Windows Analysis Report
https://docs.google.com/presentation/d/e/2PACX-1vT0H9eT4PcoyegTqKvLCT0rot4dyJa6nIDfnrx610SL6nwVFi-dTMpNO0mYjpM8BU-uE0pedvG-QWkx/pub?start=false&loop=false&delayms=3000

Overview

General Information

Sample URL:	https://docs.google.com/presentation/d/e/2PACX-1vT0H9eT4PcoyegTqKvLCT0rot4dyJa6nIDfnrx610SL6nwVFi-dTMpNO0mYjpM8BU-uE0pedvG-QWkx/pub?start=false&loop=false&delayms=3000
Analysis ID:	1426832
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Classification

Signatures

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://docs.google.com/presentation/d/e/2PACX-1vT0H9eT4PcoyegTqKvLCT0rot4dyJa6nIDfnrx610SL6nwVFi-dTMpNO0mYjpM8BU-uE0pedvG-QWkx/pub?start=false&loop=false&delayms=3000

SlashNext: detection malicious, Label: Credential Stealing type: Phishing & Social usering

Source: unknown	HTTPS traffic detected: 23.63.206.91:443 -> 192.168.2.6:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.63.206.91:443 -> 192.168.2.6:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.222.162.64:443 -> 192.168.2.6:49698 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /presentation/d/e/2PACX-1vT0H9eT4PcoyegTqKvLCT0rot4dyJa6nIDfnrx610SL6nwVFi-dTMpNO0mYjpM8BU-uE0pedvG-QWkx/pub?start=false&loop=false&delayms=3000 HTTP/1.1Host: docs.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/presentation/client/css/1389369063-viewer_css_ltr.css HTTP/1.1Host: docs.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.134"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://docs.google.com/presentation/d/e/2PACX-1vT0H9eT4PcoyegTqKvLCT0rot4dyJa6nIDfnrx610SL6nwVFi-dTMpNO0mYjpM8BU-uE0pedvG-QWkx/pub?start=false&loop=false&delayms=3000Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=513=hkUA5y7MXvRvUrbZrh4M9d73MDQmWoICo3tDa-2rJG5nE5cxb9j7HAYNIt0iMxyR1T56fV1PT38NWy8DC4vHYx-WyMlNWF4R1JfrZJHsx3OysQUhFVQ5LnQ89BHb5zr_9JhBWUjc7vsxhQueBruJpmorCpAM9cWbpA1juWmATdU; GFE_RTT=237
Source: global traffic	HTTP traffic detected: GET /static/presentation/client/js/3354192287-viewer_integrated_core.js HTTP/1.1Host: docs.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.134"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://docs.google.com/presentation/d/e/2PACX-1vT0H9eT4PcoyegTqKvLCT0rot4dyJa6nIDfnrx610SL6nwVFi-dTMpNO0mYjpM8BU-uE0pedvG-QWkx/pub?start=false&loop=false&delayms=3000Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=513=hkUA5y7MXvRvUrbZrh4M9d73MDQmWoICo3tDa-2rJG5nE5cxb9j7HAYNIt0iMxyR1T56fV1PT38NWy8DC4vHYx-WyMlNWF4R1JfrZJHsx3OysQUhFVQ5LnQ89BHb5zr_9JhBWUjc7vsxhQueBruJpmorCpAM9cWbpA1juWmATdU; GFE_RTT=237
Source: global traffic	HTTP traffic detected: GET /static/presentation/client/js/3581521856-punch_viewer_worker_binary_viewercore.js HTTP/1.1Host: docs.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=513=hkUA5y7MXvRvUrbZrh4M9d73MDQmWoICo3tDa-2rJG5nE5cxb9j7HAYNIt0iMxyR1T56fV1PT38NWy8DC4vHYx-WyMlNWF4R1JfrZJHsx3OysQUhFVQ5LnQ89BHb5zr_9JhBWUjc7vsxhQueBruJpmorCpAM9cWbpA1juWmATdU
Source: global traffic	HTTP traffic detected: GET /static/presentation/client/js/1575113683-viewer_integrated_app.js HTTP/1.1Host: docs.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.134"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://docs.google.com/presentation/d/e/2PACX-1vT0H9eT4PcoyegTqKvLCT0rot4dyJa6nIDfnrx610SL6nwVFi-dTMpNO0mYjpM8BU-uE0pedvG-QWkx/pub?start=false&loop=false&delayms=3000&slide=id.pAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=513=hkUA5y7MXvRvUrbZrh4M9d73MDQmWoICo3tDa-2rJG5nE5cxb9j7HAYNIt0iMxyR1T56fV1PT38NWy8DC4vHYx-WyMlNWF4R1JfrZJHsx3OysQUhFVQ5LnQ89BHb5zr_9JhBWUjc7vsxhQueBruJpmorCpAM9cWbpA1juWmATdU; GFE_RTT=237
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /static/presentation/client/js/1576329357-viewer_integrated_help.js HTTP/1.1Host: docs.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.134"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://docs.google.com/presentation/d/e/2PACX-1vT0H9eT4PcoyegTqKvLCT0rot4dyJa6nIDfnrx610SL6nwVFi-dTMpNO0mYjpM8BU-uE0pedvG-QWkx/pub?start=false&loop=false&delayms=3000&slide=id.pAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=513=TWhSwWnid4Ej_Q02mRwu9Gb-jJnYbG-C_0uZu6gQnotpMmqufp2MurU1IQ0MGZ1Z4lTzwMSWZGQUsG4yilME4UliGvCGGFS2Yn-uQh9-lO28rdXkMNzUvLA9Oy0htsQ1MaT6pBPG_OE1zNCr3jXas591WL9HfPM5i673Qwk5XEQ
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=513=TWhSwWnid4Ej_Q02mRwu9Gb-jJnYbG-C_0uZu6gQnotpMmqufp2MurU1IQ0MGZ1Z4lTzwMSWZGQUsG4yilME4UliGvCGGFS2Yn-uQh9-lO28rdXkMNzUvLA9Oy0htsQ1MaT6pBPG_OE1zNCr3jXas591WL9HfPM5i673Qwk5XEQ
Source: global traffic	HTTP traffic detected: GET /presentation/manifest.json HTTP/1.1Host: docs.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.134"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: manifestReferer: https://docs.google.com/presentation/d/e/2PACX-1vT0H9eT4PcoyegTqKvLCT0rot4dyJa6nIDfnrx610SL6nwVFi-dTMpNO0mYjpM8BU-uE0pedvG-QWkx/pub?start=false&loop=false&delayms=3000&slide=id.pAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=513=TWhSwWnid4Ej_Q02mRwu9Gb-jJnYbG-C_0uZu6gQnotpMmqufp2MurU1IQ0MGZ1Z4lTzwMSWZGQUsG4yilME4UliGvCGGFS2Yn-uQh9-lO28rdXkMNzUvLA9Oy0htsQ1MaT6pBPG_OE1zNCr3jXas591WL9HfPM5i673Qwk5XEQ
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=513=TWhSwWnid4Ej_Q02mRwu9Gb-jJnYbG-C_0uZu6gQnotpMmqufp2MurU1IQ0MGZ1Z4lTzwMSWZGQUsG4yilME4UliGvCGGFS2Yn-uQh9-lO28rdXkMNzUvLA9Oy0htsQ1MaT6pBPG_OE1zNCr3jXas591WL9HfPM5i673Qwk5XEQ

Source: chromecache_70.2.dr

String found in binary or memory: function yWa(a,c){zWa(a);var d=new TN(c,a.o);5==c?a.l.callback(d):(a.j.onload=h(),a.j.onerror=h(),bt(a.j),3<=a.o?a.l.callback(d):xWa(a))}function zWa(a){clearTimeout(a.v);a.v=null;clearTimeout(a.B);a.B=null}vWa.prototype.getStatus=function(){return this.l&&gsa(this.l)?this.l.getValue():new TN(1,this.o)};var AWa=Ol(["https://www.youtube.com/iframe_api"]),BWa=Ol(["https://youtube.googleapis.com/iframe_api"]);function UN(a){this.B=a=void 0===a?this.C:a;this.v=CWa;this.l=this.B(this.v);this.j=0;this.o=[]}function DWa(a){for(var c=0;c<a.o.length;c++)a.o[c].callback(a.l.getStatus());a.o=[]}function EWa(a,c){2===a.j&&c.callback(a.l.getStatus());a.o.push(c);1!==a.j&&(a.l=a.B(a.v),a.j=1,wWa(a.l).ya(function(d){2!==d.eh()&&(a.j=3,DWa(a))}))}UN.prototype.C=function(a){return new vWa(a)}; equals www.youtube.com (Youtube)

Source: unknown

DNS traffic detected: queries for: docs.google.com

Source: unknown

HTTP traffic detected: POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 4851sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"Content-Type: text/plain;charset=UTF-8sec-ch-ua-full-version: "117.0.5938.134"sec-ch-ua-platform-version: "10.0.0"X-Goog-AuthUser: 0sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: */*Origin: https://docs.google.comX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://docs.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=513=hkUA5y7MXvRvUrbZrh4M9d73MDQmWoICo3tDa-2rJG5nE5cxb9j7HAYNIt0iMxyR1T56fV1PT38NWy8DC4vHYx-WyMlNWF4R1JfrZJHsx3OysQUhFVQ5LnQ89BHb5zr_9JhBWUjc7vsxhQueBruJpmorCpAM9cWbpA1juWmATdU

Source: chromecache_70.2.dr	String found in binary or memory: http://csi.gstatic.com/csi
Source: chromecache_70.2.dr	String found in binary or memory: https://accounts.google.com/ServiceLogin
Source: chromecache_60.2.dr	String found in binary or memory: https://angular.io/license
Source: chromecache_70.2.dr	String found in binary or memory: https://apis.google.com/js/api.js
Source: chromecache_70.2.dr	String found in binary or memory: https://csi.gstatic.com/csi
Source: chromecache_66.2.dr	String found in binary or memory: https://fonts.google.com/license/googlerestricted
Source: chromecache_70.2.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Roboto:300
Source: chromecache_66.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/googlesans/v58/4Ua_rENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RF
Source: chromecache_56.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4WxKOzY.woff2)
Source: chromecache_56.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2)
Source: chromecache_56.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu5mxKOzY.woff2)
Source: chromecache_56.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu72xKOzY.woff2)
Source: chromecache_56.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu7GxKOzY.woff2)
Source: chromecache_56.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu7WxKOzY.woff2)
Source: chromecache_56.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu7mxKOzY.woff2)
Source: chromecache_70.2.dr	String found in binary or memory: https://itunes.apple.com/app/apple-store/id842842640?pt=9008&ct=docs_mo&mt=8
Source: chromecache_70.2.dr	String found in binary or memory: https://itunes.apple.com/app/apple-store/id842849113?pt=9008&ct=sheets_mo&mt=8
Source: chromecache_70.2.dr	String found in binary or memory: https://itunes.apple.com/app/apple-store/id879478102?pt=9008&ct=slides_mo&mt=8
Source: chromecache_54.2.dr	String found in binary or memory: https://play.google.com
Source: chromecache_54.2.dr	String found in binary or memory: https://policies.google.com/privacy?hl=en
Source: chromecache_54.2.dr	String found in binary or memory: https://policies.google.com/terms?hl=en
Source: chromecache_54.2.dr	String found in binary or memory: https://support.google.com
Source: chromecache_54.2.dr	String found in binary or memory: https://support.google.com/
Source: chromecache_54.2.dr	String found in binary or memory: https://support.google.com/docs/answer/1696717?hl=en
Source: chromecache_54.2.dr	String found in binary or memory: https://support.google.com/drive/?hl=en
Source: chromecache_70.2.dr	String found in binary or memory: https://uberproxy-pen-redirect.corp.google.com/uberproxy/pen?url=
Source: chromecache_54.2.dr	String found in binary or memory: https://www.google.com
Source: chromecache_70.2.dr	String found in binary or memory: https://www.google.com/recaptcha/api.js?trustedtypes=true&render=
Source: chromecache_54.2.dr	String found in binary or memory: https://www.google.com/tools/feedback
Source: chromecache_54.2.dr	String found in binary or memory: https://www.gstatic.com/feedback/js/help/prod/service/lazy.min.js
Source: chromecache_54.2.dr	String found in binary or memory: https://www.gstatic.com/uservoice/feedback/client/web/
Source: chromecache_70.2.dr	String found in binary or memory: https://www.youtube.com/iframe_api
Source: chromecache_70.2.dr	String found in binary or memory: https://youtube.googleapis.com
Source: chromecache_70.2.dr	String found in binary or memory: https://youtube.googleapis.com/iframe_api

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown	HTTPS traffic detected: 23.63.206.91:443 -> 192.168.2.6:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.63.206.91:443 -> 192.168.2.6:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.222.162.64:443 -> 192.168.2.6:49698 version: TLS 1.2

Source: classification engine

Classification label: mal48.win@16/31@8/6

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 --field-trial-handle=2232,i,2543764262290811461,8211529355654771602,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://docs.google.com/presentation/d/e/2PACX-1vT0H9eT4PcoyegTqKvLCT0rot4dyJa6nIDfnrx610SL6nwVFi-dTMpNO0mYjpM8BU-uE0pedvG-QWkx/pub?start=false&loop=false&delayms=3000"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 --field-trial-handle=2232,i,2543764262290811461,8211529355654771602,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.9.138	unknown	United States	15169	GOOGLEUS	false
172.217.215.106	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.251.15.113	play.google.com	United States	15169	GOOGLEUS	false
64.233.176.139	docs.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.6

Contacted Domains

Name	IP	Active
docs.google.com	64.233.176.139	true
bg.microsoft.map.fastly.net	199.232.214.172	true
play.google.com	142.251.15.113	true
www.google.com	172.217.215.106	true
fp2e7a.wpc.phicdn.net	192.229.211.108	true

Contacted URLs

Name	Malicious	Reputation
https://docs.google.com/static/presentation/client/js/3354192287-viewer_integrated_core.js	false	high
https://docs.google.com/presentation/d/e/2PACX-1vT0H9eT4PcoyegTqKvLCT0rot4dyJa6nIDfnrx610SL6nwVFi-dTMpNO0mYjpM8BU-uE0pedvG-QWkx/pub?start=false&loop=false&delayms=3000	false	high
https://docs.google.com/presentation/manifest.json	false	high
https://docs.google.com/static/presentation/client/css/1389369063-viewer_css_ltr.css	false	high
https://docs.google.com/static/presentation/client/js/3581521856-punch_viewer_worker_binary_viewercore.js	false	high
https://play.google.com/log?format=json&hasfast=true&authuser=0	false	high
https://docs.google.com/static/presentation/client/js/1576329357-viewer_integrated_help.js	false	high
https://docs.google.com/presentation/d/e/2PACX-1vT0H9eT4PcoyegTqKvLCT0rot4dyJa6nIDfnrx610SL6nwVFi-dTMpNO0mYjpM8BU-uE0pedvG-QWkx/pub?start=false&loop=false&delayms=3000&slide=id.p	false	high
https://docs.google.com/static/presentation/client/js/1575113683-viewer_integrated_app.js	false	high

Name	Type	MD5	SHA1	SHA256
Chrome Cache Entry: 53	SVG Scalable Vector Graphics image	9556918BC6DC794275B3F24BAE3EF8DC	0EFC6D4886FFD39DC1FF993A0563C25601B31699	8195D4EE53F853A6EFFF850D16F629CFFF9F6938FB7684998F50B471D9F63BDB
Chrome Cache Entry: 54	ASCII text, with very long lines (1599)	CC2E19DED2237D9B136B227290F12B7D	FC44C300E6986D9BDA71C869ECEA90F5A7ECEF9C	C9AA0F7B33007F5FC7762601E1A7500EA7D18C52389D643300326F9A12151071
Chrome Cache Entry: 55	MS Windows icon resource - 4 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel	5A0EB0DCD9EE0EECD82FB9A75AC67677	99C103FF8EFFC753757E90F14AE73526F4124F66	1D2B1BF6C2921393F0EEB1B21613BB9E1C9144DFDA918306EF99DBF0D9D2AEE4
Chrome Cache Entry: 56	ASCII text	E90E36C9FCF4283439F0C2BB5BB96254	ABE9B8FEEFFCBFF899A67603CDCCB93065C0480D	44004199012159C073F8C965213F9E0AECD633DFE1D58641D7F497D3C7423A61
Chrome Cache Entry: 57	PNG image data, 21 x 21, 8-bit/color RGBA, non-interlaced	E6D4B60D1F1070F9C70E11E181BD4821	54860D1365CB29C657E6B3066FE9B081F8A15609	C4529BB647D07FBC3A858BD39FE0AFF051DD7B5CCBA99C7CEA5A307FDD7F4241
Chrome Cache Entry: 58	SVG Scalable Vector Graphics image	B13911FE3DEE5B24E33B6DB093D2F92F	FBF22083144CF1971D88CB897A01C6062B1E1DD2	D9955DE358E85AA81E1C72D29ED7F168628AF4E3F474FBEC9A6DF00FD2D5FCD7
Chrome Cache Entry: 59	ASCII text, with very long lines (65536), with no line terminators	2B256F45E4F8FDC8402DA1F6E336E40C	EF1098D8B871584CE719718B6C4A9CFDF17278AA	9C1EB6EB6B48F717AA75D659D832560D8E2CED7F8090C1D9661128AD26F1EBBA
Chrome Cache Entry: 60	ASCII text, with very long lines (2044)	47949E9BFD9F02B24DF0877F3B6A12BA	73A1BF652BA8CF7366A94D31937C3E443C6B0D5F	00BDFF11C866145B86473426E3A88760E041E77829F2555866F0A1CAF701180A
Chrome Cache Entry: 61	PNG image data, 21 x 21, 8-bit/color RGBA, non-interlaced	E6D4B60D1F1070F9C70E11E181BD4821	54860D1365CB29C657E6B3066FE9B081F8A15609	C4529BB647D07FBC3A858BD39FE0AFF051DD7B5CCBA99C7CEA5A307FDD7F4241
Chrome Cache Entry: 62	MS Windows icon resource - 4 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel	5A0EB0DCD9EE0EECD82FB9A75AC67677	99C103FF8EFFC753757E90F14AE73526F4124F66	1D2B1BF6C2921393F0EEB1B21613BB9E1C9144DFDA918306EF99DBF0D9D2AEE4
Chrome Cache Entry: 63	ASCII text, with very long lines (6778)	9671A5CE4562424450BE1BA5175555E0	33A54C8E39BEFF6F94EEDA67DBC7D8921915CFF3	C6440A0CC3DC4AE8F653E4079BB900CDEB07FB83CE272FEA086E1C6271B3A113
Chrome Cache Entry: 64	HTML document, Unicode text, UTF-8 text, with very long lines (1136)	FBE36EB2EECF1B90451A3A72701E49D2	AE56EA57C52D1153CEC33CEF91CF935D2D3AF14D	E8F2DED5D74C0EE5F427A20B6715E65BC79ED5C4FC67FB00D89005515C8EFE63
Chrome Cache Entry: 65	Web Open Font Format (Version 2), TrueType, length 15552, version 1.0	285467176F7FE6BB6A9C6873B3DAD2CC	EA04E4FF5142DDD69307C183DEF721A160E0A64E	5A8C1E7681318CAA29E9F44E8A6E271F6A4067A2703E9916DFD4FE9099241DB7
Chrome Cache Entry: 66	ASCII text	A1316684E5829DF29FE33143253E8F59	793DD3B27AAB82DEA62420836D90874CD42739F7	C4F9C8E8BC991879BEAC20D773034E76BF154576B50D177B0575836AE9BE52C6
Chrome Cache Entry: 67	Web Open Font Format (Version 2), TrueType, length 15344, version 1.0	5D4AEB4E5F5EF754E307D7FFAEF688BD	06DB651CDF354C64A7383EA9C77024EF4FB4CEF8	3E253B66056519AA065B00A453BAC37AC5ED8F3E6FE7B542E93A9DCDCC11D0BC
Chrome Cache Entry: 68	SVG Scalable Vector Graphics image	B13911FE3DEE5B24E33B6DB093D2F92F	FBF22083144CF1971D88CB897A01C6062B1E1DD2	D9955DE358E85AA81E1C72D29ED7F168628AF4E3F474FBEC9A6DF00FD2D5FCD7
Chrome Cache Entry: 69	SVG Scalable Vector Graphics image	9556918BC6DC794275B3F24BAE3EF8DC	0EFC6D4886FFD39DC1FF993A0563C25601B31699	8195D4EE53F853A6EFFF850D16F629CFFF9F6938FB7684998F50B471D9F63BDB
Chrome Cache Entry: 70	HTML document, ASCII text, with very long lines (3481)	D72F27FDA3B5B168043E31B65B491C03	471EB1ADB107BCACBC730491D7FAEDE38F0235BA	0F288D7AC6752EA9C9072E8696F76621E0D5436724C397C3D5A4EEEC52A3F046

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://docs.google.com/presentation/d/e/2PACX-1vT0H9eT4PcoyegTqKvLCT0rot4dyJa6nIDfnrx610SL6nwVFi-dTMpNO0mYjpM8BU-uE0pedvG-QWkx/pub?start=false&loop=false&delayms=3000

SlashNext: detection malicious, Label: Credential Stealing type: Phishing & Social usering

Source: unknown	HTTPS traffic detected: 23.63.206.91:443 -> 192.168.2.6:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.63.206.91:443 -> 192.168.2.6:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.222.162.64:443 -> 192.168.2.6:49698 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /presentation/d/e/2PACX-1vT0H9eT4PcoyegTqKvLCT0rot4dyJa6nIDfnrx610SL6nwVFi-dTMpNO0mYjpM8BU-uE0pedvG-QWkx/pub?start=false&loop=false&delayms=3000 HTTP/1.1Host: docs.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/presentation/client/css/1389369063-viewer_css_ltr.css HTTP/1.1Host: docs.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.134"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://docs.google.com/presentation/d/e/2PACX-1vT0H9eT4PcoyegTqKvLCT0rot4dyJa6nIDfnrx610SL6nwVFi-dTMpNO0mYjpM8BU-uE0pedvG-QWkx/pub?start=false&loop=false&delayms=3000Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=513=hkUA5y7MXvRvUrbZrh4M9d73MDQmWoICo3tDa-2rJG5nE5cxb9j7HAYNIt0iMxyR1T56fV1PT38NWy8DC4vHYx-WyMlNWF4R1JfrZJHsx3OysQUhFVQ5LnQ89BHb5zr_9JhBWUjc7vsxhQueBruJpmorCpAM9cWbpA1juWmATdU; GFE_RTT=237
Source: global traffic	HTTP traffic detected: GET /static/presentation/client/js/3354192287-viewer_integrated_core.js HTTP/1.1Host: docs.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.134"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://docs.google.com/presentation/d/e/2PACX-1vT0H9eT4PcoyegTqKvLCT0rot4dyJa6nIDfnrx610SL6nwVFi-dTMpNO0mYjpM8BU-uE0pedvG-QWkx/pub?start=false&loop=false&delayms=3000Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=513=hkUA5y7MXvRvUrbZrh4M9d73MDQmWoICo3tDa-2rJG5nE5cxb9j7HAYNIt0iMxyR1T56fV1PT38NWy8DC4vHYx-WyMlNWF4R1JfrZJHsx3OysQUhFVQ5LnQ89BHb5zr_9JhBWUjc7vsxhQueBruJpmorCpAM9cWbpA1juWmATdU; GFE_RTT=237
Source: global traffic	HTTP traffic detected: GET /static/presentation/client/js/3581521856-punch_viewer_worker_binary_viewercore.js HTTP/1.1Host: docs.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=513=hkUA5y7MXvRvUrbZrh4M9d73MDQmWoICo3tDa-2rJG5nE5cxb9j7HAYNIt0iMxyR1T56fV1PT38NWy8DC4vHYx-WyMlNWF4R1JfrZJHsx3OysQUhFVQ5LnQ89BHb5zr_9JhBWUjc7vsxhQueBruJpmorCpAM9cWbpA1juWmATdU
Source: global traffic	HTTP traffic detected: GET /static/presentation/client/js/1575113683-viewer_integrated_app.js HTTP/1.1Host: docs.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.134"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://docs.google.com/presentation/d/e/2PACX-1vT0H9eT4PcoyegTqKvLCT0rot4dyJa6nIDfnrx610SL6nwVFi-dTMpNO0mYjpM8BU-uE0pedvG-QWkx/pub?start=false&loop=false&delayms=3000&slide=id.pAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=513=hkUA5y7MXvRvUrbZrh4M9d73MDQmWoICo3tDa-2rJG5nE5cxb9j7HAYNIt0iMxyR1T56fV1PT38NWy8DC4vHYx-WyMlNWF4R1JfrZJHsx3OysQUhFVQ5LnQ89BHb5zr_9JhBWUjc7vsxhQueBruJpmorCpAM9cWbpA1juWmATdU; GFE_RTT=237
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /static/presentation/client/js/1576329357-viewer_integrated_help.js HTTP/1.1Host: docs.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.134"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://docs.google.com/presentation/d/e/2PACX-1vT0H9eT4PcoyegTqKvLCT0rot4dyJa6nIDfnrx610SL6nwVFi-dTMpNO0mYjpM8BU-uE0pedvG-QWkx/pub?start=false&loop=false&delayms=3000&slide=id.pAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=513=TWhSwWnid4Ej_Q02mRwu9Gb-jJnYbG-C_0uZu6gQnotpMmqufp2MurU1IQ0MGZ1Z4lTzwMSWZGQUsG4yilME4UliGvCGGFS2Yn-uQh9-lO28rdXkMNzUvLA9Oy0htsQ1MaT6pBPG_OE1zNCr3jXas591WL9HfPM5i673Qwk5XEQ
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=513=TWhSwWnid4Ej_Q02mRwu9Gb-jJnYbG-C_0uZu6gQnotpMmqufp2MurU1IQ0MGZ1Z4lTzwMSWZGQUsG4yilME4UliGvCGGFS2Yn-uQh9-lO28rdXkMNzUvLA9Oy0htsQ1MaT6pBPG_OE1zNCr3jXas591WL9HfPM5i673Qwk5XEQ
Source: global traffic	HTTP traffic detected: GET /presentation/manifest.json HTTP/1.1Host: docs.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.134"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: manifestReferer: https://docs.google.com/presentation/d/e/2PACX-1vT0H9eT4PcoyegTqKvLCT0rot4dyJa6nIDfnrx610SL6nwVFi-dTMpNO0mYjpM8BU-uE0pedvG-QWkx/pub?start=false&loop=false&delayms=3000&slide=id.pAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=513=TWhSwWnid4Ej_Q02mRwu9Gb-jJnYbG-C_0uZu6gQnotpMmqufp2MurU1IQ0MGZ1Z4lTzwMSWZGQUsG4yilME4UliGvCGGFS2Yn-uQh9-lO28rdXkMNzUvLA9Oy0htsQ1MaT6pBPG_OE1zNCr3jXas591WL9HfPM5i673Qwk5XEQ
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=513=TWhSwWnid4Ej_Q02mRwu9Gb-jJnYbG-C_0uZu6gQnotpMmqufp2MurU1IQ0MGZ1Z4lTzwMSWZGQUsG4yilME4UliGvCGGFS2Yn-uQh9-lO28rdXkMNzUvLA9Oy0htsQ1MaT6pBPG_OE1zNCr3jXas591WL9HfPM5i673Qwk5XEQ

Source: chromecache_70.2.dr

Source: unknown

DNS traffic detected: queries for: docs.google.com

Source: unknown

Source: chromecache_70.2.dr	String found in binary or memory: http://csi.gstatic.com/csi
Source: chromecache_70.2.dr	String found in binary or memory: https://accounts.google.com/ServiceLogin
Source: chromecache_60.2.dr	String found in binary or memory: https://angular.io/license
Source: chromecache_70.2.dr	String found in binary or memory: https://apis.google.com/js/api.js
Source: chromecache_70.2.dr	String found in binary or memory: https://csi.gstatic.com/csi
Source: chromecache_66.2.dr	String found in binary or memory: https://fonts.google.com/license/googlerestricted
Source: chromecache_70.2.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Roboto:300
Source: chromecache_66.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/googlesans/v58/4Ua_rENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RF
Source: chromecache_56.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4WxKOzY.woff2)
Source: chromecache_56.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2)
Source: chromecache_56.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu5mxKOzY.woff2)
Source: chromecache_56.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu72xKOzY.woff2)
Source: chromecache_56.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu7GxKOzY.woff2)
Source: chromecache_56.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu7WxKOzY.woff2)
Source: chromecache_56.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu7mxKOzY.woff2)
Source: chromecache_70.2.dr	String found in binary or memory: https://itunes.apple.com/app/apple-store/id842842640?pt=9008&ct=docs_mo&mt=8
Source: chromecache_70.2.dr	String found in binary or memory: https://itunes.apple.com/app/apple-store/id842849113?pt=9008&ct=sheets_mo&mt=8
Source: chromecache_70.2.dr	String found in binary or memory: https://itunes.apple.com/app/apple-store/id879478102?pt=9008&ct=slides_mo&mt=8
Source: chromecache_54.2.dr	String found in binary or memory: https://play.google.com
Source: chromecache_54.2.dr	String found in binary or memory: https://policies.google.com/privacy?hl=en
Source: chromecache_54.2.dr	String found in binary or memory: https://policies.google.com/terms?hl=en
Source: chromecache_54.2.dr	String found in binary or memory: https://support.google.com
Source: chromecache_54.2.dr	String found in binary or memory: https://support.google.com/
Source: chromecache_54.2.dr	String found in binary or memory: https://support.google.com/docs/answer/1696717?hl=en
Source: chromecache_54.2.dr	String found in binary or memory: https://support.google.com/drive/?hl=en
Source: chromecache_70.2.dr	String found in binary or memory: https://uberproxy-pen-redirect.corp.google.com/uberproxy/pen?url=
Source: chromecache_54.2.dr	String found in binary or memory: https://www.google.com
Source: chromecache_70.2.dr	String found in binary or memory: https://www.google.com/recaptcha/api.js?trustedtypes=true&render=
Source: chromecache_54.2.dr	String found in binary or memory: https://www.google.com/tools/feedback
Source: chromecache_54.2.dr	String found in binary or memory: https://www.gstatic.com/feedback/js/help/prod/service/lazy.min.js
Source: chromecache_54.2.dr	String found in binary or memory: https://www.gstatic.com/uservoice/feedback/client/web/
Source: chromecache_70.2.dr	String found in binary or memory: https://www.youtube.com/iframe_api
Source: chromecache_70.2.dr	String found in binary or memory: https://youtube.googleapis.com
Source: chromecache_70.2.dr	String found in binary or memory: https://youtube.googleapis.com/iframe_api

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown	HTTPS traffic detected: 23.63.206.91:443 -> 192.168.2.6:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.63.206.91:443 -> 192.168.2.6:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.222.162.64:443 -> 192.168.2.6:49698 version: TLS 1.2

Source: classification engine

Classification label: mal48.win@16/31@8/6

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 --field-trial-handle=2232,i,2543764262290811461,8211529355654771602,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://docs.google.com/presentation/d/e/2PACX-1vT0H9eT4PcoyegTqKvLCT0rot4dyJa6nIDfnrx610SL6nwVFi-dTMpNO0mYjpM8BU-uE0pedvG-QWkx/pub?start=false&loop=false&delayms=3000"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 --field-trial-handle=2232,i,2543764262290811461,8211529355654771602,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

ID:	1426832
Product:	CloudBasic
Start time:	17:19:38
Start date:	16.04.2024
Cookbook:	browseurl.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Windows Analysis Report
https://docs.google.com/presentation/d/e/2PACX-1vT0H9eT4PcoyegTqKvLCT0rot4dyJa6nIDfnrx610SL6nwVFi-dTMpNO0mYjpM8BU-uE0pedvG-QWkx/pub?start=false&loop=false&delayms=3000

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Compliance

Networking

System Summary

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report https://docs.google.com/presentation/d/e/2PACX-1vT0H9eT4PcoyegTqKvLCT0rot4dyJa6nIDfnrx610SL6nwVFi-dTMpNO0mYjpM8BU-uE0pedvG-QWkx/pub?start=false&loop=false&delayms=3000

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Compliance

Networking

System Summary

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
https://docs.google.com/presentation/d/e/2PACX-1vT0H9eT4PcoyegTqKvLCT0rot4dyJa6nIDfnrx610SL6nwVFi-dTMpNO0mYjpM8BU-uE0pedvG-QWkx/pub?start=false&loop=false&delayms=3000