Windows Analysis Report
https://cionfacttalleriproj.norwayeast.cloudapp.azure.com/?finanzas.busqueda?q=Secretar%C3%ADa+de+Administraci%C3%B3n+y+Finanzas?30337974_3097_705331937556-157889157889770732479410588494105884

Overview

General Information

Sample URL:	https://cionfacttalleriproj.norwayeast.cloudapp.azure.com/?finanzas.busqueda?q=Secretar%C3%ADa+de+Administraci%C3%B3n+y+Finanzas?30337974_3097_705331937556-157889157889770732479410588494105884
Analysis ID:	1428674
Infos:

Detection

HTMLPhisher

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected HtmlPhish9

Yara detected Phisher

Classification

Signatures

Phishing

Yara detected HtmlPhish9

Source: Yara match

File source: dropped/chromecache_55, type: DROPPED

Yara detected Phisher

Source: Yara match

File source: dropped/chromecache_55, type: DROPPED

Source: https://www.google.com/sorry/index?continue=https://www.google.com/&q=EgRRtTk0GIz2iLEGIjAjDLXVbqJIxQ9VovRCB4l5UMB8icWT8-HmyTmmMKx48rPveKmVBsB_AS9thBCC4yYyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM	HTTP Parser: No favicon
Source: https://www.google.com/sorry/index?continue=https://www.google.com/&q=EgRRtTk0GIz2iLEGIjAjDLXVbqJIxQ9VovRCB4l5UMB8icWT8-HmyTmmMKx48rPveKmVBsB_AS9thBCC4yYyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM	HTTP Parser: No favicon
Source: https://www.google.com/sorry/index?continue=https://www.google.com/&q=EgRRtTk0GIz2iLEGIjAjDLXVbqJIxQ9VovRCB4l5UMB8icWT8-HmyTmmMKx48rPveKmVBsB_AS9thBCC4yYyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM	HTTP Parser: No favicon
Source: https://www.google.com/sorry/index?continue=https://www.google.com/&q=EgRRtTk0GIz2iLEGIjAjDLXVbqJIxQ9VovRCB4l5UMB8icWT8-HmyTmmMKx48rPveKmVBsB_AS9thBCC4yYyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&size=normal&s=Bss4p4UumWJ-kTq3T6zkijdjt5jAMsKHX0MbVHFKzSuqsMexs4PJ7hBSly44pUgjTmXTOAwqbT-0Pt5luH3tK3ech5qZy2PRg9NWnR_rOKIzBgBE9rscyUrYoBVVu7RXKYs_GRqVCqFcRcH12ib_n1nbehuLIb6AUfJE8W52IvQbkTol_RwQHJNihwvD6napmM9Blz_ef32yyOSSafG-jQeuNj1yYvqYzcWFlPIbAFMhLIGRxUD5XWByrSv8ugoJz1UWvvAfcgI59AuZKa5rwXFhlvI4mP8&cb=iwo4l0f6ltdu	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&size=normal&s=Bss4p4UumWJ-kTq3T6zkijdjt5jAMsKHX0MbVHFKzSuqsMexs4PJ7hBSly44pUgjTmXTOAwqbT-0Pt5luH3tK3ech5qZy2PRg9NWnR_rOKIzBgBE9rscyUrYoBVVu7RXKYs_GRqVCqFcRcH12ib_n1nbehuLIb6AUfJE8W52IvQbkTol_RwQHJNihwvD6napmM9Blz_ef32yyOSSafG-jQeuNj1yYvqYzcWFlPIbAFMhLIGRxUD5XWByrSv8ugoJz1UWvvAfcgI59AuZKa5rwXFhlvI4mP8&cb=iwo4l0f6ltdu	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&size=normal&s=Bss4p4UumWJ-kTq3T6zkijdjt5jAMsKHX0MbVHFKzSuqsMexs4PJ7hBSly44pUgjTmXTOAwqbT-0Pt5luH3tK3ech5qZy2PRg9NWnR_rOKIzBgBE9rscyUrYoBVVu7RXKYs_GRqVCqFcRcH12ib_n1nbehuLIb6AUfJE8W52IvQbkTol_RwQHJNihwvD6napmM9Blz_ef32yyOSSafG-jQeuNj1yYvqYzcWFlPIbAFMhLIGRxUD5XWByrSv8ugoJz1UWvvAfcgI59AuZKa5rwXFhlvI4mP8&cb=iwo4l0f6ltdu	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/bframe?hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/bframe?hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 23.55.253.34:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.55.253.34:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.222.162.32:443 -> 192.168.2.4:49749 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 23.40.205.18
Source: unknown	TCP traffic detected without corresponding DNS query: 23.40.205.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.40.205.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.40.205.18
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://cionfacttalleriproj.norwayeast.cloudapp.azure.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sorry/index?continue=https://www.google.com/&q=EgRRtTk0GIz2iLEGIjAjDLXVbqJIxQ9VovRCB4l5UMB8icWT8-HmyTmmMKx48rPveKmVBsB_AS9thBCC4yYyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1Host: www.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://cionfacttalleriproj.norwayeast.cloudapp.azure.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AQTF6HwtFkiCbv5YHwLXY0jmXXYplGIBo0MT0bC-ch3aiIrErN58z-5-zw; NID=513=JrCBqA6sNM8eyyO-f3VQG6IIckLkqRebCZ6VT7UfO_IV71sn3BAiK3Tpx3hWhwb5BqTRkRiZKvYVYYvLH-DNzLS4C97KziAr1iUjNUf3EuJ2iY5YPA7-CNgtptubU4m2qUB21G6_r5a3CXo7XopBiAT4XecG_2VW4srsEUWr4S4
Source: global traffic	HTTP traffic detected: GET /recaptcha/api.js HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCJDKzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com/sorry/index?continue=https://www.google.com/&q=EgRRtTk0GIz2iLEGIjAjDLXVbqJIxQ9VovRCB4l5UMB8icWT8-HmyTmmMKx48rPveKmVBsB_AS9thBCC4yYyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUMAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AQTF6HwtFkiCbv5YHwLXY0jmXXYplGIBo0MT0bC-ch3aiIrErN58z-5-zw; NID=513=JrCBqA6sNM8eyyO-f3VQG6IIckLkqRebCZ6VT7UfO_IV71sn3BAiK3Tpx3hWhwb5BqTRkRiZKvYVYYvLH-DNzLS4C97KziAr1iUjNUf3EuJ2iY5YPA7-CNgtptubU4m2qUB21G6_r5a3CXo7XopBiAT4XecG_2VW4srsEUWr4S4
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&size=normal&s=Bss4p4UumWJ-kTq3T6zkijdjt5jAMsKHX0MbVHFKzSuqsMexs4PJ7hBSly44pUgjTmXTOAwqbT-0Pt5luH3tK3ech5qZy2PRg9NWnR_rOKIzBgBE9rscyUrYoBVVu7RXKYs_GRqVCqFcRcH12ib_n1nbehuLIb6AUfJE8W52IvQbkTol_RwQHJNihwvD6napmM9Blz_ef32yyOSSafG-jQeuNj1yYvqYzcWFlPIbAFMhLIGRxUD5XWByrSv8ugoJz1UWvvAfcgI59AuZKa5rwXFhlvI4mP8&cb=iwo4l0f6ltdu HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCJDKzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.google.com/sorry/index?continue=https://www.google.com/&q=EgRRtTk0GIz2iLEGIjAjDLXVbqJIxQ9VovRCB4l5UMB8icWT8-HmyTmmMKx48rPveKmVBsB_AS9thBCC4yYyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUMAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AQTF6HwtFkiCbv5YHwLXY0jmXXYplGIBo0MT0bC-ch3aiIrErN58z-5-zw; NID=513=JrCBqA6sNM8eyyO-f3VQG6IIckLkqRebCZ6VT7UfO_IV71sn3BAiK3Tpx3hWhwb5BqTRkRiZKvYVYYvLH-DNzLS4C97KziAr1iUjNUf3EuJ2iY5YPA7-CNgtptubU4m2qUB21G6_r5a3CXo7XopBiAT4XecG_2VW4srsEUWr4S4
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/webworker.js?hl=en&v=rz4DvU-cY2JYCwHSTck0_qm- HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCJDKzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: workerReferer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&size=normal&s=Bss4p4UumWJ-kTq3T6zkijdjt5jAMsKHX0MbVHFKzSuqsMexs4PJ7hBSly44pUgjTmXTOAwqbT-0Pt5luH3tK3ech5qZy2PRg9NWnR_rOKIzBgBE9rscyUrYoBVVu7RXKYs_GRqVCqFcRcH12ib_n1nbehuLIb6AUfJE8W52IvQbkTol_RwQHJNihwvD6napmM9Blz_ef32yyOSSafG-jQeuNj1yYvqYzcWFlPIbAFMhLIGRxUD5XWByrSv8ugoJz1UWvvAfcgI59AuZKa5rwXFhlvI4mP8&cb=iwo4l0f6ltduAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AQTF6HwtFkiCbv5YHwLXY0jmXXYplGIBo0MT0bC-ch3aiIrErN58z-5-zw; NID=513=JrCBqA6sNM8eyyO-f3VQG6IIckLkqRebCZ6VT7UfO_IV71sn3BAiK3Tpx3hWhwb5BqTRkRiZKvYVYYvLH-DNzLS4C97KziAr1iUjNUf3EuJ2iY5YPA7-CNgtptubU4m2qUB21G6_r5a3CXo7XopBiAT4XecG_2VW4srsEUWr4S4
Source: global traffic	HTTP traffic detected: GET /js/bg/rIjZlM8ZNfOeVQTojtt5OPuY9YnE0CAT82tG0V-YUX0.js HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCJDKzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&size=normal&s=Bss4p4UumWJ-kTq3T6zkijdjt5jAMsKHX0MbVHFKzSuqsMexs4PJ7hBSly44pUgjTmXTOAwqbT-0Pt5luH3tK3ech5qZy2PRg9NWnR_rOKIzBgBE9rscyUrYoBVVu7RXKYs_GRqVCqFcRcH12ib_n1nbehuLIb6AUfJE8W52IvQbkTol_RwQHJNihwvD6napmM9Blz_ef32yyOSSafG-jQeuNj1yYvqYzcWFlPIbAFMhLIGRxUD5XWByrSv8ugoJz1UWvvAfcgI59AuZKa5rwXFhlvI4mP8&cb=iwo4l0f6ltduAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AQTF6HwtFkiCbv5YHwLXY0jmXXYplGIBo0MT0bC-ch3aiIrErN58z-5-zw; NID=513=JrCBqA6sNM8eyyO-f3VQG6IIckLkqRebCZ6VT7UfO_IV71sn3BAiK3Tpx3hWhwb5BqTRkRiZKvYVYYvLH-DNzLS4C97KziAr1iUjNUf3EuJ2iY5YPA7-CNgtptubU4m2qUB21G6_r5a3CXo7XopBiAT4XecG_2VW4srsEUWr4S4
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCJDKzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.google.com/sorry/index?continue=https://www.google.com/&q=EgRRtTk0GIz2iLEGIjAjDLXVbqJIxQ9VovRCB4l5UMB8icWT8-HmyTmmMKx48rPveKmVBsB_AS9thBCC4yYyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUMAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AQTF6HwtFkiCbv5YHwLXY0jmXXYplGIBo0MT0bC-ch3aiIrErN58z-5-zw; NID=513=JrCBqA6sNM8eyyO-f3VQG6IIckLkqRebCZ6VT7UfO_IV71sn3BAiK3Tpx3hWhwb5BqTRkRiZKvYVYYvLH-DNzLS4C97KziAr1iUjNUf3EuJ2iY5YPA7-CNgtptubU4m2qUB21G6_r5a3CXo7XopBiAT4XecG_2VW4srsEUWr4S4
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/bframe?hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCJDKzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.google.com/sorry/index?continue=https://www.google.com/&q=EgRRtTk0GIz2iLEGIjAjDLXVbqJIxQ9VovRCB4l5UMB8icWT8-HmyTmmMKx48rPveKmVBsB_AS9thBCC4yYyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUMAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AQTF6HwtFkiCbv5YHwLXY0jmXXYplGIBo0MT0bC-ch3aiIrErN58z-5-zw; NID=513=JrCBqA6sNM8eyyO-f3VQG6IIckLkqRebCZ6VT7UfO_IV71sn3BAiK3Tpx3hWhwb5BqTRkRiZKvYVYYvLH-DNzLS4C97KziAr1iUjNUf3EuJ2iY5YPA7-CNgtptubU4m2qUB21G6_r5a3CXo7XopBiAT4XecG_2VW4srsEUWr4S4
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AQTF6HwtFkiCbv5YHwLXY0jmXXYplGIBo0MT0bC-ch3aiIrErN58z-5-zw; NID=513=JrCBqA6sNM8eyyO-f3VQG6IIckLkqRebCZ6VT7UfO_IV71sn3BAiK3Tpx3hWhwb5BqTRkRiZKvYVYYvLH-DNzLS4C97KziAr1iUjNUf3EuJ2iY5YPA7-CNgtptubU4m2qUB21G6_r5a3CXo7XopBiAT4XecG_2VW4srsEUWr4S4
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/reload?k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _GRECAPTCHA=09ALYNOaj22Knv-ZVku1X-AeFXd7_ePdieZSAcJbSOZYOtjlPcmpW-Ds8Iet8wzYEZC0B5rN73cdU3T1rADbJKV8U; AEC=AQTF6HwtFkiCbv5YHwLXY0jmXXYplGIBo0MT0bC-ch3aiIrErN58z-5-zw; NID=513=JrCBqA6sNM8eyyO-f3VQG6IIckLkqRebCZ6VT7UfO_IV71sn3BAiK3Tpx3hWhwb5BqTRkRiZKvYVYYvLH-DNzLS4C97KziAr1iUjNUf3EuJ2iY5YPA7-CNgtptubU4m2qUB21G6_r5a3CXo7XopBiAT4XecG_2VW4srsEUWr4S4
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/payload?p=06AFcWeA407PX6KZPO_EZMp_NZbasNkhse1n9EzmIo2dBbRb4x9Gi9vRNiZyFRManWTdB3isufJ6LkOCy4Xga80NHHoKO85DUdTIlvj-_OeAbbdpD7MppuLHIJzJgBUQRn4GP9mi-KPxzCaEUkHF1v2lrTYZWJePF7qtkgN9glOLLs2BEZnXT9boVDHOf75I3XVsoLG0JYbXKc&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCJDKzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.google.com/recaptcha/api2/bframe?hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1bAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _GRECAPTCHA=09ALYNOaj22Knv-ZVku1X-AeFXd7_ePdieZSAcJbSOZYOtjlPcmpW-Ds8Iet8wzYEZC0B5rN73cdU3T1rADbJKV8U; AEC=AQTF6HwtFkiCbv5YHwLXY0jmXXYplGIBo0MT0bC-ch3aiIrErN58z-5-zw; NID=513=JrCBqA6sNM8eyyO-f3VQG6IIckLkqRebCZ6VT7UfO_IV71sn3BAiK3Tpx3hWhwb5BqTRkRiZKvYVYYvLH-DNzLS4C97KziAr1iUjNUf3EuJ2iY5YPA7-CNgtptubU4m2qUB21G6_r5a3CXo7XopBiAT4XecG_2VW4srsEUWr4S4
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/payload?p=06AFcWeA407PX6KZPO_EZMp_NZbasNkhse1n9EzmIo2dBbRb4x9Gi9vRNiZyFRManWTdB3isufJ6LkOCy4Xga80NHHoKO85DUdTIlvj-_OeAbbdpD7MppuLHIJzJgBUQRn4GP9mi-KPxzCaEUkHF1v2lrTYZWJePF7qtkgN9glOLLs2BEZnXT9boVDHOf75I3XVsoLG0JYbXKc&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _GRECAPTCHA=09ALYNOaj22Knv-ZVku1X-AeFXd7_ePdieZSAcJbSOZYOtjlPcmpW-Ds8Iet8wzYEZC0B5rN73cdU3T1rADbJKV8U; AEC=AQTF6HwtFkiCbv5YHwLXY0jmXXYplGIBo0MT0bC-ch3aiIrErN58z-5-zw; NID=513=JrCBqA6sNM8eyyO-f3VQG6IIckLkqRebCZ6VT7UfO_IV71sn3BAiK3Tpx3hWhwb5BqTRkRiZKvYVYYvLH-DNzLS4C97KziAr1iUjNUf3EuJ2iY5YPA7-CNgtptubU4m2qUB21G6_r5a3CXo7XopBiAT4XecG_2VW4srsEUWr4S4

Source: unknown

DNS traffic detected: queries for: www.google.com

Source: unknown

HTTP traffic detected: POST /recaptcha/api2/reload?k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b HTTP/1.1Host: www.google.comConnection: keep-aliveContent-Length: 7719sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-protobufferAccept: */*Origin: https://www.google.comX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCJDKzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.google.com/recaptcha/api2/bframe?hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1bAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AQTF6HwtFkiCbv5YHwLXY0jmXXYplGIBo0MT0bC-ch3aiIrErN58z-5-zw; NID=513=JrCBqA6sNM8eyyO-f3VQG6IIckLkqRebCZ6VT7UfO_IV71sn3BAiK3Tpx3hWhwb5BqTRkRiZKvYVYYvLH-DNzLS4C97KziAr1iUjNUf3EuJ2iY5YPA7-CNgtptubU4m2qUB21G6_r5a3CXo7XopBiAT4XecG_2VW4srsEUWr4S4

Source: chromecache_72.2.dr	String found in binary or memory: https://cloud.google.com/contact
Source: chromecache_72.2.dr	String found in binary or memory: https://cloud.google.com/recaptcha-enterprise/billing-information
Source: chromecache_72.2.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#are-there-any-qps-or-daily-limits-on-my-use-of-reca
Source: chromecache_72.2.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#localhost_support
Source: chromecache_72.2.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#my-computer-or-network-may-be-sending-automated-que
Source: chromecache_72.2.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_72.2.dr	String found in binary or memory: https://recaptcha.net
Source: chromecache_72.2.dr	String found in binary or memory: https://support.google.com/recaptcha
Source: chromecache_72.2.dr	String found in binary or memory: https://support.google.com/recaptcha#6262736
Source: chromecache_72.2.dr	String found in binary or memory: https://support.google.com/recaptcha/#6175971
Source: chromecache_72.2.dr	String found in binary or memory: https://support.google.com/recaptcha/?hl=en#6223828
Source: chromecache_55.2.dr	String found in binary or memory: https://www.google.com/
Source: chromecache_59.2.dr, chromecache_72.2.dr	String found in binary or memory: https://www.google.com/recaptcha/api2/
Source: chromecache_72.2.dr	String found in binary or memory: https://www.gstatic.c..?/recaptcha/releases/rz4DvU-cY2JYCwHSTck0_qm-/recaptcha__.
Source: chromecache_59.2.dr, chromecache_64.2.dr	String found in binary or memory: https://www.gstatic.com/recaptcha/releases/rz4DvU-cY2JYCwHSTck0_qm-/recaptcha__en.js

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49672
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown	HTTPS traffic detected: 23.55.253.34:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.55.253.34:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.222.162.32:443 -> 192.168.2.4:49749 version: TLS 1.2

Source: classification engine

Classification label: mal56.phis.win@17/39@4/5

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1920 --field-trial-handle=2012,i,13379061869876988813,15450211964942131721,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://cionfacttalleriproj.norwayeast.cloudapp.azure.com/?finanzas.busqueda?q=Secretar%C3%ADa+de+Administraci%C3%B3n+y+Finanzas?30337974_3097_705331937556-157889157889770732479410588494105884"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1920 --field-trial-handle=2012,i,13379061869876988813,15450211964942131721,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
74.125.136.105	www.google.com	United States	15169	GOOGLEUS	false
142.250.105.103	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false

Private

IP
192.168.2.4
192.168.2.23

Contacted Domains

Name	IP	Active
www.google.com	74.125.136.105	true
fp2e7a.wpc.phicdn.net	192.229.211.108	true

Contacted URLs

Name	Malicious	Reputation
https://www.google.com/recaptcha/api2/bframe?hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b	false	high
https://www.google.com/js/bg/rIjZlM8ZNfOeVQTojtt5OPuY9YnE0CAT82tG0V-YUX0.js	false	high
https://www.google.com/recaptcha/api2/reload?k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b	false	high
https://www.google.com/recaptcha/api2/payload?p=06AFcWeA407PX6KZPO_EZMp_NZbasNkhse1n9EzmIo2dBbRb4x9Gi9vRNiZyFRManWTdB3isufJ6LkOCy4Xga80NHHoKO85DUdTIlvj-_OeAbbdpD7MppuLHIJzJgBUQRn4GP9mi-KPxzCaEUkHF1v2lrTYZWJePF7qtkgN9glOLLs2BEZnXT9boVDHOf75I3XVsoLG0JYbXKc&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b	false	high
https://www.google.com/recaptcha/api.js	false	high
about:blank	false	low
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&size=normal&s=Bss4p4UumWJ-kTq3T6zkijdjt5jAMsKHX0MbVHFKzSuqsMexs4PJ7hBSly44pUgjTmXTOAwqbT-0Pt5luH3tK3ech5qZy2PRg9NWnR_rOKIzBgBE9rscyUrYoBVVu7RXKYs_GRqVCqFcRcH12ib_n1nbehuLIb6AUfJE8W52IvQbkTol_RwQHJNihwvD6napmM9Blz_ef32yyOSSafG-jQeuNj1yYvqYzcWFlPIbAFMhLIGRxUD5XWByrSv8ugoJz1UWvvAfcgI59AuZKa5rwXFhlvI4mP8&cb=iwo4l0f6ltdu	false	high
https://www.google.com/	false	high
https://www.google.com/sorry/index?continue=https://www.google.com/&q=EgRRtTk0GIz2iLEGIjAjDLXVbqJIxQ9VovRCB4l5UMB8icWT8-HmyTmmMKx48rPveKmVBsB_AS9thBCC4yYyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM	false	high
https://www.google.com/favicon.ico	false	high
https://www.google.com/recaptcha/api2/webworker.js?hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-	false	high

Name	Type	MD5	SHA1	SHA256
Chrome Cache Entry: 52	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 450x450, components 3	CE2C4103FA40DBAAD991E067F76F515F	9EC78FC3C478D528A4FD5F7235753F5ACD54F56C	29810E3B624889558A8811647A8E48B775BDE1CE06299AA60FA019B86B3ACDB4
Chrome Cache Entry: 53	MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel	F3418A443E7D841097C714D69EC4BCB8	49263695F6B0CDD72F45CF1B775E660FDC36C606	6DA5620880159634213E197FAFCA1DDE0272153BE3E4590818533FAB8D040770
Chrome Cache Entry: 54	ASCII text, with very long lines (17696)	8D120D4D5CB207E52720218A143FEF17	DAE68D4F786BDA08FE39D89AB6F3366B1199CB8B	AC88D994CF1935F39E5504E88EDB7938FB98F589C4D02013F36B46D15F98517D
Chrome Cache Entry: 55	HTML document, ASCII text, with CRLF line terminators	2404AF761BF0E15075083A7ADD25B545	EE799763A2AC937D5DB8381FD8A3EB216DE2A30D	479B3AEF58E8CD792B2DF47C8F2BF94B54DC77ADB973A5D7D5A05702EC2654C8
Chrome Cache Entry: 56	PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced	0F2A4639B8A4CB30C76E8333C00D30A6	57E273A270BB864970D747C74B3F0A7C8E515B13	44B988703019CD6BFA86C91840FECF2A42B611B364E3EEA2F4EB63BF62714E98
Chrome Cache Entry: 57	PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced	07BF314AAB04047B9E9A959EE6F63DA3	17BEF6602672E2FD9956381E01356245144003E5	55EAF62CB05DA20088DC12B39D7D254D046CB1FD61DDF3AE641F1439EFD0A5EE
Chrome Cache Entry: 58	MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel	F3418A443E7D841097C714D69EC4BCB8	49263695F6B0CDD72F45CF1B775E660FDC36C606	6DA5620880159634213E197FAFCA1DDE0272153BE3E4590818533FAB8D040770
Chrome Cache Entry: 59	ASCII text, with very long lines (1222), with no line terminators	3F1B1790C083261F6FD3CF02FB56F2F8	BF1B289456E260CF5C5F0AF7C1B0F4E9BA7EB97B	A58FF2DE4D6A14E055A553E83A4E67AEA6AAF589A57364305EEC36105CCE9EF3
Chrome Cache Entry: 60	PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced	07BF314AAB04047B9E9A959EE6F63DA3	17BEF6602672E2FD9956381E01356245144003E5	55EAF62CB05DA20088DC12B39D7D254D046CB1FD61DDF3AE641F1439EFD0A5EE
Chrome Cache Entry: 61	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced	EF9941290C50CD3866E2BA6B793F010D	4736508C795667DCEA21F8D864233031223B7832	1B9EFB22C938500971AAC2B2130A475FA23684DD69E43103894968DF83145B8A
Chrome Cache Entry: 62	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced	EF9941290C50CD3866E2BA6B793F010D	4736508C795667DCEA21F8D864233031223B7832	1B9EFB22C938500971AAC2B2130A475FA23684DD69E43103894968DF83145B8A
Chrome Cache Entry: 63	PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced	0F2A4639B8A4CB30C76E8333C00D30A6	57E273A270BB864970D747C74B3F0A7C8E515B13	44B988703019CD6BFA86C91840FECF2A42B611B364E3EEA2F4EB63BF62714E98
Chrome Cache Entry: 64	ASCII text, with no line terminators	701C50FE2F9D8CFCA61542DEE7684552	952A04F81A291E11F5D4ECD7364A3840412BA65E	9FC5DFC54DE18E9C98733BBEA6EBDCBC1F01C0B23F985556F24684EE96DC0582
Chrome Cache Entry: 65	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 450x450, components 3	CE2C4103FA40DBAAD991E067F76F515F	9EC78FC3C478D528A4FD5F7235753F5ACD54F56C	29810E3B624889558A8811647A8E48B775BDE1CE06299AA60FA019B86B3ACDB4
Chrome Cache Entry: 66	Web Open Font Format (Version 2), TrueType, length 15340, version 1.0	19B7A0ADFDD4F808B53AF7E2CE2AD4E5	81D5D4C7B5035AD10CCE63CF7100295E0C51FDDA	C912A9CE0C3122D4B2B29AD26BFE06B0390D1A5BDAA5D6128692C0BEFD1DFBBD
Chrome Cache Entry: 67	Web Open Font Format (Version 2), TrueType, length 15552, version 1.0	285467176F7FE6BB6A9C6873B3DAD2CC	EA04E4FF5142DDD69307C183DEF721A160E0A64E	5A8C1E7681318CAA29E9F44E8A6E271F6A4067A2703E9916DFD4FE9099241DB7
Chrome Cache Entry: 68	Web Open Font Format (Version 2), TrueType, length 15344, version 1.0	5D4AEB4E5F5EF754E307D7FFAEF688BD	06DB651CDF354C64A7383EA9C77024EF4FB4CEF8	3E253B66056519AA065B00A453BAC37AC5ED8F3E6FE7B542E93A9DCDCC11D0BC
Chrome Cache Entry: 69	PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced	88E0F42C9FA4F94AA8BCD54D1685C180	5AD9D47A49B82718BAA3BE88550A0B3350270C42	89C62095126FCA89EA1511CF35B49B8306162946B0C26D6F60C5506C51D85992
Chrome Cache Entry: 70	HTML document, ASCII text	B54D0452E2FDB8C0D91C455D1C5495F9	DDD85730B9CB4CB9905B1D7E7643F595D2F33CB8	F4138D99EC6E17514BB87CEEAD1C1D2A204219C970864FC85BFF00949EE18082
Chrome Cache Entry: 71	ASCII text, with very long lines (56398), with no line terminators	EB4BC511F79F7A1573B45F5775B3A99B	D910FB51AD7316AA54F055079374574698E74B35	7859A62E04B0ACB06516EB12454DE6673883ECFAEAED6C254659BCA7CD59C050
Chrome Cache Entry: 72	ASCII text, with very long lines (554)	E9CCB3DBDE79BA5FFDF9CAD4B32D59FD	3A8CD67ADC7C885BDF683F1E7F491E6A4A50679F	8F2C6777C7CCC01AB67290FA8ACD5A4C4866BE64129F39DFAEB9197DFA15E137
Chrome Cache Entry: 73	PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced	88E0F42C9FA4F94AA8BCD54D1685C180	5AD9D47A49B82718BAA3BE88550A0B3350270C42	89C62095126FCA89EA1511CF35B49B8306162946B0C26D6F60C5506C51D85992
Chrome Cache Entry: 74	ASCII text, with no line terminators	AFB69DF47958EB78B4E941270772BD6A	D9FE9A625E906FF25C1F165E7872B1D9C731E78E	874809FB1235F80831B706B9E9B903D80BD5662D036B7712CC76F8C684118878

Phishing

Yara detected HtmlPhish9

Source: Yara match

File source: dropped/chromecache_55, type: DROPPED

Yara detected Phisher

Source: Yara match

File source: dropped/chromecache_55, type: DROPPED

Source: https://www.google.com/sorry/index?continue=https://www.google.com/&q=EgRRtTk0GIz2iLEGIjAjDLXVbqJIxQ9VovRCB4l5UMB8icWT8-HmyTmmMKx48rPveKmVBsB_AS9thBCC4yYyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM	HTTP Parser: No favicon
Source: https://www.google.com/sorry/index?continue=https://www.google.com/&q=EgRRtTk0GIz2iLEGIjAjDLXVbqJIxQ9VovRCB4l5UMB8icWT8-HmyTmmMKx48rPveKmVBsB_AS9thBCC4yYyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM	HTTP Parser: No favicon
Source: https://www.google.com/sorry/index?continue=https://www.google.com/&q=EgRRtTk0GIz2iLEGIjAjDLXVbqJIxQ9VovRCB4l5UMB8icWT8-HmyTmmMKx48rPveKmVBsB_AS9thBCC4yYyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM	HTTP Parser: No favicon
Source: https://www.google.com/sorry/index?continue=https://www.google.com/&q=EgRRtTk0GIz2iLEGIjAjDLXVbqJIxQ9VovRCB4l5UMB8icWT8-HmyTmmMKx48rPveKmVBsB_AS9thBCC4yYyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&size=normal&s=Bss4p4UumWJ-kTq3T6zkijdjt5jAMsKHX0MbVHFKzSuqsMexs4PJ7hBSly44pUgjTmXTOAwqbT-0Pt5luH3tK3ech5qZy2PRg9NWnR_rOKIzBgBE9rscyUrYoBVVu7RXKYs_GRqVCqFcRcH12ib_n1nbehuLIb6AUfJE8W52IvQbkTol_RwQHJNihwvD6napmM9Blz_ef32yyOSSafG-jQeuNj1yYvqYzcWFlPIbAFMhLIGRxUD5XWByrSv8ugoJz1UWvvAfcgI59AuZKa5rwXFhlvI4mP8&cb=iwo4l0f6ltdu	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&size=normal&s=Bss4p4UumWJ-kTq3T6zkijdjt5jAMsKHX0MbVHFKzSuqsMexs4PJ7hBSly44pUgjTmXTOAwqbT-0Pt5luH3tK3ech5qZy2PRg9NWnR_rOKIzBgBE9rscyUrYoBVVu7RXKYs_GRqVCqFcRcH12ib_n1nbehuLIb6AUfJE8W52IvQbkTol_RwQHJNihwvD6napmM9Blz_ef32yyOSSafG-jQeuNj1yYvqYzcWFlPIbAFMhLIGRxUD5XWByrSv8ugoJz1UWvvAfcgI59AuZKa5rwXFhlvI4mP8&cb=iwo4l0f6ltdu	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&size=normal&s=Bss4p4UumWJ-kTq3T6zkijdjt5jAMsKHX0MbVHFKzSuqsMexs4PJ7hBSly44pUgjTmXTOAwqbT-0Pt5luH3tK3ech5qZy2PRg9NWnR_rOKIzBgBE9rscyUrYoBVVu7RXKYs_GRqVCqFcRcH12ib_n1nbehuLIb6AUfJE8W52IvQbkTol_RwQHJNihwvD6napmM9Blz_ef32yyOSSafG-jQeuNj1yYvqYzcWFlPIbAFMhLIGRxUD5XWByrSv8ugoJz1UWvvAfcgI59AuZKa5rwXFhlvI4mP8&cb=iwo4l0f6ltdu	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/bframe?hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/bframe?hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 23.55.253.34:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.55.253.34:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.222.162.32:443 -> 192.168.2.4:49749 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 23.40.205.18
Source: unknown	TCP traffic detected without corresponding DNS query: 23.40.205.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.40.205.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.40.205.18
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://cionfacttalleriproj.norwayeast.cloudapp.azure.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sorry/index?continue=https://www.google.com/&q=EgRRtTk0GIz2iLEGIjAjDLXVbqJIxQ9VovRCB4l5UMB8icWT8-HmyTmmMKx48rPveKmVBsB_AS9thBCC4yYyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1Host: www.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://cionfacttalleriproj.norwayeast.cloudapp.azure.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AQTF6HwtFkiCbv5YHwLXY0jmXXYplGIBo0MT0bC-ch3aiIrErN58z-5-zw; NID=513=JrCBqA6sNM8eyyO-f3VQG6IIckLkqRebCZ6VT7UfO_IV71sn3BAiK3Tpx3hWhwb5BqTRkRiZKvYVYYvLH-DNzLS4C97KziAr1iUjNUf3EuJ2iY5YPA7-CNgtptubU4m2qUB21G6_r5a3CXo7XopBiAT4XecG_2VW4srsEUWr4S4
Source: global traffic	HTTP traffic detected: GET /recaptcha/api.js HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCJDKzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com/sorry/index?continue=https://www.google.com/&q=EgRRtTk0GIz2iLEGIjAjDLXVbqJIxQ9VovRCB4l5UMB8icWT8-HmyTmmMKx48rPveKmVBsB_AS9thBCC4yYyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUMAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AQTF6HwtFkiCbv5YHwLXY0jmXXYplGIBo0MT0bC-ch3aiIrErN58z-5-zw; NID=513=JrCBqA6sNM8eyyO-f3VQG6IIckLkqRebCZ6VT7UfO_IV71sn3BAiK3Tpx3hWhwb5BqTRkRiZKvYVYYvLH-DNzLS4C97KziAr1iUjNUf3EuJ2iY5YPA7-CNgtptubU4m2qUB21G6_r5a3CXo7XopBiAT4XecG_2VW4srsEUWr4S4
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&size=normal&s=Bss4p4UumWJ-kTq3T6zkijdjt5jAMsKHX0MbVHFKzSuqsMexs4PJ7hBSly44pUgjTmXTOAwqbT-0Pt5luH3tK3ech5qZy2PRg9NWnR_rOKIzBgBE9rscyUrYoBVVu7RXKYs_GRqVCqFcRcH12ib_n1nbehuLIb6AUfJE8W52IvQbkTol_RwQHJNihwvD6napmM9Blz_ef32yyOSSafG-jQeuNj1yYvqYzcWFlPIbAFMhLIGRxUD5XWByrSv8ugoJz1UWvvAfcgI59AuZKa5rwXFhlvI4mP8&cb=iwo4l0f6ltdu HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCJDKzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.google.com/sorry/index?continue=https://www.google.com/&q=EgRRtTk0GIz2iLEGIjAjDLXVbqJIxQ9VovRCB4l5UMB8icWT8-HmyTmmMKx48rPveKmVBsB_AS9thBCC4yYyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUMAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AQTF6HwtFkiCbv5YHwLXY0jmXXYplGIBo0MT0bC-ch3aiIrErN58z-5-zw; NID=513=JrCBqA6sNM8eyyO-f3VQG6IIckLkqRebCZ6VT7UfO_IV71sn3BAiK3Tpx3hWhwb5BqTRkRiZKvYVYYvLH-DNzLS4C97KziAr1iUjNUf3EuJ2iY5YPA7-CNgtptubU4m2qUB21G6_r5a3CXo7XopBiAT4XecG_2VW4srsEUWr4S4
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/webworker.js?hl=en&v=rz4DvU-cY2JYCwHSTck0_qm- HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCJDKzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: workerReferer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&size=normal&s=Bss4p4UumWJ-kTq3T6zkijdjt5jAMsKHX0MbVHFKzSuqsMexs4PJ7hBSly44pUgjTmXTOAwqbT-0Pt5luH3tK3ech5qZy2PRg9NWnR_rOKIzBgBE9rscyUrYoBVVu7RXKYs_GRqVCqFcRcH12ib_n1nbehuLIb6AUfJE8W52IvQbkTol_RwQHJNihwvD6napmM9Blz_ef32yyOSSafG-jQeuNj1yYvqYzcWFlPIbAFMhLIGRxUD5XWByrSv8ugoJz1UWvvAfcgI59AuZKa5rwXFhlvI4mP8&cb=iwo4l0f6ltduAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AQTF6HwtFkiCbv5YHwLXY0jmXXYplGIBo0MT0bC-ch3aiIrErN58z-5-zw; NID=513=JrCBqA6sNM8eyyO-f3VQG6IIckLkqRebCZ6VT7UfO_IV71sn3BAiK3Tpx3hWhwb5BqTRkRiZKvYVYYvLH-DNzLS4C97KziAr1iUjNUf3EuJ2iY5YPA7-CNgtptubU4m2qUB21G6_r5a3CXo7XopBiAT4XecG_2VW4srsEUWr4S4
Source: global traffic	HTTP traffic detected: GET /js/bg/rIjZlM8ZNfOeVQTojtt5OPuY9YnE0CAT82tG0V-YUX0.js HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCJDKzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&size=normal&s=Bss4p4UumWJ-kTq3T6zkijdjt5jAMsKHX0MbVHFKzSuqsMexs4PJ7hBSly44pUgjTmXTOAwqbT-0Pt5luH3tK3ech5qZy2PRg9NWnR_rOKIzBgBE9rscyUrYoBVVu7RXKYs_GRqVCqFcRcH12ib_n1nbehuLIb6AUfJE8W52IvQbkTol_RwQHJNihwvD6napmM9Blz_ef32yyOSSafG-jQeuNj1yYvqYzcWFlPIbAFMhLIGRxUD5XWByrSv8ugoJz1UWvvAfcgI59AuZKa5rwXFhlvI4mP8&cb=iwo4l0f6ltduAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AQTF6HwtFkiCbv5YHwLXY0jmXXYplGIBo0MT0bC-ch3aiIrErN58z-5-zw; NID=513=JrCBqA6sNM8eyyO-f3VQG6IIckLkqRebCZ6VT7UfO_IV71sn3BAiK3Tpx3hWhwb5BqTRkRiZKvYVYYvLH-DNzLS4C97KziAr1iUjNUf3EuJ2iY5YPA7-CNgtptubU4m2qUB21G6_r5a3CXo7XopBiAT4XecG_2VW4srsEUWr4S4
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCJDKzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.google.com/sorry/index?continue=https://www.google.com/&q=EgRRtTk0GIz2iLEGIjAjDLXVbqJIxQ9VovRCB4l5UMB8icWT8-HmyTmmMKx48rPveKmVBsB_AS9thBCC4yYyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUMAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AQTF6HwtFkiCbv5YHwLXY0jmXXYplGIBo0MT0bC-ch3aiIrErN58z-5-zw; NID=513=JrCBqA6sNM8eyyO-f3VQG6IIckLkqRebCZ6VT7UfO_IV71sn3BAiK3Tpx3hWhwb5BqTRkRiZKvYVYYvLH-DNzLS4C97KziAr1iUjNUf3EuJ2iY5YPA7-CNgtptubU4m2qUB21G6_r5a3CXo7XopBiAT4XecG_2VW4srsEUWr4S4
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/bframe?hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCJDKzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.google.com/sorry/index?continue=https://www.google.com/&q=EgRRtTk0GIz2iLEGIjAjDLXVbqJIxQ9VovRCB4l5UMB8icWT8-HmyTmmMKx48rPveKmVBsB_AS9thBCC4yYyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUMAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AQTF6HwtFkiCbv5YHwLXY0jmXXYplGIBo0MT0bC-ch3aiIrErN58z-5-zw; NID=513=JrCBqA6sNM8eyyO-f3VQG6IIckLkqRebCZ6VT7UfO_IV71sn3BAiK3Tpx3hWhwb5BqTRkRiZKvYVYYvLH-DNzLS4C97KziAr1iUjNUf3EuJ2iY5YPA7-CNgtptubU4m2qUB21G6_r5a3CXo7XopBiAT4XecG_2VW4srsEUWr4S4
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AQTF6HwtFkiCbv5YHwLXY0jmXXYplGIBo0MT0bC-ch3aiIrErN58z-5-zw; NID=513=JrCBqA6sNM8eyyO-f3VQG6IIckLkqRebCZ6VT7UfO_IV71sn3BAiK3Tpx3hWhwb5BqTRkRiZKvYVYYvLH-DNzLS4C97KziAr1iUjNUf3EuJ2iY5YPA7-CNgtptubU4m2qUB21G6_r5a3CXo7XopBiAT4XecG_2VW4srsEUWr4S4
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/reload?k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _GRECAPTCHA=09ALYNOaj22Knv-ZVku1X-AeFXd7_ePdieZSAcJbSOZYOtjlPcmpW-Ds8Iet8wzYEZC0B5rN73cdU3T1rADbJKV8U; AEC=AQTF6HwtFkiCbv5YHwLXY0jmXXYplGIBo0MT0bC-ch3aiIrErN58z-5-zw; NID=513=JrCBqA6sNM8eyyO-f3VQG6IIckLkqRebCZ6VT7UfO_IV71sn3BAiK3Tpx3hWhwb5BqTRkRiZKvYVYYvLH-DNzLS4C97KziAr1iUjNUf3EuJ2iY5YPA7-CNgtptubU4m2qUB21G6_r5a3CXo7XopBiAT4XecG_2VW4srsEUWr4S4
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/payload?p=06AFcWeA407PX6KZPO_EZMp_NZbasNkhse1n9EzmIo2dBbRb4x9Gi9vRNiZyFRManWTdB3isufJ6LkOCy4Xga80NHHoKO85DUdTIlvj-_OeAbbdpD7MppuLHIJzJgBUQRn4GP9mi-KPxzCaEUkHF1v2lrTYZWJePF7qtkgN9glOLLs2BEZnXT9boVDHOf75I3XVsoLG0JYbXKc&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCJDKzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.google.com/recaptcha/api2/bframe?hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1bAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _GRECAPTCHA=09ALYNOaj22Knv-ZVku1X-AeFXd7_ePdieZSAcJbSOZYOtjlPcmpW-Ds8Iet8wzYEZC0B5rN73cdU3T1rADbJKV8U; AEC=AQTF6HwtFkiCbv5YHwLXY0jmXXYplGIBo0MT0bC-ch3aiIrErN58z-5-zw; NID=513=JrCBqA6sNM8eyyO-f3VQG6IIckLkqRebCZ6VT7UfO_IV71sn3BAiK3Tpx3hWhwb5BqTRkRiZKvYVYYvLH-DNzLS4C97KziAr1iUjNUf3EuJ2iY5YPA7-CNgtptubU4m2qUB21G6_r5a3CXo7XopBiAT4XecG_2VW4srsEUWr4S4
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/payload?p=06AFcWeA407PX6KZPO_EZMp_NZbasNkhse1n9EzmIo2dBbRb4x9Gi9vRNiZyFRManWTdB3isufJ6LkOCy4Xga80NHHoKO85DUdTIlvj-_OeAbbdpD7MppuLHIJzJgBUQRn4GP9mi-KPxzCaEUkHF1v2lrTYZWJePF7qtkgN9glOLLs2BEZnXT9boVDHOf75I3XVsoLG0JYbXKc&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _GRECAPTCHA=09ALYNOaj22Knv-ZVku1X-AeFXd7_ePdieZSAcJbSOZYOtjlPcmpW-Ds8Iet8wzYEZC0B5rN73cdU3T1rADbJKV8U; AEC=AQTF6HwtFkiCbv5YHwLXY0jmXXYplGIBo0MT0bC-ch3aiIrErN58z-5-zw; NID=513=JrCBqA6sNM8eyyO-f3VQG6IIckLkqRebCZ6VT7UfO_IV71sn3BAiK3Tpx3hWhwb5BqTRkRiZKvYVYYvLH-DNzLS4C97KziAr1iUjNUf3EuJ2iY5YPA7-CNgtptubU4m2qUB21G6_r5a3CXo7XopBiAT4XecG_2VW4srsEUWr4S4

Source: unknown

DNS traffic detected: queries for: www.google.com

Source: unknown

Source: chromecache_72.2.dr	String found in binary or memory: https://cloud.google.com/contact
Source: chromecache_72.2.dr	String found in binary or memory: https://cloud.google.com/recaptcha-enterprise/billing-information
Source: chromecache_72.2.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#are-there-any-qps-or-daily-limits-on-my-use-of-reca
Source: chromecache_72.2.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#localhost_support
Source: chromecache_72.2.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#my-computer-or-network-may-be-sending-automated-que
Source: chromecache_72.2.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_72.2.dr	String found in binary or memory: https://recaptcha.net
Source: chromecache_72.2.dr	String found in binary or memory: https://support.google.com/recaptcha
Source: chromecache_72.2.dr	String found in binary or memory: https://support.google.com/recaptcha#6262736
Source: chromecache_72.2.dr	String found in binary or memory: https://support.google.com/recaptcha/#6175971
Source: chromecache_72.2.dr	String found in binary or memory: https://support.google.com/recaptcha/?hl=en#6223828
Source: chromecache_55.2.dr	String found in binary or memory: https://www.google.com/
Source: chromecache_59.2.dr, chromecache_72.2.dr	String found in binary or memory: https://www.google.com/recaptcha/api2/
Source: chromecache_72.2.dr	String found in binary or memory: https://www.gstatic.c..?/recaptcha/releases/rz4DvU-cY2JYCwHSTck0_qm-/recaptcha__.
Source: chromecache_59.2.dr, chromecache_64.2.dr	String found in binary or memory: https://www.gstatic.com/recaptcha/releases/rz4DvU-cY2JYCwHSTck0_qm-/recaptcha__en.js

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49672
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown	HTTPS traffic detected: 23.55.253.34:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.55.253.34:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.222.162.32:443 -> 192.168.2.4:49749 version: TLS 1.2

Source: classification engine

Classification label: mal56.phis.win@17/39@4/5

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1920 --field-trial-handle=2012,i,13379061869876988813,15450211964942131721,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://cionfacttalleriproj.norwayeast.cloudapp.azure.com/?finanzas.busqueda?q=Secretar%C3%ADa+de+Administraci%C3%B3n+y+Finanzas?30337974_3097_705331937556-157889157889770732479410588494105884"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1920 --field-trial-handle=2012,i,13379061869876988813,15450211964942131721,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

ID:	1428674
Product:	CloudBasic
Start time:	11:35:09
Start date:	19.04.2024
Cookbook:	browseurl.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Windows Analysis Report
https://cionfacttalleriproj.norwayeast.cloudapp.azure.com/?finanzas.busqueda?q=Secretar%C3%ADa+de+Administraci%C3%B3n+y+Finanzas?30337974_3097_705331937556-157889157889770732479410588494105884

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report https://cionfacttalleriproj.norwayeast.cloudapp.azure.com/?finanzas.busqueda?q=Secretar%C3%ADa+de+Administraci%C3%B3n+y+Finanzas?30337974_3097_705331937556-157889157889770732479410588494105884

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
https://cionfacttalleriproj.norwayeast.cloudapp.azure.com/?finanzas.busqueda?q=Secretar%C3%ADa+de+Administraci%C3%B3n+y+Finanzas?30337974_3097_705331937556-157889157889770732479410588494105884