Edit tour

Windows Analysis Report
000.docx

Overview

General Information

Sample Name:	000.docx
Analysis ID:	610796
MD5:	6dac61eecd8791841e234cfd1da3919b
SHA1:	3fc7fa088e1e846a0f01caccef625ccdb8b8da4a
SHA256:	5ec5f9fca53aa5778d5e5da7b6bba287132f098955090caeff06dd1a67bc42e3
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Potential document exploit detected (unknown TCP traffic)

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

IP address seen in connection with other malware

Document misses a certain OLE stream usually present in this Microsoft Office document type

Classification

Process Tree

System is w10x64

WINWORD.EXE (PID: 7008 cmdline: "C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE" /Automation -Embedding MD5: 0B9AB9B9C4DE429473D6450D4297A123)

chrome.exe (PID: 5692 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "https://tinyurl.com/carmela00 MD5: C139654B5C1438A95B321BB01AD63EF6)

chrome.exe (PID: 4340 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1548,2158869827915305042,4737385198857068162,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1908 /prefetch:8 MD5: C139654B5C1438A95B321BB01AD63EF6)

chrome.exe (PID: 1136 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1548,2158869827915305042,4737385198857068162,131072 --lang=en-US --service-sandbox-type=audio --enable-audio-service-sandbox --mojo-platform-channel-handle=5956 /prefetch:8 MD5: C139654B5C1438A95B321BB01AD63EF6)

cleanup

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic			Jump to behavior

Source: Joe Sandbox View	IP Address: 104.20.139.65 104.20.139.65
Source: Joe Sandbox View	IP Address: 104.20.139.65 104.20.139.65

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789

Source: global traffic	HTTP traffic detected: GET /carmela00 HTTP/1.1Host: tinyurl.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfmX-Goog-Update-Updater: chromecrx-85.0.4183.121Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /click?o=79&a=1636 HTTP/1.1Host: ssl.scaletrk.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /click?o=95&a=1636 HTTP/1.1Host: ssl.scaletrk.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: U-d1fe173d08e959397adf34b1d77e88d7=unique
Source: global traffic	HTTP traffic detected: GET /click?o=135&a=1636 HTTP/1.1Host: ssl.scaletrk.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: U-d1fe173d08e959397adf34b1d77e88d7=unique; U-812b4ba287f5ee0bc9d43bbf5bbe87fb=unique
Source: global traffic	HTTP traffic detected: GET /gtm.js?id=GTM-PPJGZHL HTTP/1.1Host: www.googletagmanager.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: http://i.gratissesso.me/c/da57dc555e50572d?s1=149667&s2=1382674&click_id=c72c5c4350cf701a8c1f88e8492ea2e2&j1=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/roboto/v29/KFOlCnqEu92Fr1MmWUlfBBc4.woff2 HTTP/1.1Host: fonts.gstatic.comConnection: keep-aliveOrigin: http://i.gratissesso.meUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://fonts.googleapis.com/css2?family=Roboto:wght@300;400;700&display=swapAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/roboto/v29/KFOmCnqEu92Fr1Mu4mxK.woff2 HTTP/1.1Host: fonts.gstatic.comConnection: keep-aliveOrigin: http://i.gratissesso.meUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://fonts.googleapis.com/css2?family=Roboto:wght@300;400;700&display=swapAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /crx/blobs/Acy1k0bLIjHsvnKaKN_oRpVaYYvFs25d7GKYF1WXrT6yizCMksBO0c_ggE0B6tx6HPRHe6q1GOEe3_NcIbSiGG8kXeLMUY0sAKVvC6R89zvKM13s5VqoAMZSmuUgjQL5vlygJuArQghXXE_qTL7NlQ/extension_8520_615_0_5.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /c/da57dc555e50572d?s1=149667&s2=1382674&click_id=c72c5c4350cf701a8c1f88e8492ea2e2&j1=1 HTTP/1.1Host: i.gratissesso.meConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/pushjs/1.0.0/subscriber.js HTTP/1.1Host: i.gratissesso.meConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Referer: http://i.gratissesso.me/c/da57dc555e50572d?s1=149667&s2=1382674&click_id=c72c5c4350cf701a8c1f88e8492ea2e2&j1=1Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: unique_id=625d8c7b0004d968; unique_id2=625d8c7b0006a03f; 625d8c7b0006a03f_c=1; ref_token=149667; 625d8c7b0006a03f_sl=[271434]
Source: global traffic	HTTP traffic detected: GET /js/pushjs/1.0.0/utils.js HTTP/1.1Host: i.gratissesso.meConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Referer: http://i.gratissesso.me/c/da57dc555e50572d?s1=149667&s2=1382674&click_id=c72c5c4350cf701a8c1f88e8492ea2e2&j1=1Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: unique_id=625d8c7b0004d968; unique_id2=625d8c7b0006a03f; 625d8c7b0006a03f_c=1; ref_token=149667; 625d8c7b0006a03f_sl=[271434]

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE" /Automation -Embedding
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "https://tinyurl.com/carmela00
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1548,2158869827915305042,4737385198857068162,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1908 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1548,2158869827915305042,4737385198857068162,131072 --lang=en-US --service-sandbox-type=audio --enable-audio-service-sandbox --mojo-platform-channel-handle=5956 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1548,2158869827915305042,4737385198857068162,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1908 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1548,2158869827915305042,4737385198857068162,131072 --lang=en-US --service-sandbox-type=audio --enable-audio-service-sandbox --mojo-platform-channel-handle=5956 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: ~WRF{A1C57E19-F456-4B4E-B614-D816E10EAAE0}.tmp.1.dr	OLE document summary: title field not present or empty
Source: ~WRF{A1C57E19-F456-4B4E-B614-D816E10EAAE0}.tmp.1.dr	OLE document summary: author field not present or empty
Source: ~WRF{A1C57E19-F456-4B4E-B614-D816E10EAAE0}.tmp.1.dr	OLE document summary: edited time not present or 0

Source: ~WRD0000.tmp.1.dr	Initial sample: OLE zip file path = word/glossary/settings.xml
Source: ~WRD0000.tmp.1.dr	Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: ~WRD0000.tmp.1.dr	Initial sample: OLE zip file path = word/glossary/document.xml
Source: ~WRD0000.tmp.1.dr	Initial sample: OLE zip file path = word/glossary/fontTable.xml
Source: ~WRD0000.tmp.1.dr	Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: ~WRD0000.tmp.1.dr	Initial sample: OLE zip file path = word/glossary/styles.xml

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	3 Exploitation for Client Execution	Path Interception	1 Process Injection	3 Masquerading	OS Credential Dumping	1 File and Directory Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Extra Window Memory Injection	1 Process Injection	LSASS Memory	2 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	3 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	1 Extra Window Memory Injection	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	4 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	1 Ingress Tool Transfer	SIM Card Swap		Carrier Billing Fraud

Source	Detection	Scanner	Label
https://roaming.edog.	0%	URL Reputation	safe
https://ssl.scaletrk.com/click?o=79&a=16362:	0%	Avira URL Cloud	safe
https://cdn.entity.	0%	URL Reputation	safe
https://powerlift.acompli.net	0%	URL Reputation	safe
https://rpsticket.partnerservices.getmicrosoftkey.com	0%	URL Reputation	safe
https://cortana.ai	0%	URL Reputation	safe
https://ssl.scaletrk.com/click?o=79&a=1636	0%	Avira URL Cloud	safe
https://api.aadrm.com/	0%	URL Reputation	safe
https://ofcrecsvcapi-int.azurewebsites.net/	0%	URL Reputation	safe
https://ssl.scaletrk.com/click?o=135&a=16362	0%	Avira URL Cloud	safe
https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h	0%	Avira URL Cloud	safe
https://ssl.scaletrk.com/click?o=135&a=1636	0%	Avira URL Cloud	safe
https://res.getmicrosoftkey.com/api/redemptionevents	0%	URL Reputation	safe
https://powerlift-user.acompli.net	0%	URL Reputation	safe
https://officeci.azurewebsites.net/api/	0%	URL Reputation	safe
https://dns.google	0%	URL Reputation	safe
https://store.office.cn/addinstemplate	0%	URL Reputation	safe
https://api.aadrm.com	0%	URL Reputation	safe
https://dev0-api.acompli.net/autodetect	0%	URL Reputation	safe
https://www.odwebp.svc.ms	0%	URL Reputation	safe
https://api.addins.store.officeppe.com/addinstemplate	0%	URL Reputation	safe
https://ssl.scaletrk.com/click?o=135&a=16362:	0%	Avira URL Cloud	safe
https://dataservice.o365filtering.com/	0%	URL Reputation	safe
https://officesetup.getmicrosoftkey.com	0%	URL Reputation	safe
https://prod-global-autodetect.acompli.net/autodetect	0%	URL Reputation	safe
http://i.gratissesso.me/js/pushjs/1.0.0/utils.js	0%	Avira URL Cloud	safe
https://ncus.contentsync.	0%	URL Reputation	safe
https://ssl.scaletrk.com/click?o=79&a=16362	0%	Avira URL Cloud	safe
https://apis.live.net/v5.0/	0%	URL Reputation	safe
https://ssl.scaletrk.com/click?o=95&a=16362:	0%	Avira URL Cloud	safe
https://wus2.contentsync.	0%	URL Reputation	safe
https://asgsmsproxyapi.azurewebsites.net/	0%	URL Reputation	safe
http://i.gratissesso.me/js/pushjs/1.0.0/subscriber.js	0%	Avira URL Cloud	safe

Source: History Provider Cache.7.dr	String found in binary or memory: http://i.gratissesso.me/c/da57dc555e50572d?s1=149667&s2=1382674&click_id=c72c5c4350cf701a8c1f88e8492
Source: 365F7C69-9AE5-4CCF-AE98-CF3053869A9D.1.dr	String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: 365F7C69-9AE5-4CCF-AE98-CF3053869A9D.1.dr	String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: 5731ed72-884a-4c01-90eb-cac4f81da01b.tmp.8.dr, fb504025-b848-4a54-83ae-53762c3266e9.tmp.8.dr	String found in binary or memory: https://accounts.google.com
Source: craw_window.js.7.dr	String found in binary or memory: https://accounts.google.com/MergeSession
Source: 365F7C69-9AE5-4CCF-AE98-CF3053869A9D.1.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: 365F7C69-9AE5-4CCF-AE98-CF3053869A9D.1.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: 365F7C69-9AE5-4CCF-AE98-CF3053869A9D.1.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/authenticated
Source: 365F7C69-9AE5-4CCF-AE98-CF3053869A9D.1.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: 365F7C69-9AE5-4CCF-AE98-CF3053869A9D.1.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: 365F7C69-9AE5-4CCF-AE98-CF3053869A9D.1.dr	String found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticated
Source: 365F7C69-9AE5-4CCF-AE98-CF3053869A9D.1.dr	String found in binary or memory: https://addinslicensing.store.office.com/apps/remove
Source: 365F7C69-9AE5-4CCF-AE98-CF3053869A9D.1.dr	String found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: 365F7C69-9AE5-4CCF-AE98-CF3053869A9D.1.dr	String found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
Source: 365F7C69-9AE5-4CCF-AE98-CF3053869A9D.1.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
Source: 365F7C69-9AE5-4CCF-AE98-CF3053869A9D.1.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
Source: 365F7C69-9AE5-4CCF-AE98-CF3053869A9D.1.dr	String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: 365F7C69-9AE5-4CCF-AE98-CF3053869A9D.1.dr	String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 365F7C69-9AE5-4CCF-AE98-CF3053869A9D.1.dr	String found in binary or memory: https://api.aadrm.com
Source: 365F7C69-9AE5-4CCF-AE98-CF3053869A9D.1.dr	String found in binary or memory: https://api.aadrm.com/
Source: 365F7C69-9AE5-4CCF-AE98-CF3053869A9D.1.dr	String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: 365F7C69-9AE5-4CCF-AE98-CF3053869A9D.1.dr	String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: 365F7C69-9AE5-4CCF-AE98-CF3053869A9D.1.dr	String found in binary or memory: https://api.addins.store.office.com/addinstemplate
Source: 365F7C69-9AE5-4CCF-AE98-CF3053869A9D.1.dr	String found in binary or memory: https://api.addins.store.office.com/app/query
Source: 365F7C69-9AE5-4CCF-AE98-CF3053869A9D.1.dr	String found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
Source: 365F7C69-9AE5-4CCF-AE98-CF3053869A9D.1.dr	String found in binary or memory: https://api.cortana.ai
Source: 365F7C69-9AE5-4CCF-AE98-CF3053869A9D.1.dr	String found in binary or memory: https://api.diagnostics.office.com
Source: 365F7C69-9AE5-4CCF-AE98-CF3053869A9D.1.dr	String found in binary or memory: https://api.diagnosticssdf.office.com
Source: 365F7C69-9AE5-4CCF-AE98-CF3053869A9D.1.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/feedback
Source: 365F7C69-9AE5-4CCF-AE98-CF3053869A9D.1.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/file
Source: 365F7C69-9AE5-4CCF-AE98-CF3053869A9D.1.dr	String found in binary or memory: https://api.microsoftstream.com/api/
Source: 365F7C69-9AE5-4CCF-AE98-CF3053869A9D.1.dr	String found in binary or memory: https://api.office.net
Source: 365F7C69-9AE5-4CCF-AE98-CF3053869A9D.1.dr	String found in binary or memory: https://api.onedrive.com
Source: 365F7C69-9AE5-4CCF-AE98-CF3053869A9D.1.dr	String found in binary or memory: https://api.powerbi.com/beta/myorg/imports
Source: 365F7C69-9AE5-4CCF-AE98-CF3053869A9D.1.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: 365F7C69-9AE5-4CCF-AE98-CF3053869A9D.1.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: 5731ed72-884a-4c01-90eb-cac4f81da01b.tmp.8.dr, fb504025-b848-4a54-83ae-53762c3266e9.tmp.8.dr	String found in binary or memory: https://apis.google.com
Source: 365F7C69-9AE5-4CCF-AE98-CF3053869A9D.1.dr	String found in binary or memory: https://apis.live.net/v5.0/
Source: 365F7C69-9AE5-4CCF-AE98-CF3053869A9D.1.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection
Source: 365F7C69-9AE5-4CCF-AE98-CF3053869A9D.1.dr	String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/

Name	IP	Active	Malicious	Reputation
gstaticadssl.l.google.com	142.250.203.99	true	false	high
tinyurl.com	104.20.139.65	true	false	high
accounts.google.com	142.250.185.237	true	false	high
www-googletagmanager.l.google.com	142.250.186.104	true	false	high
ssl.scaletrk.com	18.192.75.235	true	false	unknown
j1.jump4geo.com	52.19.101.114	true	false	unknown
clients.l.google.com	142.250.184.238	true	false	high
googlehosted.l.googleusercontent.com	142.250.185.65	true	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
clients2.google.com	unknown	unknown	false	high
i.gratissesso.me	unknown	unknown	false	unknown

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.diagnosticssdf.office.com	365F7C69-9AE5-4CCF-AE98-CF3053869A9D.1.dr	false		high
https://login.microsoftonline.com/	365F7C69-9AE5-4CCF-AE98-CF3053869A9D.1.dr	false		high
https://shell.suite.office.com:1443	365F7C69-9AE5-4CCF-AE98-CF3053869A9D.1.dr	false		high
https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize	365F7C69-9AE5-4CCF-AE98-CF3053869A9D.1.dr	false		high
https://autodiscover-s.outlook.com/	365F7C69-9AE5-4CCF-AE98-CF3053869A9D.1.dr	false		high
https://roaming.edog.	365F7C69-9AE5-4CCF-AE98-CF3053869A9D.1.dr	false	URL Reputation: safe	unknown
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr	365F7C69-9AE5-4CCF-AE98-CF3053869A9D.1.dr	false		high
https://ssl.scaletrk.com/click?o=79&a=16362:	History Provider Cache.7.dr	false	Avira URL Cloud: safe	unknown
https://cdn.entity.	365F7C69-9AE5-4CCF-AE98-CF3053869A9D.1.dr	false	URL Reputation: safe	unknown
https://api.addins.omex.office.net/appinfo/query	365F7C69-9AE5-4CCF-AE98-CF3053869A9D.1.dr	false		high
https://clients.config.office.net/user/v1.0/tenantassociationkey	365F7C69-9AE5-4CCF-AE98-CF3053869A9D.1.dr	false		high
https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/	365F7C69-9AE5-4CCF-AE98-CF3053869A9D.1.dr	false		high
https://powerlift.acompli.net	365F7C69-9AE5-4CCF-AE98-CF3053869A9D.1.dr	false	URL Reputation: safe	unknown
https://rpsticket.partnerservices.getmicrosoftkey.com	365F7C69-9AE5-4CCF-AE98-CF3053869A9D.1.dr	false	URL Reputation: safe	unknown
https://lookup.onenote.com/lookup/geolocation/v1	365F7C69-9AE5-4CCF-AE98-CF3053869A9D.1.dr	false		high
https://cortana.ai	365F7C69-9AE5-4CCF-AE98-CF3053869A9D.1.dr	false	URL Reputation: safe	unknown
https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	365F7C69-9AE5-4CCF-AE98-CF3053869A9D.1.dr	false		high
https://cloudfiles.onenote.com/upload.aspx	365F7C69-9AE5-4CCF-AE98-CF3053869A9D.1.dr	false		high
https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile	365F7C69-9AE5-4CCF-AE98-CF3053869A9D.1.dr	false		high
https://entitlement.diagnosticssdf.office.com	365F7C69-9AE5-4CCF-AE98-CF3053869A9D.1.dr	false		high
https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy	365F7C69-9AE5-4CCF-AE98-CF3053869A9D.1.dr	false		high
https://api.aadrm.com/	365F7C69-9AE5-4CCF-AE98-CF3053869A9D.1.dr	false	URL Reputation: safe	unknown
https://ofcrecsvcapi-int.azurewebsites.net/	365F7C69-9AE5-4CCF-AE98-CF3053869A9D.1.dr	false	URL Reputation: safe	unknown
https://www.google.com	5731ed72-884a-4c01-90eb-cac4f81da01b.tmp.8.dr, fb504025-b848-4a54-83ae-53762c3266e9.tmp.8.dr	false		high
https://ssl.scaletrk.com/click?o=135&a=16362	History Provider Cache.7.dr	false	Avira URL Cloud: safe	unknown
https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies	365F7C69-9AE5-4CCF-AE98-CF3053869A9D.1.dr	false		high
https://api.microsoftstream.com/api/	365F7C69-9AE5-4CCF-AE98-CF3053869A9D.1.dr	false		high
https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive	365F7C69-9AE5-4CCF-AE98-CF3053869A9D.1.dr	false		high
https://cr.office.com	365F7C69-9AE5-4CCF-AE98-CF3053869A9D.1.dr	false		high
https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h	365F7C69-9AE5-4CCF-AE98-CF3053869A9D.1.dr	false	Avira URL Cloud: safe	low
https://portal.office.com/account/?ref=ClientMeControl	365F7C69-9AE5-4CCF-AE98-CF3053869A9D.1.dr	false		high
https://www.google.com/accounts/OAuthLogin?issueuberauth=1	craw_window.js.7.dr	false		high
https://graph.ppe.windows.net	365F7C69-9AE5-4CCF-AE98-CF3053869A9D.1.dr	false		high
https://res.getmicrosoftkey.com/api/redemptionevents	365F7C69-9AE5-4CCF-AE98-CF3053869A9D.1.dr	false	URL Reputation: safe	unknown
https://powerlift-user.acompli.net	365F7C69-9AE5-4CCF-AE98-CF3053869A9D.1.dr	false	URL Reputation: safe	unknown
https://tasks.office.com	365F7C69-9AE5-4CCF-AE98-CF3053869A9D.1.dr	false		high
https://officeci.azurewebsites.net/api/	365F7C69-9AE5-4CCF-AE98-CF3053869A9D.1.dr	false	URL Reputation: safe	unknown
https://sr.outlook.office.net/ws/speech/recognize/assistant/work	365F7C69-9AE5-4CCF-AE98-CF3053869A9D.1.dr	false		high
https://dns.google	5731ed72-884a-4c01-90eb-cac4f81da01b.tmp.8.dr, fb504025-b848-4a54-83ae-53762c3266e9.tmp.8.dr, acfb3dc1-35df-4491-a4e6-1c3e16318bce.tmp.8.dr	false	URL Reputation: safe	unknown
https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p	craw_window.js.7.dr, craw_background.js.7.dr	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
18.192.75.235	ssl.scaletrk.com	United States	16509	AMAZON-02US	false
104.20.139.65	tinyurl.com	United States	13335	CLOUDFLARENETUS	false
142.250.185.237	accounts.google.com	United States	15169	GOOGLEUS	false
52.19.101.114	j1.jump4geo.com	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.184.238	clients.l.google.com	United States	15169	GOOGLEUS	false
142.250.203.99	gstaticadssl.l.google.com	United States	15169	GOOGLEUS	false
142.250.186.104	www-googletagmanager.l.google.com	United States	15169	GOOGLEUS	false
142.250.185.65	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	610796
Start date and time: 18/04/202218:04:17	2022-04-18 18:04:17 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 22s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	000.docx
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Run name:	Potential for more IOCs and behavior
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean2.winDOCX@27/110@6/13
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .docx Adjust boot time Enable AMSI Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Browse link: https://tinyurl.com/carmela00 Scroll down Close Viewer

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
104.20.139.65	0B7410C41DD49A7A43487FA0E56F5B336951609E67B87.exe	Get hash	malicious	Browse	tinyurl.com/4jecay9v
	yt64cMMhTw.exe	Get hash	malicious	Browse	tinyurl.com/38amadeus01261
	034E8E297165EEB14372EEA7A7E68756E561DF39B84C5.exe	Get hash	malicious	Browse	tinyurl.com/4jecay9v
	p2iZplibsb.exe	Get hash	malicious	Browse	tinyurl.com/4jecay9v
	EarZA1AonY.exe	Get hash	malicious	Browse	tinyurl.com/4jecay9v
	SecuriteInfo.com.Heur.3552.xls	Get hash	malicious	Browse	tinyurl.com/4q2y4afm
	product_qoute_6847684898.xls	Get hash	malicious	Browse	tinyurl.com/sd32242134

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
tinyurl.com	tipp.exe	Get hash	malicious	Browse	64.62.243.82
	33586405.exe	Get hash	malicious	Browse	64.62.243.82
	91141640.exe	Get hash	malicious	Browse	64.62.243.82
	https://tinyurl.com/22eh8bne	Get hash	malicious	Browse	104.20.139.65
	ConsoleAppVV.exe	Get hash	malicious	Browse	104.20.138.65
	N6ePDKSEDC.exe	Get hash	malicious	Browse	64.62.243.82
	0CBA0F9DAFBB15B07C0E8B87CCD3EA7C306198B67DD48.exe	Get hash	malicious	Browse	64.62.243.82
	0B7410C41DD49A7A43487FA0E56F5B336951609E67B87.exe	Get hash	malicious	Browse	104.20.138.65
	0B7410C41DD49A7A43487FA0E56F5B336951609E67B87.exe	Get hash	malicious	Browse	104.20.139.65
	yt64cMMhTw.exe	Get hash	malicious	Browse	104.20.138.65
	Invoice 20221901.exe	Get hash	malicious	Browse	172.67.1.225
	O0UY1OOM0Z.exe	Get hash	malicious	Browse	172.67.1.225
	034E8E297165EEB14372EEA7A7E68756E561DF39B84C5.exe	Get hash	malicious	Browse	104.20.139.65
	0AB9CD8D5F1DA2D03AB76DB5BE55DBBCB575EC0D8785D.exe	Get hash	malicious	Browse	172.67.1.225
	Divergencias.exe	Get hash	malicious	Browse	104.20.138.65
	Divergencias.exe	Get hash	malicious	Browse	104.20.139.65
	PO#098273.html	Get hash	malicious	Browse	104.20.138.65
	PO#098273.html	Get hash	malicious	Browse	172.67.1.225
	tributaria.exe	Get hash	malicious	Browse	172.67.1.225
	hrebBwxQXQ.exe	Get hash	malicious	Browse	172.67.1.225
j1.jump4geo.com	Swift copy.exe	Get hash	malicious	Browse	52.19.101.114
	Shipment Docs.exe	Get hash	malicious	Browse	52.19.101.114
	Purchase order.exe	Get hash	malicious	Browse	52.19.101.114
	Revised PI.exe	Get hash	malicious	Browse	52.19.101.114
	payment.exe	Get hash	malicious	Browse	52.19.101.114
	PO N0-2600002488_PDF.exe	Get hash	malicious	Browse	52.19.101.114
	Payment.exe	Get hash	malicious	Browse	54.228.153.41
	SecuriteInfo.com.W32.AIDetect.malware2.2724.exe	Get hash	malicious	Browse	54.228.153.41
	b97NYb1Qg3.exe	Get hash	malicious	Browse	54.228.153.41
	atZdmSgC4J.exe	Get hash	malicious	Browse	54.228.153.41
	HmNbJdmFSY.exe	Get hash	malicious	Browse	54.228.153.41
	https://www.thegoodplan.ovh	Get hash	malicious	Browse	3.248.111.124
	http://watchingsquare.com/cgi-bin/r.cgi?p=15001&i=4f7d5e66&j=333&m=04ac7852a72b37d5252e09f704509df5&h=www.szigetiedit.hu&u=/cd/Gyerekek/Magyar_jatekok/pages/Keresztrejtveny%2024%20allattal.html&q=&t=20190719153342	Get hash	malicious	Browse	18.200.159.16
	http://www.thepawshdog.com/	Get hash	malicious	Browse	52.50.18.181
	http://www.sharebutton.co	Get hash	malicious	Browse	52.50.18.181
	http://tracking.onlinebesteducation.com/campaigns/gg5264rz9sa20/track-url/kx3049341c95c/ae3b8194d0ab224de956b50a0999362ac5ef5ba8	Get hash	malicious	Browse	52.211.95.198

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
AMAZON-02US	T1 Transfera document 63553645364.vbs	Get hash	malicious	Browse	3.249.18.57
	STATEMENT 4142022.html	Get hash	malicious	Browse	54.230.206.25
	http://jim.cutter83446.otojaponeyupusta.com/Cinbell/aHR0cHM6Ly90YnNtZXRhbC5jb20vcmVkLzxOVU1CRVI3Pi9qaW0uY3V0dGVyQGNpbmJlbGwuY29t	Get hash	malicious	Browse	143.204.243.109
	https://elitecustomglass.com/?utm_source=bing&utm_medium=cpc&utm_campaign=Branding%20-%20Search&utm_term=elitecustomglass&utm_content=Elite%20Custom%20Glass%20-%20Only	Get hash	malicious	Browse	52.222.189.12
	HUCz54Ez73	Get hash	malicious	Browse	54.127.233.8
	http://www.ms-activate.com/reject-password#tno@way.com	Get hash	malicious	Browse	52.84.140.60
	https://s3.eu-west-1.amazonaws.com/voicemprompt/304904323425.pdf	Get hash	malicious	Browse	99.84.158.33
	sky7765463554.exe	Get hash	malicious	Browse	13.214.5.92
	PMT06127412000.exe	Get hash	malicious	Browse	3.110.216.64
	https://ironworldl-fencing.mypixieset.com/	Get hash	malicious	Browse	99.84.158.60
	ajLRgB06H1	Get hash	malicious	Browse	18.253.96.23
	qwUQud4KHq	Get hash	malicious	Browse	18.195.198.234
	wuxznEjJoI	Get hash	malicious	Browse	13.252.213.54
	TRELakPzu5.exe	Get hash	malicious	Browse	18.197.239.5
	Xyu2DPv1gU	Get hash	malicious	Browse	34.212.157.154
	xLqrVI9xbv	Get hash	malicious	Browse	54.126.166.12
	dAUDXNXEoZ	Get hash	malicious	Browse	184.77.31.186
	http://162.247.72.199	Get hash	malicious	Browse	15.188.95.229
	D4wjfqiOf1	Get hash	malicious	Browse	184.78.239.141
	meihao.x86	Get hash	malicious	Browse	99.81.3.142
CLOUDFLARENETUS	Statement851.htm	Get hash	malicious	Browse	104.18.10.207
	STATEMENT 4142022.html	Get hash	malicious	Browse	104.18.11.207
	Your_File_Is_Ready_To_Download.exe	Get hash	malicious	Browse	104.18.88.101
	Brfcxjv.exe	Get hash	malicious	Browse	162.159.134.233
	NEW ORDER 9421056G_00529941.exe	Get hash	malicious	Browse	188.114.96.7
	Hesap Hareketleri.exe	Get hash	malicious	Browse	188.114.96.7
	http://jim.cutter83446.otojaponeyupusta.com/Cinbell/aHR0cHM6Ly90YnNtZXRhbC5jb20vcmVkLzxOVU1CRVI3Pi9qaW0uY3V0dGVyQGNpbmJlbGwuY29t	Get hash	malicious	Browse	104.17.25.14
	Acunetix Premium Activation Tool.exe	Get hash	malicious	Browse	188.114.97.7
	https://t6eki5.axshare.com/#id=toh4sh&p=page_1&c=1	Get hash	malicious	Browse	104.17.204.204
	https://crimson-butterfly-3076.on.fleek.co/	Get hash	malicious	Browse	104.18.6.145
	http://www.ms-activate.com/reject-password#tno@way.com	Get hash	malicious	Browse	104.16.13.194
	Receivable-Statement.exe	Get hash	malicious	Browse	162.159.138.232
	https://ironworldl-fencing.mypixieset.com/	Get hash	malicious	Browse	188.114.96.140
	ajLRgB06H1	Get hash	malicious	Browse	162.159.156.20
	U8rM3A6kDo.exe	Get hash	malicious	Browse	162.159.134.233
	https://cdn.discordapp.com/attachments/926917160364806166/957780798910644314/svhost.exe	Get hash	malicious	Browse	104.20.67.143
	https://cdn.discordapp.com/attachments/926917160364806166/957780798910644314/svhost.exe	Get hash	malicious	Browse	162.159.130.233
	BZfApQSvig.exe	Get hash	malicious	Browse	104.25.233.53
	YyuMVv3pBr.exe	Get hash	malicious	Browse	188.114.96.7
	pandora.arm7	Get hash	malicious	Browse	1.15.145.128

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	451603
Entropy (8bit):	5.009711072558331
Encrypted:	false
SSDEEP:	12288:ZHfRTyGZ6lup8Cfrvq4JBPKh+FBlESBw4p6:NfOCzvRKhGvwJ
MD5:	A78AD14E77147E7DE3647E61964C0335
SHA1:	CECC3DD41F4CEA0192B24300C71E1911BD4FCE45
SHA-256:	0D6803758FF8F87081FAFD62E90F0950DFB2DD7991E9607FE76A8F92D0E893FA
SHA-512:	DDE24D5AD50D68FC91E9E325D31E66EF8F624B6BB3A07D14FFED1104D3AB5F4EF1D7969A5CDE0DFBB19CB31C506F7DE97AF67C2F244F7E7E8E10648EA8321101
Malicious:	false
Reputation:	high, very likely benign file
Preview:	BDic.... ....6...."..Z..4g....6.2...{/...3...5....AF 1363.AF nm.AF pt.AF n1.AF p.AF tc.AF SM.AF M.AF S.AF MS.AF MNR.AF GDS.AF MNT.AF MH.AF MR.AF SZMR.AF MJ.AF MT.AF MY.AF MRZ.AF MN.AF MG.AF RM.AF N.AF MV.AF XM.AF DSM.AF SD.AF G.AF R.AF MNX.AF MRS.AF MD.AF MNRB.AF B.AF ZSMR.AF PM.AF SMNGJ.AF SMN.AF ZMR.AF SMGB.AF MZR.AF GM.AF SMR.AF SMDG.AF RMZ.AF ZM.AF MDG.AF MDT.AF SMNXT.AF SDY.AF LSDG.AF LGDS.AF GLDS.AF UY.AF U.AF DSGNX.AF GNDSX.AF DSG.AF Y.AF GS.AF IEMS.AF YP.AF ZGDRS.AF XGNVDS.AF UT.AF GNDS.AF GVDS.AF MYPS.AF XGNDS.AF TPRY.AF MDSG.AF ZGSDR.AF DYSG.AF PMYTNS.AF AGDS.AF DRZGS.AF PY.AF GSPMDY.AF EGVDS.AF SL.AF GNXDS.AF DSBG.AF IM.AF I.AF MDGS.AF SMY.AF DSGN.AF DSLG.AF GMDS.AF MDSBG.AF SGD.AF IY.AF P.AF DSMG.AF BLZGDRS.AF TR.AF AGSD.AF ZGBDRSL.AF PTRY.AF ASDGV.AF ASM.AF ICANGSD.AF ICAM.AF IKY.AF AMS.AF PMYTRS.AF BZGVDRS.AF SDRBZG.AF GVMDS.AF PSM.AF DGLS.AF GNVXDS.AF AGDSL.AF DGS.AF XDSGNV.AF BZGDRS.AF AM.AF AS.AF A.AF LDSG.AF AGVDS.AF SDG.AF LDSMG.AF EDSMG.AF EY.AF DRSMZG.AF PRYT.AF LZ

Process:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
File Type:	XML 1.0 document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	144710
Entropy (8bit):	5.356925740834559
Encrypted:	false
SSDEEP:	1536:ucQIfgxgBdB3guw0/Q9DQW+zzWk4F77nXmvidZXHETLWZ69:oIQ9DQW+zyXkf
MD5:	786EC89ECC8EDB39B277CDE965351AE8
SHA1:	1458A959782BD43E743CF6A009D451BFB53C2C0C
SHA-256:	071A9C338EBC7B76B30C4F66E59CC9695DEBE40C9CE08793FB840468D68CC775
SHA-512:	983CACD490B0F6BCF3CDD0B828EBA3AAE667E0A11DFD7F740851F67683B7A1476CC2C9901624E19A0EB6DF32FE19281ADBF1AAD337FF0F58CE2DC21408F2665A
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2022-04-18T16:05:32">.. Build: 16.0.15210.30525-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://rr.office.microsoft.com/research/query.asmx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. </o:service>.. <o:service o:name="ClViewClientHome">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. </o:service>.. <o:service o:name="ClViewClientTemplate">.. <o:url>https://ocsa.office.microsoft.com/client/15/help/template</o:url>.. </o:service>.. <o:

File type:	Microsoft Word 2007+
Entropy (8bit):	7.900012000724075
TrID:	Word Microsoft Office Open XML Format document (49504/1) 49.01% Word Microsoft Office Open XML Format document (43504/1) 43.07% ZIP compressed archive (8000/1) 7.92%
File name:	000.docx
File size:	140707
MD5:	6dac61eecd8791841e234cfd1da3919b
SHA1:	3fc7fa088e1e846a0f01caccef625ccdb8b8da4a
SHA256:	5ec5f9fca53aa5778d5e5da7b6bba287132f098955090caeff06dd1a67bc42e3
SHA512:	7f1f9306f59d2227e964527b148a81d9ba731f5438b5b1f91855707e2d98976d44afd2c584e53cecdf52cdac8a9231f0436ed7868c4f24337bab7c6ebd365513
SSDEEP:	1536:vOFwYuh+aCBcSOnee3+6nJk6NlwN3zdomMWmbrInfZV5ewZvtlFwYRV47ItSUVrq:zochl3ny9JkIBJvZT47ItSU5GtZOOx
TLSH:	3DD312F1DB08B62FC2AE82FED441D2F4EB5EEAA60368BD895973E16851708C2C551D43
File Content Preview:	PK..........!....us...T.......[Content_Types].xml ...(.........................................................................................................................................................................................................

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 18, 2022 18:06:16.380534887 CEST	50125	53	192.168.2.7	8.8.8.8
Apr 18, 2022 18:06:16.402307987 CEST	53	50125	8.8.8.8	192.168.2.7
Apr 18, 2022 18:06:16.539907932 CEST	51824	53	192.168.2.7	8.8.8.8
Apr 18, 2022 18:06:16.558571100 CEST	53	51824	8.8.8.8	192.168.2.7
Apr 18, 2022 18:06:16.581903934 CEST	65214	53	192.168.2.7	8.8.8.8
Apr 18, 2022 18:06:16.608211994 CEST	53	65214	8.8.8.8	192.168.2.7
Apr 18, 2022 18:06:17.700193882 CEST	60920	53	192.168.2.7	8.8.8.8
Apr 18, 2022 18:06:17.721002102 CEST	53	60920	8.8.8.8	192.168.2.7
Apr 18, 2022 18:06:18.794739962 CEST	51160	53	192.168.2.7	8.8.8.8
Apr 18, 2022 18:06:18.832268000 CEST	53	51160	8.8.8.8	192.168.2.7
Apr 18, 2022 18:06:19.781738997 CEST	59447	443	192.168.2.7	142.250.184.238
Apr 18, 2022 18:06:19.806492090 CEST	443	59447	142.250.184.238	192.168.2.7
Apr 18, 2022 18:06:19.808437109 CEST	59447	443	192.168.2.7	142.250.184.238
Apr 18, 2022 18:06:19.833225012 CEST	443	59447	142.250.184.238	192.168.2.7
Apr 18, 2022 18:06:19.833272934 CEST	443	59447	142.250.184.238	192.168.2.7
Apr 18, 2022 18:06:19.833297014 CEST	443	59447	142.250.184.238	192.168.2.7
Apr 18, 2022 18:06:19.833338976 CEST	443	59447	142.250.184.238	192.168.2.7
Apr 18, 2022 18:06:19.839502096 CEST	59447	443	192.168.2.7	142.250.184.238
Apr 18, 2022 18:06:19.840560913 CEST	59447	443	192.168.2.7	142.250.184.238
Apr 18, 2022 18:06:19.934354067 CEST	59447	443	192.168.2.7	142.250.184.238
Apr 18, 2022 18:06:19.940239906 CEST	59447	443	192.168.2.7	142.250.184.238
Apr 18, 2022 18:06:19.966850042 CEST	443	59447	142.250.184.238	192.168.2.7
Apr 18, 2022 18:06:19.980659962 CEST	443	59447	142.250.184.238	192.168.2.7
Apr 18, 2022 18:06:19.980705023 CEST	443	59447	142.250.184.238	192.168.2.7
Apr 18, 2022 18:06:19.997384071 CEST	443	59447	142.250.184.238	192.168.2.7
Apr 18, 2022 18:06:20.004298925 CEST	59447	443	192.168.2.7	142.250.184.238
Apr 18, 2022 18:06:20.004621983 CEST	59447	443	192.168.2.7	142.250.184.238
Apr 18, 2022 18:06:20.045171976 CEST	59447	443	192.168.2.7	142.250.184.238
Apr 18, 2022 18:06:34.998007059 CEST	49182	53	192.168.2.7	8.8.8.8
Apr 18, 2022 18:06:35.014584064 CEST	53	49182	8.8.8.8	192.168.2.7

Timestamp	kBytes transferred	Direction	Data
Apr 18, 2022 18:06:18.997771978 CEST	1978	OUT	GET /c/da57dc555e50572d?s1=149667&s2=1382674&click_id=c72c5c4350cf701a8c1f88e8492ea2e2&j1=1 HTTP/1.1 Host: i.gratissesso.me Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Apr 18, 2022 18:06:19.063214064 CEST	1979	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 18 Apr 2022 16:06:19 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: unique_id=625d8c7b0004d968; Path=/; Expires=Fri, 17 Jun 2022 16:06:19 GMT Set-Cookie: unique_id2=625d8c7b0006a03f; Path=/; Expires=Sun, 17 Jul 2022 16:06:19 GMT Set-Cookie: 625d8c7b0006a03f_c=1; Path=/; Expires=Sun, 17 Jul 2022 16:06:19 GMT Set-Cookie: ref_token=149667; Path=/; Expires=Wed, 18 May 2022 16:06:19 GMT Set-Cookie: impression=; Path=/; Expires=Mon, 18 Apr 2022 16:06:19 GMT Set-Cookie: 625d8c7b0006a03f_sl=[271434]; Path=/; Expires=Mon, 02 May 2022 16:06:19 GMT Content-Encoding: gzip Data Raw: 31 35 38 62 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 1d 69 77 db b8 f1 7b 7e 05 c2 6e 4d f9 c5 a2 44 5d 3e e5 bc c4 ce d5 cd b5 b1 d3 ec d6 9b ea 51 24 24 52 a6 08 2e 41 4a d6 6e fd df 3b 03 92 e2 29 89 3e 92 d7 97 1a 2f d1 01 0c 30 83 c1 9c 00 44 1f 3d 3e fd 70 72 fe db c7 17 e4 f5 f9 bb b7 c7 47 a6 3f b5 89 ad 39 e3 be 44 9d fa e7 33 09 aa a8 66 1c 1f 4d a9 af 11 dd d4 3c 4e fd be f4 f9 fc 65 7d 0f da 86 1a a7 c4 f4 e8 a8 2f 99 be ef f2 83 46 43 37 9c fa d0 9a 5a 8a 76 a9 4d 35 eb 4f 6a 28 0e f5 01 96 eb 9e e5 fa c7 a3 c0 d1 7d 8b 39 04 60 86 c3 da 36 f9 eb 11 81 32 d3 3c c2 67 a4 1f 7d c5 22 1b a3 bd 5e 6f 7f 7f d4 53 db 4d aa 76 54 f9 80 c8 f2 0e 91 5b 6a 67 6f b7 d9 32 76 f5 d6 ee 5e cb 18 c5 f5 cd 51 b7 ad ab 2d bd b5 df 1a 8d 46 dd a1 a8 17 c3 5d 1f 2e 91 98 1a 37 01 cd dc 72 0c 36 57 6c a6 6b 48 8d e2 6a be e9 68 53 aa 78 d4 b5 35 9d d6 e4 86 de c0 41 e5 ed a4 6f e0 d9 65 5d 3d e6 33 9d d9 e4 09 91 1b 0d 19 de f2 10 26 e3 7e 49 75 8c 33 44 60 8d 48 4d 10 b7 b5 25 88 54 6c ea 8c 7d 93 1c 13 15 ab f8 ec 02 6b bf 6e a7 38 f4 8d e8 c9 f2 00 00 11 31 b0 22 fa b6 a4 24 a4 fb 7a c9 1e 3d f0 50 16 4a 48 c2 ea 84 8d f6 1f 01 f5 16 25 60 9c 6a 9e 6e 2e d1 4b 4f a5 1d 22 49 db 0a 77 6d cb af c9 5b e9 b5 70 e2 41 24 ae f6 d5 ce 7e af b7 bb c5 5b 7d b5 bd d7 ea ed 76 b6 78 bb bf c5 bb fd a1 a6 5f 06 9c 7a 5b ba 6d e9 97 03 cb e8 eb bb 2d bd ab 77 da dd a6 3e da 6d aa da 9e ae 8e f6 f6 e8 5e 67 bf 45 b5 16 6d 6d 59 f4 ca 75 fb ea d6 04 86 95 32 a8 73 b8 2f e9 82 03 fe 8b af 21 51 23 e6 91 1a b6 4e fa cd c3 c9 51 08 13 2d e2 e1 e4 c9 93 f4 c2 25 03 28 6e c0 cd 5a f8 fd 62 f2 35 c6 d7 97 b7 2f 9a 09 87 cb 10 d8 eb 10 20 98 3f 75 81 3c bb 64 e8 c3 25 1c 0a 5d 8a 18 58 0f 7a f5 61 54 83 ae 88 9e f4 fb 7d 52 57 d3 03 27 d4 87 94 87 90 20 15 52 5f 82 57 fc aa 7e 4d 21 b8 4e cf 20 94 57 7c 05 d1 7c 8a b2 14 0d 35 61 96 53 93 b6 a4 a8 a3 0f 0b 9b a0 34 2d ee b3 08 df 99 af f9 b4 f6 d7 f5 8e d0 78 18 29 85 6a 13 dc 12 30 12 3b e6 b8 cc e5 08 08 44 2d cd Data Ascii: 158biw{~nMD]>Q$$R.AJn;)>/0D=>prG?9D3fM<Ne}/FC7ZvM5Oj(}9`62<g}"^oSMvT[jgo2v^Q-F].7r6WlkHjhSx5Aoe]=3&~Iu3D`HM%Tl}kn81"$z=PJH%`jn.KO"Iwm[pA$~[}vx_z[m-w>m^gEmmYu2s/!Q#NQ-%(nZb5/ ?u<d%]XzaT}RW' R_W~M!N W\|\|5aS4-x)j0;D-
Apr 18, 2022 18:06:19.063282013 CEST	1980	IN	Data Raw: 52 8d ce f2 f3 45 26 d1 d9 85 2c 60 e5 af f9 e6 d4 90 f4 ca f2 71 30 cd e6 f4 b0 00 84 e3 44 3a b2 e4 b4 1c cb 9b bc 4d 1e 97 72 bb 1c 85 ef 05 25 18 ae 0b 35 4b dd 8a 95 2a cb b3 6c a7 c8 4c 5e 13 e8 a3 9b 30 e9 ab 34 31 3a 73 38 b3 29 a8 eb 18 Data Ascii: RE&,`q0D:Mr%5K*lL^041:s8)[b}p/m}&5nzlJI=Is_\5D6j'65GYcZA~6H]BD8n}0^[5P&O eE&xqd'+_^,)e_[0]"_[>"e4K
Apr 18, 2022 18:06:19.063306093 CEST	1982	IN	Data Raw: b6 c6 79 4d 9e 59 dc 1a da 34 e4 de 75 8c 1a 19 98 6c a8 27 72 93 19 04 b4 44 16 aa 98 8a fb 6b db 59 3d 99 32 b2 dc b8 16 22 94 10 0c 38 70 1b 6a 87 48 83 a1 ad 39 97 52 4a 76 90 08 e8 0a e2 eb 04 b6 8d 1e 2e fc b6 94 e5 a4 2a 97 47 84 65 ca 94 Data Ascii: yMY4ul'rDkY=2"8pjH9RJv.*Gex]e4Y'mgrmu$9m]B?KYghvVH&.i,Ao2$-Ow\-t1PL-_rEc}\maa?-]Ij_8yNT
Apr 18, 2022 18:06:19.063328028 CEST	1983	IN	Data Raw: 84 7b a3 52 ac 53 4a 38 b9 be 3c 67 60 13 e4 02 1f 5e d2 29 44 c3 a4 62 c9 cd 5d ab 36 01 07 c8 0e 69 ef dc 8e f6 52 ca df dd 89 ee 70 b1 8a af 79 65 b9 a3 52 e0 ac d5 5e 8e f6 67 3e 06 fe 10 08 3c 26 1b cb 3d 6a 82 ce 6c e6 15 d9 68 69 bd 7d 62 Data Ascii: {RSJ8<g`^)Db]6iRpyeR^g><&=jlhi}buTz5!`58rJT,+1!~^Xi75JPQ<cT,wVdgb:KG39nM%KVI{7RRf^Q nZ6"I9%`#AK=!28eSN@
Apr 18, 2022 18:06:19.063348055 CEST	1984	IN	Data Raw: 9d fb d2 d0 4e 2e 0a a6 57 79 56 a4 cb 66 a1 2f 28 67 16 c1 b9 d8 8f 73 2e c9 5c e3 64 6c cd a8 43 86 10 6b 92 91 67 41 20 bc 03 ea 20 73 32 81 d5 86 80 d8 7d 8c e0 1e 85 1a 87 c5 fe 73 0e a1 29 c4 ca 42 45 a3 ab 18 df 53 4d 3b 0f 6a 5a 91 f0 1f Data Ascii: N.WyVf/(gs.\dlCkgA s2}s)BESM;jZWM{_j=;5.,]by6z2OY9<z.zZ.Fx{MoFZ}Z-X{E`4620~.Bz: udHF>(1qHc
Apr 18, 2022 18:06:20.096179962 CEST	2466	OUT	GET /js/pushjs/1.0.0/subscriber.js HTTP/1.1 Host: i.gratissesso.me Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: / Referer: http://i.gratissesso.me/c/da57dc555e50572d?s1=149667&s2=1382674&click_id=c72c5c4350cf701a8c1f88e8492ea2e2&j1=1 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: unique_id=625d8c7b0004d968; unique_id2=625d8c7b0006a03f; 625d8c7b0006a03f_c=1; ref_token=149667; 625d8c7b0006a03f_sl=[271434]
Apr 18, 2022 18:06:20.144944906 CEST	2540	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 18 Apr 2022 16:06:20 GMT Content-Type: application/javascript Transfer-Encoding: chunked Connection: keep-alive Expires: Mon, 25 Apr 2022 16:06:20 GMT Cache-Control: max-age=604800 Content-Encoding: gzip Data Raw: 63 65 31 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b5 5a 6d 73 db 36 12 fe 7e bf 82 c6 dc e8 c8 31 4d 49 4e d3 a4 52 19 4d 6d a7 57 77 f2 d6 c8 b9 ce 9c ab c9 50 24 24 b1 91 08 16 20 6d cb b2 fe fb 3d 0b be 8a a2 ec f4 ae 37 93 91 41 70 b1 58 ec 2e 9e 7d 61 58 aa b8 a1 12 19 fa 09 1b de 78 d2 50 0b 71 7b c1 a7 e9 dc 3d ea db b1 27 93 f5 65 e0 32 ff a7 7f dd 7b ff fc 79 3d 7d 16 dc ff fb 4a 7c fb cb e9 e2 a7 77 5f ee d2 5f e6 ae cb ec 34 1c 73 79 c3 e5 27 b9 74 6f c3 28 10 b7 ce 52 f8 5e 12 8a c8 11 32 9c 87 d1 31 eb fe ae 98 ed c5 35 4a b6 48 92 58 0d ba dd c0 f3 c2 e5 3a e2 b7 ca f1 c5 8a d9 ea 76 ec 8b 98 3f c6 aa cb 6c 3f 55 89 58 fd 2a e4 17 2e 7f 1e bb 4c 81 71 e8 f3 93 5b 3d e3 d0 76 71 aa 16 e7 22 9a 85 73 77 93 48 cf ff 72 e1 25 de 60 a3 12 2f f9 e0 49 6f a5 06 d7 cc 17 69 94 c8 35 b3 99 1f 26 d9 9f 80 4d ec 54 2e 4b 12 d5 c7 b4 3a a5 9f 67 f4 f3 0d 7e 24 9f e1 97 7b 69 0a 72 9b 25 7a 51 c0 49 02 ac 58 79 10 01 d3 2b 11 f0 25 9b 6c 6d 15 06 03 c6 88 ab 1a 6c 7c 11 41 05 0a 47 a2 b9 80 47 21 d7 6f 55 ea fb 5c 29 0c b7 5b 7b 85 91 87 e3 42 f4 ad 0d 45 f0 3b 1e 5c 9c 15 a7 99 7a 8a bf f3 56 7c c0 54 3a 55 be 0c a7 5c d2 e1 c0 24 11 f2 b1 57 01 8d df 7a f1 00 fa 36 f0 d7 2e 44 39 ad 6d f3 e3 f9 db fd 9d 66 fe ea 73 22 be f0 e8 73 c0 13 58 4c 7d 0e a6 3b fb 55 04 62 fa 3b f7 93 cf 63 7a f7 d4 be fd ad b6 d3 1b 21 e2 0b b1 f2 c2 48 b9 9b 20 1b 40 93 77 eb 7b a7 e9 1f ec 7e 7d d7 32 79 b7 de 9f bc bb 6f 99 5c df b7 2c 5f df ed 6d 34 b1 21 76 28 71 12 b8 eb 40 bb 2b bc f5 f6 f6 d6 39 f5 17 5e e2 f8 cb 74 da f5 bb a7 bd a9 f7 e2 bb e9 cb 97 2f bf 7d f1 ac e7 cd 46 aa ef 5e ab fe a4 a3 4e dd 48 74 d4 37 78 fa 06 4f cf f1 f7 f9 84 15 a6 e5 67 22 58 bb 9b 30 9a 89 c1 66 bb 1d ce d2 c8 27 37 37 96 62 3e e7 d2 e4 d6 a6 bc 8b 9d 0e 7c 46 89 25 c7 65 98 e3 cd 96 6e ea 52 78 c1 18 f6 8d 93 1f d4 3a f2 dd 82 01 ad 94 3c 49 65 64 90 ae 3f 48 b1 0a 15 37 cd c8 16 96 fb 6a a3 2f b9 1b 08 3f 5d f1 08 87 90 dc 4b f8 eb 25 a7 27 93 29 cd 90 59 43 e5 28 e9 bb dc 56 8e a7 b9 1f f5 30 14 11 6d ea 9a 26 31 8a 4c 6b 6b 69 cc 90 15 bb 39 4f 72 5e ea 6c 7d e5 cd c9 33 2a ae d7 bd c9 50 3a 40 15 bc 7f 87 bb e1 c0 c8 5c 26 67 7c 06 0f 31 95 2d c1 71 3b 6c 1c cc 2c 81 82 54 3f a7 db 1b fa 64 a0 ee 0c c6 21 ff 04 1e 3c 77 7a ce 69 39 71 e2 c5 31 21 80 65 ff 05 bc ca 9b a8 39 66 20 a9 39 be 01 6f 1e b8 cd 2d 6a 68 08 ac 22 df 06 cf 3e 78 f6 ba 69 82 6b 93 b1 29 cd 1d f0 99 97 2e 93 cb d9 eb 55 9c ac 4d 6e 47 a5 f9 6e 44 18 18 bd 23 d7 e5 9d 4e 7d cc 47 7c 10 6d 4b 0e 91 48 ce 96 5e f4 a5 6e f8 74 b9 3c 22 52 c6 f0 67 5b 97 d7 49 16 3c 32 4b 67 b1 36 25 1f 8e 87 0a 32 1d 02 2b a7 c2 2a 97 a5 80 87 59 18 f1 00 3c 93 75 cc c5 cc a8 5e e3 b4 a3 9d 27 42 b4 26 b7 0c eb 5a 39 65 af 88 4b 39 6a e3 90 63 64 2b 8b fc 1d f1 a8 86 c4 a4 76 e1 00 f8 91 77 13 ce 3d 60 92 93 87 8c 2c 86 38 92 cf 43 95 70 29 a2 04 ee c9 26 7b f1 67 21 54 12 c1 9f eb fc 1c ba bf ce 54 8a 5b 30 73 e1 fd 67 d9 f0 12 d3 a6 b5 43 79 88 a8 78 b1 cf 56 ad 21 cf 8a 16 8c f5 a8 85 a9 a6 83 f1 e7 29 66 88 f2 4d 3e 6e a3 93 1c 18 92 d2 59 88 f2 63 f9 d4 46 9b c5 32 a2 bb d0 a3 2b e8 d8 cc bc 9f bb 35 ef c9 26 40 f6 a9 88 98 e0 16 b9 a5 bb 7e 26 0b 3a 65 38 ed 74 1a 13 a3 9f c7 ef df 11 24 00 a2 f4 90 92 91 68 1e ce d6 66 83 d2 b2 80 93 b6 40 3c 1c c2 b1 df eb 10 Data Ascii: ce1Zms6~1MINRMmWwP$$ m=7ApX.}aXxPq{='e2{y=}J\|w__4sy'to(R^215JHX:v?l?UX.Lq[=vq"swHr%`/Ioi5&MT.K:g~${ir%zQIXy+%lml\|AGG!oU\)[{BE;\zV\|T:U\$Wz6.D9mfs"sXL};Ub;cz!H @w{~}2yo\,_m4!v(q@+9^t/}F^NHt7xOg"X0f'77b>\|F%enRx:<Ied?H7j/?]K%')YC(V0m&1Lkki9Or^l}3P:@\&g\|1-q;l,T?d!<wzi9q1!e9f 9o-jh">xik).UMnGnD#N}G\|mKH^nt<"Rg[I<2Kg6%2+*Y<u^'B&Z9eK9jcd+vw=`,8Cp)&{g!TT[0sgCyxV!)fM>nYcF2+5&@~&:e8t$hf@<
Apr 18, 2022 18:06:20.144984961 CEST	2542	IN	Data Raw: e3 7c e1 6b 05 bf 77 00 20 af 3d 7f 51 f9 75 64 e5 48 c7 af a3 c9 30 c7 54 24 0f 03 83 1d 2b cb 2e e5 83 44 f8 67 0a 50 b9 8a 00 2d da e5 1d b5 f0 e6 05 ef e8 9a 97 bc f9 21 de 47 c2 59 78 ea fd 6d 04 24 8e 81 76 b8 e3 96 de 91 e7 3b e6 77 36 e7 Data Ascii: \|kw =QudH0T$+.DgP-!GYxm$v;w6Le@\|[2Erj/a`rJweW\y52Q?@F$\|q,dH,BenmKni,.q14JkxE^02.'Q4;nbBElU[
Apr 18, 2022 18:06:20.145032883 CEST	2543	IN	Data Raw: 58 4e 9c 22 30 58 87 bc ac 91 e4 7e 48 13 ed f6 e4 62 e4 6e c1 54 fb be 5d b8 d5 d6 6e ba 2f 8e 6e a2 96 26 85 68 84 42 92 a2 07 bb 31 b8 c2 8b 0a cb 14 4f ce 85 f8 12 72 1d 7b 3f b3 63 ea b6 a4 d3 ac 03 6d e6 6c b0 75 4e fe 77 93 7d 1f ae e6 46 Data Ascii: XN"0X~HbnT]n/n&hB1Or{?cmluNw}F%47_/W,pPvuQ%!'5\|s/VA"pJTLf&.(e2rXk/dB@=-uXR.t}RJ4B%bGa4h
Apr 18, 2022 18:06:20.431698084 CEST	2745	OUT	GET /js/pushjs/1.0.0/utils.js HTTP/1.1 Host: i.gratissesso.me Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: / Referer: http://i.gratissesso.me/c/da57dc555e50572d?s1=149667&s2=1382674&click_id=c72c5c4350cf701a8c1f88e8492ea2e2&j1=1 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: unique_id=625d8c7b0004d968; unique_id2=625d8c7b0006a03f; 625d8c7b0006a03f_c=1; ref_token=149667; 625d8c7b0006a03f_sl=[271434]
Apr 18, 2022 18:06:20.479269981 CEST	2747	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 18 Apr 2022 16:06:20 GMT Content-Type: application/javascript Transfer-Encoding: chunked Connection: keep-alive Expires: Mon, 25 Apr 2022 16:06:20 GMT Cache-Control: max-age=604800 Content-Encoding: gzip Data Raw: 64 33 62 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ad 59 0b 73 db 38 92 fe 2b 0c 77 cf 03 44 6f c9 f2 4b c3 73 cd 64 b2 5b d9 9a 24 be 71 b2 3b 57 92 36 05 91 10 85 88 24 18 12 7a c5 ed ff 7e 1f f8 b0 1e f6 ed ed 6e 9d 4b 16 1b 40 77 a3 d1 fd 75 03 a0 e6 ab c4 37 4a 27 4e 26 73 1d ad e5 1b 15 30 5f 05 cd 54 05 fc 61 2d 32 db bf 8a 8c d7 ea 8d d4 9c 99 5d 2a f5 dc 01 c3 2b cf 73 57 49 20 e7 2a 91 81 7b 76 56 76 25 ab 28 3a 3b 7b a5 f2 0f e2 03 4b 45 96 cb 77 89 b1 fa 38 e7 0f 95 26 b4 1e 65 94 4b 67 af 2f 7d ae 2f fd 07 fa d2 23 7d 68 3d 66 d2 ac b2 a4 b2 f5 71 5e af a9 90 f8 fc db af 6c 95 45 e5 6a 84 17 68 7f 15 cb c4 b4 fd 4c 0a 23 df 46 d2 b6 98 2b 5c 3e 12 ed 45 26 e7 1e b8 47 a5 c6 87 5c af 32 5f de a0 a7 99 66 da 68 5f 47 37 a2 5d 93 ed 4c a6 91 f0 25 73 6f dc a6 eb f2 e6 42 e7 06 e3 f6 91 88 58 36 53 9d d9 b6 7d 34 bf ad 64 b6 43 23 97 22 f3 17 4d d8 26 e2 fc a6 b6 95 d5 de 36 de c3 63 33 97 a1 57 73 3e 4d d2 f9 fb e4 b6 63 a7 69 e7 69 a4 60 f2 19 66 8c 64 e2 81 bb 8d 67 68 16 4d e5 75 9b f9 68 ae 33 36 52 3f a2 6f a4 1a 0d fe 00 4f bf 02 d3 58 4d f9 83 af 13 a3 92 95 7c cc bd b2 ab d6 e6 c1 01 98 7e 9c 8f bb d3 a9 97 8f 7b d3 bd 5b cd 23 e3 cd b9 8a e4 0d c3 6a 84 59 d8 d5 b5 63 61 fc 05 eb b0 f1 df 3b b7 7f 98 36 f8 1f 3b 8a 13 8d 61 e2 94 5b f1 7d 20 42 69 ee 57 b3 40 c7 42 d9 95 56 7a 37 2a 09 f4 a6 1d 69 5f 58 ae c2 f9 b5 35 1d 97 8f fb 4f b6 b5 d1 ea 4e 1f ad 87 72 69 de 68 bd 54 d2 7b 72 5d e1 ea b5 88 56 b2 74 62 e0 25 72 e3 fc 82 e8 8e 02 38 d1 7c 52 b1 64 41 3b ac 28 de e8 bf 7e c2 52 8f bf be e8 da 4f 4f 0e f8 c8 4a cb 6d aa 32 e9 b9 e5 33 f7 dc 46 d0 36 fa f3 a7 37 f7 26 53 49 c8 f8 68 0f a1 d2 10 3b 7f 03 fe 6b 14 36 34 dc 91 f5 90 d7 19 b9 8d 52 c7 e3 e8 d0 11 a5 f5 85 d1 fc c1 46 ca 4e 6a 9e 94 34 13 ef 44 7f ed 84 11 c2 8d f8 22 b0 49 15 ee 32 ba b5 8e cc 4b 10 ce 91 eb b8 9e e7 65 6d 7f 21 b2 9f 0c eb f2 11 cf d0 cc 57 b3 bc 5c 40 8f db 54 ee 16 4c 88 80 dc 7e 44 22 72 5e 07 fb 80 d3 d4 b0 ca 2a 82 57 90 78 d5 db c7 b6 82 e7 e7 2c b2 69 76 27 8c 91 59 d2 2c 48 8b f0 32 24 68 7a fb d1 d1 c7 d9 57 e9 9b f6 52 ee 72 b6 e7 6c 63 25 6f 05 20 f5 14 59 30 f0 87 4a 76 9f 6c 63 b7 81 81 86 3b 75 f7 d3 8c d1 33 e5 8f bc 4a 5c e7 50 a0 33 19 b7 5f df 4e a6 9d d0 66 cf 21 2a 13 99 01 25 9f 3f bf fb 85 d5 d0 b1 b0 69 27 7a c3 f8 41 c1 4b 65 06 db 62 91 f8 f2 b4 50 3d e7 b0 d2 70 ae 5b cf e3 f2 87 a0 e1 9d 30 b0 da 95 ee b6 fa 6b 15 5f e7 f6 6b 57 37 eb 3f 77 bf 96 f1 76 67 17 f2 e4 22 bf 2a 1c 1e 0b 1a ef 81 bb 76 26 90 55 31 e3 af 7b 17 fc 3f 7a 17 d4 1d 05 5e 31 30 8f 34 90 12 74 d0 5f 79 89 f9 d6 ce ad 7b 9b dd 64 67 03 ba e2 00 7a 85 72 30 3d 1e b9 ca 7c ae 5d 5d b9 4a a2 50 8d 5e 4c e1 bd ad b7 67 d3 06 ca 83 87 07 f7 40 9c 4d 5f f3 4e a8 f6 d6 9b a6 6a 0a fe 20 01 5c 4f ec a3 27 8f 66 fe 39 d3 9b 5c 66 ef 92 b9 c6 dc 89 58 ab 50 18 9d b5 45 9a fe 55 66 39 b8 ca c4 6d 16 da bc 3d c3 0a 52 3f 21 ca 06 49 75 24 f6 c1 56 8c cc 73 dd 46 51 08 fe 14 69 61 d8 4b 8a 79 53 7b 4f b5 e2 25 86 66 0f 09 f6 cf f0 94 2b 6b f5 5e 79 cc a0 b6 d7 89 e7 7e 04 30 b0 f7 f0 b3 33 96 78 55 0b a6 89 c3 34 6c 5c f0 e6 73 c9 4a 7b 29 7b 2a 71 85 1d f2 05 99 8f 77 bf 81 ff f6 1f 4c 75 ce f9 cd 73 b9 f7 f7 ef de d6 82 ef 95 9f e9 5c cf 8d 83 05 23 9b a5 71 de 6e d3 48 67 32 7b ae 6e f8 a2 ba 37 8b 4c c7 Data Ascii: d3bYs8+wDoKsd[$q;W6$z~nK@wu7J'N&s0_Ta-2]+sWI {vVv%(:;{KEw8&eKg/}/#}h=fq^lEjhL#F+\>E&G\2_fh_G7]L%soBX6S}4dC#"M&6c3Ws>Mcii`fdghMuh36R?oOXM\|~{[#jYca;6;a[} BiW@BVz7i_X5ONrihT{r]Vtb%r8\|RdA;(~ROOJm23F67&SIh;k64RFNj4D"I2Kem!W\@TL~D"r^Wx,iv'Y,H2$hzWRrlc%o Y0Jvlc;u3J\P3_Nf!%?i'zAKebP=p[0k_kW7?wvg"v&U1{?z^104t_y{dgzr0=\|]]JP^Lg@M_Nj \O'f9\fXPEUf9m=R?!Iu$VsFQiaKyS{O%f+k^y~03xU4l\sJ{){*qwLus\#qnHg2{n7L
Apr 18, 2022 18:06:20.479316950 CEST	2748	IN	Data Raw: b2 56 58 b5 9e c9 5e be 28 7b 2f e6 22 53 b5 6c d5 7a 41 f6 df f1 d8 0b d3 fd 09 05 7c ae b7 f5 7c 75 f3 d9 84 57 95 f4 81 e8 a7 4c 05 00 1f b6 b2 7f d5 6f 07 4a b2 f5 8d cb 1b 03 68 67 12 3c 91 c8 cd bb 7a cc c1 48 8f ff 58 18 7c 34 d0 a9 01 75 Data Ascii: VX^({/"SlzA\|\|uWLoJhg<zHX\|4uY;e4;E:EUp6wCBg6Q"Oi$u5cUg>>*p%B?GqefO"(n]-see,`aa;`u
Apr 18, 2022 18:06:20.479338884 CEST	2749	IN	Data Raw: 17 0c eb 41 dd ec 5d a1 01 e3 51 31 00 51 e3 47 10 32 41 68 bf 51 0d 94 9d de 28 5b 7a 4c 91 c0 46 b3 34 82 7d e8 cd d9 65 d7 a2 0e f0 04 38 d1 b1 9d b4 ae 51 d2 91 e1 33 d4 00 d8 cf 69 65 72 e4 cd 39 a6 5a 5f 02 59 38 1b 28 5a 2b 96 85 d0 8e 5a Data Ascii: A]Q1QG2AhQ([zLF4}e8Q3ier9Z_Y8(Z+Zd@>HMZ:Fh\|Zo\!W=lH0}3((9i?6%)&FdEK(hnT'(pG$#;>Zbv}c@iN.h{

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 000.docx

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic

C:\Users\user\AppData\Local\Google\Chrome\User Data\1082e503-cfe1-42c2-9d94-7da51b7fabf5.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\467cd08a-ea74-408a-a75e-ea07ea30ff7b.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\299e35fe-316b-4e36-8019-1b175ea8c1c8.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\353b71e8-f351-453a-a56b-e84288eb011a.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\5731ed72-884a-4c01-90eb-cac4f81da01b.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\831a0bc3-0237-4bd4-9c13-1737e766fa6e.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\000003.log

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG.old (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Provider Cache

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network Persistent State (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Preferences (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\GPUCache\data_1

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Network Persistent State (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\acfb3dc1-35df-4491-a4e6-1c3e16318bce.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\acafa79c-716c-43b2-b9eb-038c8cb09101.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000004.dbtmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\CURRENT (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\ece15a02-d32c-4396-96db-a6566a39a060.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\f03270ae-9f09-40db-87c9-8ff2410c85d5.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\fb504025-b848-4a54-83ae-53762c3266e9.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Last Browser

C:\Users\user\AppData\Local\Google\Chrome\User Data\Last Version

C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Module Info Cache (copy)

Windows Analysis Report
000.docx

Timestamp	kBytes transferred	Direction	Data
2022-04-18 16:06:17 UTC	0	OUT	GET /carmela00 HTTP/1.1 Host: tinyurl.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-18 16:06:17 UTC	5	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 18 Apr 2022 16:06:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.28 Location: https://ssl.scaletrk.com/click?o=79&a=1636 Cache-Control: max-age=0, public, s-max-age=900, stale-if-error: 86400 Referrer-Policy: unsafe-url X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Strict-Transport-Security: max-age=31536000; includeSubDomains; preload CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Server: cloudflare CF-RAY: 6fdea5953c14913d-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2022-04-18 16:06:17 UTC	6	IN	Data Raw: 31 61 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 27 68 74 74 70 73 3a 2f 2f 73 73 6c 2e 73 63 61 6c 65 74 72 6b 2e 63 6f 6d 2f 63 6c 69 63 6b 3f 6f 3d 37 39 26 61 6d 70 3b 61 3d 31 36 33 36 27 22 20 2f 3e 0a 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 68 74 74 70 73 3a 2f 2f 73 73 6c 2e 73 63 61 6c 65 74 72 6b 2e 63 6f 6d 2f 63 6c 69 63 6b 3f 6f 3d 37 39 26 61 6d 70 3b 61 3d 31 36 33 36 3c 2f 74 Data Ascii: 1ae<!DOCTYPE html><html> <head> <meta charset="UTF-8" /> <meta http-equiv="refresh" content="0;url='https://ssl.scaletrk.com/click?o=79&a=1636'" /> <title>Redirecting to https://ssl.scaletrk.com/click?o=79&a=1636</t
2022-04-18 16:06:17 UTC	6	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-04-18 16:06:17 UTC	0	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfm X-Goog-Update-Updater: chromecrx-85.0.4183.121 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-18 16:06:17 UTC	1	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-4/4LRRUBKvZiXpGDGRN02w' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 18 Apr 2022 16:06:17 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 5586 X-Daystart: 32777 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-04-18 16:06:17 UTC	2	IN	Data Raw: 35 31 65 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 35 35 38 36 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 33 32 37 37 37 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 51e<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="5586" elapsed_seconds="32777"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2022-04-18 16:06:17 UTC	3	IN	Data Raw: 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 2e 63 72 78 22 20 66 70 3d 22 31 2e 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 61 70 Data Ascii: mhkkegccagdldgiimedpiccmgmieda.crx" fp="1.81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app><ap
2022-04-18 16:06:17 UTC	3	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-04-18 16:06:17 UTC	1	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-18 16:06:17 UTC	1	OUT	Data Raw: 20 Data Ascii:
2022-04-18 16:06:17 UTC	3	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 18 Apr 2022 16:06:17 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-TLwFipVJM9IEqNl3ELSFNg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'nonce-TLwFipVJM9IEqNl3ELSFNg' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site,Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-04-18 16:06:17 UTC	5	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2022-04-18 16:06:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-04-18 16:06:17 UTC	6	OUT	GET /click?o=79&a=1636 HTTP/1.1 Host: ssl.scaletrk.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-18 16:06:17 UTC	7	IN	HTTP/1.1 302 Found Date: Mon, 18 Apr 2022 16:06:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Server: nginx/1.20.0 X-Powered-By: PHP/7.4.21 Set-Cookie: U-d1fe173d08e959397adf34b1d77e88d7=unique; expires=Wed, 18-May-2022 16:06:17 GMT; Max-Age=2592000; path=/; secure; SameSite=None Location: https://ssl.scaletrk.com/click?o=95&a=1636
2022-04-18 16:06:17 UTC	7	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-04-18 16:06:18 UTC	7	OUT	GET /click?o=95&a=1636 HTTP/1.1 Host: ssl.scaletrk.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: U-d1fe173d08e959397adf34b1d77e88d7=unique
2022-04-18 16:06:18 UTC	8	IN	HTTP/1.1 302 Found Date: Mon, 18 Apr 2022 16:06:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Server: nginx/1.20.0 X-Powered-By: PHP/7.4.21 Set-Cookie: U-812b4ba287f5ee0bc9d43bbf5bbe87fb=unique; expires=Wed, 18-May-2022 16:06:18 GMT; Max-Age=2592000; path=/; secure; SameSite=None Location: https://ssl.scaletrk.com/click?o=135&a=1636
2022-04-18 16:06:18 UTC	8	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-04-18 16:06:18 UTC	8	OUT	GET /click?o=135&a=1636 HTTP/1.1 Host: ssl.scaletrk.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: U-d1fe173d08e959397adf34b1d77e88d7=unique; U-812b4ba287f5ee0bc9d43bbf5bbe87fb=unique
2022-04-18 16:06:18 UTC	9	IN	HTTP/1.1 200 OK Date: Mon, 18 Apr 2022 16:06:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Server: nginx/1.20.0 X-Powered-By: PHP/7.4.21 Set-Cookie: U-7f1de29e6da19d22b51c68001e7e0e54=unique; expires=Wed, 18-May-2022 16:06:18 GMT; Max-Age=2592000; path=/; secure; SameSite=None Set-Cookie: o_7f1de29e6da19d22b51c68001e7e0e54=2f5d9028-7caf-4fd9-9fc2-4d48454da525; expires=Mon, 25-Apr-2022 16:06:18 GMT; Max-Age=604800; path=/; secure; SameSite=None Set-Cookie: advanced-core=t54sk5q93to4oj45i780lqa7f3; path=/; HttpOnly Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache
2022-04-18 16:06:18 UTC	9	IN	Data Raw: 33 38 31 0d 0a 09 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 09 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 3e 0a 09 09 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 0a 09 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 63 73 72 66 2d 70 61 72 61 6d 22 20 63 6f 6e 74 65 6e 74 3d 22 5f 63 73 72 66 2d Data Ascii: 381<!DOCTYPE html><html lang="en"><head><meta charset="UTF-8"/><meta name="viewport" content="width=device-width, initial-scale=1"><link rel="shortcut icon" href="/favicon.ico"><title></title><meta name="csrf-param" content="_csrf-
2022-04-18 16:06:18 UTC	10	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-04-18 16:06:20 UTC	95	OUT	GET /s/roboto/v29/KFOlCnqEu92Fr1MmWUlfBBc4.woff2 HTTP/1.1 Host: fonts.gstatic.com Connection: keep-alive Origin: http://i.gratissesso.me User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://fonts.googleapis.com/css2?family=Roboto:wght@300;400;700&display=swap Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-18 16:06:20 UTC	95	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="apps-themes" Report-To: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} Timing-Allow-Origin: * Content-Length: 15828 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed, 13 Apr 2022 10:18:14 GMT Expires: Thu, 13 Apr 2023 10:18:14 GMT Cache-Control: public, max-age=31536000 Age: 452886 Last-Modified: Wed, 22 Sep 2021 16:13:28 GMT Content-Type: font/woff2 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2022-04-18 16:06:20 UTC	96	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 00 3d d4 00 12 00 00 00 00 8d b0 00 00 3d 71 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 64 1b 9a 1e 1c 85 5e 06 60 00 83 20 08 48 09 83 3c 11 0c 0a 81 db 1c 81 c2 38 0b 84 0a 00 12 82 10 01 36 02 24 03 88 10 04 20 05 82 7e 07 20 0c 82 29 1b 08 7e 15 ec d8 a3 80 f3 00 41 22 7b de 23 8a 60 e3 00 08 22 9f 3a 8a 92 4d 3a bd e2 ff 6f 07 74 88 ac 65 a6 c0 fc 55 54 89 52 50 20 bc a3 ee 41 a3 58 7c 5a d3 c3 f4 a2 be 8c 01 df 54 b9 4f 2f 37 a3 8d cd 3b 15 94 49 b4 6d 3d 63 ed 88 32 ab 35 06 45 cd 15 1e f5 a3 d4 2f 23 ac c5 ad a9 66 4b 1c 8e e1 e8 fa 0f 0b 4b 3e f4 c0 59 28 c3 c7 1e 8e 22 ec e9 2b 62 fc 35 81 5d 8b da de b6 be 46 1d 47 73 8a 1f a1 b1 4f 72 09 22 bb e0 bf a6 b1 7b f7 44 45 32 33 7f 29 06 1c Data Ascii: wOF2==qd^` H<86$ ~ )~A"{#`":M:oteUTRP AX\|ZTO/7;Im=c25E/#fKK>Y("+b5]FGsOr"{DE23)
2022-04-18 16:06:20 UTC	96	IN	Data Raw: 00 c3 7f a1 79 cf f1 c7 c8 80 eb 0c 30 02 56 68 f8 1c 39 73 e5 78 9f 3a bf 19 09 81 99 dd 45 70 97 bb 10 53 79 d5 75 bb 2b d2 b7 20 db e6 87 2c c1 34 92 7f 87 70 d1 5c 0a 6d 88 45 15 93 00 87 ea ec 77 f5 51 05 b7 79 08 cc 02 c2 04 22 ba 4d 58 18 59 bf ff b5 fd 65 43 22 8a cd 42 f6 06 f9 41 16 9b 41 2d 69 f5 c4 79 29 7f 99 6d df 72 dd 0f 61 b7 2f 1a 33 4e 4b b2 96 95 10 f7 93 6b 7b 69 16 2a 16 3a 47 c4 bb 4d 1e 48 24 12 47 d4 1a 09 c9 65 73 4c 12 dc ac 1f be ef f7 43 1f 04 11 55 84 a1 92 b0 ad ae 15 bb 67 ee fc f8 4f d7 fa b3 91 c1 97 1a a5 01 fc 04 26 56 fd fc ff b7 65 96 fe 5b bf 4b 68 fa 26 2e 03 46 1d 64 32 2e e1 c9 29 df f8 d7 ab 92 aa 7e fd ae 6e 1e ab 5b a3 81 92 41 a5 36 34 19 7a 24 83 24 83 a6 47 5e a6 08 38 03 ea 56 2f b5 17 11 83 84 22 cc 29 da Data Ascii: y0Vh9sx:EpSyu+ ,4p\mEwQy"MXYeC"BAA-iy)mra/3NKk{i*:GMH$GesLCUgO&Ve[Kh&.Fd2.)~n[A64z$$G^8V/")
2022-04-18 16:06:20 UTC	98	IN	Data Raw: ef 44 8a fd 1f f6 6e ac de 3d 25 5d f7 b4 f5 f0 f0 6e 32 32 d4 0b 30 b3 95 70 5b 2d 72 f5 83 35 95 54 bf 05 e3 9e 8f d6 72 60 76 b3 7b d9 7c 87 be 25 de 9d 66 53 9b 3d 6f 1e 3a 47 29 30 02 63 ab d4 94 b0 bb 9a 96 85 2b 82 9e 63 28 7e da 97 06 f4 7a be 13 a9 63 77 e6 77 1d ab 0e 15 f3 18 d0 83 38 6e 08 60 4b 01 41 0a 18 b1 c1 70 87 1c 83 a0 42 03 1f 6d 06 41 bd 39 22 69 64 08 39 d6 c9 f2 1c 38 51 e0 2c 94 b8 26 2b 73 e7 e9 a0 dc e4 23 2a 5d 74 54 ed 5b ab 6a d4 8a 53 36 ed a2 fa 69 9f 1b 18 4d 07 b8 24 97 e4 b2 90 95 10 30 87 85 b4 23 42 d4 51 01 39 26 b8 a8 0a 7e a7 84 00 ac 90 80 13 10 0d 21 4e 5b 08 d1 11 fc 08 42 86 ae 90 a2 27 90 f4 85 20 03 21 c2 5c 70 b3 10 3c 88 c1 01 0f c7 f1 02 11 3b 42 a0 40 c0 39 05 3c de 8e 43 81 4f 42 88 f1 10 7c 3c 85 b0 5c Data Ascii: Dn=%]n220p[-r5Tr`v{\|%fS=o:G)0c+c(~zcww8n`KApBmA9"id98Q,&+s#*]tT[jS6iM$0#BQ9&~!N[B' !\p<;B@9<COB\|<\
2022-04-18 16:06:20 UTC	99	IN	Data Raw: 29 d0 3d 5f 12 5e af 9d 5f 87 0d fb e7 5e a2 3a 36 59 87 d7 8f 82 90 90 af 27 d2 dd e5 4b 6f f7 12 de cf de 88 57 46 63 18 3d 23 b5 8d fc d2 4a 2c cb 69 7b 7c d4 53 c5 0a f8 17 5b 7f 0b 76 3e 07 d4 11 00 f1 1b 38 f1 79 fd 12 c4 57 3a 02 30 8d d0 1f 02 86 9f 96 5c 62 9c 20 4c 2c 01 4a 31 dd 81 c1 4d 16 35 92 9e 09 6c c3 9d 20 1c 2c 95 59 2b 5c ea 1a c0 e0 66 31 fb 87 4f 8d 12 97 3a d4 44 08 46 99 0b d6 0b 1a 6c c1 9a b9 26 02 a2 27 85 ff 71 39 56 ec 6f 8a 86 f3 05 9e b8 d4 59 5c 2a c3 8b 22 b3 1a 2d a6 4e 74 57 0c 0e 4d 2a 1a 6b ea 54 20 8a 99 be 63 25 cb a4 5c 5a 6d f5 da 62 9e 26 99 ce 9d 55 95 cb d4 91 cc 45 6a 95 96 28 05 62 6f bc 5d 66 ba 96 d5 c2 e4 68 52 9d e2 aa 70 d6 eb cc b8 83 4a fd cf 95 eb 19 b6 35 aa cd b0 f0 0d e2 89 d5 66 ee b2 85 4e 32 57 Data Ascii: )=_^_^:6Y'KoWFc=#J,i{\|S[v>8yW:0\b L,J1M5l ,Y+\f1O:DFl&'q9VoY\"-NtWMkT c%\Zmb&UEj(bo]fhRpJ5fN2W
2022-04-18 16:06:20 UTC	100	IN	Data Raw: 32 31 3e 72 d2 07 96 02 e6 86 fd 0e 3b 4a 45 01 ac 1f 4e 78 16 42 31 95 cc 3e 4d 83 3b 93 dc 1d 2e 50 b3 c3 3d 00 af 99 0b a2 c8 24 60 86 fb 62 fd e9 2d a1 b0 01 89 8c 02 1e f6 b4 b6 01 b2 29 d6 4e fc 24 02 bd c3 49 14 66 89 61 9a 12 ba ca af c5 a1 da 12 20 41 c1 f1 34 18 15 4a 14 3b aa 51 52 c5 92 f4 14 ff 63 b4 36 cf 5f bc b0 3f 95 c1 71 56 27 13 94 31 af 11 07 ff df 5d 9f 5d cd da 64 0a f2 d7 1d d7 5a 33 eb 24 cf 2e 18 46 70 27 ca 1a af 17 fb a9 3a a6 f9 63 7f 57 fe bb f7 3e 9a 65 96 c9 0c 35 1b bd 11 5a a2 10 d7 e0 70 1e 9c 04 f6 ea 6f e0 41 a4 9c 40 d2 27 b7 82 b5 b0 87 9d 99 bc 7a d6 a1 92 3a ea 77 f8 89 26 f4 56 a0 77 52 33 65 c7 d7 62 89 2b e8 3f 4d 38 95 ee be 9b 9d 93 7c c0 2c 19 94 77 c5 b6 51 8d 2a 38 fe 67 07 3a ea 00 94 d6 2a 16 99 99 ee a2 Data Ascii: 21>r;JENxB1>M;.P=$`b-)N$Ifa A4J;QRc6_?qV'1]]dZ3$.Fp':cW>e5ZpoA@'z:w&VwR3eb+?M8\|,wQ8g:
2022-04-18 16:06:20 UTC	101	IN	Data Raw: a7 9a 9b b9 39 91 88 6e 4e ca d3 49 2f 31 ec 93 2f 51 a6 91 ae aa ff 19 ee 6c ed eb c0 0e 0a aa fd d6 7d b7 af 0d 3b 88 96 1e f0 6d a6 07 7a 5f 84 b5 fa f6 7a 5f 0d 61 78 b4 40 97 49 18 8c 2b 8d b1 ee fa 52 91 40 5e 9a 78 f1 dd 9b ee 7e 89 e8 e3 13 e6 e6 cb 62 87 29 65 26 bf 5d 4e 2a fd f4 eb e5 38 33 7c 3e ab cc d2 3d d2 4d aa 94 56 1d 46 0f 75 a3 05 fb b8 53 c2 5d c9 98 c8 33 fd ef 02 32 97 b9 de dd f3 4f 68 f3 55 39 73 22 be 3b fe 9e cc ea ea 1b f1 c5 3b 18 c7 33 41 ae 41 d1 4c d7 37 5f 2f 14 eb 36 1e 6c 59 6d d1 c5 e8 52 05 07 0e ed 0d 1f 3c 8c cb 33 81 a1 2d f3 ef 53 3e 63 77 4c 95 b5 03 35 a3 1f af 43 2b f9 b1 1f de 9f a9 cc f8 c4 48 1b 81 27 2a f0 ba 32 fd 69 be f4 bc d4 a4 84 74 56 d0 f7 1b a1 5a f8 e1 2d b9 51 d8 d6 b8 64 77 54 4c cf d0 bc c8 87 Data Ascii: 9nNI/1/Ql};mz_z_ax@I+R@^x~b)e&]N83\|>=MVFuS]32OhU9s";;3AAL7_/6lYmR<3-S>cwL5C+H'2itVZ-QdwTL
2022-04-18 16:06:20 UTC	103	IN	Data Raw: 67 76 d5 42 29 73 b8 00 70 e3 0a e6 39 80 67 87 73 10 78 9c 23 87 b9 4f 1e 45 81 55 2d 9e 9b 2f cc 74 2b 3c 22 87 68 ec 9c 5a 3a fe e2 69 53 b3 78 44 07 1c 17 f2 ff 86 64 94 9d 66 36 51 78 5d 89 05 cd 9c e0 e8 f6 ba c7 d7 f2 ae fe bd f6 15 64 1a 58 59 bb 50 c8 8e e6 fa 18 cf a8 ba 67 ae 19 53 6b 53 83 cf c1 85 63 b6 a2 62 53 46 21 da 75 37 99 af 85 ca 81 a6 95 79 82 e9 02 0a f1 5e 69 92 13 cc 16 8c 44 00 6e 80 39 e2 17 dd 34 f1 51 89 17 8d 68 0e aa 08 ca c5 b1 ae 68 44 9c cf 3b 91 23 6e 1c 88 9d b3 f7 3b 0d 91 44 40 68 cc e0 03 ff a4 15 81 c3 08 d4 ff 7c c7 56 ee 7f 5b 82 86 45 20 8a 5f b0 63 40 60 49 8b 42 5b 40 b1 8d f1 c1 3f 0b 27 c6 6b 03 63 8e 2a 81 22 e0 12 8a 0c 61 5f 1e 5e 52 41 ff a8 a2 37 04 b0 35 59 57 f0 ac cc 27 7e de a8 ad e3 ca 7b 72 4d 67 Data Ascii: gvB)sp9gsx#OEU-/t+<"hZ:iSxDdf6Qx]dXYPgSkScbSF!u7y^iDn94QhhD;#n;D@h\|V[E _c@`IB[@?'kc*"a_^RA75YW'~{rMg
2022-04-18 16:06:20 UTC	104	IN	Data Raw: f2 98 9f b9 a3 65 e2 91 f7 26 0e aa 1e 06 ae b6 31 47 d8 92 78 2a de 86 a4 6f 60 45 0e b6 b2 4c b2 b6 7c 82 d3 b4 27 11 74 6d c9 78 0d f4 4b 45 c1 fc a9 53 55 57 83 d1 ed b9 fe 88 ae a1 b9 da a6 ab cd e5 17 bd dd 1c 69 ee fe 6c c0 4a 8c 09 60 bb bb b8 d8 fb b6 64 b4 96 cb 89 5e 6e aa 43 36 d5 28 3a 55 2b 22 5b 8d c4 3a 2a 15 1d 90 6d 33 37 5d 2c 27 52 1a d9 fd 5b 61 e6 c1 1d 57 d2 f8 f0 08 69 f2 96 4b b9 db dd ea 60 6b 87 a4 d8 b4 33 f4 b0 b6 f8 ce 40 dc b9 68 63 92 3a f6 aa 50 70 57 4a 76 56 4d 61 a6 9e 8f b4 bd 57 ea 51 ca c1 f6 6c 86 15 a0 ea aa d1 58 7a a2 b1 53 88 c4 2b a6 b2 d4 57 d4 8f db 01 79 7f 30 ff 77 f1 c6 d5 a1 d2 51 ba b2 33 3b 99 c5 d2 9f c5 86 35 73 9b 56 20 6b 46 ea ad 8d 4d 6c 2e 65 66 5b 7a 1a 6a 58 58 10 dc 41 7e 09 be 85 a7 b7 ad 57 Data Ascii: e&1Gxo`EL\|'tmxKESUWilJ`d^nC6(:U+"[:m37],'R[aWiK`k3@hc:PpWJvVMaWQlXzS+Wy0wQ3;5sV kFMl.ef[zjXXA~W
2022-04-18 16:06:20 UTC	105	IN	Data Raw: 34 96 5f a3 cd 59 58 e9 c0 16 68 01 34 df 87 a8 c7 66 05 fb c1 99 b0 da 57 b5 13 c0 db e3 cd 3f 12 1d 4d 2d 85 15 bf fc 28 ce 40 5e fe af 15 d9 7f 82 d3 cf 06 33 53 12 21 ff 13 41 69 49 0c 7a 46 62 88 a4 8d c0 76 c1 4d c9 4c 94 64 e6 4d 24 b2 af 46 f4 6f bd 2e da 2e 44 5e 66 fe 94 e5 5d e2 43 69 2d 20 ec 10 25 25 a5 35 74 27 05 e5 9d 44 b9 0c 1e 75 19 9e fd 8e aa 8e 24 f5 19 bd 82 dc d7 93 e0 a6 a7 29 28 ef 7a 28 ba c9 ca a0 6d aa ec 92 ec 4a 0d 33 76 c3 bc 48 61 de 3e 29 0a b5 d1 e1 67 c3 cb 15 52 36 7a 52 bb 0b ba b3 99 95 61 86 4a 4e 5e 1b 5e 62 03 27 c9 8f 8c 3a 74 ff c7 bb 4f 59 77 09 c7 b6 7c e4 42 90 06 33 7d 2a cf e7 9e 07 66 29 11 94 32 35 cc d1 54 3e cb b1 36 f2 f9 32 50 d2 f9 2d 3a 41 b7 96 67 e6 2a 1d 15 81 f7 5d c9 f3 59 34 e5 df ef 38 fb de Data Ascii: 4_YXh4fW?M-(@^3S!AiIzFbvMLdM$Fo..D^f]Ci- %%5t'Du$)(z(mJ3vHa>)gR6zRaJN^^b':tOYw\|B3}f)25T>62P-:Ag]Y48
2022-04-18 16:06:20 UTC	107	IN	Data Raw: bc 3a d8 b0 60 40 fd 11 66 8f 07 f7 04 f6 ec 4d f8 23 e8 75 13 93 cd f5 fc 51 b6 48 db e3 a1 30 01 90 4b 5d 96 8f 01 e3 e3 bd 83 8d 91 78 cb e8 72 09 6f 47 4d ef b7 f6 38 3a 50 db f6 86 09 1e 0f d3 09 c0 9e fd 57 cc 09 be 37 44 26 76 ca 82 6f 2e 29 c8 01 bb 58 86 f9 7a a0 ac 33 f3 6d d8 59 67 e4 ce 48 68 3f 1f a8 8b 7a 8c d1 b2 c2 91 d2 72 ad 3b 9a 83 ae 4c 80 78 cb af 87 45 29 ab d4 bc f3 b2 5b 9f d3 3b 78 65 7f f0 2a 16 8d d3 a6 ed dd c7 47 c0 08 d8 a5 20 a5 7c e8 12 7e 97 10 5c 5e 28 fd 24 b6 3d 91 6e 44 bd dc 93 07 6a 60 96 54 0c 8b 64 32 01 36 c4 a0 a1 7b 19 93 bf 3e 7e 5f fc eb f4 b7 79 34 09 22 c1 9e da 87 6c 62 11 aa 75 0b db a2 c4 e4 d2 bb 76 76 df 7e 58 64 7d e8 ec c0 0e 59 f8 b4 6f 03 dd 93 5a 74 41 37 3e b1 b4 da 0b f8 af 65 9c 30 08 67 18 ce Data Ascii: :`@fM#uQH0K]xroGM8:PW7D&vo.)Xz3mYgHh?zr;LxE)[;xe*G \|~\^($=nDj`Td26{>~_y4"lbuvv~Xd}YoZtA7>e0g
2022-04-18 16:06:20 UTC	108	IN	Data Raw: 7a 92 2c 29 88 59 68 32 f9 42 82 ac 04 99 63 c9 12 40 d8 ec f2 2e 78 1a 25 8d 9d 6c c7 75 1d e6 61 5d a9 37 8a 3a d9 7e a3 ce d6 7a 85 a2 29 06 2c 60 33 39 4b 06 c9 1b 52 09 f5 8c c2 29 78 28 7e 4f 6b 99 e8 02 08 fc 23 25 60 d2 cf 8f 47 15 b7 87 da 8b 91 8d 76 dc c1 28 d5 d1 b9 d8 78 e0 91 da a2 43 73 b0 cc 4a 84 68 34 c5 ce 04 11 f4 a4 61 42 1e 0c 35 3e d0 c9 65 7c 37 97 0e 5e 24 23 0c b0 6b 76 00 74 77 27 6c 9e b7 09 6c 47 28 80 a4 58 1f 31 4d f2 8b df c9 85 21 50 e3 3d ff 68 61 08 22 42 41 14 50 7a 0a e5 03 a3 5c 95 28 17 b3 91 4a 4c 50 43 8f 6c ad 96 1f a4 49 72 6b 05 ba 91 e4 d3 2c 2d b8 cd 59 ce e1 26 5b b0 39 03 06 e0 3c 2e 63 59 66 0e 64 4a 4d a9 43 79 36 85 d8 9f 14 09 96 1f dc be e4 cc 09 74 23 c1 59 e8 b3 5e 58 cd 83 71 94 dc b3 35 70 45 74 92 Data Ascii: z,)Yh2Bc@.x%lua]7:~z),`39KR)x(~Ok#%`Gv(xCsJh4aB5>e\|7^$#kvtw'llG(X1M!P=ha"BAPz\(JLPClIrk,-Y&[9<.cYfdJMCy6t#Y^Xq5pEt
2022-04-18 16:06:20 UTC	109	IN	Data Raw: f2 8d 63 42 fb 2a 98 16 68 25 e4 80 30 48 3c 6a 67 48 18 bc d7 1e 41 63 69 05 1d 25 60 0b 99 3b 15 0e 2b 90 5e 41 ad 4e f5 22 31 95 92 cb f3 d2 ef 25 1f a8 b3 d1 47 25 35 5e d8 2c 67 1b 71 d1 cc 8c 02 7b bf f7 b3 ea 02 da 3b da 08 cb 1a 19 56 c9 44 d6 8c b7 fd 7a c1 ae f7 0c f8 44 9e 38 f3 3c c9 18 21 7c 5c 30 7d 9e d0 35 73 6d 91 50 ad 56 3f a1 ac a7 ec b8 56 5d 90 b9 02 58 d0 46 3a 79 13 9f 10 e8 bd 4a 5e 99 3a 9b 33 ad 3c 57 d1 f9 96 98 b1 01 fa b4 e6 93 7c 85 26 d2 6d a0 c8 15 7e 2e 94 be 1e 07 5f a2 08 76 08 ca 82 80 a1 dc 53 e0 af a9 fc 6a 51 79 2e a7 7b 8d 76 bb 2d 43 8e ce 88 29 3b 18 9e 7b 8c 6d 66 44 f4 65 2b 45 2a 96 43 f0 51 7e d1 5d 74 75 ba 7c be 7b 53 f6 0b e7 db cf 83 0e 8b 6a 69 4b 21 49 3b 4f 97 6c e4 c2 16 c2 54 3f 5e da 36 b3 0e 43 a7 Data Ascii: cBh%0H<jgHAci%`;+^AN"1%G%5^,gq{;VDzD8<!\|\0}5smPV?V]XF:yJ^:3<W\|&m~._vSjQy.{v-C);{mfDe+ECQ~]tu\|{SjiK!I;OlT?^6C
2022-04-18 16:06:20 UTC	110	IN	Data Raw: 3a 37 9f d4 1d 4a 52 72 b5 b0 7a f2 54 1c f4 14 c2 b2 a1 47 46 a0 da 14 61 24 00 6b 2d 45 d7 ea 9a b8 30 a5 2d ad 55 8b e2 be 9e 45 b3 14 34 c6 90 51 b6 2d 56 21 a1 de 53 72 e8 80 01 8c d5 7a 5d 40 44 64 f7 3c 8d cc ea c8 cc c6 d6 93 19 2d 6a 35 d1 48 23 c5 4f d1 dd e6 00 5b f9 bd b6 39 ab 2e 2c fd 90 62 ac 10 a2 a5 7b 79 c7 d4 38 75 4c 35 97 84 15 4b 55 73 bf c4 9f 49 ad 8e e8 a9 6b 14 eb 55 b9 31 3f 70 cf f1 66 b5 90 73 66 99 b6 73 4f 75 85 2f 0b d6 47 54 e4 84 46 4e 98 26 34 62 62 9f 33 b2 d5 e5 e4 1f a5 38 70 87 cf 5e 77 33 0f 33 bd bf f3 4a af 00 c0 37 ff 94 1f 03 f0 e3 e1 f8 93 ff af fd ff b9 ca 5a 45 81 f0 81 01 18 c0 fc e8 c6 02 b0 7e e3 7f da e0 d7 59 20 c5 e5 46 e5 9b f9 63 a9 4d a3 47 1c 2d 29 8a 19 d5 d8 36 b8 92 7b af f0 6a 23 c4 61 c5 30 1e Data Ascii: :7JRrzTGFa$k-E0-UE4Q-V!Srz]@Dd<-j5H#O[9.,b{y8uL5KUsIkU1?pfsfsOu/GTFN&4bb38p^w33J7ZE~Y FcMG-)6{j#a0

Timestamp	kBytes transferred	Direction	Data
2022-04-18 16:06:20 UTC	112	OUT	GET /s/roboto/v29/KFOmCnqEu92Fr1Mu4mxK.woff2 HTTP/1.1 Host: fonts.gstatic.com Connection: keep-alive Origin: http://i.gratissesso.me User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://fonts.googleapis.com/css2?family=Roboto:wght@300;400;700&display=swap Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-18 16:06:20 UTC	112	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="apps-themes" Report-To: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} Timing-Allow-Origin: * Content-Length: 15688 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed, 13 Apr 2022 10:14:52 GMT Expires: Thu, 13 Apr 2023 10:14:52 GMT Cache-Control: public, max-age=31536000 Age: 453088 Last-Modified: Wed, 22 Sep 2021 16:13:19 GMT Content-Type: font/woff2 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2022-04-18 16:06:20 UTC	113	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 00 3d 48 00 12 00 00 00 00 8e 74 00 00 3c e4 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 64 1b 99 64 1c 85 5e 06 60 00 83 20 08 54 09 83 3c 11 0c 0a 81 dc 7c 81 c4 7b 0b 84 0a 00 12 82 10 01 36 02 24 03 88 10 04 20 05 82 74 07 20 0c 82 49 1b 33 7f 15 ec d8 4b 80 f3 40 81 10 7d 8e 20 23 11 c2 c6 99 30 36 78 3d 32 90 db 01 a9 4a f8 fd e0 ff af 09 72 8c d1 c0 fe 06 6a f6 25 32 5b ce 90 5d a2 5b d6 5c 74 47 da 16 b2 da 25 2a 22 f2 8d 26 b1 a6 75 27 27 59 a2 08 4f 74 8b d0 62 e0 9f 92 de f9 79 32 8b 5f 63 5f 01 83 af a0 08 06 b8 e8 5d 83 a7 7c f9 22 5b e5 00 a1 02 d3 99 dd e1 0e 55 6d be d6 53 42 5f 6f 6d c2 8a 4e e6 c9 2b 3b 03 db 46 fe 24 27 2f 0f 91 dd ff ff af aa ae 9e d9 e7 0a d1 13 f4 65 66 df 11 Data Ascii: wOF2=Ht<dd^` T<\|{6$ t I3K@} #06x=2Jrj%2[][\tG%*"&u''YOtby2_c_]\|"[UmSB_omN+;F$'/ef
2022-04-18 16:06:20 UTC	113	IN	Data Raw: b7 f7 cf cc 9c 69 e5 d6 fe de de 4d 6b 9b 52 c9 02 18 d0 0f 16 c0 10 3e c0 00 06 f0 d3 53 7f db eb 5f 62 de 78 0a 01 f5 4c 9c 9a 74 27 d9 ce e8 de b0 3f 08 7b c2 44 40 8a 51 20 78 c0 37 2f 63 c0 0d 64 db 86 03 70 09 0b 23 bb 78 9a b4 dd 79 e0 ef 45 20 ba f3 a9 36 c2 f2 90 86 65 9b ff 39 5d 30 6e ac 9f ab ee e1 71 dd fb 47 32 a6 f0 78 2e 4e bd ba d6 0b 8e 74 99 33 3a f2 cd 68 a5 0f 10 d4 dc fe 57 01 5a ed 1e f8 7d 40 b6 15 60 c1 34 92 af 93 ec a2 09 41 d1 3a 7d 3a 2a a5 3b 43 c2 f0 fd ff 7e bf f3 c5 14 51 4d 54 2a a4 4e 0d 33 9b bb de fd cf 69 c1 25 11 ba ae b2 46 93 fe 50 1c 0b 8f 6a cf cf a9 19 45 70 c7 25 68 03 00 05 ac ff a7 b3 6c 67 34 f6 62 68 76 2f 2f 7b 61 27 ec 6e 8b 6e 13 2e 1d 28 81 fa d4 a3 2f 6b 25 cd 48 b6 0c 07 f2 91 17 0e ec 43 db 47 64 fb Data Ascii: iMkR>S_bxLt'?{D@Q x7/cdp#xyE 6e9]0nqG2x.Nt3:hWZ}@`4A:}:;C~QMTN3i%FPjEp%hlg4bhv//{a'nn.(/k%HCGd
2022-04-18 16:06:20 UTC	115	IN	Data Raw: bc c1 d2 db dd 2e fb fa be d2 7a 7f d1 a6 e0 6d 36 f5 7d 14 be 13 af f8 63 58 e9 c0 c6 bb 38 16 4a 3a d8 4e e9 2b 4e 4d b1 1b 73 a4 62 fb 6e de d6 9a 2f f9 57 31 4d ce 1a 1c 1d 54 66 2b ff bb e6 a2 94 ed 03 74 42 76 3b f1 85 2e ca 9b eb 43 6e 55 4b a2 69 01 cd b6 aa 1a 1e f8 ae f5 b6 69 29 f6 95 77 71 d1 f9 ad 76 1b 5a b7 e5 a2 75 b0 11 6b 1e 25 ee b7 d7 04 ad 97 af 5a c6 b1 63 fd 3f 1b a7 96 6e 5f 27 12 37 54 45 81 dd 14 82 a1 30 d8 13 86 93 24 0b 41 9e 3a 66 5a 0c ac 54 73 16 04 58 81 0a b3 ad 2d c2 89 0b 51 6e 54 82 57 ed e3 7c f8 39 a1 ac b6 b4 46 6d 64 74 9c 55 45 73 0e 28 79 e7 13 57 df fd e6 0d 46 d3 02 e1 23 7c 44 08 0b 31 50 18 29 2a 40 9a 72 91 a1 10 59 8a a4 48 59 28 51 56 ca 94 97 1a 85 a8 53 6e 5a 94 9d 36 65 a1 43 05 e9 52 7e 7a 14 43 9f b2 Data Ascii: .zm6}cX8J:N+NMsbn/W1MTf+tBv;.CnUKii)wqvZuk%Zc?n_'7TE0$A:fZTsX-QnTW\|9FmdtUEs(yWF#\|D1P)*@rYHY(QVSnZ6eCR~zC
2022-04-18 16:06:20 UTC	116	IN	Data Raw: 5a 2f a0 08 77 d7 59 4c 63 b3 20 8b e9 9b 67 16 26 78 f2 81 ac 79 06 19 79 10 df df a0 68 18 e9 ef c3 88 12 74 1b 4f 08 bc 8f 2e 26 bc 78 ec 84 d9 c6 81 64 75 b3 ac dc d6 07 a1 31 c0 fa ff ab 77 45 d4 65 ca 0d e0 5f c0 de df 03 47 5f 07 d4 c5 40 fe 06 b8 f4 2b da cc 07 81 23 78 20 60 e6 44 21 72 0c ce 56 4c b4 02 c0 24 9b 0f 6e 2c 5d c5 d0 32 8d c9 d2 99 62 8d 62 6a 48 c0 a2 db 72 cb ac 0e 14 20 d5 32 c2 42 ed 4a 4d f8 e9 87 2a 0f 2a af b9 a1 09 85 a3 18 7c cb 7d a0 68 18 52 10 be c5 54 6e fc f1 80 9a f3 11 9f 06 ef 02 2e da f1 3c 8f 4e a3 c1 10 64 7b 5a 9c 2b 2f 5b 63 5a 2f 11 65 a7 6f 5e b1 a8 f4 e4 8c 33 ab c3 e4 44 34 79 b0 ba f6 51 9f aa 90 85 d3 46 a1 92 88 8b 89 76 4e b6 56 75 6f 73 d4 de 78 9c f3 e4 92 4d 36 9c 75 26 bd 4b a6 c3 ae 45 bd ef 63 6c Data Ascii: Z/wYLc g&xyyhtO.&xdu1wEe_G_@+#x `D!rVL$n,]2bbjHr 2BJM**\|}hRTn.<Nd{Z+/[cZ/eo^3D4yQFvNVuosxM6u&KEcl
2022-04-18 16:06:20 UTC	117	IN	Data Raw: b2 35 06 90 95 50 d4 7c c3 94 dd 2a c2 0b 2d 4b 7a 7d ed 91 72 8b 23 2b 85 73 00 33 f9 31 e5 4f 73 03 0d 31 f7 34 98 85 ab 67 30 0c b2 e0 eb 1b 91 7f 62 8b 86 90 07 7a 89 f5 15 48 1c 4f da 58 d8 79 26 e5 2c 19 b8 8e 97 0c 03 d3 0c eb 32 89 40 cb 2b 3f ea af c0 85 1c 65 60 dd da 21 f7 3b dc ee 50 8b e5 ad ea b0 36 99 44 ac c0 04 0d 3c 54 ff 2e d8 10 a8 ed fa 5d 9f 59 f5 8a e7 19 06 c4 fe 02 b3 1e bf 46 8a a0 41 4d e0 d2 ee bb 99 fe 7b b2 bb c4 dc fe a3 b0 3d 62 ee ff 9f 6c ce 21 74 f5 8c be 6a 79 ad c4 40 4c 03 26 6f 72 44 4f c1 1e f8 63 96 db 84 1b 46 10 61 9b 25 80 c9 38 34 4d 1c ea c4 78 16 51 ec a8 03 f4 d5 53 bf 31 86 b7 77 83 48 3c f4 cb 0b 3f 09 04 16 bd b1 0c 33 3a 84 93 86 c8 c3 55 97 f5 17 43 c4 49 66 1a aa 95 70 39 aa e5 65 75 53 ad 06 a2 cf 4b Data Ascii: 5P\|*-Kz}r#+s31Os14g0bzHOXy&,2@+?e`!;P6D<T.]YFAM{=bl!tjy@L&orDOcFa%84MxQS1wH<?3:UCIfp9euSK
2022-04-18 16:06:20 UTC	118	IN	Data Raw: b6 37 85 0f a9 95 f9 eb d0 a6 cc 5b f2 0e a5 b4 e8 01 ec 85 ee 13 c6 bd 24 72 1f d7 a2 88 8e 1a a3 f8 bb 52 5c 8e 4b 87 2b b1 b4 3a b1 ac a9 ad 9c be 0c fb fe e4 e6 9b b5 8b 8f b8 64 8a 7b 9e 39 f0 07 ab 52 0a a0 fa 62 22 f8 1f 57 92 13 e8 c3 7f f6 e6 56 0f 9f 5c f7 cf b8 18 79 32 55 b2 60 24 77 fe ff cb 16 b0 79 89 91 58 5f 9a 43 aa a0 14 e6 b6 96 d4 40 94 4c ad c0 c3 95 c6 15 67 86 73 63 8c cc dc c7 05 e9 cf 4b 0b 2b ee d6 b7 9f 58 ad bf 1e b4 3b 59 1e 65 40 5e 3a 44 ed ec 7e 82 3d 9d fd bc 8e b9 32 82 c9 a2 e6 a4 e4 d7 8c b4 d6 74 d0 8a d2 cd d4 99 42 d4 bf 5e 6c 97 78 04 ff ff bd d8 21 16 2e 5d 7b ce ba b6 fb 85 7d f5 1e dc e8 af 45 8d 5b 9f 33 e2 1e d5 bf 33 41 d4 d5 6c bc fb 59 7a 76 e5 64 7d 43 d5 94 93 89 ab a5 e4 84 e5 75 c9 7a 7e ee a6 c7 6a 06 Data Ascii: 7[$rR\K+:d{9Rb"WV\y2U`$wyX_C@LgscK+X;Ye@^:D~=2tB^lx!.]{}E[33AlYzvd}Cuz~j
2022-04-18 16:06:20 UTC	120	IN	Data Raw: 98 46 93 42 29 d0 70 a0 21 2f c3 70 32 9a 66 5d 7f 62 cd 4a 0b 9e bb 7c 75 77 48 ee 61 ae ec c3 41 69 ed bc c6 ba c6 3a 61 91 73 4f 3b 21 c9 ed e3 32 ff 99 cf bc e2 b1 ae 5b e3 94 7e c0 38 1c 77 0d 4c 24 26 04 17 07 5b 30 9c 88 0d f3 ee 29 97 1f 30 e0 67 3f d5 4b ba 63 be 94 bb b7 7a 4a 58 6c 55 bb 2c b9 27 06 66 99 c0 b8 7e bc 90 9f b9 1d 57 85 ce 1a 00 28 f0 59 3f ae ac 6c 47 16 3e 85 b8 5a 7d bb 74 d2 a1 7f cd a5 7f bc b8 f6 76 98 7e 41 70 6d 2a 93 e7 08 c2 27 b9 77 3e 38 76 13 21 05 8e 7d 95 f8 f5 71 49 dd a5 0f 4f 98 86 47 98 22 2a 49 91 15 2d 2b 33 c7 2f 37 2f db f8 49 fe 7c a3 38 7d 2d 36 5f 9d 0e 50 e0 3d 3a 31 b6 64 f1 ca 5b b5 1f 53 a8 a9 c6 3b 24 9a 63 fb 47 e7 a6 21 72 e3 bd 30 5b dc 06 4e ec 93 44 77 c6 9f 8d ca fc 07 87 3c 70 bb 4d 78 e7 e8 Data Ascii: FB)p!/p2f]bJ\|uwHaAi:asO;!2[~8wL$&[0)0g?KczJXlU,'f~W(Y?lG>Z}tv~Apm'w>8v!}qIOG"I-+3/7/I\|8}-6_P=:1d[S;$cG!r0[NDw<pMx
2022-04-18 16:06:20 UTC	121	IN	Data Raw: 6b 1d 62 7e 5a c3 a1 c8 58 c8 89 66 87 c3 87 98 7b 94 11 8a 50 ae de 57 1a 50 6c d7 61 39 15 ff 57 41 d4 fc 93 6b f3 50 57 47 fb 95 fb 97 62 69 d7 ee b7 76 0d 9e ad af 09 f6 73 f1 f6 8b 2e cd 4c 48 8b 2e f5 f3 f1 c1 87 fe 2b 1c ea 3c 81 3d 6f c4 75 be f3 c4 d0 40 bb 38 b6 a7 bb 0b 77 ae e3 38 b1 7f 85 e1 69 bd 98 67 b5 c8 f0 5c 59 18 73 b7 be bb b8 60 bd 3a e1 de 1c 39 73 d1 d5 c6 35 2f 35 3f 33 3c ae 27 75 88 a0 5e 92 65 6e af a1 d6 c5 1a 3e 98 5f 5a dc 5c 49 d2 0b 14 70 f4 ce 38 e9 2e cd a8 8c 77 06 1e 06 6a 7e 71 ba bb a9 0c 74 71 b7 a1 90 e7 e3 cd 23 c4 45 61 8e a9 ab 1b d7 d7 26 3e 34 d8 26 86 6b 7f 04 4d 7f 71 ae 70 e2 6e ee 2b c8 ce cc 35 4a 57 01 cd fa 6e 48 4c f5 03 ba 18 a7 3f 11 3e 92 db 66 01 b9 1b 6b 5a d9 e9 85 94 0d ab be e4 ed a2 76 09 a0 Data Ascii: kb~ZXf{PWPla9WAkPWGbivs.LH.+<=ou@8w8ig\Ys`:9s5/5?3<'u^en>_Z\Ip8.wj~qtq#Ea&>4&kMqpn+5JWnHL?>fkZv
2022-04-18 16:06:20 UTC	122	IN	Data Raw: 46 ad 9a 2c 00 c1 01 8b e2 e5 82 11 96 5e 39 b0 ea 14 7a 48 68 d0 f2 b1 72 f9 08 0b 2f 32 ac 89 4e 3f 47 08 ba bf 61 48 bd 1c 19 e7 a2 03 ee aa a0 cf 22 dc 63 e3 7c bc 13 08 be 92 ee 31 31 7e be b1 b1 1e 7c 22 92 50 79 85 54 21 4e aa a8 02 c3 91 38 71 97 95 b1 2b a1 0a a8 12 73 26 26 fc c7 17 76 bb 53 33 e3 34 b0 22 79 f0 eb 63 f7 ce 27 85 8a e3 3a 53 45 d2 7e 08 9f 40 b2 8e 66 8d 96 8e 66 8f 32 23 85 45 3f 47 91 44 71 dd 04 89 d8 73 b4 15 e4 e5 dc ec bc d2 3c 8a fe 4b 71 4a a9 3a 85 5c ea 25 10 4f ad a4 56 c6 0b 78 7d 59 aa bd e1 7d a3 ce a9 20 d6 60 94 62 da 68 2a bc 52 66 5e 29 3e 13 ab cb 57 e3 07 f4 44 5b b3 54 12 52 23 a2 a2 fd 36 a9 9b 83 56 0c 1d 46 b1 1a 32 38 13 67 7b e3 7e 74 e9 c9 e9 8b 1e e3 14 30 34 3d 79 31 54 4e 0f 20 1f d3 fd ca d4 16 55 Data Ascii: F,^9zHhr/2N?GaH"c\|11~\|"PyT!N8q+s&&vS34"yc':SE~@ff2#E?GDqs<KqJ:\%OVx}Y} `bh*Rf^)>WD[TR#6VF28g{~t04=y1TN U
2022-04-18 16:06:20 UTC	123	IN	Data Raw: b3 fc 5f f9 2a d8 81 55 73 8c e5 37 4e a0 3e 11 50 cc 6e 38 af 17 80 99 e7 5b d7 42 9b 8b 37 9f ad 19 df 96 3d 5f 6c 87 cf 0b 00 1b 3b 9e 5e 04 e2 b1 f3 3f 78 0a e4 15 28 ff 7f 07 9f 8b 2f b7 7e ab 39 af 1c 18 3f 9f 6f 79 63 37 ac fa 02 50 5f 57 33 17 90 cb cf 46 7e c8 f0 f0 6e 6d 48 53 20 eb c9 f0 12 f7 97 1a 0a 9b c7 c5 73 61 f1 86 c5 98 0f 06 ea 92 39 cf 6f dc f8 09 43 43 9f ff 6e 93 a6 25 b4 0a c0 4d 1e e5 79 51 51 6d 89 39 2f a4 ff c3 7f 18 25 40 07 f3 b9 7d 1c f7 7a fd 27 39 16 48 46 04 d1 27 e9 25 7a 97 47 b1 30 5d bd ff ee 30 94 41 df 00 92 7c 21 0a 3f 75 49 a2 86 b3 69 ff 77 05 e2 07 88 b2 c3 ba 69 a9 28 63 8b ed 09 5a b8 7e 27 3f 5b 8f 17 ff 7a e2 91 41 96 31 00 ad a9 75 2c 90 14 31 96 12 3d 80 d8 95 38 9c 78 ea d5 58 b9 7b dc e3 3e c6 d4 c2 4f Data Ascii: _*Us7N>Pn8[B7=_l;^?x(/~9?oyc7P_W3F~nmHS sa9oCCn%MyQQm9/%@}z'9HF'%zG0]0A\|!?uIiwi(cZ~'?[zA1u,1=8xX{>O
2022-04-18 16:06:20 UTC	125	IN	Data Raw: b2 a0 22 17 35 da bc d9 ab 03 44 ad 11 3b f5 08 07 58 3f 9c 22 9d f2 88 4b 15 9a a3 63 f2 bf 9b b5 3a 1c 9a b1 4d 56 16 c0 83 0a 9d 75 b1 4d 86 88 c5 cf 48 f6 50 cd 1b 42 ff 42 36 70 34 fb 2b 79 f1 5d 39 8b 49 f4 1b c0 a8 33 d3 a6 0c 75 fa 3c 70 1c da b4 74 bb 00 23 df 0c a6 d2 6a 63 67 56 98 cf de c9 48 cf 70 34 62 49 ca 10 38 53 97 aa 9d 2f 7b 6a 47 8e c5 84 b2 92 04 64 4f fc b1 6a da 9a 69 eb 14 c1 b6 a4 7a 52 5e d0 74 e8 cc ca 50 7d 90 0b a8 1e e9 21 ff 9b 23 c2 a4 5c 8a ca 4a c1 a9 c0 f0 e2 38 9d 98 c1 50 b2 17 87 cc 99 4d 83 67 e0 20 de dc e7 59 e7 a8 88 4b 78 53 fb de 7e 57 3b ac 0e 89 41 20 ca 02 76 c6 8e 8d 4e b6 25 e9 ad 54 9c 35 b2 f8 53 7a f5 10 9b a2 63 92 6f 70 57 a6 1f 4c 46 7f 00 49 83 80 ca e9 1e 61 20 84 1c 6c b1 79 23 50 89 c1 90 69 e2 Data Ascii: "5D;X?"Kc:MVuMHPBB6p4+y]9I3u<pt#jcgVHp4bI8S/{jGdOjizR^tP}!#\J8PMg YKxS~W;A vN%T5SzcopWLFIa ly#Pi
2022-04-18 16:06:20 UTC	126	IN	Data Raw: f1 01 d0 54 cd bb 49 6d 2b fd 22 2e 48 5b 3f dc 61 1d 1a 8f 4f 62 04 5a 6e 8d bb c8 fe 9b 99 81 ea b9 98 72 34 99 72 68 a0 e4 98 4a aa 74 47 e8 bb f0 da d7 66 53 24 23 a3 6c 6a 56 44 35 5c 00 db 4c aa d9 08 40 96 db 82 21 de c2 05 61 86 f9 52 03 cd b4 0c 65 46 a5 87 09 6e 56 0d f5 f5 bd d7 87 a6 0e e2 8e 2b 37 a9 3d fc e8 3e 97 d6 d0 8f b9 37 4c 8d 53 ce 0c 9f fa 74 19 fd 69 e7 56 17 ca 21 3d b4 ff 9a 34 d4 64 7f e2 f6 b9 1e fd 9b f4 a7 65 e0 d3 dc dd 7f cf 23 bc 19 87 ff 7e f9 fa ab fb 44 e2 4e c7 0b 3d 8e 6f ca d7 f2 f4 8c e4 71 57 09 e0 74 96 d0 ff ee b8 59 d9 23 4d b2 2b a2 34 53 24 d7 89 85 d7 d2 ac 0b d2 1a 99 c9 79 0d 5e bd 35 e7 4b 72 c2 ab ac a5 8b ab f5 15 d6 d3 da c1 61 69 18 7a 24 f4 88 5e cc 1d c7 56 2a 3b c5 64 0b 32 4b 68 9e d1 dd bc 43 5d Data Ascii: TIm+".H[?aObZnr4rhJtGfS$#ljVD5\L@!aReFnV+7=>7LStiV!=4de#~DN=oqWtY#M+4S$y^5Kraiz$^V*;d2KhC]
2022-04-18 16:06:20 UTC	127	IN	Data Raw: b0 1e 53 be 18 51 4e bd bf a3 05 36 00 e0 8b 1f 97 a2 02 fc 68 9c ff f6 eb 98 bf eb 3b ca 9b 44 c0 0e 18 80 00 d6 27 6d d9 00 d8 b9 fd 7f 84 fe 59 57 ca 20 cd 9d a8 f1 72 21 d4 f5 ff 76 9f 9a fb 75 25 15 b9 de 49 ad 1c b1 73 43 64 fd 14 1a a1 c2 f3 8a e2 bc 41 6a 10 09 57 29 fb a8 21 92 1a 24 53 48 d5 b0 85 dd 39 16 12 61 80 2f 3f 1a 5a 14 b1 13 9f 77 48 7c 40 8a 8b 64 8b 8b 65 85 68 2a 45 a4 b1 c4 66 55 12 35 b5 08 d7 6f fd 53 43 ea 34 d4 5f e5 53 20 e8 63 89 32 e6 78 46 2a 98 ac 28 1a 13 61 17 ec 07 96 3f fa af cc 3c 29 93 2d cf 37 a6 de e9 ab 69 8e b5 48 65 2a 2b 9f 7c 84 57 01 fa 13 41 bb 56 71 d6 d7 b9 e5 31 35 c3 92 cc 94 0f f3 b8 1f a3 d1 06 91 cf a7 5d 5e 62 2a 5b 79 29 f3 a9 42 fe a5 cf 37 97 e8 59 a5 02 2a 42 79 7c 54 11 87 3d bd 1c 78 ed a3 b6 Data Ascii: SQN6h;D'mYW r!vu%IsCdAjW)!$SH9a/?ZwH\|@dehEfU5oSC4_S c2xF(a?<)-7iHe+\|WAVq15]^b[y)B7Y*By\|T=x

Target ID:	1
Start time:	18:05:29
Start date:	18/04/2022
Path:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE" /Automation -Embedding
Imagebase:	0xf30000
File size:	1937688 bytes
MD5 hash:	0B9AB9B9C4DE429473D6450D4297A123
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Target ID:	7
Start time:	18:06:11
Start date:	18/04/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "https://tinyurl.com/carmela00
Imagebase:	0x7ff6a37e0000
File size:	2150896 bytes
MD5 hash:	C139654B5C1438A95B321BB01AD63EF6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high