Windows Analysis Report
https://brewing.biolar.ind.br/seven/youtube/iq1jC2ZhL4UbNkFjktgne6XT03PVjfYH414ywbQNRLLYPzqpDL4qGzc3nGkvdPiY745Wtcu6pJvGyJhRPwMQrqcgx0FAKHBiGqSAjkwH6icNAQe82xAML7uzUV6UfkReUKaJ4mL5BR0CyZ0Bg3t7pzrq2a5xfU8np0MjkfnzkxVhCcTwiQRJ3AhXRYyzxFyguXExN61zpRFygMCKBpgN2dBcHqAFMiKxEw7f5YvdHb1U2xJqDkptF35mD5Y3FSM9

Overview

General Information

Sample URL:	https://brewing.biolar.ind.br/seven/youtube/iq1jC2ZhL4UbNkFjktgne6XT03PVjfYH414ywbQNRLLYPzqpDL4qGzc3nGkvdPiY745Wtcu6pJvGyJhRPwMQrqcgx0FAKHBiGqSAjkwH6icNAQe82xAML7uzUV6UfkReUKaJ4mL5BR0CyZ0Bg3t7pzrq2a5x
Analysis ID:	1417059
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Stores files to the Windows start menu directory

Uses insecure TLS / SSL version for HTTPS connection

Classification

Signatures

Source: https://brewing.biolar.ind.br/seven/youtube/iq1jC2ZhL4UbNkFjktgne6XT03PVjfYH414ywbQNRLLYPzqpDL4qGzc3nGkvdPiY745Wtcu6pJvGyJhRPwMQrqcgx0FAKHBiGqSAjkwH6icNAQe82xAML7uzUV6UfkReUKaJ4mL5BR0CyZ0Bg3t7pzrq2a5xfU8np0MjkfnzkxVhCcTwiQRJ3AhXRYyzxFyguXExN61zpRFygMCKBpgN2dBcHqAFMiKxEw7f5YvdHb1U2xJqDkptF35mD5Y3FSM9wNMw0x9QNXSYnend0EkYcnh8juky941H5eifpRuWfHXjQbtDghaHfKPXgGktc7iESue5HJwYrJvhDVYg5YQ2MeG0VW2EQcT2E5dq2cijS2UAPakfjGchNN2rZY94mxbqW9YfLUv1Z4aUmvBmC6Ch6z0Bn9357uaHwYTFXfUkHugWP-am9lbC5hZGFtc0Bzb3V0aHNpZGUuY29t

HTTP Parser: No favicon

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49736 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 23.54.46.90:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.54.46.90:443 -> 192.168.2.5:49731 version: TLS 1.2

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49736 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /seven/youtube/iq1jC2ZhL4UbNkFjktgne6XT03PVjfYH414ywbQNRLLYPzqpDL4qGzc3nGkvdPiY745Wtcu6pJvGyJhRPwMQrqcgx0FAKHBiGqSAjkwH6icNAQe82xAML7uzUV6UfkReUKaJ4mL5BR0CyZ0Bg3t7pzrq2a5xfU8np0MjkfnzkxVhCcTwiQRJ3AhXRYyzxFyguXExN61zpRFygMCKBpgN2dBcHqAFMiKxEw7f5YvdHb1U2xJqDkptF35mD5Y3FSM9wNMw0x9QNXSYnend0EkYcnh8juky941H5eifpRuWfHXjQbtDghaHfKPXgGktc7iESue5HJwYrJvhDVYg5YQ2MeG0VW2EQcT2E5dq2cijS2UAPakfjGchNN2rZY94mxbqW9YfLUv1Z4aUmvBmC6Ch6z0Bn9357uaHwYTFXfUkHugWP-am9lbC5hZGFtc0Bzb3V0aHNpZGUuY29t HTTP/1.1Host: brewing.biolar.ind.brConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/css/style.css?v=14 HTTP/1.1Host: brewing.biolar.ind.brConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://brewing.biolar.ind.br/seven/youtube/iq1jC2ZhL4UbNkFjktgne6XT03PVjfYH414ywbQNRLLYPzqpDL4qGzc3nGkvdPiY745Wtcu6pJvGyJhRPwMQrqcgx0FAKHBiGqSAjkwH6icNAQe82xAML7uzUV6UfkReUKaJ4mL5BR0CyZ0Bg3t7pzrq2a5xfU8np0MjkfnzkxVhCcTwiQRJ3AhXRYyzxFyguXExN61zpRFygMCKBpgN2dBcHqAFMiKxEw7f5YvdHb1U2xJqDkptF35mD5Y3FSM9wNMw0x9QNXSYnend0EkYcnh8juky941H5eifpRuWfHXjQbtDghaHfKPXgGktc7iESue5HJwYrJvhDVYg5YQ2MeG0VW2EQcT2E5dq2cijS2UAPakfjGchNN2rZY94mxbqW9YfLUv1Z4aUmvBmC6Ch6z0Bn9357uaHwYTFXfUkHugWP-am9lbC5hZGFtc0Bzb3V0aHNpZGUuY29tAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=73d5babcfbfb2ead48e7302053e1dd2d
Source: global traffic	HTTP traffic detected: GET /img/sharepoint.png HTTP/1.1Host: brewing.biolar.ind.brConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://brewing.biolar.ind.br/seven/youtube/iq1jC2ZhL4UbNkFjktgne6XT03PVjfYH414ywbQNRLLYPzqpDL4qGzc3nGkvdPiY745Wtcu6pJvGyJhRPwMQrqcgx0FAKHBiGqSAjkwH6icNAQe82xAML7uzUV6UfkReUKaJ4mL5BR0CyZ0Bg3t7pzrq2a5xfU8np0MjkfnzkxVhCcTwiQRJ3AhXRYyzxFyguXExN61zpRFygMCKBpgN2dBcHqAFMiKxEw7f5YvdHb1U2xJqDkptF35mD5Y3FSM9wNMw0x9QNXSYnend0EkYcnh8juky941H5eifpRuWfHXjQbtDghaHfKPXgGktc7iESue5HJwYrJvhDVYg5YQ2MeG0VW2EQcT2E5dq2cijS2UAPakfjGchNN2rZY94mxbqW9YfLUv1Z4aUmvBmC6Ch6z0Bn9357uaHwYTFXfUkHugWP-am9lbC5hZGFtc0Bzb3V0aHNpZGUuY29tAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=73d5babcfbfb2ead48e7302053e1dd2d
Source: global traffic	HTTP traffic detected: GET /img/type.png HTTP/1.1Host: brewing.biolar.ind.brConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://brewing.biolar.ind.br/seven/youtube/iq1jC2ZhL4UbNkFjktgne6XT03PVjfYH414ywbQNRLLYPzqpDL4qGzc3nGkvdPiY745Wtcu6pJvGyJhRPwMQrqcgx0FAKHBiGqSAjkwH6icNAQe82xAML7uzUV6UfkReUKaJ4mL5BR0CyZ0Bg3t7pzrq2a5xfU8np0MjkfnzkxVhCcTwiQRJ3AhXRYyzxFyguXExN61zpRFygMCKBpgN2dBcHqAFMiKxEw7f5YvdHb1U2xJqDkptF35mD5Y3FSM9wNMw0x9QNXSYnend0EkYcnh8juky941H5eifpRuWfHXjQbtDghaHfKPXgGktc7iESue5HJwYrJvhDVYg5YQ2MeG0VW2EQcT2E5dq2cijS2UAPakfjGchNN2rZY94mxbqW9YfLUv1Z4aUmvBmC6Ch6z0Bn9357uaHwYTFXfUkHugWP-am9lbC5hZGFtc0Bzb3V0aHNpZGUuY29tAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=73d5babcfbfb2ead48e7302053e1dd2d
Source: global traffic	HTTP traffic detected: GET /captchaImageSource.php HTTP/1.1Host: brewing.biolar.ind.brConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://brewing.biolar.ind.br/seven/youtube/iq1jC2ZhL4UbNkFjktgne6XT03PVjfYH414ywbQNRLLYPzqpDL4qGzc3nGkvdPiY745Wtcu6pJvGyJhRPwMQrqcgx0FAKHBiGqSAjkwH6icNAQe82xAML7uzUV6UfkReUKaJ4mL5BR0CyZ0Bg3t7pzrq2a5xfU8np0MjkfnzkxVhCcTwiQRJ3AhXRYyzxFyguXExN61zpRFygMCKBpgN2dBcHqAFMiKxEw7f5YvdHb1U2xJqDkptF35mD5Y3FSM9wNMw0x9QNXSYnend0EkYcnh8juky941H5eifpRuWfHXjQbtDghaHfKPXgGktc7iESue5HJwYrJvhDVYg5YQ2MeG0VW2EQcT2E5dq2cijS2UAPakfjGchNN2rZY94mxbqW9YfLUv1Z4aUmvBmC6Ch6z0Bn9357uaHwYTFXfUkHugWP-am9lbC5hZGFtc0Bzb3V0aHNpZGUuY29tAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=73d5babcfbfb2ead48e7302053e1dd2d
Source: global traffic	HTTP traffic detected: GET /img/submit.png HTTP/1.1Host: brewing.biolar.ind.brConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://brewing.biolar.ind.br/seven/youtube/iq1jC2ZhL4UbNkFjktgne6XT03PVjfYH414ywbQNRLLYPzqpDL4qGzc3nGkvdPiY745Wtcu6pJvGyJhRPwMQrqcgx0FAKHBiGqSAjkwH6icNAQe82xAML7uzUV6UfkReUKaJ4mL5BR0CyZ0Bg3t7pzrq2a5xfU8np0MjkfnzkxVhCcTwiQRJ3AhXRYyzxFyguXExN61zpRFygMCKBpgN2dBcHqAFMiKxEw7f5YvdHb1U2xJqDkptF35mD5Y3FSM9wNMw0x9QNXSYnend0EkYcnh8juky941H5eifpRuWfHXjQbtDghaHfKPXgGktc7iESue5HJwYrJvhDVYg5YQ2MeG0VW2EQcT2E5dq2cijS2UAPakfjGchNN2rZY94mxbqW9YfLUv1Z4aUmvBmC6Ch6z0Bn9357uaHwYTFXfUkHugWP-am9lbC5hZGFtc0Bzb3V0aHNpZGUuY29tAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=73d5babcfbfb2ead48e7302053e1dd2d
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: brewing.biolar.ind.brConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://brewing.biolar.ind.br/seven/youtube/iq1jC2ZhL4UbNkFjktgne6XT03PVjfYH414ywbQNRLLYPzqpDL4qGzc3nGkvdPiY745Wtcu6pJvGyJhRPwMQrqcgx0FAKHBiGqSAjkwH6icNAQe82xAML7uzUV6UfkReUKaJ4mL5BR0CyZ0Bg3t7pzrq2a5xfU8np0MjkfnzkxVhCcTwiQRJ3AhXRYyzxFyguXExN61zpRFygMCKBpgN2dBcHqAFMiKxEw7f5YvdHb1U2xJqDkptF35mD5Y3FSM9wNMw0x9QNXSYnend0EkYcnh8juky941H5eifpRuWfHXjQbtDghaHfKPXgGktc7iESue5HJwYrJvhDVYg5YQ2MeG0VW2EQcT2E5dq2cijS2UAPakfjGchNN2rZY94mxbqW9YfLUv1Z4aUmvBmC6Ch6z0Bn9357uaHwYTFXfUkHugWP-am9lbC5hZGFtc0Bzb3V0aHNpZGUuY29tAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=73d5babcfbfb2ead48e7302053e1dd2d
Source: global traffic	HTTP traffic detected: GET /captchaImageSource.php HTTP/1.1Host: brewing.biolar.ind.brConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=73d5babcfbfb2ead48e7302053e1dd2d
Source: global traffic	HTTP traffic detected: GET /img/sharepoint.png HTTP/1.1Host: brewing.biolar.ind.brConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=73d5babcfbfb2ead48e7302053e1dd2d
Source: global traffic	HTTP traffic detected: GET /img/type.png HTTP/1.1Host: brewing.biolar.ind.brConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=73d5babcfbfb2ead48e7302053e1dd2d
Source: global traffic	HTTP traffic detected: GET /img/submit.png HTTP/1.1Host: brewing.biolar.ind.brConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=73d5babcfbfb2ead48e7302053e1dd2d
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: brewing.biolar.ind.brConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=73d5babcfbfb2ead48e7302053e1dd2d
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com

Source: unknown

DNS traffic detected: queries for: brewing.biolar.ind.br

Source: unknown

HTTP traffic detected: POST /threshold/xls.aspx HTTP/1.1Origin: https://www.bing.comReferer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: */*Accept-Language: en-CHContent-type: text/xmlX-Agent-DeviceId: 01000A410900D492X-BM-CBT: 1696428841X-BM-DateFormat: dd/MM/yyyyX-BM-DeviceDimensions: 784x984X-BM-DeviceDimensionsLogical: 784x984X-BM-DeviceScale: 100X-BM-DTZ: 120X-BM-Market: CHX-BM-Theme: 000000;0078d7X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66EX-Device-ClientSession: DB0AFB19004F47BC80E5208C7478FF22X-Device-isOptin: falseX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-Device-OSSKU: 48X-Device-Touch: falseX-DeviceID: 01000A410900D492X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,staticshX-MSEdge-ExternalExpType: JointCoordX-PositionerType: DesktopX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateX-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard TimeX-UserAgeClass: UnknownAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: www.bing.comContent-Length: 2484Connection: Keep-AliveCache-Control: no-cacheCookie: MUID=2F4E96DB8B7049E59AD4484C3C00F7CF; _SS=SID=1A6DEABB468B65843EB5F91B47916435&CPID=1711635235037&AC=1&CPH=d1a4eb75; _EDGE_S=SID=1A6DEABB468B65843EB5F91B47916435; SRCHUID=V=2&GUID=3D32B8AC657C4AD781A584E283227995&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231004; SRCHHPGUSR=SRCHLANG=en&IPMH=986d886c&IPMID=1696428841029&HV=1696428756; CortanaAppUID=5A290E2CC4B523E2D8B5E2E3E4CB7CB7; MUIDB=2F4E96DB8B7049E59AD4484C3C00F7CF

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown	HTTPS traffic detected: 23.54.46.90:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.54.46.90:443 -> 192.168.2.5:49731 version: TLS 1.2

Source: classification engine

Classification label: clean1.win@16/19@6/4

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 --field-trial-handle=2184,i,1065761751446354512,15847831607037171849,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://brewing.biolar.ind.br/seven/youtube/iq1jC2ZhL4UbNkFjktgne6XT03PVjfYH414ywbQNRLLYPzqpDL4qGzc3nGkvdPiY745Wtcu6pJvGyJhRPwMQrqcgx0FAKHBiGqSAjkwH6icNAQe82xAML7uzUV6UfkReUKaJ4mL5BR0CyZ0Bg3t7pzrq2a5xfU8np0MjkfnzkxVhCcTwiQRJ3AhXRYyzxFyguXExN61zpRFygMCKBpgN2dBcHqAFMiKxEw7f5YvdHb1U2xJqDkptF35mD5Y3FSM9wNMw0x9QNXSYnend0EkYcnh8juky941H5eifpRuWfHXjQbtDghaHfKPXgGktc7iESue5HJwYrJvhDVYg5YQ2MeG0VW2EQcT2E5dq2cijS2UAPakfjGchNN2rZY94mxbqW9YfLUv1Z4aUmvBmC6Ch6z0Bn9357uaHwYTFXfUkHugWP-am9lbC5hZGFtc0Bzb3V0aHNpZGUuY29t"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 --field-trial-handle=2184,i,1065761751446354512,15847831607037171849,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
192.185.214.242	brewing.biolar.ind.br	United States	46606	UNIFIEDLAYER-AS-1US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.251.167.99	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.5

Contacted Domains

Name	IP	Active
brewing.biolar.ind.br	192.185.214.242	true
www.google.com	142.251.167.99	true
fp2e7a.wpc.phicdn.net	192.229.211.108	true

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://brewing.biolar.ind.br/img/type.png	false	Avira URL Cloud: safe	unknown
https://brewing.biolar.ind.br/favicon.ico	false	Avira URL Cloud: safe	unknown
https://brewing.biolar.ind.br/captchaImageSource.php	false	Avira URL Cloud: safe	unknown
https://brewing.biolar.ind.br/assets/css/style.css?v=14	false	Avira URL Cloud: safe	unknown
https://brewing.biolar.ind.br/img/submit.png	false	Avira URL Cloud: safe	unknown
https://brewing.biolar.ind.br/seven/youtube/iq1jC2ZhL4UbNkFjktgne6XT03PVjfYH414ywbQNRLLYPzqpDL4qGzc3nGkvdPiY745Wtcu6pJvGyJhRPwMQrqcgx0FAKHBiGqSAjkwH6icNAQe82xAML7uzUV6UfkReUKaJ4mL5BR0CyZ0Bg3t7pzrq2a5xfU8np0MjkfnzkxVhCcTwiQRJ3AhXRYyzxFyguXExN61zpRFygMCKBpgN2dBcHqAFMiKxEw7f5YvdHb1U2xJqDkptF35mD5Y3FSM9wNMw0x9QNXSYnend0EkYcnh8juky941H5eifpRuWfHXjQbtDghaHfKPXgGktc7iESue5HJwYrJvhDVYg5YQ2MeG0VW2EQcT2E5dq2cijS2UAPakfjGchNN2rZY94mxbqW9YfLUv1Z4aUmvBmC6Ch6z0Bn9357uaHwYTFXfUkHugWP-am9lbC5hZGFtc0Bzb3V0aHNpZGUuY29t	false		unknown
https://brewing.biolar.ind.br/img/sharepoint.png	false	Avira URL Cloud: safe	unknown

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Mar 28 13:14:10 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	5642A4FD5CD38BEA0EB1291FB5EA1696	058D324ABC343FCFFB94FE44D06168C78FA52A3D	F761185D96229B8BD30744A569FADF1F12F2907ABDAE5FC685F11932E79BC2D3
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Mar 28 13:14:10 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	29A86F65E1FB62A9287D23E4803AE7B5	B7966B42FD5D5FFF639D2ECCF2F773253C4466F7	7F6532701164F71B119AD46F4305CC41991866189CD718F31257C3DB5663BF44
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	A31F2F4BAB2AE6941B1BEAD2AF46433D	0168CF858D66772710FDE6900C45F3C358923EC6	BEE6EA874883E27AEE6C094C76AED05929D2365FC4F28860DA52935A5E69E9A1
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Mar 28 13:14:10 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	DF587C1DFEC988591F7E08FAA0CA90B1	210DAA7AD2F4D3B06AD8D489FA991E1F59EB3AE2	DC8F2A4B4B8115AE5108AF419E9344A51A2CE1F413EC2D2624F130919C7E70C4
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Mar 28 13:14:10 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	3CDDB4CD558E2438F1F1129BFBF64568	4F34A4FD26770E6398A76C6A544CFD75B68CAA40	1CB23C4FA0ED1CD070B5FEE50978193467EC3B0C89127633DEA8C27ACF5F0E7A
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Mar 28 13:14:10 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	F5F3A78F9677DAD505D3405082989B41	DB60F38FFC46BD97A8D30850816D5F2495ADBBA8	C5C9E1FE3A7E055FA38CBB39D0362222BE4A6BB485918ACBBB6BE71B8633C40E
Chrome Cache Entry: 61	PNG image data, 498 x 45, 8-bit/color RGBA, non-interlaced	338CE2AB34AF5CEF8638EF06A443BE65	CE5E56423DCC490F2AC724D79B03623B9F2D0C26	ADE7BA1E7C3AEC0CFF796A1B81B10345F3E61F4090C6E527D0F59DB8C795CD14
Chrome Cache Entry: 62	ASCII text	8E649F7D63D8E0B4831190B16B618C38	B03BCDA706720DF86970FB6C93091399BBE358D4	E524AC5A41F4658D6A5D958F9B09DF9CAFC3D9101672ABAE483065BF3D61D05B
Chrome Cache Entry: 63	ASCII text, with no line terminators	F20C48603763A982D7F6B2C8830F01AD	DEA4D0A2ABFADDA68DB41B134271C3A4A84475F7	C91C7EEE4E89FF52C17776184F3134DB98F2C1C8A9AFB98F0D5E0A9EC7D6BC43
Chrome Cache Entry: 64	PNG image data, 387 x 119, 8-bit/color RGBA, non-interlaced	783F85F1A3FF1F6CFC4DA4329A97C0FA	4CBE5EC9DEC0DB5AB1CEA9086F1C21A96652AB84	E934DC43BC6036CE60D89D59059B171D9EABDA2A482D8B43A7E1F8AFD9CB95BF
Chrome Cache Entry: 65	PNG image data, 498 x 45, 8-bit/color RGBA, non-interlaced	338CE2AB34AF5CEF8638EF06A443BE65	CE5E56423DCC490F2AC724D79B03623B9F2D0C26	ADE7BA1E7C3AEC0CFF796A1B81B10345F3E61F4090C6E527D0F59DB8C795CD14
Chrome Cache Entry: 66	PNG image data, 652 x 223, 8-bit/color RGBA, non-interlaced	C5E77AD973295C98D715B54869F95649	C9C06E6DA8A471F4378E6E3C28061616C0B7E394	4ECF9D58FE10AE3BAF948569D385E4B13CC731FE680BD1399EA4E61D97B6F085
Chrome Cache Entry: 67	PNG image data, 652 x 223, 8-bit/color RGBA, non-interlaced	C5E77AD973295C98D715B54869F95649	C9C06E6DA8A471F4378E6E3C28061616C0B7E394	4ECF9D58FE10AE3BAF948569D385E4B13CC731FE680BD1399EA4E61D97B6F085
Chrome Cache Entry: 68	PNG image data, 387 x 119, 8-bit/color RGBA, non-interlaced	783F85F1A3FF1F6CFC4DA4329A97C0FA	4CBE5EC9DEC0DB5AB1CEA9086F1C21A96652AB84	E934DC43BC6036CE60D89D59059B171D9EABDA2A482D8B43A7E1F8AFD9CB95BF

HTTP Parser: No favicon

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49736 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 23.54.46.90:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.54.46.90:443 -> 192.168.2.5:49731 version: TLS 1.2

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49736 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /seven/youtube/iq1jC2ZhL4UbNkFjktgne6XT03PVjfYH414ywbQNRLLYPzqpDL4qGzc3nGkvdPiY745Wtcu6pJvGyJhRPwMQrqcgx0FAKHBiGqSAjkwH6icNAQe82xAML7uzUV6UfkReUKaJ4mL5BR0CyZ0Bg3t7pzrq2a5xfU8np0MjkfnzkxVhCcTwiQRJ3AhXRYyzxFyguXExN61zpRFygMCKBpgN2dBcHqAFMiKxEw7f5YvdHb1U2xJqDkptF35mD5Y3FSM9wNMw0x9QNXSYnend0EkYcnh8juky941H5eifpRuWfHXjQbtDghaHfKPXgGktc7iESue5HJwYrJvhDVYg5YQ2MeG0VW2EQcT2E5dq2cijS2UAPakfjGchNN2rZY94mxbqW9YfLUv1Z4aUmvBmC6Ch6z0Bn9357uaHwYTFXfUkHugWP-am9lbC5hZGFtc0Bzb3V0aHNpZGUuY29t HTTP/1.1Host: brewing.biolar.ind.brConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/css/style.css?v=14 HTTP/1.1Host: brewing.biolar.ind.brConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://brewing.biolar.ind.br/seven/youtube/iq1jC2ZhL4UbNkFjktgne6XT03PVjfYH414ywbQNRLLYPzqpDL4qGzc3nGkvdPiY745Wtcu6pJvGyJhRPwMQrqcgx0FAKHBiGqSAjkwH6icNAQe82xAML7uzUV6UfkReUKaJ4mL5BR0CyZ0Bg3t7pzrq2a5xfU8np0MjkfnzkxVhCcTwiQRJ3AhXRYyzxFyguXExN61zpRFygMCKBpgN2dBcHqAFMiKxEw7f5YvdHb1U2xJqDkptF35mD5Y3FSM9wNMw0x9QNXSYnend0EkYcnh8juky941H5eifpRuWfHXjQbtDghaHfKPXgGktc7iESue5HJwYrJvhDVYg5YQ2MeG0VW2EQcT2E5dq2cijS2UAPakfjGchNN2rZY94mxbqW9YfLUv1Z4aUmvBmC6Ch6z0Bn9357uaHwYTFXfUkHugWP-am9lbC5hZGFtc0Bzb3V0aHNpZGUuY29tAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=73d5babcfbfb2ead48e7302053e1dd2d
Source: global traffic	HTTP traffic detected: GET /img/sharepoint.png HTTP/1.1Host: brewing.biolar.ind.brConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://brewing.biolar.ind.br/seven/youtube/iq1jC2ZhL4UbNkFjktgne6XT03PVjfYH414ywbQNRLLYPzqpDL4qGzc3nGkvdPiY745Wtcu6pJvGyJhRPwMQrqcgx0FAKHBiGqSAjkwH6icNAQe82xAML7uzUV6UfkReUKaJ4mL5BR0CyZ0Bg3t7pzrq2a5xfU8np0MjkfnzkxVhCcTwiQRJ3AhXRYyzxFyguXExN61zpRFygMCKBpgN2dBcHqAFMiKxEw7f5YvdHb1U2xJqDkptF35mD5Y3FSM9wNMw0x9QNXSYnend0EkYcnh8juky941H5eifpRuWfHXjQbtDghaHfKPXgGktc7iESue5HJwYrJvhDVYg5YQ2MeG0VW2EQcT2E5dq2cijS2UAPakfjGchNN2rZY94mxbqW9YfLUv1Z4aUmvBmC6Ch6z0Bn9357uaHwYTFXfUkHugWP-am9lbC5hZGFtc0Bzb3V0aHNpZGUuY29tAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=73d5babcfbfb2ead48e7302053e1dd2d
Source: global traffic	HTTP traffic detected: GET /img/type.png HTTP/1.1Host: brewing.biolar.ind.brConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://brewing.biolar.ind.br/seven/youtube/iq1jC2ZhL4UbNkFjktgne6XT03PVjfYH414ywbQNRLLYPzqpDL4qGzc3nGkvdPiY745Wtcu6pJvGyJhRPwMQrqcgx0FAKHBiGqSAjkwH6icNAQe82xAML7uzUV6UfkReUKaJ4mL5BR0CyZ0Bg3t7pzrq2a5xfU8np0MjkfnzkxVhCcTwiQRJ3AhXRYyzxFyguXExN61zpRFygMCKBpgN2dBcHqAFMiKxEw7f5YvdHb1U2xJqDkptF35mD5Y3FSM9wNMw0x9QNXSYnend0EkYcnh8juky941H5eifpRuWfHXjQbtDghaHfKPXgGktc7iESue5HJwYrJvhDVYg5YQ2MeG0VW2EQcT2E5dq2cijS2UAPakfjGchNN2rZY94mxbqW9YfLUv1Z4aUmvBmC6Ch6z0Bn9357uaHwYTFXfUkHugWP-am9lbC5hZGFtc0Bzb3V0aHNpZGUuY29tAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=73d5babcfbfb2ead48e7302053e1dd2d
Source: global traffic	HTTP traffic detected: GET /captchaImageSource.php HTTP/1.1Host: brewing.biolar.ind.brConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://brewing.biolar.ind.br/seven/youtube/iq1jC2ZhL4UbNkFjktgne6XT03PVjfYH414ywbQNRLLYPzqpDL4qGzc3nGkvdPiY745Wtcu6pJvGyJhRPwMQrqcgx0FAKHBiGqSAjkwH6icNAQe82xAML7uzUV6UfkReUKaJ4mL5BR0CyZ0Bg3t7pzrq2a5xfU8np0MjkfnzkxVhCcTwiQRJ3AhXRYyzxFyguXExN61zpRFygMCKBpgN2dBcHqAFMiKxEw7f5YvdHb1U2xJqDkptF35mD5Y3FSM9wNMw0x9QNXSYnend0EkYcnh8juky941H5eifpRuWfHXjQbtDghaHfKPXgGktc7iESue5HJwYrJvhDVYg5YQ2MeG0VW2EQcT2E5dq2cijS2UAPakfjGchNN2rZY94mxbqW9YfLUv1Z4aUmvBmC6Ch6z0Bn9357uaHwYTFXfUkHugWP-am9lbC5hZGFtc0Bzb3V0aHNpZGUuY29tAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=73d5babcfbfb2ead48e7302053e1dd2d
Source: global traffic	HTTP traffic detected: GET /img/submit.png HTTP/1.1Host: brewing.biolar.ind.brConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://brewing.biolar.ind.br/seven/youtube/iq1jC2ZhL4UbNkFjktgne6XT03PVjfYH414ywbQNRLLYPzqpDL4qGzc3nGkvdPiY745Wtcu6pJvGyJhRPwMQrqcgx0FAKHBiGqSAjkwH6icNAQe82xAML7uzUV6UfkReUKaJ4mL5BR0CyZ0Bg3t7pzrq2a5xfU8np0MjkfnzkxVhCcTwiQRJ3AhXRYyzxFyguXExN61zpRFygMCKBpgN2dBcHqAFMiKxEw7f5YvdHb1U2xJqDkptF35mD5Y3FSM9wNMw0x9QNXSYnend0EkYcnh8juky941H5eifpRuWfHXjQbtDghaHfKPXgGktc7iESue5HJwYrJvhDVYg5YQ2MeG0VW2EQcT2E5dq2cijS2UAPakfjGchNN2rZY94mxbqW9YfLUv1Z4aUmvBmC6Ch6z0Bn9357uaHwYTFXfUkHugWP-am9lbC5hZGFtc0Bzb3V0aHNpZGUuY29tAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=73d5babcfbfb2ead48e7302053e1dd2d
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: brewing.biolar.ind.brConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://brewing.biolar.ind.br/seven/youtube/iq1jC2ZhL4UbNkFjktgne6XT03PVjfYH414ywbQNRLLYPzqpDL4qGzc3nGkvdPiY745Wtcu6pJvGyJhRPwMQrqcgx0FAKHBiGqSAjkwH6icNAQe82xAML7uzUV6UfkReUKaJ4mL5BR0CyZ0Bg3t7pzrq2a5xfU8np0MjkfnzkxVhCcTwiQRJ3AhXRYyzxFyguXExN61zpRFygMCKBpgN2dBcHqAFMiKxEw7f5YvdHb1U2xJqDkptF35mD5Y3FSM9wNMw0x9QNXSYnend0EkYcnh8juky941H5eifpRuWfHXjQbtDghaHfKPXgGktc7iESue5HJwYrJvhDVYg5YQ2MeG0VW2EQcT2E5dq2cijS2UAPakfjGchNN2rZY94mxbqW9YfLUv1Z4aUmvBmC6Ch6z0Bn9357uaHwYTFXfUkHugWP-am9lbC5hZGFtc0Bzb3V0aHNpZGUuY29tAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=73d5babcfbfb2ead48e7302053e1dd2d
Source: global traffic	HTTP traffic detected: GET /captchaImageSource.php HTTP/1.1Host: brewing.biolar.ind.brConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=73d5babcfbfb2ead48e7302053e1dd2d
Source: global traffic	HTTP traffic detected: GET /img/sharepoint.png HTTP/1.1Host: brewing.biolar.ind.brConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=73d5babcfbfb2ead48e7302053e1dd2d
Source: global traffic	HTTP traffic detected: GET /img/type.png HTTP/1.1Host: brewing.biolar.ind.brConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=73d5babcfbfb2ead48e7302053e1dd2d
Source: global traffic	HTTP traffic detected: GET /img/submit.png HTTP/1.1Host: brewing.biolar.ind.brConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=73d5babcfbfb2ead48e7302053e1dd2d
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: brewing.biolar.ind.brConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=73d5babcfbfb2ead48e7302053e1dd2d
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com

Source: unknown

DNS traffic detected: queries for: brewing.biolar.ind.br

Source: unknown

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown	HTTPS traffic detected: 23.54.46.90:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.54.46.90:443 -> 192.168.2.5:49731 version: TLS 1.2

Source: classification engine

Classification label: clean1.win@16/19@6/4

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 --field-trial-handle=2184,i,1065761751446354512,15847831607037171849,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://brewing.biolar.ind.br/seven/youtube/iq1jC2ZhL4UbNkFjktgne6XT03PVjfYH414ywbQNRLLYPzqpDL4qGzc3nGkvdPiY745Wtcu6pJvGyJhRPwMQrqcgx0FAKHBiGqSAjkwH6icNAQe82xAML7uzUV6UfkReUKaJ4mL5BR0CyZ0Bg3t7pzrq2a5xfU8np0MjkfnzkxVhCcTwiQRJ3AhXRYyzxFyguXExN61zpRFygMCKBpgN2dBcHqAFMiKxEw7f5YvdHb1U2xJqDkptF35mD5Y3FSM9wNMw0x9QNXSYnend0EkYcnh8juky941H5eifpRuWfHXjQbtDghaHfKPXgGktc7iESue5HJwYrJvhDVYg5YQ2MeG0VW2EQcT2E5dq2cijS2UAPakfjGchNN2rZY94mxbqW9YfLUv1Z4aUmvBmC6Ch6z0Bn9357uaHwYTFXfUkHugWP-am9lbC5hZGFtc0Bzb3V0aHNpZGUuY29t"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 --field-trial-handle=2184,i,1065761751446354512,15847831607037171849,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

ID:	1417059
Product:	CloudBasic
Start time:	15:13:18
Start date:	28.03.2024
Cookbook:	browseurl.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs