404c116662Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=3799c4d50f12ef500b796d3f6ccc3ffa; cf_clearance=4phD4d0nAz2cvuMhVTqfRjZplh5XgKm6ImXH14CzkOQ-1728316605-1.2.1.1-O.PvMpDW6Wd_J2BKHwMR3czuZCsB7KPvODQx4sG1cc8i5XokNul7mRE2ifDtDFlr0slbx0tWrljT_uT1jHxHlz_0bZwGUKIiPZLKKZWAWfE.qFmEk25SpbNzL5CBcn5JiakkZyMlXcZIbLQoCrwHcTlj3k_INxUrunrh5jO_TQSykzK34rPAgB7eGQiPultpOsLm9Uhv843waRJvBsHx046_.UID701tD4TP7v_ucTvovLRk7Cgm984.592Mqa.BytbneMbvpA6PtCqCqjNylKnZDPOHQ0f9zhxU_ZSfOA4Wzg8mKUqTVA61DlHFlJ4CgND.F3OznLFfZGV4WDLFVY7Qo8StYxbUvEeYJWDKvE8nFm1CeL8Gx9OZo3HzedMtgnGoQv_282Ak.BLNcTWwugpM6x9T3F11gcfXJ_GhKYjw6TO7cZHYVVhLUU7Ycn9X
Source: global traffic	HTTP traffic detected: GET /js_/670404c158f8e-62ba4cbda984ea2df3057eb8390e0d8c HTTP/1.1Host: harmesmg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=3799c4d50f12ef500b796d3f6ccc3ffa
Source: global traffic	HTTP traffic detected: GET /js___/670404c158f86-62ba4cbda984ea2df3057eb8390e0d8c HTTP/1.1Host: harmesmg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=3799c4d50f12ef500b796d3f6ccc3ffa
Source: global traffic	HTTP traffic detected: GET /b_/670404c158f8d-62ba4cbda984ea2df3057eb8390e0d8c HTTP/1.1Host: harmesmg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=3799c4d50f12ef500b796d3f6ccc3ffa
Source: global traffic	HTTP traffic detected: GET /home6dca65610bad709b07a9e6041699d6ce HTTP/1.1Host: harmesmg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://harmesmg.com/&redirect=467dbb71ea415b9eb4af299f337a08a557ae6ee7main&uid=f253efe302d32ab264a76e0ce65be769670404c116662Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=3799c4d50f12ef500b796d3f6ccc3ffa; cf_clearance=4phD4d0nAz2cvuMhVTqfRjZplh5XgKm6ImXH14CzkOQ-1728316605-1.2.1.1-O.PvMpDW6Wd_J2BKHwMR3czuZCsB7KPvODQx4sG1cc8i5XokNul7mRE2ifDtDFlr0slbx0tWrljT_uT1jHxHlz_0bZwGUKIiPZLKKZWAWfE.qFmEk25SpbNzL5CBcn5JiakkZyMlXcZIbLQoCrwHcTlj3k_INxUrunrh5jO_TQSykzK34rPAgB7eGQiPultpOsLm9Uhv843waRJvBsHx046_.UID701tD4TP7v_ucTvovLRk7Cgm984.592Mqa.BytbneMbvpA6PtCqCqjNylKnZDPOHQ0f9zhxU_ZSfOA4Wzg8mKUqTVA61DlHFlJ4CgND.F3OznLFfZGV4WDLFVY7Qo8StYxbUvEeYJWDKvE8nFm1CeL8Gx9OZo3HzedMtgnGoQv_282Ak.BLNcTWwugpM6x9T3F11gcfXJ_GhKYjw6TO7cZHYVVhLUU7Ycn9X
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: harmesmg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://harmesmg.com/&redirect=467dbb71ea415b9eb4af299f337a08a557ae6ee7main&uid=f253efe302d32ab264a76e0ce65be769670404c116662Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=3799c4d50f12ef500b796d3f6ccc3ffa; cf_clearance=4phD4d0nAz2cvuMhVTqfRjZplh5XgKm6ImXH14CzkOQ-1728316605-1.2.1.1-O.PvMpDW6Wd_J2BKHwMR3czuZCsB7KPvODQx4sG1cc8i5XokNul7mRE2ifDtDFlr0slbx0tWrljT_uT1jHxHlz_0bZwGUKIiPZLKKZWAWfE.qFmEk25SpbNzL5CBcn5JiakkZyMlXcZIbLQoCrwHcTlj3k_INxUrunrh5jO_TQSykzK34rPAgB7eGQiPultpOsLm9Uhv843waRJvBsHx046_.UID701tD4TP7v_ucTvovLRk7Cgm984.592Mqa.BytbneMbvpA6PtCqCqjNylKnZDPOHQ0f9zhxU_ZSfOA4Wzg8mKUqTVA61DlHFlJ4CgND.F3OznLFfZGV4WDLFVY7Qo8StYxbUvEeYJWDKvE8nFm1CeL8Gx9OZo3HzedMtgnGoQv_282Ak.BLNcTWwugpM6x9T3F11gcfXJ_GhKYjw6TO7cZHYVVhLUU7Ycn9X
Source: global traffic	HTTP traffic detected: GET /home6dca65610bad709b07a9e6041699d6ce HTTP/1.1Host: harmesmg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=3799c4d50f12ef500b796d3f6ccc3ffa
Source: global traffic	HTTP traffic detected: GET /css_/Bk0skH0VKnC5GQh HTTP/1.1Host: harmesmg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://harmesmg.com/&redirect=467dbb71ea415b9eb4af299f337a08a557ae6ee7main&uid=f253efe302d32ab264a76e0ce65be769670404c116662Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=3799c4d50f12ef500b796d3f6ccc3ffa; cf_clearance=4phD4d0nAz2cvuMhVTqfRjZplh5XgKm6ImXH14CzkOQ-1728316605-1.2.1.1-O.PvMpDW6Wd_J2BKHwMR3czuZCsB7KPvODQx4sG1cc8i5XokNul7mRE2ifDtDFlr0slbx0tWrljT_uT1jHxHlz_0bZwGUKIiPZLKKZWAWfE.qFmEk25SpbNzL5CBcn5JiakkZyMlXcZIbLQoCrwHcTlj3k_INxUrunrh5jO_TQSykzK34rPAgB7eGQiPultpOsLm9Uhv843waRJvBsHx046_.UID701tD4TP7v_ucTvovLRk7Cgm984.592Mqa.BytbneMbvpA6PtCqCqjNylKnZDPOHQ0f9zhxU_ZSfOA4Wzg8mKUqTVA61DlHFlJ4CgND.F3OznLFfZGV4WDLFVY7Qo8StYxbUvEeYJWDKvE8nFm1CeL8Gx9OZo3HzedMtgnGoQv_282Ak.BLNcTWwugpM6x9T3F11gcfXJ_GhKYjw6TO7cZHYVVhLUU7Ycn9X
Source: global traffic	HTTP traffic detected: GET /fav/s9G0tr0IOlyQ1oA HTTP/1.1Host: harmesmg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://harmesmg.com/&redirect=467dbb71ea415b9eb4af299f337a08a557ae6ee7main&uid=f253efe302d32ab264a76e0ce65be769670404c116662Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=3799c4d50f12ef500b796d3f6ccc3ffa; cf_clearance=4phD4d0nAz2cvuMhVTqfRjZplh5XgKm6ImXH14CzkOQ-1728316605-1.2.1.1-O.PvMpDW6Wd_J2BKHwMR3czuZCsB7KPvODQx4sG1cc8i5XokNul7mRE2ifDtDFlr0slbx0tWrljT_uT1jHxHlz_0bZwGUKIiPZLKKZWAWfE.qFmEk25SpbNzL5CBcn5JiakkZyMlXcZIbLQoCrwHcTlj3k_INxUrunrh5jO_TQSykzK34rPAgB7eGQiPultpOsLm9Uhv843waRJvBsHx046_.UID701tD4TP7v_ucTvovLRk7Cgm984.592Mqa.BytbneMbvpA6PtCqCqjNylKnZDPOHQ0f9zhxU_ZSfOA4Wzg8mKUqTVA61DlHFlJ4CgND.F3OznLFfZGV4WDLFVY7Qo8StYxbUvEeYJWDKvE8nFm1CeL8Gx9OZo3HzedMtgnGoQv_282Ak.BLNcTWwugpM6x9T3F11gcfXJ_GhKYjw6TO7cZHYVVhLUU7Ycn9X
Source: global traffic	HTTP traffic detected: GET /logo_/Cb8v7L0xnbUZCJD HTTP/1.1Host: harmesmg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://harmesmg.com/&redirect=467dbb71ea415b9eb4af299f337a08a557ae6ee7main&uid=f253efe302d32ab264a76e0ce65be769670404c116662Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=3799c4d50f12ef500b796d3f6ccc3ffa; cf_clearance=4phD4d0nAz2cvuMhVTqfRjZplh5XgKm6ImXH14CzkOQ-1728316605-1.2.1.1-O.PvMpDW6Wd_J2BKHwMR3czuZCsB7KPvODQx4sG1cc8i5XokNul7mRE2ifDtDFlr0slbx0tWrljT_uT1jHxHlz_0bZwGUKIiPZLKKZWAWfE.qFmEk25SpbNzL5CBcn5JiakkZyMlXcZIbLQoCrwHcTlj3k_INxUrunrh5jO_TQSykzK34rPAgB7eGQiPultpOsLm9Uhv843waRJvBsHx046_.UID701tD4TP7v_ucTvovLRk7Cgm984.592Mqa.BytbneMbvpA6PtCqCqjNylKnZDPOHQ0f9zhxU_ZSfOA4Wzg8mKUqTVA61DlHFlJ4CgND.F3OznLFfZGV4WDLFVY7Qo8StYxbUvEeYJWDKvE8nFm1CeL8Gx9OZo3HzedMtgnGoQv_282Ak.BLNcTWwugpM6x9T3F11gcfXJ_GhKYjw6TO7cZHYVVhLUU7Ycn9X
Source: global traffic	HTTP traffic detected: GET /logo_/68ae214891024d21f46f0db6cb776026670404c42b8ef HTTP/1.1Host: harmesmg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://harmesmg.com/&redirect=467dbb71ea415b9eb4af299f337a08a557ae6ee7main&uid=f253efe302d32ab264a76e0ce65be769670404c116662Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=3799c4d50f12ef500b796d3f6ccc3ffa; cf_clearance=4phD4d0nAz2cvuMhVTqfRjZplh5XgKm6ImXH14CzkOQ-1728316605-1.2.1.1-O.PvMpDW6Wd_J2BKHwMR3czuZCsB7KPvODQx4sG1cc8i5XokNul7mRE2ifDtDFlr0slbx0tWrljT_uT1jHxHlz_0bZwGUKIiPZLKKZWAWfE.qFmEk25SpbNzL5CBcn5JiakkZyMlXcZIbLQoCrwHcTlj3k_INxUrunrh5jO_TQSykzK34rPAgB7eGQiPultpOsLm9Uhv843waRJvBsHx046_.UID701tD4TP7v_ucTvovLRk7Cgm984.592Mqa.BytbneMbvpA6PtCqCqjNylKnZDPOHQ0f9zhxU_ZSfOA4Wzg8mKUqTVA61DlHFlJ4CgND.F3OznLFfZGV4WDLFVY7Qo8StYxbUvEeYJWDKvE8nFm1CeL8Gx9OZo3HzedMtgnGoQv_282Ak.BLNcTWwugpM6x9T3F11gcfXJ_GhKYjw6TO7cZHYVVhLUU7Ycn9X
Source: global traffic	HTTP traffic detected: GET /sig/68ae214891024d21f46f0db6cb776026670404c42b933 HTTP/1.1Host: harmesmg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://harmesmg.com/&redirect=467dbb71ea415b9eb4af299f337a08a557ae6ee7main&uid=f253efe302d32ab264a76e0ce65be769670404c116662Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=3799c4d50f12ef500b796d3f6ccc3ffa; cf_clearance=4phD4d0nAz2cvuMhVTqfRjZplh5XgKm6ImXH14CzkOQ-1728316605-1.2.1.1-O.PvMpDW6Wd_J2BKHwMR3czuZCsB7KPvODQx4sG1cc8i5XokNul7mRE2ifDtDFlr0slbx0tWrljT_uT1jHxHlz_0bZwGUKIiPZLKKZWAWfE.qFmEk25SpbNzL5CBcn5JiakkZyMlXcZIbLQoCrwHcTlj3k_INxUrunrh5jO_TQSykzK34rPAgB7eGQiPultpOsLm9Uhv843waRJvBsHx046_.UID701tD4TP7v_ucTvovLRk7Cgm984.592Mqa.BytbneMbvpA6PtCqCqjNylKnZDPOHQ0f9zhxU_ZSfOA4Wzg8mKUqTVA61DlHFlJ4CgND.F3OznLFfZGV4WDLFVY7Qo8StYxbUvEeYJWDKvE8nFm1CeL8Gx9OZo3HzedMtgnGoQv_282Ak.BLNcTWwugpM6x9T3F11gcfXJ_GhKYjw6TO7cZHYVVhLUU7Ycn9X
Source: global traffic	HTTP traffic detected: GET /%3C?php%20echo%20SVGBKG;%20?%3E HTTP/1.1Host: harmesmg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://harmesmg.com/&redirect=467dbb71ea415b9eb4af299f337a08a557ae6ee7main&uid=f253efe302d32ab264a76e0ce65be769670404c116662Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=3799c4d50f12ef500b796d3f6ccc3ffa; cf_clearance=4phD4d0nAz2cvuMhVTqfRjZplh5XgKm6ImXH14CzkOQ-1728316605-1.2.1.1-O.PvMpDW6Wd_J2BKHwMR3czuZCsB7KPvODQx4sG1cc8i5XokNul7mRE2ifDtDFlr0slbx0tWrljT_uT1jHxHlz_0bZwGUKIiPZLKKZWAWfE.qFmEk25SpbNzL5CBcn5JiakkZyMlXcZIbLQoCrwHcTlj3k_INxUrunrh5jO_TQSykzK34rPAgB7eGQiPultpOsLm9Uhv843waRJvBsHx046_.UID701tD4TP7v_ucTvovLRk7Cgm984.592Mqa.BytbneMbvpA6PtCqCqjNylKnZDPOHQ0f9zhxU_ZSfOA4Wzg8mKUqTVA61DlHFlJ4CgND.F3OznLFfZGV4WDLFVY7Qo8StYxbUvEeYJWDKvE8nFm1CeL8Gx9OZo3HzedMtgnGoQv_282Ak.BLNcTWwugpM6x9T3F11gcfXJ_GhKYjw6TO7cZHYVVhLUU7Ycn9X
Source: global traffic	HTTP traffic detected: GET /logo_/Cb8v7L0xnbUZCJD HTTP/1.1Host: harmesmg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=3799c4d50f12ef500b796d3f6ccc3ffa
Source: global traffic	HTTP traffic detected: GET /sig/68ae214891024d21f46f0db6cb776026670404c42b933 HTTP/1.1Host: harmesmg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=3799c4d50f12ef500b796d3f6ccc3ffa
Source: global traffic	HTTP traffic detected: GET /logo_/68ae214891024d21f46f0db6cb776026670404c42b8ef HTTP/1.1Host: harmesmg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=3799c4d50f12ef500b796d3f6ccc3ffa
Source: global traffic	HTTP traffic detected: GET /fav/s9G0tr0IOlyQ1oA HTTP/1.1Host: harmesmg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=3799c4d50f12ef500b796d3f6ccc3ffa
Source: global traffic	HTTP traffic detected: GET /endpoint2c12176623711ee3913b50a64a6de7cesec?data=mail&email=hgjhghjgjh%40aol.com&_=1728316610376 HTTP/1.1Host: harmesmg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: application/json, text/javascript, /; q=0.01X-Requested-With: XMLHttpRequestsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://harmesmg.com/&redirect=467dbb71ea415b9eb4af299f337a08a557ae6ee7main&uid=f253efe302d32ab264a76e0ce65be769670404c116662Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=3799c4d50f12ef500b796d3f6ccc3ffa; cf_clearance=4phD4d0nAz2cvuMhVTqfRjZplh5XgKm6ImXH14CzkOQ-1728316605-1.2.1.1-O.PvMpDW6Wd_J2BKHwMR3czuZCsB7KPvODQx4sG1cc8i5XokNul7mRE2ifDtDFlr0slbx0tWrljT_uT1jHxHlz_0bZwGUKIiPZLKKZWAWfE.qFmEk25SpbNzL5CBcn5JiakkZyMlXcZIbLQoCrwHcTlj3k_INxUrunrh5jO_TQSykzK34rPAgB7eGQiPultpOsLm9Uhv843waRJvBsHx046_.UID701tD4TP7v_ucTvovLRk7Cgm984.592Mqa.BytbneMbvpA6PtCqCqjNylKnZDPOHQ0f9zhxU_ZSfOA4Wzg8mKUqTVA61DlHFlJ4CgND.F3OznLFfZGV4WDLFVY7Qo8StYxbUvEeYJWDKvE8nFm1CeL8Gx9OZo3HzedMtgnGoQv_282Ak.BLNcTWwugpM6x9T3F11gcfXJ_GhKYjw6TO7cZHYVVhLUU7Ycn9X
Source: global traffic	HTTP traffic detected: GET /endpoint2c12176623711ee3913b50a64a6de7cesec?data=mail&email=hgjhghjgjh%40aol.com&_=1728316610376 HTTP/1.1Host: harmesmg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=3799c4d50f12ef500b796d3f6ccc3ffa
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=TeuEZyGPM7SSppK&MD=F5PkWHhV HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: global traffic	DNS traffic detected: DNS query: t.dripemail3.com
Source: global traffic	DNS traffic detected: DNS query: dailyalaska.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: google.com
Source: global traffic	DNS traffic detected: DNS query: harmesmg.com
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com

Source: unknown

HTTP traffic detected: POST /cdn-cgi/challenge-platform/h/g/flow/ov1/593885740:1728315463:QEvZ1HiOoBQogM0yRR2m-igmMF_DCUtjMQMpy3zrY7g/8cef14ec2b888c29/ac3f70574c87d9b HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveContent-Length: 2680sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Content-type: application/x-www-form-urlencodedsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36CF-Challenge: ac3f70574c87d9bsec-ch-ua-platform: "Windows"Accept: */*Origin: https://challenges.cloudflare.comSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/c4rds/0x4AAAAAAAwkfvalCr0Ft9wJ/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 07 Oct 2024 15:56:34 GMTContent-Type: application/jsonContent-Length: 7Connection: closecf-chl-out: GwjVgR5K+D1SBdULZsotBJAnLzEaw1weSXU=$mnxFv6EGi8NJNi1Ccache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0Server: cloudflareCF-RAY: 8cef14fe0c5b1a13-EWR
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 07 Oct 2024 15:56:37 GMTContent-Type: application/jsonContent-Length: 7Connection: closecf-chl-out: e7dnZfCCMpTK/BmqIWTkhPIyCZrgDQEacgE=$USW3iaBOFRTFqSExcache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0Server: cloudflareCF-RAY: 8cef1510cde342c9-EWR
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 07 Oct 2024 15:56:45 GMTContent-Type: application/jsonContent-Length: 7Connection: closecf-chl-out: UsdjPpy6HR1dMBtz1hF4bs3rpL2Bo3ZNIuk=$Z78Srt2cWkj7Tc+tcache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0Server: cloudflareCF-RAY: 8cef153efac417bd-EWR
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 07 Oct 2024 15:56:46 GMTContent-Type: application/jsonContent-Length: 7Connection: closecf-chl-out: lbl0oLB+XnBq54356QOzDC98pC+yJ7us7pc=$Ar8J7YK3Q44mRZKTcache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nIcguF3VCMyMrhdkg8LIxJaJYb9Udub%2FU4jCXc48pGARZQ70IjFLyCW89F5PuGYPyJkufHCvEecKjtXBce3BKubnRYskwwhkeXtX%2FbmK00k9OehMLd1Yvi3vqigxxR0%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8cef1545be5a8ce3-EWR
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 07 Oct 2024 15:56:52 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachex-turbo-charged-by: LiteSpeedCF-Cache-Status: BYPASSReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6FWCw2EdLcdwhrUGc3oJZ7K19nT5YGdTxtdOi6WM58t0cRtAHUXzr7XP8qLR61xILn2grEOcevTh0iSkfEbygyjrkEjfYaInKjJEgFkfPTux0GAp%2FFRx2Y2t5f2d9%2Bs%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Speculation-Rules: "/cdn-cgi/speculation"Server: cloudflareCF-RAY: 8cef15696d427ca8-EWR
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 07 Oct 2024 15:56:54 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachex-turbo-charged-by: LiteSpeedcf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Dle%2FZtd9QHIh4fpIAnNFnGPGDa8iI9UoSxbc4Rz7%2BxE6dkXco3ZOMGaRniqG99zYObOHMty1bv%2BGaGr8MST6Q8k5i3ZxNZdkAxKnVKSltL0J8nF%2BuIw6VmlwDmCQgfg%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Speculation-Rules: "/cdn-cgi/speculation"Server: cloudflareCF-RAY: 8cef15746c9343df-EWR

Source: chromecache_97.1.dr, chromecache_98.1.dr	String found in binary or memory: https://getbootstrap.com/)
Source: chromecache_97.1.dr, chromecache_98.1.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: chromecache_97.1.dr, chromecache_98.1.dr	String found in binary or memory: https://github.com/twbs/bootstrap/graphs/contributors)
Source: chromecache_83.1.dr	String found in binary or memory: https://google.com
Source: chromecache_83.1.dr	String found in binary or memory: https://harmesmg.com

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49796 version: TLS 1.2

Source: classification engine

Classification label: mal80.phis.troj.win@23/52@28/12

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1840,i,10789607078351078241,3572493302472614712,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://t.dripemail3.com/c/eyJhbGciOiJIUzI1NiJ9.eyJhdWQiOiJkZXRvdXIiLCJpc3MiOiJtb25vbGl0aCIsInN1YiI6ImRldG91cl9saW5rIiwiaWF0IjoxNzI4MzEwODA2LCJuYmYiOjE3MjgzMTA4MDYsImFjY291bnRfaWQiOiIyNzYyNjA5IiwiZGVsaXZlcnlfaWQiOiJwODJtNGNzMzB4cXl2Zmh0NzQxaSIsInRva2VuIjoicDgybTRjczMweHF5dmZodDc0MWkiLCJzZW5kX2F0IjoxNzI4MzA5NzMyLCJlbWFpbF9pZCI6OTk2NDE4NiwiZW1haWxhYmxlX3R5cGUiOiJCcm9hZGNhc3QiLCJlbWFpbGFibGVfaWQiOjM5NTQwMTYsInVybCI6Imh0dHBzOi8vZGFpbHlhbGFza2EuY29tL25ld3M_X19zPWw5bzljOTZzbG8xZjF3aGFiODZrJnV0bV9zb3VyY2U9ZHJpcCZ1dG1fbWVkaXVtPWVtYWlsJnV0bV9jYW1wYWlnbj0lRjAlOUYlOTElOEMrV2UrTWFkZStJdCtFYXN5K0ZvcitZb3UrJUYwJTlGJTkxJThDIn0.MNRoosOspCCWwx3VuYY41W-crcEzfjjfIELlO_QMAdM"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1840,i,10789607078351078241,3572493302472614712,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Data Obfuscation

Yara detected Html Dropper

Source: Yara match	File source: 0.3.pages.csv, type: HTML
Source: Yara match	File source: 0.4.pages.csv, type: HTML

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.217.18.4	www.google.com	United States	15169	GOOGLEUS	false
104.18.94.41	unknown	United States	13335	CLOUDFLARENETUS	false
104.18.95.41	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
104.21.23.186	harmesmg.com	United States	13335	CLOUDFLARENETUS	true
216.58.206.68	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.67.212.190	unknown	United States	13335	CLOUDFLARENETUS	false
151.101.194.137	code.jquery.com	United States	54113	FASTLYUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
162.241.114.35	dailyalaska.com	United States	46606	UNIFIEDLAYER-AS-1US	false
23.22.106.69	t.dripemail3.com	United States	14618	AMAZON-AESUS	false

Private

IP
192.168.2.16

Contacted Domains

Name	IP	Active
t.dripemail3.com	23.22.106.69	true
harmesmg.com	104.21.23.186	true
google.com	142.250.74.206	true
a.nel.cloudflare.com	35.190.80.1	true
dailyalaska.com	162.241.114.35	true
code.jquery.com	151.101.194.137	true
challenges.cloudflare.com	104.18.95.41	true
www.google.com	172.217.18.4	true

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://dailyalaska.com/news/?__s=l9o9c96slo1f1whab86k&utm_source=drip&utm_medium=email&utm_campaign=%F0%9F%91%8C+We+Made+It+Easy+For+You+%F0%9F%91%8C	false		unknown
https://challenges.cloudflare.com/turnstile/v0/g/ec4b873d446c/api.js	false		unknown
https://code.jquery.com/jquery-3.6.0.min.js	false	URL Reputation: safe	unknown
https://harmesmg.com/js_/670404c158f8e-62ba4cbda984ea2df3057eb8390e0d8c	true		unknown
https://harmesmg.com/css_/Bk0skH0VKnC5GQh	true		unknown
https://harmesmg.com/home6dca65610bad709b07a9e6041699d6ce	true		unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/flow/ov1/593885740:1728315463:QEvZ1HiOoBQogM0yRR2m-igmMF_DCUtjMQMpy3zrY7g/8cef14ec2b888c29/ac3f70574c87d9b	false		unknown
https://harmesmg.com/%3C?php%20echo%20SVGBKG;%20?%3E	true		unknown
https://harmesmg.com/&redirect=467dbb71ea415b9eb4af299f337a08a557ae6ee7main&uid=f253efe302d32ab264a76e0ce65be769670404c116662	true		unknown
https://harmesmg.com/js___/670404c158f86-62ba4cbda984ea2df3057eb8390e0d8c	true		unknown
https://a.nel.cloudflare.com/report/v4?s=j89aznBYGZX%2FKVwQ8TaxuNNXG5lFd7Mw%2F6l93XhoiY2P8Vjg6n%2B7cFuEOlx04%2F4xsiP8ofaA1%2BlNE3CG8BailTGska1y5ZEq1h7X7npWp3iLKAIkXLLk%2Bbr%2BlGW4vDU%3D	false		unknown
https://t.dripemail3.com/c/eyJhbGciOiJIUzI1NiJ9.eyJhdWQiOiJkZXRvdXIiLCJpc3MiOiJtb25vbGl0aCIsInN1YiI6ImRldG91cl9saW5rIiwiaWF0IjoxNzI4MzEwODA2LCJuYmYiOjE3MjgzMTA4MDYsImFjY291bnRfaWQiOiIyNzYyNjA5IiwiZGVsaXZlcnlfaWQiOiJwODJtNGNzMzB4cXl2Zmh0NzQxaSIsInRva2VuIjoicDgybTRjczMweHF5dmZodDc0MWkiLCJzZW5kX2F0IjoxNzI4MzA5NzMyLCJlbWFpbF9pZCI6OTk2NDE4NiwiZW1haWxhYmxlX3R5cGUiOiJCcm9hZGNhc3QiLCJlbWFpbGFibGVfaWQiOjM5NTQwMTYsInVybCI6Imh0dHBzOi8vZGFpbHlhbGFza2EuY29tL25ld3M_X19zPWw5bzljOTZzbG8xZjF3aGFiODZrJnV0bV9zb3VyY2U9ZHJpcCZ1dG1fbWVkaXVtPWVtYWlsJnV0bV9jYW1wYWlnbj0lRjAlOUYlOTElOEMrV2UrTWFkZStJdCtFYXN5K0ZvcitZb3UrJUYwJTlGJTkxJThDIn0.MNRoosOspCCWwx3VuYY41W-crcEzfjjfIELlO_QMAdM	true		unknown
https://harmesmg.com/captcha/style.css	true		unknown
https://harmesmg.com/captcha/logo.svg	true		unknown
https://harmesmg.com/cdn-cgi/challenge-platform/h/g/rc/8cef14ec2b888c29	true		unknown
https://harmesmg.com/logo_/68ae214891024d21f46f0db6cb776026670404c42b8ef	true		unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=8cef14ec2b888c29&lang=auto	false		unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/pat/8cef14ec2b888c29/1728316593724/565d402329806b0e0b1bb81f496f43867780d73d369807fad6a60f01d771e0cb/F-bN9h4xjeTkyvK	false		unknown
https://harmesmg.com/favicon.ico	true		unknown
https://a.nel.cloudflare.com/report/v4?s=nIcguF3VCMyMrhdkg8LIxJaJYb9Udub%2FU4jCXc48pGARZQ70IjFLyCW89F5PuGYPyJkufHCvEecKjtXBce3BKubnRYskwwhkeXtX%2FbmK00k9OehMLd1Yvi3vqigxxR0%3D	false		unknown
https://harmesmg.com/sig/68ae214891024d21f46f0db6cb776026670404c42b933	true		unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/i/8cef14ec2b888c29/1728316593729/L9YnqAj51e-zh63	false		unknown
https://dailyalaska.com/news?__s=l9o9c96slo1f1whab86k&utm_source=drip&utm_medium=email&utm_campaign=%F0%9F%91%8C+We+Made+It+Easy+For+You+%F0%9F%91%8C	false		unknown
https://harmesmg.com/endpoint2c12176623711ee3913b50a64a6de7cesec?data=mail&email=hgjhghjgjh%40aol.com&_=1728316610376	true		unknown
https://harmesmg.com/logo_/Cb8v7L0xnbUZCJD	true		unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/cmg/1/wh0E0SXYnx6pTBdJW%2Fl926I%2BPRUplRdtQz3K9lHXs%2Fs%3D	false		unknown
https://harmesmg.com/b_/670404c158f8d-62ba4cbda984ea2df3057eb8390e0d8c	true		unknown
https://harmesmg.com/	true		unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/c4rds/0x4AAAAAAAwkfvalCr0Ft9wJ/auto/fbE/normal/auto/	false		unknown
https://harmesmg.com/fav/s9G0tr0IOlyQ1oA	true		unknown
https://harmesmg.com/VkZ6ZVFsa1A0REpranpmrobotVkZ6ZVFsa1A0REpranpm	true		unknown

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 7 14:56:24 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	D464966B12437F19E486E55FCC8BAC63	01F0C7B59A5CEA9DBD328DD8B06F9C1B70B07972	BFE7D5DE54E847897602D4D210D7B17041B9F8B33FD92037D8F6A7945CA08DED
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 7 14:56:24 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	38B4055A10005739A006E443DD79F962	63A9E35B5F4910F84257159F2C803495469DA9D9	D0927C0C0244346F883F2802DB21B776D80E17FEE0F242628C2193548C9B16BE
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	6F26AC12E0A60A5D160BFD22D95497CC	A738DFFDC44FEFDCE7F410D2F22E71DE9EB89561	F53FB91B3C53AA8EC853A187337771FB600A5A6904D753273226715FF5359776
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 7 14:56:24 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	16B54641496F310ED56BF1ADA015125D	D4E51D52931B63318DAA6C73DA323DE86D88764C	47DF96E94B4F3CC837D3EC90793C6B511E6933559E87B43C258383C3DD64BE4C
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 7 14:56:24 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	DCF316900312633BE0E1DED88803D189	56F25C79F52EEECF4FF7FFCA7E2701DC47B0A338	9E6D597B71429D6FBC5F262F66FB18507F58F842682C7875CB5D5383B5C0540E
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 7 14:56:24 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	BF9969450FAC0C9E59C09BD530B2CDF1	BECC2333A4FF786BF37B5210C9A3590B9F653F76	033BB1A616770E97302EABC14782D35E89DE5B1DDC75FEC43C80BEAD9670F72A
Chrome Cache Entry: 100	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors	12E3DAC858061D088023B2BD48E2FA96	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
Chrome Cache Entry: 72	ASCII text, with very long lines (32065)	2F6B11A7E914718E0290410E85366FE9	69BB69E25CA7D5EF0935317584E6153F3FD9A88C	05B85D96F41FFF14D8F608DAD03AB71E2C1017C2DA0914D7C59291BAD7A54F8E
Chrome Cache Entry: 73	ASCII text, with very long lines (6791), with no line terminators	71B4BCB170F0685E4EF29DE4813BC978	824E23E1C2C412CC950839F7EC36B06DB95C4760	CBE9DD3F51A57B77A3A894EC01460972217CEF771058ACF169D1BC7B785ADA4B
Chrome Cache Entry: 74	ASCII text, with very long lines (32065)	2F6B11A7E914718E0290410E85366FE9	69BB69E25CA7D5EF0935317584E6153F3FD9A88C	05B85D96F41FFF14D8F608DAD03AB71E2C1017C2DA0914D7C59291BAD7A54F8E
Chrome Cache Entry: 75	SVG Scalable Vector Graphics image	EE5C8D9FB6248C938FD0DC19370E90BD	D01A22720918B781338B5BBF9202B241A5F99EE4	04D29248EE3A13A074518C93A18D6EFC491BF1F298F9B87FC989A6AE4B9FAD7A
Chrome Cache Entry: 76	PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced	9246CCA8FC3C00F50035F28E9F6B7F7D	3AA538440F70873B574F40CD793060F53EC17A5D	C07D7D29E3C20FA6CA4C5D20663688D52BAD13E129AD82CE06B80EB187D9DC84
Chrome Cache Entry: 77	PNG image data, 13 x 28, 8-bit/color RGB, non-interlaced	D151B071898589DD91FAC25171488BEF	3F67869431D857D6AA88BC8EDE0556C89D172610	5F0A0C74B7D564DC0FAF6FD3106DFFF9D1E758CCDA81CA12C6DAB16EAB565094
Chrome Cache Entry: 78	ASCII text, with very long lines (65447)	8FB8FEE4FCC3CC86FF6C724154C49C42	B82D238D4E31FDF618BAE8AC11A6C812C03DD0D4	FF1523FB7389539C84C65ABA19260648793BB4F5E29329D2EE8804BC37A3FE6E
Chrome Cache Entry: 79	SVG Scalable Vector Graphics image	7D2B8F25545A2894E2721E9FE528E34C	D0DAE76F4BF5C04ACD5FCDF1BCB12908099E328C	797BDA35D13E5130FE5A14E0069C31B46EC1AF6EA47F2D300309803BB4D2608C
Chrome Cache Entry: 80	ASCII text, with very long lines (47261)	E07E7ED6F75A7D48B3DF3C153EB687EB	4601D83C67CC128D1E75D3E035FB8A3BDFA1EE34	96BD1C81D59D6AC2EC9F8EBE4937A315E85443667C5728A7CD9053848DD8D3D7
Chrome Cache Entry: 81	SVG Scalable Vector Graphics image	EE5C8D9FB6248C938FD0DC19370E90BD	D01A22720918B781338B5BBF9202B241A5F99EE4	04D29248EE3A13A074518C93A18D6EFC491BF1F298F9B87FC989A6AE4B9FAD7A
Chrome Cache Entry: 82	SVG Scalable Vector Graphics image	4E48046CE74F4B89D45037C90576BFAC	4A41B3B51ED787F7B33294202DA72220C7CD2C32	8E6DB1634F1812D42516778FC890010AA57F3E39914FB4803DF2C38ABBF56D93
Chrome Cache Entry: 83	HTML document, ASCII text	6245A1B2745316615295C40FB3586C4C	AD8545B0E3CCBD1B22DAC8DFA169434144A72036	A82570EB737AEB3EE77F0C37CF422BB6FA30FF9779101E0C76E21CADE7097D0C
Chrome Cache Entry: 84	ASCII text, with very long lines (6791), with no line terminators	71B4BCB170F0685E4EF29DE4813BC978	824E23E1C2C412CC950839F7EC36B06DB95C4760	CBE9DD3F51A57B77A3A894EC01460972217CEF771058ACF169D1BC7B785ADA4B
Chrome Cache Entry: 85	PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced	9246CCA8FC3C00F50035F28E9F6B7F7D	3AA538440F70873B574F40CD793060F53EC17A5D	C07D7D29E3C20FA6CA4C5D20663688D52BAD13E129AD82CE06B80EB187D9DC84
Chrome Cache Entry: 86	ASCII text, with no line terminators	011B17B116126E6E0C4A9B0DE9145805	DF63A6EB731FFCE96F79802EFF6D53D00CDA42BC	3418E6E704387A99F1611EB7BB883328A438BA600971E6D692E8BEA60F10B179
Chrome Cache Entry: 87	ASCII text, with very long lines (65447)	8FB8FEE4FCC3CC86FF6C724154C49C42	B82D238D4E31FDF618BAE8AC11A6C812C03DD0D4	FF1523FB7389539C84C65ABA19260648793BB4F5E29329D2EE8804BC37A3FE6E
Chrome Cache Entry: 88	ASCII text, with very long lines (47261)	E07E7ED6F75A7D48B3DF3C153EB687EB	4601D83C67CC128D1E75D3E035FB8A3BDFA1EE34	96BD1C81D59D6AC2EC9F8EBE4937A315E85443667C5728A7CD9053848DD8D3D7
Chrome Cache Entry: 89	SVG Scalable Vector Graphics image	7D2B8F25545A2894E2721E9FE528E34C	D0DAE76F4BF5C04ACD5FCDF1BCB12908099E328C	797BDA35D13E5130FE5A14E0069C31B46EC1AF6EA47F2D300309803BB4D2608C
Chrome Cache Entry: 90	ASCII text, with very long lines (65536), with no line terminators	4C674D8D4294C4A6B763AA1FC836827C	88DEC91B36CAD6555FB73B9ED28D6FDC7A944467	99855F2433E80A925CE4CABD975E2DD7A9FE01FAB8E164B26F67010FF5769EC0
Chrome Cache Entry: 91	HTML document, ASCII text, with very long lines (4928)	8ED6427BF824F77E402EB8E81F4C1A5B	4CC0BFD59ECFF97882D034C84087C7F681431E22	4B76D5C0CDD6E4428E17792509E9A41717CF9A6B4D35ED4D23C2D07F139B2B72
Chrome Cache Entry: 92	SVG Scalable Vector Graphics image	EE5C8D9FB6248C938FD0DC19370E90BD	D01A22720918B781338B5BBF9202B241A5F99EE4	04D29248EE3A13A074518C93A18D6EFC491BF1F298F9B87FC989A6AE4B9FAD7A
Chrome Cache Entry: 93	SVG Scalable Vector Graphics image	4E48046CE74F4B89D45037C90576BFAC	4A41B3B51ED787F7B33294202DA72220C7CD2C32	8E6DB1634F1812D42516778FC890010AA57F3E39914FB4803DF2C38ABBF56D93
Chrome Cache Entry: 94	ASCII text, with very long lines (3379)	59087D72EEDCB7650C9D5D6088440DD3	97B607FCE11F640E5764699038E50A76EB98944B	E0E3FB0FE5CA541950CF8DD213FBE9E8957A3DB0010B515AD01ADFF6CA908A3E
Chrome Cache Entry: 95	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors	12E3DAC858061D088023B2BD48E2FA96	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
Chrome Cache Entry: 96	SVG Scalable Vector Graphics image	EE5C8D9FB6248C938FD0DC19370E90BD	D01A22720918B781338B5BBF9202B241A5F99EE4	04D29248EE3A13A074518C93A18D6EFC491BF1F298F9B87FC989A6AE4B9FAD7A
Chrome Cache Entry: 97	ASCII text, with very long lines (50758)	67176C242E1BDC20603C878DEE836DF3	27A71B00383D61EF3C489326B3564D698FC1227C	56C12A125B021D21A69E61D7190CEFA168D6C28CE715265CEA1B3B0112D169C4
Chrome Cache Entry: 98	ASCII text, with very long lines (50758)	67176C242E1BDC20603C878DEE836DF3	27A71B00383D61EF3C489326B3564D698FC1227C	56C12A125B021D21A69E61D7190CEFA168D6C28CE715265CEA1B3B0112D169C4
Chrome Cache Entry: 99	PNG image data, 13 x 28, 8-bit/color RGB, non-interlaced	D151B071898589DD91FAC25171488BEF	3F67869431D857D6AA88BC8EDE0556C89D172610	5F0A0C74B7D564DC0FAF6FD3106DFFF9D1E758CCDA81CA12C6DAB16EAB565094

AV Detection

Antivirus / Scanner detection for submitted sample

SlashNext: detection malicious, Label: Credential Stealing type: Phishing & Social Engineering

Phishing

AI detected phishing page

Source: https://harmesmg.com/&redirect=467dbb71ea415b9eb4af299f337a08a557ae6ee7main&uid=f253efe302d32ab264a76e0ce65be769670404c116662

Phishing site detected (based on favicon image match)

Source: https://harmesmg.com/	Matcher: Template: microsoft matched with high similarity
Source: https://harmesmg.com/&redirect=467dbb71ea415b9eb4af299f337a08a557ae6ee7main&uid=f253efe302d32ab264a76e0ce65be769670404c116662	Matcher: Template: microsoft matched with high similarity

Phishing site detected (based on image similarity)

Source: https://harmesmg.com/&redirect=467dbb71ea415b9eb4af299f337a08a557ae6ee7main&uid=f253efe302d32ab264a76e0ce65be769670404c116662

Matcher: Found strong image similarity, brand: MICROSOFT

Phishing site detected (based on logo match)

Source: https://harmesmg.com/&redirect=467dbb71ea415b9eb4af299f337a08a557ae6ee7main&uid=f253efe302d32ab264a76e0ce65be769670404c116662	Matcher: Template: microsoft matched
Source: https://harmesmg.com/&redirect=467dbb71ea415b9eb4af299f337a08a557ae6ee7main&uid=f253efe302d32ab264a76e0ce65be769670404c116662	Matcher: Template: microsoft matched

Phishing site or detected (based on various text indicators)

Source: Chrome DOM: 0.1	OCR Text: Verifying... CLOUDFLARE Ten-rs Microsoft
Source: Chrome DOM: 0.0	OCR Text: Verifying... CLOUDFLARE Ten-rs Microsoft

HTML body contains low number of good links

Source: https://harmesmg.com/&redirect=467dbb71ea415b9eb4af299f337a08a557ae6ee7main&uid=f253efe302d32ab264a76e0ce65be769670404c116662

HTTP Parser: Number of links: 0

HTML page contains hidden javascript code

Source: https://harmesmg.com/

HTML title does not match URL

Source: https://harmesmg.com/&redirect=467dbb71ea415b9eb4af299f337a08a557ae6ee7main&uid=f253efe302d32ab264a76e0ce65be769670404c116662

HTTP Parser: Title: bce28becd7c63e8e2ec9b99d34f008d8670404c11662d does not match URL

Invalid 'sign-in options' or 'sign-up' link found

Source: https://harmesmg.com/&redirect=467dbb71ea415b9eb4af299f337a08a557ae6ee7main&uid=f253efe302d32ab264a76e0ce65be769670404c116662

HTTP Parser: Invalid link: get a new Microsoft account

Invalid T&C link found

Source: https://harmesmg.com/&redirect=467dbb71ea415b9eb4af299f337a08a557ae6ee7main&uid=f253efe302d32ab264a76e0ce65be769670404c116662	HTTP Parser: Invalid link: Terms of use
Source: https://harmesmg.com/&redirect=467dbb71ea415b9eb4af299f337a08a557ae6ee7main&uid=f253efe302d32ab264a76e0ce65be769670404c116662	HTTP Parser: Invalid link: Privacy & cookies
Source: https://harmesmg.com/&redirect=467dbb71ea415b9eb4af299f337a08a557ae6ee7main&uid=f253efe302d32ab264a76e0ce65be769670404c116662	HTTP Parser: Invalid link: Terms of use
Source: https://harmesmg.com/&redirect=467dbb71ea415b9eb4af299f337a08a557ae6ee7main&uid=f253efe302d32ab264a76e0ce65be769670404c116662	HTTP Parser: Invalid link: Privacy & cookies

Source: https://harmesmg.com/&redirect=467dbb71ea415b9eb4af299f337a08a557ae6ee7main&uid=f253efe302d32ab264a76e0ce65be769670404c116662	HTTP Parser: No <meta name="author".. found
Source: https://harmesmg.com/&redirect=467dbb71ea415b9eb4af299f337a08a557ae6ee7main&uid=f253efe302d32ab264a76e0ce65be769670404c116662	HTTP Parser: No <meta name="author".. found

Source: https://harmesmg.com/&redirect=467dbb71ea415b9eb4af299f337a08a557ae6ee7main&uid=f253efe302d32ab264a76e0ce65be769670404c116662	HTTP Parser: No <meta name="copyright".. found
Source: https://harmesmg.com/&redirect=467dbb71ea415b9eb4af299f337a08a557ae6ee7main&uid=f253efe302d32ab264a76e0ce65be769670404c116662	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49796 version: TLS 1.2

Source: chrome.exe

Memory has grown: Private usage: 26MB later: 36MB

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /c/eyJhbGciOiJIUzI1NiJ9.eyJhdWQiOiJkZXRvdXIiLCJpc3MiOiJtb25vbGl0aCIsInN1YiI6ImRldG91cl9saW5rIiwiaWF0IjoxNzI4MzEwODA2LCJuYmYiOjE3MjgzMTA4MDYsImFjY291bnRfaWQiOiIyNzYyNjA5IiwiZGVsaXZlcnlfaWQiOiJwODJtNGNzMzB4cXl2Zmh0NzQxaSIsInRva2VuIjoicDgybTRjczMweHF5dmZodDc0MWkiLCJzZW5kX2F0IjoxNzI4MzA5NzMyLCJlbWFpbF9pZCI6OTk2NDE4NiwiZW1haWxhYmxlX3R5cGUiOiJCcm9hZGNhc3QiLCJlbWFpbGFibGVfaWQiOjM5NTQwMTYsInVybCI6Imh0dHBzOi8vZGFpbHlhbGFza2EuY29tL25ld3M_X19zPWw5bzljOTZzbG8xZjF3aGFiODZrJnV0bV9zb3VyY2U9ZHJpcCZ1dG1fbWVkaXVtPWVtYWlsJnV0bV9jYW1wYWlnbj0lRjAlOUYlOTElOEMrV2UrTWFkZStJdCtFYXN5K0ZvcitZb3UrJUYwJTlGJTkxJThDIn0.MNRoosOspCCWwx3VuYY41W-crcEzfjjfIELlO_QMAdM HTTP/1.1Host: t.dripemail3.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /news?__s=l9o9c96slo1f1whab86k&utm_source=drip&utm_medium=email&utm_campaign=%F0%9F%91%8C+We+Made+It+Easy+For+You+%F0%9F%91%8C HTTP/1.1Host: dailyalaska.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /news/?__s=l9o9c96slo1f1whab86k&utm_source=drip&utm_medium=email&utm_campaign=%F0%9F%91%8C+We+Made+It+Easy+For+You+%F0%9F%91%8C HTTP/1.1Host: dailyalaska.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: harmesmg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://dailyalaska.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /captcha/style.css HTTP/1.1Host: harmesmg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://harmesmg.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=3799c4d50f12ef500b796d3f6ccc3ffa
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/api.js?render=explicit HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://harmesmg.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.6.0.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://harmesmg.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /captcha/logo.svg HTTP/1.1Host: harmesmg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://harmesmg.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=3799c4d50f12ef500b796d3f6ccc3ffa
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/g/ec4b873d446c/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://harmesmg.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.6.0.min.js HTTP/1.1Host: code.jquery.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /captcha/logo.svg HTTP/1.1Host: harmesmg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=3799c4d50f12ef500b796d3f6ccc3ffa
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=TeuEZyGPM7SSppK&MD=F5PkWHhV HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/c4rds/0x4AAAAAAAwkfvalCr0Ft9wJ/auto/fbE/normal/auto/ HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://harmesmg.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/g/ec4b873d446c/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=8cef14ec2b888c29&lang=auto HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/c4rds/0x4AAAAAAAwkfvalCr0Ft9wJ/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/cmg/1/wh0E0SXYnx6pTBdJW%2Fl926I%2BPRUplRdtQz3K9lHXs%2Fs%3D HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/c4rds/0x4AAAAAAAwkfvalCr0Ft9wJ/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/cmg/1/wh0E0SXYnx6pTBdJW%2Fl926I%2BPRUplRdtQz3K9lHXs%2Fs%3D HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=8cef14ec2b888c29&lang=auto HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/flow/ov1/593885740:1728315463:QEvZ1HiOoBQogM0yRR2m-igmMF_DCUtjMQMpy3zrY7g/8cef14ec2b888c29/ac3f70574c87d9b HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/pat/8cef14ec2b888c29/1728316593724/565d402329806b0e0b1bb81f496f43867780d73d369807fad6a60f01d771e0cb/F-bN9h4xjeTkyvK HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/c4rds/0x4AAAAAAAwkfvalCr0Ft9wJ/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/i/8cef14ec2b888c29/1728316593729/L9YnqAj51e-zh63 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/c4rds/0x4AAAAAAAwkfvalCr0Ft9wJ/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/i/8cef14ec2b888c29/1728316593729/L9YnqAj51e-zh63 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/flow/ov1/593885740:1728315463:QEvZ1HiOoBQogM0yRR2m-igmMF_DCUtjMQMpy3zrY7g/8cef14ec2b888c29/ac3f70574c87d9b HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/flow/ov1/593885740:1728315463:QEvZ1HiOoBQogM0yRR2m-igmMF_DCUtjMQMpy3zrY7g/8cef14ec2b888c29/ac3f70574c87d9b HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/rc/8cef14ec2b888c29 HTTP/1.1Host: harmesmg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=3799c4d50f12ef500b796d3f6ccc3ffa
Source: global traffic	HTTP traffic detected: GET /VkZ6ZVFsa1A0REpranpmrobotVkZ6ZVFsa1A0REpranpm HTTP/1.1Host: harmesmg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=3799c4d50f12ef500b796d3f6ccc3ffa
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: harmesmg.comConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://harmesmg.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=3799c4d50f12ef500b796d3f6ccc3ffa; cf_clearance=4phD4d0nAz2cvuMhVTqfRjZplh5XgKm6ImXH14CzkOQ-1728316605-1.2.1.1-O.PvMpDW6Wd_J2BKHwMR3czuZCsB7KPvODQx4sG1cc8i5XokNul7mRE2ifDtDFlr0slbx0tWrljT_uT1jHxHlz_0bZwGUKIiPZLKKZWAWfE.qFmEk25SpbNzL5CBcn5JiakkZyMlXcZIbLQoCrwHcTlj3k_INxUrunrh5jO_TQSykzK34rPAgB7eGQiPultpOsLm9Uhv843waRJvBsHx046_.UID701tD4TP7v_ucTvovLRk7Cgm984.592Mqa.BytbneMbvpA6PtCqCqjNylKnZDPOHQ0f9zhxU_ZSfOA4Wzg8mKUqTVA61DlHFlJ4CgND.F3OznLFfZGV4WDLFVY7Qo8StYxbUvEeYJWDKvE8nFm1CeL8Gx9OZo3HzedMtgnGoQv_282Ak.BLNcTWwugpM6x9T3F11gcfXJ_GhKYjw6TO7cZHYVVhLUU7Ycn9X
Source: global traffic	HTTP traffic detected: GET /&redirect=467dbb71ea415b9eb4af299f337a08a557ae6ee7main&uid=f253efe302d32ab264a76e0ce65be769670404c116662 HTTP/1.1Host: harmesmg.comConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://harmesmg.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=3799c4d50f12ef500b796d3f6ccc3ffa; cf_clearance=4phD4d0nAz2cvuMhVTqfRjZplh5XgKm6ImXH14CzkOQ-1728316605-1.2.1.1-O.PvMpDW6Wd_J2BKHwMR3czuZCsB7KPvODQx4sG1cc8i5XokNul7mRE2ifDtDFlr0slbx0tWrljT_uT1jHxHlz_0bZwGUKIiPZLKKZWAWfE.qFmEk25SpbNzL5CBcn5JiakkZyMlXcZIbLQoCrwHcTlj3k_INxUrunrh5jO_TQSykzK34rPAgB7eGQiPultpOsLm9Uhv843waRJvBsHx046_.UID701tD4TP7v_ucTvovLRk7Cgm984.592Mqa.BytbneMbvpA6PtCqCqjNylKnZDPOHQ0f9zhxU_ZSfOA4Wzg8mKUqTVA61DlHFlJ4CgND.F3OznLFfZGV4WDLFVY7Qo8StYxbUvEeYJWDKvE8nFm1CeL8Gx9OZo3HzedMtgnGoQv_282Ak.BLNcTWwugpM6x9T3F11gcfXJ_GhKYjw6TO7cZHYVVhLUU7Ycn9X
Source: global traffic	HTTP traffic detected: GET /js___/670404c158f86-62ba4cbda984ea2df3057eb8390e0d8c HTTP/1.1Host: harmesmg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://harmesmg.com/&redirect=467dbb71ea415b9eb4af299f337a08a557ae6ee7main&uid=f253efe302d32ab264a76e0ce65be769670404c116662Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=3799c4d50f12ef500b796d3f6ccc3ffa; cf_clearance=4phD4d0nAz2cvuMhVTqfRjZplh5XgKm6ImXH14CzkOQ-1728316605-1.2.1.1-O.PvMpDW6Wd_J2BKHwMR3czuZCsB7KPvODQx4sG1cc8i5XokNul7mRE2ifDtDFlr0slbx0tWrljT_uT1jHxHlz_0bZwGUKIiPZLKKZWAWfE.qFmEk25SpbNzL5CBcn5JiakkZyMlXcZIbLQoCrwHcTlj3k_INxUrunrh5jO_TQSykzK34rPAgB7eGQiPultpOsLm9Uhv843waRJvBsHx046_.UID701tD4TP7v_ucTvovLRk7Cgm984.592Mqa.BytbneMbvpA6PtCqCqjNylKnZDPOHQ0f9zhxU_ZSfOA4Wzg8mKUqTVA61DlHFlJ4CgND.F3OznLFfZGV4WDLFVY7Qo8StYxbUvEeYJWDKvE8nFm1CeL8Gx9OZo3HzedMtgnGoQv_282Ak.BLNcTWwugpM6x9T3F11gcfXJ_GhKYjw6TO7cZHYVVhLUU7Ycn9X
Source: global traffic	HTTP traffic detected: GET /b_/670404c158f8d-62ba4cbda984ea2df3057eb8390e0d8c HTTP/1.1Host: harmesmg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://harmesmg.com/&redirect=467dbb71ea415b9eb4af299f337a08a557ae6ee7main&uid=f253efe302d32ab264a76e0ce65be769670404c116662Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=3799c4d50f12ef500b796d3f6ccc3ffa; cf_clearance=4phD4d0nAz2cvuMhVTqfRjZplh5XgKm6ImXH14CzkOQ-1728316605-1.2.1.1-O.PvMpDW6Wd_J2BKHwMR3czuZCsB7KPvODQx4sG1cc8i5XokNul7mRE2ifDtDFlr0slbx0tWrljT_uT1jHxHlz_0bZwGUKIiPZLKKZWAWfE.qFmEk25SpbNzL5CBcn5JiakkZyMlXcZIbLQoCrwHcTlj3k_INxUrunrh5jO_TQSykzK34rPAgB7eGQiPultpOsLm9Uhv843waRJvBsHx046_.UID701tD4TP7v_ucTvovLRk7Cgm984.592Mqa.BytbneMbvpA6PtCqCqjNylKnZDPOHQ0f9zhxU_ZSfOA4Wzg8mKUqTVA61DlHFlJ4CgND.F3OznLFfZGV4WDLFVY7Qo8StYxbUvEeYJWDKvE8nFm1CeL8Gx9OZo3HzedMtgnGoQv_282Ak.BLNcTWwugpM6x9T3F11gcfXJ_GhKYjw6TO7cZHYVVhLUU7Ycn9X
Source: global traffic	HTTP traffic detected: GET /js_/670404c158f8e-62ba4cbda984ea2df3057eb8390e0d8c HTTP/1.1Host: harmesmg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://harmesmg.com/&redirect=467dbb71ea415b9eb4af299f337a08a557ae6ee7main&uid=f253efe302d32ab264a76e0ce65be769670404c116662Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=3799c4d50f12ef500b796d3f6ccc3ffa; cf_clearance=4phD4d0nAz2cvuMhVTqfRjZplh5XgKm6ImXH14CzkOQ-1728316605-1.2.1.1-O.PvMpDW6Wd_J2BKHwMR3czuZCsB7KPvODQx4sG1cc8i5XokNul7mRE2ifDtDFlr0slbx0tWrljT_uT1jHxHlz_0bZwGUKIiPZLKKZWAWfE.qFmEk25SpbNzL5CBcn5JiakkZyMlXcZIbLQoCrwHcTlj3k_INxUrunrh5jO_TQSykzK34rPAgB7eGQiPultpOsLm9Uhv843waRJvBsHx046_.UID701tD4TP7v_ucTvovLRk7Cgm984.592Mqa.BytbneMbvpA6PtCqCqjNylKnZDPOHQ0f9zhxU_ZSfOA4Wzg8mKUqTVA61DlHFlJ4CgND.F3OznLFfZGV4WDLFVY7Qo8StYxbUvEeYJWDKvE8nFm1CeL8Gx9OZo3HzedMtgnGoQv_282Ak.BLNcTWwugpM6x9T3F11gcfXJ_GhKYjw6TO7cZHYVVhLUU7Ycn9X
Source: global traffic	HTTP traffic detected: GET /js_/670404c158f8e-62ba4cbda984ea2df3057eb8390e0d8c HTTP/1.1Host: harmesmg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=3799c4d50f12ef500b796d3f6ccc3ffa
Source: global traffic	HTTP traffic detected: GET /js___/670404c158f86-62ba4cbda984ea2df3057eb8390e0d8c HTTP/1.1Host: harmesmg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=3799c4d50f12ef500b796d3f6ccc3ffa
Source: global traffic	HTTP traffic detected: GET /b_/670404c158f8d-62ba4cbda984ea2df3057eb8390e0d8c HTTP/1.1Host: harmesmg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=3799c4d50f12ef500b796d3f6ccc3ffa
Source: global traffic	HTTP traffic detected: GET /home6dca65610bad709b07a9e6041699d6ce HTTP/1.1Host: harmesmg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://harmesmg.com/&redirect=467dbb71ea415b9eb4af299f337a08a557ae6ee7main&uid=f253efe302d32ab264a76e0ce65be769670404c116662Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=3799c4d50f12ef500b796d3f6ccc3ffa; cf_clearance=4phD4d0nAz2cvuMhVTqfRjZplh5XgKm6ImXH14CzkOQ-1728316605-1.2.1.1-O.PvMpDW6Wd_J2BKHwMR3czuZCsB7KPvODQx4sG1cc8i5XokNul7mRE2ifDtDFlr0slbx0tWrljT_uT1jHxHlz_0bZwGUKIiPZLKKZWAWfE.qFmEk25SpbNzL5CBcn5JiakkZyMlXcZIbLQoCrwHcTlj3k_INxUrunrh5jO_TQSykzK34rPAgB7eGQiPultpOsLm9Uhv843waRJvBsHx046_.UID701tD4TP7v_ucTvovLRk7Cgm984.592Mqa.BytbneMbvpA6PtCqCqjNylKnZDPOHQ0f9zhxU_ZSfOA4Wzg8mKUqTVA61DlHFlJ4CgND.F3OznLFfZGV4WDLFVY7Qo8StYxbUvEeYJWDKvE8nFm1CeL8Gx9OZo3HzedMtgnGoQv_282Ak.BLNcTWwugpM6x9T3F11gcfXJ_GhKYjw6TO7cZHYVVhLUU7Ycn9X
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: harmesmg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://harmesmg.com/&redirect=467dbb71ea415b9eb4af299f337a08a557ae6ee7main&uid=f253efe302d32ab264a76e0ce65be769670404c116662Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=3799c4d50f12ef500b796d3f6ccc3ffa; cf_clearance=4phD4d0nAz2cvuMhVTqfRjZplh5XgKm6ImXH14CzkOQ-1728316605-1.2.1.1-O.PvMpDW6Wd_J2BKHwMR3czuZCsB7KPvODQx4sG1cc8i5XokNul7mRE2ifDtDFlr0slbx0tWrljT_uT1jHxHlz_0bZwGUKIiPZLKKZWAWfE.qFmEk25SpbNzL5CBcn5JiakkZyMlXcZIbLQoCrwHcTlj3k_INxUrunrh5jO_TQSykzK34rPAgB7eGQiPultpOsLm9Uhv843waRJvBsHx046_.UID701tD4TP7v_ucTvovLRk7Cgm984.592Mqa.BytbneMbvpA6PtCqCqjNylKnZDPOHQ0f9zhxU_ZSfOA4Wzg8mKUqTVA61DlHFlJ4CgND.F3OznLFfZGV4WDLFVY7Qo8StYxbUvEeYJWDKvE8nFm1CeL8Gx9OZo3HzedMtgnGoQv_282Ak.BLNcTWwugpM6x9T3F11gcfXJ_GhKYjw6TO7cZHYVVhLUU7Ycn9X
Source: global traffic	HTTP traffic detected: GET /home6dca65610bad709b07a9e6041699d6ce HTTP/1.1Host: harmesmg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=3799c4d50f12ef500b796d3f6ccc3ffa
Source: global traffic	HTTP traffic detected: GET /css_/Bk0skH0VKnC5GQh HTTP/1.1Host: harmesmg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://harmesmg.com/&redirect=467dbb71ea415b9eb4af299f337a08a557ae6ee7main&uid=f253efe302d32ab264a76e0ce65be769670404c116662Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=3799c4d50f12ef500b796d3f6ccc3ffa; cf_clearance=4phD4d0nAz2cvuMhVTqfRjZplh5XgKm6ImXH14CzkOQ-1728316605-1.2.1.1-O.PvMpDW6Wd_J2BKHwMR3czuZCsB7KPvODQx4sG1cc8i5XokNul7mRE2ifDtDFlr0slbx0tWrljT_uT1jHxHlz_0bZwGUKIiPZLKKZWAWfE.qFmEk25SpbNzL5CBcn5JiakkZyMlXcZIbLQoCrwHcTlj3k_INxUrunrh5jO_TQSykzK34rPAgB7eGQiPultpOsLm9Uhv843waRJvBsHx046_.UID701tD4TP7v_ucTvovLRk7Cgm984.592Mqa.BytbneMbvpA6PtCqCqjNylKnZDPOHQ0f9zhxU_ZSfOA4Wzg8mKUqTVA61DlHFlJ4CgND.F3OznLFfZGV4WDLFVY7Qo8StYxbUvEeYJWDKvE8nFm1CeL8Gx9OZo3HzedMtgnGoQv_282Ak.BLNcTWwugpM6x9T3F11gcfXJ_GhKYjw6TO7cZHYVVhLUU7Ycn9X
Source: global traffic	HTTP traffic detected: GET /fav/s9G0tr0IOlyQ1oA HTTP/1.1Host: harmesmg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://harmesmg.com/&redirect=467dbb71ea415b9eb4af299f337a08a557ae6ee7main&uid=f253efe302d32ab264a76e0ce65be769670404c116662Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=3799c4d50f12ef500b796d3f6ccc3ffa; cf_clearance=4phD4d0nAz2cvuMhVTqfRjZplh5XgKm6ImXH14CzkOQ-1728316605-1.2.1.1-O.PvMpDW6Wd_J2BKHwMR3czuZCsB7KPvODQx4sG1cc8i5XokNul7mRE2ifDtDFlr0slbx0tWrljT_uT1jHxHlz_0bZwGUKIiPZLKKZWAWfE.qFmEk25SpbNzL5CBcn5JiakkZyMlXcZIbLQoCrwHcTlj3k_INxUrunrh5jO_TQSykzK34rPAgB7eGQiPultpOsLm9Uhv843waRJvBsHx046_.UID701tD4TP7v_ucTvovLRk7Cgm984.592Mqa.BytbneMbvpA6PtCqCqjNylKnZDPOHQ0f9zhxU_ZSfOA4Wzg8mKUqTVA61DlHFlJ4CgND.F3OznLFfZGV4WDLFVY7Qo8StYxbUvEeYJWDKvE8nFm1CeL8Gx9OZo3HzedMtgnGoQv_282Ak.BLNcTWwugpM6x9T3F11gcfXJ_GhKYjw6TO7cZHYVVhLUU7Ycn9X
Source: global traffic	HTTP traffic detected: GET /logo_/Cb8v7L0xnbUZCJD HTTP/1.1Host: harmesmg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://harmesmg.com/&redirect=467dbb71ea415b9eb4af299f337a08a557ae6ee7main&uid=f253efe302d32ab264a76e0ce65be769670404c116662Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=3799c4d50f12ef500b796d3f6ccc3ffa; cf_clearance=4phD4d0nAz2cvuMhVTqfRjZplh5XgKm6ImXH14CzkOQ-1728316605-1.2.1.1-O.PvMpDW6Wd_J2BKHwMR3czuZCsB7KPvODQx4sG1cc8i5XokNul7mRE2ifDtDFlr0slbx0tWrljT_uT1jHxHlz_0bZwGUKIiPZLKKZWAWfE.qFmEk25SpbNzL5CBcn5JiakkZyMlXcZIbLQoCrwHcTlj3k_INxUrunrh5jO_TQSykzK34rPAgB7eGQiPultpOsLm9Uhv843waRJvBsHx046_.UID701tD4TP7v_ucTvovLRk7Cgm984.592Mqa.BytbneMbvpA6PtCqCqjNylKnZDPOHQ0f9zhxU_ZSfOA4Wzg8mKUqTVA61DlHFlJ4CgND.F3OznLFfZGV4WDLFVY7Qo8StYxbUvEeYJWDKvE8nFm1CeL8Gx9OZo3HzedMtgnGoQv_282Ak.BLNcTWwugpM6x9T3F11gcfXJ_GhKYjw6TO7cZHYVVhLUU7Ycn9X
Source: global traffic	HTTP traffic detected: GET /logo_/68ae214891024d21f46f0db6cb776026670404c42b8ef HTTP/1.1Host: harmesmg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://harmesmg.com/&redirect=467dbb71ea415b9eb4af299f337a08a557ae6ee7main&uid=f253efe302d32ab264a76e0ce65be769670404c116662Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=3799c4d50f12ef500b796d3f6ccc3ffa; cf_clearance=4phD4d0nAz2cvuMhVTqfRjZplh5XgKm6ImXH14CzkOQ-1728316605-1.2.1.1-O.PvMpDW6Wd_J2BKHwMR3czuZCsB7KPvODQx4sG1cc8i5XokNul7mRE2ifDtDFlr0slbx0tWrljT_uT1jHxHlz_0bZwGUKIiPZLKKZWAWfE.qFmEk25SpbNzL5CBcn5JiakkZyMlXcZIbLQoCrwHcTlj3k_INxUrunrh5jO_TQSykzK34rPAgB7eGQiPultpOsLm9Uhv843waRJvBsHx046_.UID701tD4TP7v_ucTvovLRk7Cgm984.592Mqa.BytbneMbvpA6PtCqCqjNylKnZDPOHQ0f9zhxU_ZSfOA4Wzg8mKUqTVA61DlHFlJ4CgND.F3OznLFfZGV4WDLFVY7Qo8StYxbUvEeYJWDKvE8nFm1CeL8Gx9OZo3HzedMtgnGoQv_282Ak.BLNcTWwugpM6x9T3F11gcfXJ_GhKYjw6TO7cZHYVVhLUU7Ycn9X
Source: global traffic	HTTP traffic detected: GET /sig/68ae214891024d21f46f0db6cb776026670404c42b933 HTTP/1.1Host: harmesmg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://harmesmg.com/&redirect=467dbb71ea415b9eb4af299f337a08a557ae6ee7main&uid=f253efe302d32ab264a76e0ce65be769670404c116662Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=3799c4d50f12ef500b796d3f6ccc3ffa; cf_clearance=4phD4d0nAz2cvuMhVTqfRjZplh5XgKm6ImXH14CzkOQ-1728316605-1.2.1.1-O.PvMpDW6Wd_J2BKHwMR3czuZCsB7KPvODQx4sG1cc8i5XokNul7mRE2ifDtDFlr0slbx0tWrljT_uT1jHxHlz_0bZwGUKIiPZLKKZWAWfE.qFmEk25SpbNzL5CBcn5JiakkZyMlXcZIbLQoCrwHcTlj3k_INxUrunrh5jO_TQSykzK34rPAgB7eGQiPultpOsLm9Uhv843waRJvBsHx046_.UID701tD4TP7v_ucTvovLRk7Cgm984.592Mqa.BytbneMbvpA6PtCqCqjNylKnZDPOHQ0f9zhxU_ZSfOA4Wzg8mKUqTVA61DlHFlJ4CgND.F3OznLFfZGV4WDLFVY7Qo8StYxbUvEeYJWDKvE8nFm1CeL8Gx9OZo3HzedMtgnGoQv_282Ak.BLNcTWwugpM6x9T3F11gcfXJ_GhKYjw6TO7cZHYVVhLUU7Ycn9X
Source: global traffic	HTTP traffic detected: GET /%3C?php%20echo%20SVGBKG;%20?%3E HTTP/1.1Host: harmesmg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://harmesmg.com/&redirect=467dbb71ea415b9eb4af299f337a08a557ae6ee7main&uid=f253efe302d32ab264a76e0ce65be769670404c116662Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=3799c4d50f12ef500b796d3f6ccc3ffa; cf_clearance=4phD4d0nAz2cvuMhVTqfRjZplh5XgKm6ImXH14CzkOQ-1728316605-1.2.1.1-O.PvMpDW6Wd_J2BKHwMR3czuZCsB7KPvODQx4sG1cc8i5XokNul7mRE2ifDtDFlr0slbx0tWrljT_uT1jHxHlz_0bZwGUKIiPZLKKZWAWfE.qFmEk25SpbNzL5CBcn5JiakkZyMlXcZIbLQoCrwHcTlj3k_INxUrunrh5jO_TQSykzK34rPAgB7eGQiPultpOsLm9Uhv843waRJvBsHx046_.UID701tD4TP7v_ucTvovLRk7Cgm984.592Mqa.BytbneMbvpA6PtCqCqjNylKnZDPOHQ0f9zhxU_ZSfOA4Wzg8mKUqTVA61DlHFlJ4CgND.F3OznLFfZGV4WDLFVY7Qo8StYxbUvEeYJWDKvE8nFm1CeL8Gx9OZo3HzedMtgnGoQv_282Ak.BLNcTWwugpM6x9T3F11gcfXJ_GhKYjw6TO7cZHYVVhLUU7Ycn9X
Source: global traffic	HTTP traffic detected: GET /logo_/Cb8v7L0xnbUZCJD HTTP/1.1Host: harmesmg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=3799c4d50f12ef500b796d3f6ccc3ffa
Source: global traffic	HTTP traffic detected: GET /sig/68ae214891024d21f46f0db6cb776026670404c42b933 HTTP/1.1Host: harmesmg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=3799c4d50f12ef500b796d3f6ccc3ffa
Source: global traffic	HTTP traffic detected: GET /logo_/68ae214891024d21f46f0db6cb776026670404c42b8ef HTTP/1.1Host: harmesmg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=3799c4d50f12ef500b796d3f6ccc3ffa
Source: global traffic	HTTP traffic detected: GET /fav/s9G0tr0IOlyQ1oA HTTP/1.1Host: harmesmg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=3799c4d50f12ef500b796d3f6ccc3ffa
Source: global traffic	HTTP traffic detected: GET /endpoint2c12176623711ee3913b50a64a6de7cesec?data=mail&email=hgjhghjgjh%40aol.com&_=1728316610376 HTTP/1.1Host: harmesmg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: application/json, text/javascript, /; q=0.01X-Requested-With: XMLHttpRequestsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://harmesmg.com/&redirect=467dbb71ea415b9eb4af299f337a08a557ae6ee7main&uid=f253efe302d32ab264a76e0ce65be769670404c116662Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=3799c4d50f12ef500b796d3f6ccc3ffa; cf_clearance=4phD4d0nAz2cvuMhVTqfRjZplh5XgKm6ImXH14CzkOQ-1728316605-1.2.1.1-O.PvMpDW6Wd_J2BKHwMR3czuZCsB7KPvODQx4sG1cc8i5XokNul7mRE2ifDtDFlr0slbx0tWrljT_uT1jHxHlz_0bZwGUKIiPZLKKZWAWfE.qFmEk25SpbNzL5CBcn5JiakkZyMlXcZIbLQoCrwHcTlj3k_INxUrunrh5jO_TQSykzK34rPAgB7eGQiPultpOsLm9Uhv843waRJvBsHx046_.UID701tD4TP7v_ucTvovLRk7Cgm984.592Mqa.BytbneMbvpA6PtCqCqjNylKnZDPOHQ0f9zhxU_ZSfOA4Wzg8mKUqTVA61DlHFlJ4CgND.F3OznLFfZGV4WDLFVY7Qo8StYxbUvEeYJWDKvE8nFm1CeL8Gx9OZo3HzedMtgnGoQv_282Ak.BLNcTWwugpM6x9T3F11gcfXJ_GhKYjw6TO7cZHYVVhLUU7Ycn9X
Source: global traffic	HTTP traffic detected: GET /endpoint2c12176623711ee3913b50a64a6de7cesec?data=mail&email=hgjhghjgjh%40aol.com&_=1728316610376 HTTP/1.1Host: harmesmg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=3799c4d50f12ef500b796d3f6ccc3ffa
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=TeuEZyGPM7SSppK&MD=F5PkWHhV HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: global traffic	DNS traffic detected: DNS query: t.dripemail3.com
Source: global traffic	DNS traffic detected: DNS query: dailyalaska.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: google.com
Source: global traffic	DNS traffic detected: DNS query: harmesmg.com
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com

Source: unknown

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 07 Oct 2024 15:56:34 GMTContent-Type: application/jsonContent-Length: 7Connection: closecf-chl-out: GwjVgR5K+D1SBdULZsotBJAnLzEaw1weSXU=$mnxFv6EGi8NJNi1Ccache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0Server: cloudflareCF-RAY: 8cef14fe0c5b1a13-EWR
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 07 Oct 2024 15:56:37 GMTContent-Type: application/jsonContent-Length: 7Connection: closecf-chl-out: e7dnZfCCMpTK/BmqIWTkhPIyCZrgDQEacgE=$USW3iaBOFRTFqSExcache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0Server: cloudflareCF-RAY: 8cef1510cde342c9-EWR
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 07 Oct 2024 15:56:45 GMTContent-Type: application/jsonContent-Length: 7Connection: closecf-chl-out: UsdjPpy6HR1dMBtz1hF4bs3rpL2Bo3ZNIuk=$Z78Srt2cWkj7Tc+tcache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0Server: cloudflareCF-RAY: 8cef153efac417bd-EWR
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 07 Oct 2024 15:56:46 GMTContent-Type: application/jsonContent-Length: 7Connection: closecf-chl-out: lbl0oLB+XnBq54356QOzDC98pC+yJ7us7pc=$Ar8J7YK3Q44mRZKTcache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nIcguF3VCMyMrhdkg8LIxJaJYb9Udub%2FU4jCXc48pGARZQ70IjFLyCW89F5PuGYPyJkufHCvEecKjtXBce3BKubnRYskwwhkeXtX%2FbmK00k9OehMLd1Yvi3vqigxxR0%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8cef1545be5a8ce3-EWR
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 07 Oct 2024 15:56:52 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachex-turbo-charged-by: LiteSpeedCF-Cache-Status: BYPASSReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6FWCw2EdLcdwhrUGc3oJZ7K19nT5YGdTxtdOi6WM58t0cRtAHUXzr7XP8qLR61xILn2grEOcevTh0iSkfEbygyjrkEjfYaInKjJEgFkfPTux0GAp%2FFRx2Y2t5f2d9%2Bs%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Speculation-Rules: "/cdn-cgi/speculation"Server: cloudflareCF-RAY: 8cef15696d427ca8-EWR
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 07 Oct 2024 15:56:54 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachex-turbo-charged-by: LiteSpeedcf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Dle%2FZtd9QHIh4fpIAnNFnGPGDa8iI9UoSxbc4Rz7%2BxE6dkXco3ZOMGaRniqG99zYObOHMty1bv%2BGaGr8MST6Q8k5i3ZxNZdkAxKnVKSltL0J8nF%2BuIw6VmlwDmCQgfg%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Speculation-Rules: "/cdn-cgi/speculation"Server: cloudflareCF-RAY: 8cef15746c9343df-EWR

Source: chromecache_97.1.dr, chromecache_98.1.dr	String found in binary or memory: https://getbootstrap.com/)
Source: chromecache_97.1.dr, chromecache_98.1.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: chromecache_97.1.dr, chromecache_98.1.dr	String found in binary or memory: https://github.com/twbs/bootstrap/graphs/contributors)
Source: chromecache_83.1.dr	String found in binary or memory: https://google.com
Source: chromecache_83.1.dr	String found in binary or memory: https://harmesmg.com

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49796 version: TLS 1.2

Source: classification engine

Classification label: mal80.phis.troj.win@23/52@28/12

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1840,i,10789607078351078241,3572493302472614712,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://t.dripemail3.com/c/eyJhbGciOiJIUzI1NiJ9.eyJhdWQiOiJkZXRvdXIiLCJpc3MiOiJtb25vbGl0aCIsInN1YiI6ImRldG91cl9saW5rIiwiaWF0IjoxNzI4MzEwODA2LCJuYmYiOjE3MjgzMTA4MDYsImFjY291bnRfaWQiOiIyNzYyNjA5IiwiZGVsaXZlcnlfaWQiOiJwODJtNGNzMzB4cXl2Zmh0NzQxaSIsInRva2VuIjoicDgybTRjczMweHF5dmZodDc0MWkiLCJzZW5kX2F0IjoxNzI4MzA5NzMyLCJlbWFpbF9pZCI6OTk2NDE4NiwiZW1haWxhYmxlX3R5cGUiOiJCcm9hZGNhc3QiLCJlbWFpbGFibGVfaWQiOjM5NTQwMTYsInVybCI6Imh0dHBzOi8vZGFpbHlhbGFza2EuY29tL25ld3M_X19zPWw5bzljOTZzbG8xZjF3aGFiODZrJnV0bV9zb3VyY2U9ZHJpcCZ1dG1fbWVkaXVtPWVtYWlsJnV0bV9jYW1wYWlnbj0lRjAlOUYlOTElOEMrV2UrTWFkZStJdCtFYXN5K0ZvcitZb3UrJUYwJTlGJTkxJThDIn0.MNRoosOspCCWwx3VuYY41W-crcEzfjjfIELlO_QMAdM"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1840,i,10789607078351078241,3572493302472614712,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Data Obfuscation

Yara detected Html Dropper

Source: Yara match	File source: 0.3.pages.csv, type: HTML
Source: Yara match	File source: 0.4.pages.csv, type: HTML

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

ID:	1528259
Product:	CloudBasic
Start time:	17:55:50
Start date:	07.10.2024
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Boot Survival

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs