Windows Analysis Report
https://us-west-2.protection.sophos.com/?d=cudasvc.com&u=aHR0cHM6Ly9saW5rcHJvdGVjdC5jdWRhc3ZjLmNvbS91cmw_YT1odHRwcyUzYSUyZiUyZmd1bm5hdXRvLW15LnNoYXJlcG9pbnQuY29tJTJmJTNhYiUzYSUyZnIlMmZwZXJzb25hbCUyZmFlcm9kcmlndWV6X2d1bm5hdXRvX2NvbSUyZkRvY3VtZW50cyUyZkF0dGFjaG1lbnRzJTJmSDI0MTQyMy5wZGYlM2Zjc2YlM2QxJTI

Overview

General Information

Sample URL:	https://us-west-2.protection.sophos.com/?d=cudasvc.com&u=aHR0cHM6Ly9saW5rcHJvdGVjdC5jdWRhc3ZjLmNvbS91cmw_YT1odHRwcyUzYSUyZiUyZmd1bm5hdXRvLW15LnNoYXJlcG9pbnQuY29tJTJmJTNhYiUzYSUyZnIlMmZwZXJzb25hbCUyZmF
Analysis ID:	1428930

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

HTML body contains low number of good links

HTML title does not match URL

Stores files to the Windows start menu directory

Classification

Signatures

HTML body contains low number of good links

Source: https://login.microsoftonline.com/ebf86bb9-f642-4b12-a97c-cb5f0f37b474/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=553FF26F865DF2CC5C05D1D0B7DEBF5F08F869B494E743BB%2DCA5681257FA6F5F22CD72207F4D214C3A626034E2BB088A4BE8BD8DEE9FA3180&redirect%5Furi=https%3A%2F%2Fgunnauto%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=2ea020a1%2Dc0f4%2D5000%2D5ae8%2D1110347a7180	HTTP Parser: Number of links: 0
Source: https://login.microsoftonline.com/ebf86bb9-f642-4b12-a97c-cb5f0f37b474/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=553FF26F865DF2CC5C05D1D0B7DEBF5F08F869B494E743BB%2DCA5681257FA6F5F22CD72207F4D214C3A626034E2BB088A4BE8BD8DEE9FA3180&redirect%5Furi=https%3A%2F%2Fgunnauto%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=2ea020a1%2Dc0f4%2D5000%2D5ae8%2D1110347a7180&sso_reload=true	HTTP Parser: Number of links: 0
Source: https://account.live.com/password/reset?wreply=https%3a%2f%2flogin.microsoftonline.com%2febf86bb9-f642-4b12-a97c-cb5f0f37b474%2freprocess%3fctx%3drQQIARAAnVE7bNNQALTj1G1CS0MnxirKVHDy3vOz_RKpQ2zHqmghTWmhDULRe45NTBI7jZ2mH1VCTB0rxICYKGxdqJhQJaTOnTp3YEOqOiBADB1JxMJYccPppJNOp7sZAWZhIQP-QpaGLAHXhZLtDNU_6E4lUwfT77K_T7jF6sWtFN5ef3HIq40o6oSFXO5Zz_dpLwqk9lY2bNCu0wk8P8raQTtXc4NuO8zVHZf2WlGWhp3Nzzx_xvMXPH8YW1cU2bKQahFVMS1kGIoBFBOaQNfMkm4pFiADK6_jPC5pWNZ1ySgqKoFI0ayiOvARMkwNIaBZ2EQQG3JRRSqQcQnpOiCkiPUS0U1ilkp5qyhDAs5jk-ViL2qgIQVdb9v5FUsMO9Y6QRi9FeJlE_QPhWut8knIOMwlKmN5yVUxkjCDSKJ5zZZsprjAlTWGNXwqiEHH8b36WZy_jI8DoTA2lkxxt7lp7irOvx8ZbDv65WvmqCnMffh24d_fi3GnI7nq0tqdDqowtLyxzGzH1Em_Xy2vrqtbpP_IW2o0Kl5l4R42wm5lFhTgvsjvi-KxmBgTUlxaMBbhD5HfG-WOE__50tkN_nwcJhN2wLrUr3v1qQyErE4AkSWiOUDCkCkSYxqRALOxbBNKHELPx3FStFvUa4dTMztpr16Lgqbjpws76c12WLPtodqgrZ4TpgtP0oOe6ae7u7svJ66VfjLBXd389fHVwc_Xb77PXU7enbf6S80eos_xY221TFsLD4FbZcGy_IDO9c3qBp1vroTy4sJafmX2KMX9AQ2&mkt=en-US	HTTP Parser: Number of links: 0

HTML title does not match URL

Source: https://login.microsoftonline.com/ebf86bb9-f642-4b12-a97c-cb5f0f37b474/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=553FF26F865DF2CC5C05D1D0B7DEBF5F08F869B494E743BB%2DCA5681257FA6F5F22CD72207F4D214C3A626034E2BB088A4BE8BD8DEE9FA3180&redirect%5Furi=https%3A%2F%2Fgunnauto%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=2ea020a1%2Dc0f4%2D5000%2D5ae8%2D1110347a7180	HTTP Parser: Title: Redirecting does not match URL
Source: https://login.microsoftonline.com/ebf86bb9-f642-4b12-a97c-cb5f0f37b474/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=553FF26F865DF2CC5C05D1D0B7DEBF5F08F869B494E743BB%2DCA5681257FA6F5F22CD72207F4D214C3A626034E2BB088A4BE8BD8DEE9FA3180&redirect%5Furi=https%3A%2F%2Fgunnauto%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=2ea020a1%2Dc0f4%2D5000%2D5ae8%2D1110347a7180&sso_reload=true	HTTP Parser: Title: Sign in to your account does not match URL

Source: https://login.microsoftonline.com/ebf86bb9-f642-4b12-a97c-cb5f0f37b474/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=553FF26F865DF2CC5C05D1D0B7DEBF5F08F869B494E743BB%2DCA5681257FA6F5F22CD72207F4D214C3A626034E2BB088A4BE8BD8DEE9FA3180&redirect%5Furi=https%3A%2F%2Fgunnauto%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=2ea020a1%2Dc0f4%2D5000%2D5ae8%2D1110347a7180&sso_reload=true

HTTP Parser: <input type="password" .../> found

HTTP Parser: No favicon

Source: https://login.microsoftonline.com/ebf86bb9-f642-4b12-a97c-cb5f0f37b474/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=553FF26F865DF2CC5C05D1D0B7DEBF5F08F869B494E743BB%2DCA5681257FA6F5F22CD72207F4D214C3A626034E2BB088A4BE8BD8DEE9FA3180&redirect%5Furi=https%3A%2F%2Fgunnauto%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=2ea020a1%2Dc0f4%2D5000%2D5ae8%2D1110347a7180	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/ebf86bb9-f642-4b12-a97c-cb5f0f37b474/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=553FF26F865DF2CC5C05D1D0B7DEBF5F08F869B494E743BB%2DCA5681257FA6F5F22CD72207F4D214C3A626034E2BB088A4BE8BD8DEE9FA3180&redirect%5Furi=https%3A%2F%2Fgunnauto%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=2ea020a1%2Dc0f4%2D5000%2D5ae8%2D1110347a7180&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/ebf86bb9-f642-4b12-a97c-cb5f0f37b474/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=553FF26F865DF2CC5C05D1D0B7DEBF5F08F869B494E743BB%2DCA5681257FA6F5F22CD72207F4D214C3A626034E2BB088A4BE8BD8DEE9FA3180&redirect%5Furi=https%3A%2F%2Fgunnauto%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=2ea020a1%2Dc0f4%2D5000%2D5ae8%2D1110347a7180&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/ebf86bb9-f642-4b12-a97c-cb5f0f37b474/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=553FF26F865DF2CC5C05D1D0B7DEBF5F08F869B494E743BB%2DCA5681257FA6F5F22CD72207F4D214C3A626034E2BB088A4BE8BD8DEE9FA3180&redirect%5Furi=https%3A%2F%2Fgunnauto%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=2ea020a1%2Dc0f4%2D5000%2D5ae8%2D1110347a7180&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://account.live.com/password/reset?wreply=https%3a%2f%2flogin.microsoftonline.com%2febf86bb9-f642-4b12-a97c-cb5f0f37b474%2freprocess%3fctx%3drQQIARAAnVE7bNNQALTj1G1CS0MnxirKVHDy3vOz_RKpQ2zHqmghTWmhDULRe45NTBI7jZ2mH1VCTB0rxICYKGxdqJhQJaTOnTp3YEOqOiBADB1JxMJYccPppJNOp7sZAWZhIQP-QpaGLAHXhZLtDNU_6E4lUwfT77K_T7jF6sWtFN5ef3HIq40o6oSFXO5Zz_dpLwqk9lY2bNCu0wk8P8raQTtXc4NuO8zVHZf2WlGWhp3Nzzx_xvMXPH8YW1cU2bKQahFVMS1kGIoBFBOaQNfMkm4pFiADK6_jPC5pWNZ1ySgqKoFI0ayiOvARMkwNIaBZ2EQQG3JRRSqQcQnpOiCkiPUS0U1ilkp5qyhDAs5jk-ViL2qgIQVdb9v5FUsMO9Y6QRi9FeJlE_QPhWut8knIOMwlKmN5yVUxkjCDSKJ5zZZsprjAlTWGNXwqiEHH8b36WZy_jI8DoTA2lkxxt7lp7irOvx8ZbDv65WvmqCnMffh24d_fi3GnI7nq0tqdDqowtLyxzGzH1Em_Xy2vrqtbpP_IW2o0Kl5l4R42wm5lFhTgvsjvi-KxmBgTUlxaMBbhD5HfG-WOE__50tkN_nwcJhN2wLrUr3v1qQyErE4AkSWiOUDCkCkSYxqRALOxbBNKHELPx3FStFvUa4dTMztpr16Lgqbjpws76c12WLPtodqgrZ4TpgtP0oOe6ae7u7svJ66VfjLBXd389fHVwc_Xb77PXU7enbf6S80eos_xY221TFsLD4FbZcGy_IDO9c3qBp1vroTy4sJafmX2KMX9AQ2&mkt=en-US	HTTP Parser: No <meta name="author".. found

Source: https://login.microsoftonline.com/ebf86bb9-f642-4b12-a97c-cb5f0f37b474/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=553FF26F865DF2CC5C05D1D0B7DEBF5F08F869B494E743BB%2DCA5681257FA6F5F22CD72207F4D214C3A626034E2BB088A4BE8BD8DEE9FA3180&redirect%5Furi=https%3A%2F%2Fgunnauto%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=2ea020a1%2Dc0f4%2D5000%2D5ae8%2D1110347a7180	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/ebf86bb9-f642-4b12-a97c-cb5f0f37b474/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=553FF26F865DF2CC5C05D1D0B7DEBF5F08F869B494E743BB%2DCA5681257FA6F5F22CD72207F4D214C3A626034E2BB088A4BE8BD8DEE9FA3180&redirect%5Furi=https%3A%2F%2Fgunnauto%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=2ea020a1%2Dc0f4%2D5000%2D5ae8%2D1110347a7180&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/ebf86bb9-f642-4b12-a97c-cb5f0f37b474/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=553FF26F865DF2CC5C05D1D0B7DEBF5F08F869B494E743BB%2DCA5681257FA6F5F22CD72207F4D214C3A626034E2BB088A4BE8BD8DEE9FA3180&redirect%5Furi=https%3A%2F%2Fgunnauto%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=2ea020a1%2Dc0f4%2D5000%2D5ae8%2D1110347a7180&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/ebf86bb9-f642-4b12-a97c-cb5f0f37b474/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=553FF26F865DF2CC5C05D1D0B7DEBF5F08F869B494E743BB%2DCA5681257FA6F5F22CD72207F4D214C3A626034E2BB088A4BE8BD8DEE9FA3180&redirect%5Furi=https%3A%2F%2Fgunnauto%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=2ea020a1%2Dc0f4%2D5000%2D5ae8%2D1110347a7180&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://account.live.com/password/reset?wreply=https%3a%2f%2flogin.microsoftonline.com%2febf86bb9-f642-4b12-a97c-cb5f0f37b474%2freprocess%3fctx%3drQQIARAAnVE7bNNQALTj1G1CS0MnxirKVHDy3vOz_RKpQ2zHqmghTWmhDULRe45NTBI7jZ2mH1VCTB0rxICYKGxdqJhQJaTOnTp3YEOqOiBADB1JxMJYccPppJNOp7sZAWZhIQP-QpaGLAHXhZLtDNU_6E4lUwfT77K_T7jF6sWtFN5ef3HIq40o6oSFXO5Zz_dpLwqk9lY2bNCu0wk8P8raQTtXc4NuO8zVHZf2WlGWhp3Nzzx_xvMXPH8YW1cU2bKQahFVMS1kGIoBFBOaQNfMkm4pFiADK6_jPC5pWNZ1ySgqKoFI0ayiOvARMkwNIaBZ2EQQG3JRRSqQcQnpOiCkiPUS0U1ilkp5qyhDAs5jk-ViL2qgIQVdb9v5FUsMO9Y6QRi9FeJlE_QPhWut8knIOMwlKmN5yVUxkjCDSKJ5zZZsprjAlTWGNXwqiEHH8b36WZy_jI8DoTA2lkxxt7lp7irOvx8ZbDv65WvmqCnMffh24d_fi3GnI7nq0tqdDqowtLyxzGzH1Em_Xy2vrqtbpP_IW2o0Kl5l4R42wm5lFhTgvsjvi-KxmBgTUlxaMBbhD5HfG-WOE__50tkN_nwcJhN2wLrUr3v1qQyErE4AkSWiOUDCkCkSYxqRALOxbBNKHELPx3FStFvUa4dTMztpr16Lgqbjpws76c12WLPtodqgrZ4TpgtP0oOe6ae7u7svJ66VfjLBXd389fHVwc_Xb77PXU7enbf6S80eos_xY221TFsLD4FbZcGy_IDO9c3qBp1vroTy4sJafmX2KMX9AQ2&mkt=en-US	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.16:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.16:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:49738 version: TLS 1.2

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 30MB

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93

Source: unknown

DNS traffic detected: queries for: us-west-2.protection.sophos.com

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.16:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.16:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:49738 version: TLS 1.2

Source: classification engine

Classification label: clean1.win@16/27@22/209

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://us-west-2.protection.sophos.com/?d=cudasvc.com&u=aHR0cHM6Ly9saW5rcHJvdGVjdC5jdWRhc3ZjLmNvbS91cmw_YT1odHRwcyUzYSUyZiUyZmd1bm5hdXRvLW15LnNoYXJlcG9pbnQuY29tJTJmJTNhYiUzYSUyZnIlMmZwZXJzb25hbCUyZmFlcm9kcmlndWV6X2d1bm5hdXRvX2NvbSUyZkRvY3VtZW50cyUyZkF0dGFjaG1lbnRzJTJmSDI0MTQyMy5wZGYlM2Zjc2YlM2QxJTI2d2ViJTNkMSZjPUUsMSxmT1pZNThPOTZjZjNwWkY1eWU3QnhGZWM2eFRWNWtyRDdneUVGdFJaNENCSjVOQkItZ0RyMUlHdlQ1Mi01Vm95d2o4Y2h5WDJXNlFFTWhsU0o2SHJUc3pqNWVoeF9aVUhzNVNZRm8xZjJfSTdwTUNIeDdiRSZ0eXBvPTE=&p=m&i=NjVjNTQ0OGE0ZWZhMmU3ZjY4MzI4ZTU2&t=RytpUnowc0wwYVZ5TS9IN2pYN0J3ektSZ3pLWEh1Y1FlaUxrM2hUL1kzST0=&h=e542e25ebbc74310ab02d99468d3cd3c&s=AVNPUEhUT0NFTkNSWVBUSVaAbgs17mmhlH_9EhbEh07dSxVIMNlJSUD1cUzHaTNepQ
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=1952,i,12405595688666852881,17956248782078030723,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=1952,i,12405595688666852881,17956248782078030723,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
23.45.13.51	unknown	United States	20940	AKAMAI-ASN1EU	false
13.107.246.41	part-0013.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.136.10	dual-spo-0005.spo-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.105.84	unknown	United States	15169	GOOGLEUS	false
64.233.176.95	unknown	United States	15169	GOOGLEUS	false
20.42.65.88	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.253.124.103	www.google.com	United States	15169	GOOGLEUS	false
13.107.42.22	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
64.233.177.139	unknown	United States	15169	GOOGLEUS	false
40.126.29.12	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.213.41	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.45.13.16	unknown	United States	20940	AKAMAI-ASN1EU	false
40.126.28.23	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
64.233.177.94	unknown	United States	15169	GOOGLEUS	false
44.208.218.64	linkprotect.cudasvc.com	United States	14618	AMAZON-AESUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
74.125.136.95	unknown	United States	15169	GOOGLEUS	false
152.199.4.44	cs1100.wpc.omegacdn.net	United States	15133	EDGECASTUS	false
142.250.105.100	unknown	United States	15169	GOOGLEUS	false
192.229.211.199	cs1227.wpc.alphacdn.net	United States	15133	EDGECASTUS	false
18.244.202.15	d2t07dpvw9bt1v.cloudfront.net	United States	16509	AMAZON-02US	false
20.190.157.11	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
64.233.185.94	unknown	United States	15169	GOOGLEUS	false
20.50.201.204	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Private

IP
192.168.2.16

Contacted Domains

Name	IP	Active
dual-spo-0005.spo-msedge.net	13.107.136.10	true
part-0013.t-0009.t-msedge.net	13.107.246.41	true
cs1100.wpc.omegacdn.net	152.199.4.44	true
d2t07dpvw9bt1v.cloudfront.net	18.244.202.15	true
www.google.com	172.253.124.103	true
cs1227.wpc.alphacdn.net	192.229.211.199	true
linkprotect.cudasvc.com	44.208.218.64	true
us-west-2.protection.sophos.com	unknown	unknown
identity.nel.measure.office.net	unknown	unknown
aadcdn.msftauth.net	unknown	unknown
logincdn.msftauth.net	unknown	unknown
gunnauto-my.sharepoint.com	unknown	unknown
login.microsoftonline.com	unknown	unknown
account.live.com	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://login.microsoftonline.com/ebf86bb9-f642-4b12-a97c-cb5f0f37b474/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=553FF26F865DF2CC5C05D1D0B7DEBF5F08F869B494E743BB%2DCA5681257FA6F5F22CD72207F4D214C3A626034E2BB088A4BE8BD8DEE9FA3180&redirect%5Furi=https%3A%2F%2Fgunnauto%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=2ea020a1%2Dc0f4%2D5000%2D5ae8%2D1110347a7180&sso_reload=true	false		high
https://login.microsoftonline.com/ebf86bb9-f642-4b12-a97c-cb5f0f37b474/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=553FF26F865DF2CC5C05D1D0B7DEBF5F08F869B494E743BB%2DCA5681257FA6F5F22CD72207F4D214C3A626034E2BB088A4BE8BD8DEE9FA3180&redirect%5Furi=https%3A%2F%2Fgunnauto%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=2ea020a1%2Dc0f4%2D5000%2D5ae8%2D1110347a7180	false		high

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 19 18:29:44 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	650214B6F303225A3DB1062F89BABDD9	9EDBCE73A8ADA4941DF545BBBF44E40A85F1C450	F746658A25A015B41390F9D1DACB3ECAB63F137A48C3C6314F9A914ED0B973B4
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 19 18:29:43 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	186C2A0619C109711A608C33F4776214	C4D65DDE6CD04CA7626E62C90E2293BA1AC8B619	2F2134EFB16A86C0A172F3902023EBB51A9E8C359EE1CB8D6459770A3FF1F37B
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	9050AE99B1338C2E9EDAEF9DD21AB186	1BEEC5AA900116114E867390C4EBE29DBAA221B9	AA5FC217226774AC4739CCC523E0886ADEA041C7DDAF5A04A1841B0B8D15A830
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 19 18:29:43 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	39C0F7631B37BFA15489D90593DE044E	A3EC26A635A8819EF19F65AF69CF3452F3932EAC	7EBC682916262E7247EB38C60D69D4625F456FA914D23D74354451ACED51B1C0
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 19 18:29:43 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	F173F9A1BFDB169B9DB1C4E4875813EF	A748C034E93BB64087034144807646B5449A446A	3CF5A612FD8D80B5567B726A2D38F9954DEFCD282535A81D5672BF8AD7B613BB
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 19 18:29:43 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	65FCA8F5EEFD7B58F39CD9937797AB17	A2ED7F945104B093A9AF687C0DD20933E23F033E	0889672A68C5008BE19F013660B30D8D3821ED1EBB0A2299C0082B538035BADE
Chrome Cache Entry: 100	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 611582	667562F3F8787E8B89A2A9D8CCE17112	38A5AD4CB43DB47D02D7E847DDB191BABA949873	5658ABD7E0601E5A7A2C3747B1CBD06198C5586F97A34841D556151C122B8AAD
Chrome Cache Entry: 102	GIF image data, version 89a, 352 x 3	166DE53471265253AB3A456DEFE6DA23	17C6DF4D7CCF1FA2C9EFD716FBAE0FC2C71C8D6D	A46201581A7C7C667FD42787CD1E9ADF2F6BF809EFB7596E61A03E8DBA9ADA13
Chrome Cache Entry: 103	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 55071	978A6C1AA934E5B1C5320D515FD25662	64636EF3E1AD607F095DBA6CB01447AC133B483D	D1963B1837F4087E988FD18BB4CF25B38D61D675C4B6A6FC01158BD39945F10A
Chrome Cache Entry: 104	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1864	0E176276362B94279A4492511BFCBD98	389FE6B51F62254BB98939896B8C89EBEFFE2A02	9A2C174AE45CAC057822844211156A5ED293E65C5F69E1D211A7206472C5C80C
Chrome Cache Entry: 107	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113084	92A840DC3D177339DAE03FEDF22A22B5	C1C9A6E6442388D07A9D9D72C12DA25094D6920F	4A986BA8875F22A0EABC356112A6790F90E114ADB72EAEC4632E03812EC1EDE4
Chrome Cache Entry: 109	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113657	57911010756C90D58754C91EF1EE2765	BAA48FEF4866D7DAFD9F59417745EE838F0E63CA	87C5385BA17F84CC25FB7BBE1EDB4169BC702842BD74B758ACDC130986D55BC2
Chrome Cache Entry: 110	ASCII text, with no line terminators	7F6C2F2EC0AC79AF93AC42E55601E0D8	8DE377E67C5B4919C767A044051BFD52C77A985E	5F1077DECBD2768AD99AF5D592C4DDE934F19682BB8BAD05599F9D403344DA27
Chrome Cache Entry: 78	HTML document, ASCII text, with very long lines (2345), with CRLF line terminators	E86EF8B6111E5FB1D1665BCDC90888C9	994BF7651CB967CD9053056AF2D69ACB74DB7F29	3410242720DE50B090D07A23AEE2DAD879B31D36F2615732962EC4CFA8A9D458
Chrome Cache Entry: 80	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors	12E3DAC858061D088023B2BD48E2FA96	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
Chrome Cache Entry: 82	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651	9F368BC4580FED907775F31C6B26D6CF	E393A40B3E337F43057EEE3DE189F197AB056451	7ECBBA946C099539C3D9C03F4B6804958900E5B90D48336EEA7E5A2ED050FA36
Chrome Cache Entry: 83	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 4730	6B0D2BCDD2E39B2CB0BDAB6597E44505	C7199742BB5F63AEC0FD2DE7003A8B1C795D78A1	9BCEC3FDDE9BED6ABFDA1A875B596571E3DEFD078E2050DC1B2D85F4483CCAE0
Chrome Cache Entry: 84	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592	4761405717E938D7E7400BB15715DB1E	76FED7C229D353A27DB3257F5927C1EAF0AB8DE9	F7ED91A1DAB5BB2802A7A3B3890DF4777588CCBE04903260FBA83E6E64C90DDF
Chrome Cache Entry: 86	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 90690	1E5B765B32C5F65973D835E9EE3EBF20	2AE4B7B8E6303DBB2424730062C2FB1D752219B5	D443B4A9F2542CAAD44E23D0D3917456E781BAB47CD000CDAB5A2AA571395379
Chrome Cache Entry: 87	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 444227	0868DA2DD5EFFED92904047439E49D48	D760173E5E6B25461B0D2A0B32D384FE659B2338	8C41E973CB5EE0194EBF3BAA0716EEEB57EED53552F042E200190E3C37F08CFD
Chrome Cache Entry: 88	ASCII text, with very long lines (45544)	DDBE2B9D5362EF44ACA38FDCE36FC899	97281190FE4CD5F8866EABCEED16106A71FFF2E0	FA1D97AEFA6355E8B8E1D6FB58D3843B9DC2CA132C487FECDC15D01C5F00B762
Chrome Cache Entry: 89	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1378	6F68E9881DF18F8E251AB57D5786239B	C0F7A01A288752833390FC330995F25488BCE8EC	B33E30351B2F4EF67D53D2C6DBE189A4D572425037E4F1264A0190DC4A820845
Chrome Cache Entry: 91	ASCII text, with no line terminators	06B313E93DD76909460FBFC0CD98CB6B	C4F9B2BBD840A4328F85F54873C434336A193888	B4532478707B495D0BB1C21C314AEF959DD1A5E0F66E52DAD5FC332C8B697CBA
Chrome Cache Entry: 92	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 379	847A4212B99B9076EE39328B24CD30AF	73F15078CF1D396485F644A79B6E25EF0637685D	29DC0C26C372805325EB7EB926769E832A60B47BEF96A66436EC3EC05CD6128E
Chrome Cache Entry: 94	GIF image data, version 89a, 352 x 3	B540A8E518037192E32C4FE58BF2DBAB	3047C1DB97B86F6981E0AD2F96AF40CDF43511AF	8737D721808655F37B333F08A90185699E7E8B9BDAAA15CDB63C8448B426F95D
Chrome Cache Entry: 96	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 223759	799F880143F17E47C4EFDBB3FF35A54C	8CECC74EB422322F78EDE1111F175A28725CCA9F	EA70CC2977F4DEB5236041A7A0628FA671FB8AD20A5E9E3FD6885A11359EF2FE
Chrome Cache Entry: 99	JSON data	9E576E34B18E986347909C29AE6A82C6	532C767978DC2B55854B3CA2D2DF5B4DB221C934	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D

HTML body contains low number of good links

Source: https://login.microsoftonline.com/ebf86bb9-f642-4b12-a97c-cb5f0f37b474/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=553FF26F865DF2CC5C05D1D0B7DEBF5F08F869B494E743BB%2DCA5681257FA6F5F22CD72207F4D214C3A626034E2BB088A4BE8BD8DEE9FA3180&redirect%5Furi=https%3A%2F%2Fgunnauto%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=2ea020a1%2Dc0f4%2D5000%2D5ae8%2D1110347a7180	HTTP Parser: Number of links: 0
Source: https://login.microsoftonline.com/ebf86bb9-f642-4b12-a97c-cb5f0f37b474/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=553FF26F865DF2CC5C05D1D0B7DEBF5F08F869B494E743BB%2DCA5681257FA6F5F22CD72207F4D214C3A626034E2BB088A4BE8BD8DEE9FA3180&redirect%5Furi=https%3A%2F%2Fgunnauto%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=2ea020a1%2Dc0f4%2D5000%2D5ae8%2D1110347a7180&sso_reload=true	HTTP Parser: Number of links: 0
Source: https://account.live.com/password/reset?wreply=https%3a%2f%2flogin.microsoftonline.com%2febf86bb9-f642-4b12-a97c-cb5f0f37b474%2freprocess%3fctx%3drQQIARAAnVE7bNNQALTj1G1CS0MnxirKVHDy3vOz_RKpQ2zHqmghTWmhDULRe45NTBI7jZ2mH1VCTB0rxICYKGxdqJhQJaTOnTp3YEOqOiBADB1JxMJYccPppJNOp7sZAWZhIQP-QpaGLAHXhZLtDNU_6E4lUwfT77K_T7jF6sWtFN5ef3HIq40o6oSFXO5Zz_dpLwqk9lY2bNCu0wk8P8raQTtXc4NuO8zVHZf2WlGWhp3Nzzx_xvMXPH8YW1cU2bKQahFVMS1kGIoBFBOaQNfMkm4pFiADK6_jPC5pWNZ1ySgqKoFI0ayiOvARMkwNIaBZ2EQQG3JRRSqQcQnpOiCkiPUS0U1ilkp5qyhDAs5jk-ViL2qgIQVdb9v5FUsMO9Y6QRi9FeJlE_QPhWut8knIOMwlKmN5yVUxkjCDSKJ5zZZsprjAlTWGNXwqiEHH8b36WZy_jI8DoTA2lkxxt7lp7irOvx8ZbDv65WvmqCnMffh24d_fi3GnI7nq0tqdDqowtLyxzGzH1Em_Xy2vrqtbpP_IW2o0Kl5l4R42wm5lFhTgvsjvi-KxmBgTUlxaMBbhD5HfG-WOE__50tkN_nwcJhN2wLrUr3v1qQyErE4AkSWiOUDCkCkSYxqRALOxbBNKHELPx3FStFvUa4dTMztpr16Lgqbjpws76c12WLPtodqgrZ4TpgtP0oOe6ae7u7svJ66VfjLBXd389fHVwc_Xb77PXU7enbf6S80eos_xY221TFsLD4FbZcGy_IDO9c3qBp1vroTy4sJafmX2KMX9AQ2&mkt=en-US	HTTP Parser: Number of links: 0

HTML title does not match URL

Source: https://login.microsoftonline.com/ebf86bb9-f642-4b12-a97c-cb5f0f37b474/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=553FF26F865DF2CC5C05D1D0B7DEBF5F08F869B494E743BB%2DCA5681257FA6F5F22CD72207F4D214C3A626034E2BB088A4BE8BD8DEE9FA3180&redirect%5Furi=https%3A%2F%2Fgunnauto%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=2ea020a1%2Dc0f4%2D5000%2D5ae8%2D1110347a7180	HTTP Parser: Title: Redirecting does not match URL
Source: https://login.microsoftonline.com/ebf86bb9-f642-4b12-a97c-cb5f0f37b474/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=553FF26F865DF2CC5C05D1D0B7DEBF5F08F869B494E743BB%2DCA5681257FA6F5F22CD72207F4D214C3A626034E2BB088A4BE8BD8DEE9FA3180&redirect%5Furi=https%3A%2F%2Fgunnauto%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=2ea020a1%2Dc0f4%2D5000%2D5ae8%2D1110347a7180&sso_reload=true	HTTP Parser: Title: Sign in to your account does not match URL

HTTP Parser: <input type="password" .../> found

HTTP Parser: No favicon

Source: https://login.microsoftonline.com/ebf86bb9-f642-4b12-a97c-cb5f0f37b474/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=553FF26F865DF2CC5C05D1D0B7DEBF5F08F869B494E743BB%2DCA5681257FA6F5F22CD72207F4D214C3A626034E2BB088A4BE8BD8DEE9FA3180&redirect%5Furi=https%3A%2F%2Fgunnauto%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=2ea020a1%2Dc0f4%2D5000%2D5ae8%2D1110347a7180	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/ebf86bb9-f642-4b12-a97c-cb5f0f37b474/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=553FF26F865DF2CC5C05D1D0B7DEBF5F08F869B494E743BB%2DCA5681257FA6F5F22CD72207F4D214C3A626034E2BB088A4BE8BD8DEE9FA3180&redirect%5Furi=https%3A%2F%2Fgunnauto%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=2ea020a1%2Dc0f4%2D5000%2D5ae8%2D1110347a7180&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/ebf86bb9-f642-4b12-a97c-cb5f0f37b474/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=553FF26F865DF2CC5C05D1D0B7DEBF5F08F869B494E743BB%2DCA5681257FA6F5F22CD72207F4D214C3A626034E2BB088A4BE8BD8DEE9FA3180&redirect%5Furi=https%3A%2F%2Fgunnauto%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=2ea020a1%2Dc0f4%2D5000%2D5ae8%2D1110347a7180&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/ebf86bb9-f642-4b12-a97c-cb5f0f37b474/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=553FF26F865DF2CC5C05D1D0B7DEBF5F08F869B494E743BB%2DCA5681257FA6F5F22CD72207F4D214C3A626034E2BB088A4BE8BD8DEE9FA3180&redirect%5Furi=https%3A%2F%2Fgunnauto%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=2ea020a1%2Dc0f4%2D5000%2D5ae8%2D1110347a7180&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://account.live.com/password/reset?wreply=https%3a%2f%2flogin.microsoftonline.com%2febf86bb9-f642-4b12-a97c-cb5f0f37b474%2freprocess%3fctx%3drQQIARAAnVE7bNNQALTj1G1CS0MnxirKVHDy3vOz_RKpQ2zHqmghTWmhDULRe45NTBI7jZ2mH1VCTB0rxICYKGxdqJhQJaTOnTp3YEOqOiBADB1JxMJYccPppJNOp7sZAWZhIQP-QpaGLAHXhZLtDNU_6E4lUwfT77K_T7jF6sWtFN5ef3HIq40o6oSFXO5Zz_dpLwqk9lY2bNCu0wk8P8raQTtXc4NuO8zVHZf2WlGWhp3Nzzx_xvMXPH8YW1cU2bKQahFVMS1kGIoBFBOaQNfMkm4pFiADK6_jPC5pWNZ1ySgqKoFI0ayiOvARMkwNIaBZ2EQQG3JRRSqQcQnpOiCkiPUS0U1ilkp5qyhDAs5jk-ViL2qgIQVdb9v5FUsMO9Y6QRi9FeJlE_QPhWut8knIOMwlKmN5yVUxkjCDSKJ5zZZsprjAlTWGNXwqiEHH8b36WZy_jI8DoTA2lkxxt7lp7irOvx8ZbDv65WvmqCnMffh24d_fi3GnI7nq0tqdDqowtLyxzGzH1Em_Xy2vrqtbpP_IW2o0Kl5l4R42wm5lFhTgvsjvi-KxmBgTUlxaMBbhD5HfG-WOE__50tkN_nwcJhN2wLrUr3v1qQyErE4AkSWiOUDCkCkSYxqRALOxbBNKHELPx3FStFvUa4dTMztpr16Lgqbjpws76c12WLPtodqgrZ4TpgtP0oOe6ae7u7svJ66VfjLBXd389fHVwc_Xb77PXU7enbf6S80eos_xY221TFsLD4FbZcGy_IDO9c3qBp1vroTy4sJafmX2KMX9AQ2&mkt=en-US	HTTP Parser: No <meta name="author".. found

Source: https://login.microsoftonline.com/ebf86bb9-f642-4b12-a97c-cb5f0f37b474/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=553FF26F865DF2CC5C05D1D0B7DEBF5F08F869B494E743BB%2DCA5681257FA6F5F22CD72207F4D214C3A626034E2BB088A4BE8BD8DEE9FA3180&redirect%5Furi=https%3A%2F%2Fgunnauto%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=2ea020a1%2Dc0f4%2D5000%2D5ae8%2D1110347a7180	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/ebf86bb9-f642-4b12-a97c-cb5f0f37b474/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=553FF26F865DF2CC5C05D1D0B7DEBF5F08F869B494E743BB%2DCA5681257FA6F5F22CD72207F4D214C3A626034E2BB088A4BE8BD8DEE9FA3180&redirect%5Furi=https%3A%2F%2Fgunnauto%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=2ea020a1%2Dc0f4%2D5000%2D5ae8%2D1110347a7180&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/ebf86bb9-f642-4b12-a97c-cb5f0f37b474/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=553FF26F865DF2CC5C05D1D0B7DEBF5F08F869B494E743BB%2DCA5681257FA6F5F22CD72207F4D214C3A626034E2BB088A4BE8BD8DEE9FA3180&redirect%5Furi=https%3A%2F%2Fgunnauto%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=2ea020a1%2Dc0f4%2D5000%2D5ae8%2D1110347a7180&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/ebf86bb9-f642-4b12-a97c-cb5f0f37b474/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=553FF26F865DF2CC5C05D1D0B7DEBF5F08F869B494E743BB%2DCA5681257FA6F5F22CD72207F4D214C3A626034E2BB088A4BE8BD8DEE9FA3180&redirect%5Furi=https%3A%2F%2Fgunnauto%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=2ea020a1%2Dc0f4%2D5000%2D5ae8%2D1110347a7180&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://account.live.com/password/reset?wreply=https%3a%2f%2flogin.microsoftonline.com%2febf86bb9-f642-4b12-a97c-cb5f0f37b474%2freprocess%3fctx%3drQQIARAAnVE7bNNQALTj1G1CS0MnxirKVHDy3vOz_RKpQ2zHqmghTWmhDULRe45NTBI7jZ2mH1VCTB0rxICYKGxdqJhQJaTOnTp3YEOqOiBADB1JxMJYccPppJNOp7sZAWZhIQP-QpaGLAHXhZLtDNU_6E4lUwfT77K_T7jF6sWtFN5ef3HIq40o6oSFXO5Zz_dpLwqk9lY2bNCu0wk8P8raQTtXc4NuO8zVHZf2WlGWhp3Nzzx_xvMXPH8YW1cU2bKQahFVMS1kGIoBFBOaQNfMkm4pFiADK6_jPC5pWNZ1ySgqKoFI0ayiOvARMkwNIaBZ2EQQG3JRRSqQcQnpOiCkiPUS0U1ilkp5qyhDAs5jk-ViL2qgIQVdb9v5FUsMO9Y6QRi9FeJlE_QPhWut8knIOMwlKmN5yVUxkjCDSKJ5zZZsprjAlTWGNXwqiEHH8b36WZy_jI8DoTA2lkxxt7lp7irOvx8ZbDv65WvmqCnMffh24d_fi3GnI7nq0tqdDqowtLyxzGzH1Em_Xy2vrqtbpP_IW2o0Kl5l4R42wm5lFhTgvsjvi-KxmBgTUlxaMBbhD5HfG-WOE__50tkN_nwcJhN2wLrUr3v1qQyErE4AkSWiOUDCkCkSYxqRALOxbBNKHELPx3FStFvUa4dTMztpr16Lgqbjpws76c12WLPtodqgrZ4TpgtP0oOe6ae7u7svJ66VfjLBXd389fHVwc_Xb77PXU7enbf6S80eos_xY221TFsLD4FbZcGy_IDO9c3qBp1vroTy4sJafmX2KMX9AQ2&mkt=en-US	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.16:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.16:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:49738 version: TLS 1.2

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 30MB

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93

Source: unknown

DNS traffic detected: queries for: us-west-2.protection.sophos.com

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.16:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.16:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:49738 version: TLS 1.2

Source: classification engine

Classification label: clean1.win@16/27@22/209

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://us-west-2.protection.sophos.com/?d=cudasvc.com&u=aHR0cHM6Ly9saW5rcHJvdGVjdC5jdWRhc3ZjLmNvbS91cmw_YT1odHRwcyUzYSUyZiUyZmd1bm5hdXRvLW15LnNoYXJlcG9pbnQuY29tJTJmJTNhYiUzYSUyZnIlMmZwZXJzb25hbCUyZmFlcm9kcmlndWV6X2d1bm5hdXRvX2NvbSUyZkRvY3VtZW50cyUyZkF0dGFjaG1lbnRzJTJmSDI0MTQyMy5wZGYlM2Zjc2YlM2QxJTI2d2ViJTNkMSZjPUUsMSxmT1pZNThPOTZjZjNwWkY1eWU3QnhGZWM2eFRWNWtyRDdneUVGdFJaNENCSjVOQkItZ0RyMUlHdlQ1Mi01Vm95d2o4Y2h5WDJXNlFFTWhsU0o2SHJUc3pqNWVoeF9aVUhzNVNZRm8xZjJfSTdwTUNIeDdiRSZ0eXBvPTE=&p=m&i=NjVjNTQ0OGE0ZWZhMmU3ZjY4MzI4ZTU2&t=RytpUnowc0wwYVZ5TS9IN2pYN0J3ektSZ3pLWEh1Y1FlaUxrM2hUL1kzST0=&h=e542e25ebbc74310ab02d99468d3cd3c&s=AVNPUEhUT0NFTkNSWVBUSVaAbgs17mmhlH_9EhbEh07dSxVIMNlJSUD1cUzHaTNepQ
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=1952,i,12405595688666852881,17956248782078030723,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=1952,i,12405595688666852881,17956248782078030723,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

ID:	1428930
Product:	CloudBasic
Start time:	21:29:14
Start date:	19.04.2024
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs