Windows Analysis Report
https://clickme.thryv.com/ls/click?upn=u001.5dsdCa4YiGVzoib36gWoSPyltUaWCsyFq200Ntb2JspVnELOGgvw66FVBJMc1CsMmns0_-2BOVhbrxcsvz9veeoLEglpD8RiEh0AaH1ow0Lk-2FKx9DGH2EA0fWhnrHZ-2FmlnIJ5UhAxXtDoOWXX-2FPyG5rVAl4UI7bgryXtRxONxX47M69Zs408-2BvnAL8-2FwQfC38J0vo-2BNPuXd9ZQRl3mVPkcpfDB8fFzO8k72NDbDigQEVVlq88Cby

Overview

General Information

Sample URL:	https://clickme.thryv.com/ls/click?upn=u001.5dsdCa4YiGVzoib36gWoSPyltUaWCsyFq200Ntb2JspVnELOGgvw66FVBJMc1CsMmns0_-2BOVhbrxcsvz9veeoLEglpD8RiEh0AaH1ow0Lk-2FKx9DGH2EA0fWhnrHZ-2FmlnIJ5UhAxXtDoOWXX-2FPyG5
Analysis ID:	1431366

Detection

HTMLPhisher

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Phishing site detected (based on favicon image match)

Yara detected HtmlPhish54

HTML body contains low number of good links

HTML page contains hidden URLs or javascript code

HTML title does not match URL

Stores files to the Windows start menu directory

Classification

Signatures

Phishing

Phishing site detected (based on favicon image match)

Source: https://wildcardservice.crownicastle.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2F0ffice.crownicastle.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2F0ffice.crownicastle.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638495915178333267.YzBhMDY0OTEtNzMyMi00NTFkLTgzZjEtY2JjYjdmYWU0MmFkM2FjNGZmNTgtYzE4ZS00OTdiLWI3YmQtMzYyN2QyYWE3YzQ3&ui_locales=en-US&mkt=en-US&client-request-id=7f6a4a2d-3946-41ec-a768-6c7489204929&state=_8lnvJ63qLjJneAiCy1oZzPSNsgOznxWiF5-Y01jRiR1l4p31sjLky1FEFKWCWumlNFZ4KHXKrekIQePEbG-cjLcrJ5K6y3Nb40-C0vLC64xidX4HGQUITB8Atmn0wIH_eD4eK0GsVF2-EtjS_0XnT4OxTLar-2zXTpZZX8r2EUwGb5YNdL74kkIrBOhaTxkUDlb5FIrgKxLUnKUFeJU8DzjweaF5gKlKQomO8BZFKBGOScVnWusqD1fzuiFdtdd9XB8Adcq08djjwMDwf5n4g&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0&sso_reload=true

Matcher: Template: microsoft matched with high similarity

Yara detected HtmlPhish54

Source: Yara match	File source: 4.14.pages.csv, type: HTML
Source: Yara match	File source: 5.15.pages.csv, type: HTML
Source: Yara match	File source: 4.14.pages.csv, type: HTML
Source: Yara match	File source: 5.15.pages.csv, type: HTML
Source: Yara match	File source: 4.14.pages.csv, type: HTML
Source: Yara match	File source: 5.16.pages.csv, type: HTML

HTML body contains low number of good links

HTTP Parser: Number of links: 0

HTML page contains hidden URLs or javascript code

Source: https://wildcardservice.crownicastle.com/?safelink=

HTTP Parser: Base64 decoded: a[href="http://www.salidzini.lv/"][style="display: block; width: 88px; height: 31px; overflow: hidden; position: relative;"]

HTML title does not match URL

HTTP Parser: Title: Sign in to your account does not match URL

Source: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LevwsUpAAAAALD6GN6g0KAlL_FFD8-n3wCvA6Ff%0A&co=aHR0cHM6Ly93aWxkY2FyZHNlcnZpY2UuY3Jvd25pY2FzdGxlLmNvbTo0NDM.&hl=en&v=QoukH5jSO3sKFzVEA7Vc8VgC&size=normal&cb=kc16vsxr7d6i	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LevwsUpAAAAALD6GN6g0KAlL_FFD8-n3wCvA6Ff%0A&co=aHR0cHM6Ly93aWxkY2FyZHNlcnZpY2UuY3Jvd25pY2FzdGxlLmNvbTo0NDM.&hl=en&v=QoukH5jSO3sKFzVEA7Vc8VgC&size=normal&cb=kc16vsxr7d6i	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/bframe?hl=en&v=QoukH5jSO3sKFzVEA7Vc8VgC&k=6LevwsUpAAAAALD6GN6g0KAlL_FFD8-n3wCvA6Ff	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/bframe?hl=en&v=QoukH5jSO3sKFzVEA7Vc8VgC&k=6LevwsUpAAAAALD6GN6g0KAlL_FFD8-n3wCvA6Ff	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/bframe?hl=en&v=QoukH5jSO3sKFzVEA7Vc8VgC&k=6LevwsUpAAAAALD6GN6g0KAlL_FFD8-n3wCvA6Ff	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/bframe?hl=en&v=QoukH5jSO3sKFzVEA7Vc8VgC&k=6LevwsUpAAAAALD6GN6g0KAlL_FFD8-n3wCvA6Ff	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LevwsUpAAAAALD6GN6g0KAlL_FFD8-n3wCvA6Ff%0A&co=aHR0cHM6Ly93aWxkY2FyZHNlcnZpY2UuY3Jvd25pY2FzdGxlLmNvbTo0NDM.&hl=en&v=QoukH5jSO3sKFzVEA7Vc8VgC&size=normal&cb=kc16vsxr7d6i	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/bframe?hl=en&v=QoukH5jSO3sKFzVEA7Vc8VgC&k=6LevwsUpAAAAALD6GN6g0KAlL_FFD8-n3wCvA6Ff	HTTP Parser: No favicon
Source: https://wildcardservice.crownicastle.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2F0ffice.crownicastle.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2F0ffice.crownicastle.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638495915178333267.YzBhMDY0OTEtNzMyMi00NTFkLTgzZjEtY2JjYjdmYWU0MmFkM2FjNGZmNTgtYzE4ZS00OTdiLWI3YmQtMzYyN2QyYWE3YzQ3&ui_locales=en-US&mkt=en-US&client-request-id=7f6a4a2d-3946-41ec-a768-6c7489204929&state=_8lnvJ63qLjJneAiCy1oZzPSNsgOznxWiF5-Y01jRiR1l4p31sjLky1FEFKWCWumlNFZ4KHXKrekIQePEbG-cjLcrJ5K6y3Nb40-C0vLC64xidX4HGQUITB8Atmn0wIH_eD4eK0GsVF2-EtjS_0XnT4OxTLar-2zXTpZZX8r2EUwGb5YNdL74kkIrBOhaTxkUDlb5FIrgKxLUnKUFeJU8DzjweaF5gKlKQomO8BZFKBGOScVnWusqD1fzuiFdtdd9XB8Adcq08djjwMDwf5n4g&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0	HTTP Parser: No favicon

Source: https://wildcardservice.crownicastle.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2F0ffice.crownicastle.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2F0ffice.crownicastle.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638495915178333267.YzBhMDY0OTEtNzMyMi00NTFkLTgzZjEtY2JjYjdmYWU0MmFkM2FjNGZmNTgtYzE4ZS00OTdiLWI3YmQtMzYyN2QyYWE3YzQ3&ui_locales=en-US&mkt=en-US&client-request-id=7f6a4a2d-3946-41ec-a768-6c7489204929&state=_8lnvJ63qLjJneAiCy1oZzPSNsgOznxWiF5-Y01jRiR1l4p31sjLky1FEFKWCWumlNFZ4KHXKrekIQePEbG-cjLcrJ5K6y3Nb40-C0vLC64xidX4HGQUITB8Atmn0wIH_eD4eK0GsVF2-EtjS_0XnT4OxTLar-2zXTpZZX8r2EUwGb5YNdL74kkIrBOhaTxkUDlb5FIrgKxLUnKUFeJU8DzjweaF5gKlKQomO8BZFKBGOScVnWusqD1fzuiFdtdd9XB8Adcq08djjwMDwf5n4g&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://wildcardservice.crownicastle.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2F0ffice.crownicastle.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2F0ffice.crownicastle.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638495915178333267.YzBhMDY0OTEtNzMyMi00NTFkLTgzZjEtY2JjYjdmYWU0MmFkM2FjNGZmNTgtYzE4ZS00OTdiLWI3YmQtMzYyN2QyYWE3YzQ3&ui_locales=en-US&mkt=en-US&client-request-id=7f6a4a2d-3946-41ec-a768-6c7489204929&state=_8lnvJ63qLjJneAiCy1oZzPSNsgOznxWiF5-Y01jRiR1l4p31sjLky1FEFKWCWumlNFZ4KHXKrekIQePEbG-cjLcrJ5K6y3Nb40-C0vLC64xidX4HGQUITB8Atmn0wIH_eD4eK0GsVF2-EtjS_0XnT4OxTLar-2zXTpZZX8r2EUwGb5YNdL74kkIrBOhaTxkUDlb5FIrgKxLUnKUFeJU8DzjweaF5gKlKQomO8BZFKBGOScVnWusqD1fzuiFdtdd9XB8Adcq08djjwMDwf5n4g&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0&sso_reload=true	HTTP Parser: No <meta name="author".. found

Source: https://wildcardservice.crownicastle.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2F0ffice.crownicastle.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2F0ffice.crownicastle.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638495915178333267.YzBhMDY0OTEtNzMyMi00NTFkLTgzZjEtY2JjYjdmYWU0MmFkM2FjNGZmNTgtYzE4ZS00OTdiLWI3YmQtMzYyN2QyYWE3YzQ3&ui_locales=en-US&mkt=en-US&client-request-id=7f6a4a2d-3946-41ec-a768-6c7489204929&state=_8lnvJ63qLjJneAiCy1oZzPSNsgOznxWiF5-Y01jRiR1l4p31sjLky1FEFKWCWumlNFZ4KHXKrekIQePEbG-cjLcrJ5K6y3Nb40-C0vLC64xidX4HGQUITB8Atmn0wIH_eD4eK0GsVF2-EtjS_0XnT4OxTLar-2zXTpZZX8r2EUwGb5YNdL74kkIrBOhaTxkUDlb5FIrgKxLUnKUFeJU8DzjweaF5gKlKQomO8BZFKBGOScVnWusqD1fzuiFdtdd9XB8Adcq08djjwMDwf5n4g&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://wildcardservice.crownicastle.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2F0ffice.crownicastle.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2F0ffice.crownicastle.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638495915178333267.YzBhMDY0OTEtNzMyMi00NTFkLTgzZjEtY2JjYjdmYWU0MmFkM2FjNGZmNTgtYzE4ZS00OTdiLWI3YmQtMzYyN2QyYWE3YzQ3&ui_locales=en-US&mkt=en-US&client-request-id=7f6a4a2d-3946-41ec-a768-6c7489204929&state=_8lnvJ63qLjJneAiCy1oZzPSNsgOznxWiF5-Y01jRiR1l4p31sjLky1FEFKWCWumlNFZ4KHXKrekIQePEbG-cjLcrJ5K6y3Nb40-C0vLC64xidX4HGQUITB8Atmn0wIH_eD4eK0GsVF2-EtjS_0XnT4OxTLar-2zXTpZZX8r2EUwGb5YNdL74kkIrBOhaTxkUDlb5FIrgKxLUnKUFeJU8DzjweaF5gKlKQomO8BZFKBGOScVnWusqD1fzuiFdtdd9XB8Adcq08djjwMDwf5n4g&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 23.1.102.27:443 -> 192.168.2.16:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.1.102.27:443 -> 192.168.2.16:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.16:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.16:49786 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.102.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.102.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.102.27
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.102.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.102.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.102.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.102.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.102.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.102.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.102.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.102.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.102.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.102.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.102.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.102.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.102.27
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.102.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.102.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.102.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103

Source: global traffic	DNS traffic detected: DNS query: clickme.thryv.com
Source: global traffic	DNS traffic detected: DNS query: totopurel.com
Source: global traffic	DNS traffic detected: DNS query: google.com
Source: global traffic	DNS traffic detected: DNS query: wildcardservice.crownicastle.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: 0ffice.crownicastle.com
Source: global traffic	DNS traffic detected: DNS query: ff1b4edf-0ccd67d1.crownicastle.com
Source: global traffic	DNS traffic detected: DNS query: 5c7fbd0c-0ccd67d1.crownicastle.com
Source: global traffic	DNS traffic detected: DNS query: cdc7d173-0ccd67d1.crownicastle.com
Source: global traffic	DNS traffic detected: DNS query: l1ve.crownicastle.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49696
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443

Source: unknown	HTTPS traffic detected: 23.1.102.27:443 -> 192.168.2.16:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.1.102.27:443 -> 192.168.2.16:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.16:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.16:49786 version: TLS 1.2

Source: classification engine

Classification label: mal56.phis.win@19/48@28/147

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://clickme.thryv.com/ls/click?upn=u001.5dsdCa4YiGVzoib36gWoSPyltUaWCsyFq200Ntb2JspVnELOGgvw66FVBJMc1CsMmns0_-2BOVhbrxcsvz9veeoLEglpD8RiEh0AaH1ow0Lk-2FKx9DGH2EA0fWhnrHZ-2FmlnIJ5UhAxXtDoOWXX-2FPyG5rVAl4UI7bgryXtRxONxX47M69Zs408-2BvnAL8-2FwQfC38J0vo-2BNPuXd9ZQRl3mVPkcpfDB8fFzO8k72NDbDigQEVVlq88Cbyd-2FspyzvoVJPR1h-2FbZ7QQ6McqmPE9-2BcpXmxMjtiMnlH5y7my6ciUJ8oawjrr8uTV2VFCUnRz-2BYajHpdlo-2BdijTTWoN6XIqzSzzn9raVdyCv6yrtMzJIVFFK229s6J0zoOHuRdvwd4zEdpENbxbzehqnKQ8Yk3LeuEYUlsDIufaiekHtd-2BWbkmha56OPiK-2BI-3D
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1908,i,4342423110262873997,6879490936910367082,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1908,i,4342423110262873997,6879490936910367082,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
142.250.101.147	www.google.com	United States	15169	GOOGLEUS	false
45.85.146.171	totopurel.com	Germany	61317	ASDETUKhttpwwwheficedcomGB	false
194.195.252.230	cdc7d173-0ccd67d1.crownicastle.com	Germany	6659	NEXINTO-DE	false
142.251.2.84	unknown	United States	15169	GOOGLEUS	false
142.251.2.95	unknown	United States	15169	GOOGLEUS	false
142.251.2.94	unknown	United States	15169	GOOGLEUS	false
74.125.137.101	unknown	United States	15169	GOOGLEUS	false
3.163.125.15	d1rsqi0l6b7evg.cloudfront.net	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.101.95	unknown	United States	15169	GOOGLEUS	false
142.250.141.106	unknown	United States	15169	GOOGLEUS	false
142.250.101.94	unknown	United States	15169	GOOGLEUS	false
74.125.137.94	unknown	United States	15169	GOOGLEUS	false
142.251.2.101	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.16
192.168.2.4

Contacted Domains

Name	IP	Active
cdc7d173-0ccd67d1.crownicastle.com	194.195.252.230	true
totopurel.com	45.85.146.171	true
google.com	142.251.2.113	true
0ffice.crownicastle.com	194.195.252.230	true
5c7fbd0c-0ccd67d1.crownicastle.com	194.195.252.230	true
ff1b4edf-0ccd67d1.crownicastle.com	194.195.252.230	true
wildcardservice.crownicastle.com	194.195.252.230	true
l1ve.crownicastle.com	194.195.252.230	true
d1rsqi0l6b7evg.cloudfront.net	3.163.125.15	true
www.google.com	142.250.101.147	true
clickme.thryv.com	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://wildcardservice.crownicastle.com/?safelink=	false		unknown
https://www.google.com/recaptcha/api2/bframe?hl=en&v=QoukH5jSO3sKFzVEA7Vc8VgC&k=6LevwsUpAAAAALD6GN6g0KAlL_FFD8-n3wCvA6Ff	false		high
about:blank	false	Avira URL Cloud: safe	low
https://wildcardservice.crownicastle.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2F0ffice.crownicastle.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2F0ffice.crownicastle.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638495915178333267.YzBhMDY0OTEtNzMyMi00NTFkLTgzZjEtY2JjYjdmYWU0MmFkM2FjNGZmNTgtYzE4ZS00OTdiLWI3YmQtMzYyN2QyYWE3YzQ3&ui_locales=en-US&mkt=en-US&client-request-id=7f6a4a2d-3946-41ec-a768-6c7489204929&state=_8lnvJ63qLjJneAiCy1oZzPSNsgOznxWiF5-Y01jRiR1l4p31sjLky1FEFKWCWumlNFZ4KHXKrekIQePEbG-cjLcrJ5K6y3Nb40-C0vLC64xidX4HGQUITB8Atmn0wIH_eD4eK0GsVF2-EtjS_0XnT4OxTLar-2zXTpZZX8r2EUwGb5YNdL74kkIrBOhaTxkUDlb5FIrgKxLUnKUFeJU8DzjweaF5gKlKQomO8BZFKBGOScVnWusqD1fzuiFdtdd9XB8Adcq08djjwMDwf5n4g&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0&sso_reload=true	true		unknown
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LevwsUpAAAAALD6GN6g0KAlL_FFD8-n3wCvA6Ff%0A&co=aHR0cHM6Ly93aWxkY2FyZHNlcnZpY2UuY3Jvd25pY2FzdGxlLmNvbTo0NDM.&hl=en&v=QoukH5jSO3sKFzVEA7Vc8VgC&size=normal&cb=kc16vsxr7d6i	false		high
https://wildcardservice.crownicastle.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2F0ffice.crownicastle.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2F0ffice.crownicastle.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638495915178333267.YzBhMDY0OTEtNzMyMi00NTFkLTgzZjEtY2JjYjdmYWU0MmFkM2FjNGZmNTgtYzE4ZS00OTdiLWI3YmQtMzYyN2QyYWE3YzQ3&ui_locales=en-US&mkt=en-US&client-request-id=7f6a4a2d-3946-41ec-a768-6c7489204929&state=_8lnvJ63qLjJneAiCy1oZzPSNsgOznxWiF5-Y01jRiR1l4p31sjLky1FEFKWCWumlNFZ4KHXKrekIQePEbG-cjLcrJ5K6y3Nb40-C0vLC64xidX4HGQUITB8Atmn0wIH_eD4eK0GsVF2-EtjS_0XnT4OxTLar-2zXTpZZX8r2EUwGb5YNdL74kkIrBOhaTxkUDlb5FIrgKxLUnKUFeJU8DzjweaF5gKlKQomO8BZFKBGOScVnWusqD1fzuiFdtdd9XB8Adcq08djjwMDwf5n4g&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0	false		unknown

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Apr 24 20:37:35 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	1F214C454B675BA69C6E6BB831142BA9	F2FE0E838032D537B8BC9EA0031984F96F9FA86D	17919B9E5F5B9BB66BEE5A40C91AC6D4E8092CB2F3D21D4E4456955719ED83AD
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Apr 24 20:37:35 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	7724E08F6763AEDA878CD1F42B4506B1	371AA34CE5505E3F7B0FCB8AD353417BDD4AEFDA	AD03A5A98F23BFB508738C85D37177A8DCD391870E924FAAD03F435C0930D4C0
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	1AA9643CCE33D0AF576B2792923D4FA3	CAA79BDA5AB8345F87FC93F0356285539D1F0FC4	C452E4CF8C607505A5CF2A676E5A0DAE365C774F92E453B33F9A21EBA443AD1E
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Apr 24 20:37:35 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	E8F3733D9AFD3E11A07753C8ACEC3FFE	CEE63EEB0A14C8E6D4548B9635C9B946B3C32FC2	13A568C78164E5ED22275193D031D0F53B23207092A831DC6FB98BD05FC5908C
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Apr 24 20:37:35 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	35E608CD57A693843A6D40007045A352	48EF79BDA1D9008A225B7380333DA210B16ABC2E	DB3DAC984692995E3749649DA799CF61354011DC999D37850D14A3ECCC0846AB
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Apr 24 20:37:34 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	5350023CFF1E1C6E2232684762532689	0CBFDA3841D3ADD5A618E1962340980173AE952B	B2210C7F1DC8B3271EDE79051BFAF49210F93BB747AD0F4C8B3838FA0BAE3447
Chrome Cache Entry: 100	gzip compressed data, from Unix, original size modulo 2^32 444331	3C1139BD3838B77915C31D799190EB2D	5CB27192B78DD7397AA1E4610D90D2C0D238BC58	AFDACF377D0CF0237707C8AF23F9A991B3E822DB13B73D53B06B86DFC03D12DD
Chrome Cache Entry: 104	gzip compressed data, from Unix, original size modulo 2^32 15721	C261898DAA5B93F15A38F605765A83DD	E60FA04030F12DBA3752B92FCEE745BBD582C00B	3AE099624DFD5F96CF56E765AFE26E46D67A3477057CDC761329BEED46AC40D1
Chrome Cache Entry: 106	ASCII text, with no line terminators	C193745DEB63FE67F3AA6B578C40DD99	8A3ECC2696074E71D3B011C99B98CB25229E1A31	D41E076366E4207D57A5FD1725C2024F751C43AE4A3A8E93CC46DFB8462A3E5B
Chrome Cache Entry: 107	Web Open Font Format (Version 2), TrueType, length 15552, version 1.0	285467176F7FE6BB6A9C6873B3DAD2CC	EA04E4FF5142DDD69307C183DEF721A160E0A64E	5A8C1E7681318CAA29E9F44E8A6E271F6A4067A2703E9916DFD4FE9099241DB7
Chrome Cache Entry: 108	Web Open Font Format (Version 2), TrueType, length 15344, version 1.0	5D4AEB4E5F5EF754E307D7FFAEF688BD	06DB651CDF354C64A7383EA9C77024EF4FB4CEF8	3E253B66056519AA065B00A453BAC37AC5ED8F3E6FE7B542E93A9DCDCC11D0BC
Chrome Cache Entry: 109	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 100x100, components 3	BC1F87DA1921F3A817498E4CB288E14A	90B61FFA14FC2D3F51A57F4667F459E6FBFE293A	49096340ABF204263DCD91D040C8D694B76D6D56A5A7D36F3DD3D1AF9BF2C1DC
Chrome Cache Entry: 110	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced	EF9941290C50CD3866E2BA6B793F010D	4736508C795667DCEA21F8D864233031223B7832	1B9EFB22C938500971AAC2B2130A475FA23684DD69E43103894968DF83145B8A
Chrome Cache Entry: 111	PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced	07BF314AAB04047B9E9A959EE6F63DA3	17BEF6602672E2FD9956381E01356245144003E5	55EAF62CB05DA20088DC12B39D7D254D046CB1FD61DDF3AE641F1439EFD0A5EE
Chrome Cache Entry: 112	PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced	0F2A4639B8A4CB30C76E8333C00D30A6	57E273A270BB864970D747C74B3F0A7C8E515B13	44B988703019CD6BFA86C91840FECF2A42B611B364E3EEA2F4EB63BF62714E98
Chrome Cache Entry: 113	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 100x100, components 3	E57EFB41B28E508F702F8E58169DCBF9	ABB15B4B3AE412174513720551401D41DBCEF39E	A53840BDC5BD03DB1BCD90DC64FDD0F4C21445DD817AEF93DCDD4F98741E0CDB
Chrome Cache Entry: 115	ASCII text, with very long lines (56412), with no line terminators	2C00B9F417B688224937053CD0C284A5	17B4C18EBC129055DD25F214C3F11E03E9DF2D82	1E754B107428162C65A26D399B66DB3DAAEA09616BF8620D9DE4BC689CE48EED
Chrome Cache Entry: 116	gzip compressed data, from Unix, original size modulo 2^32 2461	911265C18EFEC54476A64EA776BBF73D	A608D453B96A1560EF19C3CAE791ABCFBD9ECA9C	417AFD74C46F8E12E13E197B77233AB15975218A1D856B468AEBE94936E5BAA0
Chrome Cache Entry: 118	ASCII text, with no line terminators	AFB69DF47958EB78B4E941270772BD6A	D9FE9A625E906FF25C1F165E7872B1D9C731E78E	874809FB1235F80831B706B9E9B903D80BD5662D036B7712CC76F8C684118878
Chrome Cache Entry: 119	gzip compressed data, original size modulo 2^32 3651	DF6A7721C242813411CC6950DF40F9B3	B2068C4A65C183AAD6FC22A44CC1FA449CD355B4	AA53B6DC744357B392FC57C34E516BAE465D4A6837775C137A176D599C8EA948
Chrome Cache Entry: 120	GIF image data, version 89a, 352 x 3	166DE53471265253AB3A456DEFE6DA23	17C6DF4D7CCF1FA2C9EFD716FBAE0FC2C71C8D6D	A46201581A7C7C667FD42787CD1E9ADF2F6BF809EFB7596E61A03E8DBA9ADA13
Chrome Cache Entry: 122	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 100x100, components 3	E6F0979E88118A671F514A1F7A768CEF	27D8C548B11C5FA583342855A01391DD82E64DF4	2C221FAFF59AEEF31DB28C73BB1BB82F1CC3E6FACEB8CC4EFA31809280188E6B
Chrome Cache Entry: 123	ASCII text, with very long lines (597)	8326C23D6B3EED35BC3E62F3294587FD	EDDA17E74E53E85073E5EAC9CB6BE2163DBFA23C	57F03D3BA66117EDC152646341120DD3A1D7D71B9A98A3723AF5A8AE61BCB3AB
Chrome Cache Entry: 125	MS Windows icon resource - 6 icons, 16x16 with PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, 24x24 with PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced, 32 bits/pixel	7E0D59593F3377B72C29435C4B43954A	B4C5C39A6DFB460BBD2EACCEB09EC8079FB6A8E2	62D706019A0D80173113EF70FBBEE12F286E8E221534BE788448AADA4B14C8E8
Chrome Cache Entry: 127	PNG image data, 98 x 90, 8-bit/color RGB, non-interlaced	A4741C6089E163F0E5C0CDB2C698A03E	03B190C8D9350802CBABBCCD2757CFF1FB7115F0	C9685B413894B0647B42EDF9CAC1FC0B2ED044C1FE238D843B9CA3D29DB1B805
Chrome Cache Entry: 128	gzip compressed data, original size modulo 2^32 1864	2D2CBA7D7DC75F3BA9DC756738D41A6E	F87FD26066ED5E52A65DEE0ED2D581D3C3EA15AC	00E21864CF1BC70302EBB5B496C6C471A7DA8CBF600630B478A3E2376ED20EA2
Chrome Cache Entry: 131	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 100x100, components 3	18E3D00067B8DD0B14ECEF6016075342	6384F88DD4C05B896BEAA1F6B1207921BF834124	39CA682A39320B04CC9869949B5F9E44A19B4B487DC51C73C0ED897D79194D78
Chrome Cache Entry: 132	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 100x100, components 3	FFBE48D2FA3E08793C3F7B9A6800F8A4	47CADAFA878BE493DC104EA3EC6D180C05E3E2CA	56CBEAB99D72CC9021EC787D6DF18E510ADCA33CF1F9497649F16D6DF3E7CF31
Chrome Cache Entry: 134	HTML document, ASCII text	5B6E8B92D74E151D20C46B959B20E0F3	90A4CD2701BE9CFDD70D68F60603F2D000005FC3	646A293B26C5DF7AC24FDF5E6AFCE49482F4B646596E4364260545B1C86DE77D
Chrome Cache Entry: 137	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 100x100, components 3	ECD8E1583FF4DA8626102687C74AC1D7	8D36F67DA2A343124EC037BD7CCDB4DEBF7B13C8	45768BC2C151A92AB5A06C5C77B82DE66B763A4A839653A2A52BC8EBF9387E4E
Chrome Cache Entry: 138	ASCII text, with no line terminators	9F9FA94F28FE0DE82BC8FD039A7BDB24	6FE91F82974BD5B101782941064BCB2AFDEB17D8	9A37FDC0DBA8B23EB7D3AA9473D59A45B3547CF060D68B4D52253EE0DA1AF92E
Chrome Cache Entry: 140	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 300x300, components 3	2CFB28FE2652A46D0A3D32E0E25EB0BF	BC11EED4162817D6BC6F7C6033B1270CFB7B3F46	895D2AD435FE0307AA0E4C6FE6D226F822E438714081A35EA1981857B20CF851
Chrome Cache Entry: 141	PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced	88E0F42C9FA4F94AA8BCD54D1685C180	5AD9D47A49B82718BAA3BE88550A0B3350270C42	89C62095126FCA89EA1511CF35B49B8306162946B0C26D6F60C5506C51D85992
Chrome Cache Entry: 142	gzip compressed data, from Unix, original size modulo 2^32 113084	7B082644CE5A069FB55F47B1A6B667F2	6A5FFA5369BF15FA42446C6EDE88E9E40A40E0E9	8E34884C24973C66D83BAFDEC9445F746BEFEE773A384B340CA24C7B7703AF3A
Chrome Cache Entry: 80	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 100x100, components 3	D364CEADC1C6BF93E150D69BA6C1E37A	19AFB0F84D15A7C5112D83537D604F4BF5FC5BF8	DE86C88660BB1F3DACB8AE4F8E40D2097DD6AAD5E9CBCAD95EC9EB75B3B5AB30
Chrome Cache Entry: 82	gzip compressed data, from Unix, original size modulo 2^32 55037	C9FEA7B73DB87151F6E7414DBE01BC09	749C0343CDA07BE115086D4BABA33C1482B4B331	21E3EA815C63CA5D738E667982E41C91C299E461649A812DFC28244DE41AEBC5
Chrome Cache Entry: 83	Web Open Font Format (Version 2), TrueType, length 15340, version 1.0	19B7A0ADFDD4F808B53AF7E2CE2AD4E5	81D5D4C7B5035AD10CCE63CF7100295E0C51FDDA	C912A9CE0C3122D4B2B29AD26BFE06B0390D1A5BDAA5D6128692C0BEFD1DFBBD
Chrome Cache Entry: 84	GIF image data, version 89a, 352 x 3	B540A8E518037192E32C4FE58BF2DBAB	3047C1DB97B86F6981E0AD2F96AF40CDF43511AF	8737D721808655F37B333F08A90185699E7E8B9BDAAA15CDB63C8448B426F95D
Chrome Cache Entry: 85	ASCII text, with very long lines (1222), with no line terminators	E9AD011280352C75C6F9CF212C42AACD	05A41AC3A9E296E1D9E6251E6908EABFE9697D04	B5E1FFD95251B13685BD867DFB1759CEB8DE9E5FB874E052C856022B29DDA862
Chrome Cache Entry: 87	ASCII text, with very long lines (17683)	7D07C2BBCB789E8A63340B6F449416E0	44856381D2A46155517776ADBB8B21B5EFE41FFD	E892BB3E48503E380678166AC87282496B89283E5926617F93398FF50955D436
Chrome Cache Entry: 88	gzip compressed data, from Unix, original size modulo 2^32 223846	330EEEEED76F20EE0EC13BCE500D35D5	224C9039EC398DA1F47D7780C244646E68BA082E	88EC08C0D025E383CAB692A1C7898A2E85E64274D05F28D847A0C93E6349BA47
Chrome Cache Entry: 89	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 100x100, components 3	BD06C55A0EF2A0A9DCA25F03963FEB04	E24F9EB55AB15543F97C31FE3EB59E93E06417F8	71CAD2341FDAE00356D75780D81ED887E0056788BDD6E104DDBF9A3F5B436693
Chrome Cache Entry: 91	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 100x100, components 3	80E9B72DF9E124C074038D9201A46D92	979EF483745CA15CC03E7D7BF165D03B5E4D6A44	1666B5A2DB08088AA123888E167C2EF272DE259FF52B3CBC99BA13AB5F359E86
Chrome Cache Entry: 92	gzip compressed data, from Unix, original size modulo 2^32 141269	5ADBB589A1300ED35AD51DEE53712B2E	5902CD41B85D777684F71B5A1AB6B1231FE63779	91F22732A873C91C033B803BF49AC530FE213B54827CAE7EE79759C4026D0D06
Chrome Cache Entry: 93	gzip compressed data, from Unix, original size modulo 2^32 2461	A3485F10A41B44F7D62D5E2B9983B70B	96DEFC3FDD13DBAC5F3456A83B288941E189C8C8	5A52A9F64392F080C5DBE173D4B80F7BEA3D2647DDC6DF23FEA39E2C367062A9
Chrome Cache Entry: 94	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 100x100, components 3	59EB98540672C3E4DF655B8A82DC8FFD	C974D7A5B823A99D204365FD094CF69DE7583C2C	7B8311C14607E46EC0413A034C44BCEA3D5B691C2F580165490EE642E424B8BB
Chrome Cache Entry: 95	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 300x300, components 3	10EFB709ABFD53C2CED51C6DA84E45AF	7BD7631E9B6BD58C320461D9FBCD73B7B65DBF86	D539754B7DE06BD92477D15FCB0405F79302D708B3E9730B03E8C027173EE126
Chrome Cache Entry: 96	HTML document, ASCII text	B54D0452E2FDB8C0D91C455D1C5495F9	DDD85730B9CB4CB9905B1D7E7643F595D2F33CB8	F4138D99EC6E17514BB87CEEAD1C1D2A204219C970864FC85BFF00949EE18082

Phishing

Phishing site detected (based on favicon image match)

Matcher: Template: microsoft matched with high similarity

Yara detected HtmlPhish54

Source: Yara match	File source: 4.14.pages.csv, type: HTML
Source: Yara match	File source: 5.15.pages.csv, type: HTML
Source: Yara match	File source: 4.14.pages.csv, type: HTML
Source: Yara match	File source: 5.15.pages.csv, type: HTML
Source: Yara match	File source: 4.14.pages.csv, type: HTML
Source: Yara match	File source: 5.16.pages.csv, type: HTML

HTML body contains low number of good links

HTTP Parser: Number of links: 0

HTML page contains hidden URLs or javascript code

Source: https://wildcardservice.crownicastle.com/?safelink=

HTTP Parser: Base64 decoded: a[href="http://www.salidzini.lv/"][style="display: block; width: 88px; height: 31px; overflow: hidden; position: relative;"]

HTML title does not match URL

HTTP Parser: Title: Sign in to your account does not match URL

Source: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LevwsUpAAAAALD6GN6g0KAlL_FFD8-n3wCvA6Ff%0A&co=aHR0cHM6Ly93aWxkY2FyZHNlcnZpY2UuY3Jvd25pY2FzdGxlLmNvbTo0NDM.&hl=en&v=QoukH5jSO3sKFzVEA7Vc8VgC&size=normal&cb=kc16vsxr7d6i	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LevwsUpAAAAALD6GN6g0KAlL_FFD8-n3wCvA6Ff%0A&co=aHR0cHM6Ly93aWxkY2FyZHNlcnZpY2UuY3Jvd25pY2FzdGxlLmNvbTo0NDM.&hl=en&v=QoukH5jSO3sKFzVEA7Vc8VgC&size=normal&cb=kc16vsxr7d6i	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/bframe?hl=en&v=QoukH5jSO3sKFzVEA7Vc8VgC&k=6LevwsUpAAAAALD6GN6g0KAlL_FFD8-n3wCvA6Ff	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/bframe?hl=en&v=QoukH5jSO3sKFzVEA7Vc8VgC&k=6LevwsUpAAAAALD6GN6g0KAlL_FFD8-n3wCvA6Ff	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/bframe?hl=en&v=QoukH5jSO3sKFzVEA7Vc8VgC&k=6LevwsUpAAAAALD6GN6g0KAlL_FFD8-n3wCvA6Ff	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/bframe?hl=en&v=QoukH5jSO3sKFzVEA7Vc8VgC&k=6LevwsUpAAAAALD6GN6g0KAlL_FFD8-n3wCvA6Ff	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LevwsUpAAAAALD6GN6g0KAlL_FFD8-n3wCvA6Ff%0A&co=aHR0cHM6Ly93aWxkY2FyZHNlcnZpY2UuY3Jvd25pY2FzdGxlLmNvbTo0NDM.&hl=en&v=QoukH5jSO3sKFzVEA7Vc8VgC&size=normal&cb=kc16vsxr7d6i	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/bframe?hl=en&v=QoukH5jSO3sKFzVEA7Vc8VgC&k=6LevwsUpAAAAALD6GN6g0KAlL_FFD8-n3wCvA6Ff	HTTP Parser: No favicon
Source: https://wildcardservice.crownicastle.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2F0ffice.crownicastle.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2F0ffice.crownicastle.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638495915178333267.YzBhMDY0OTEtNzMyMi00NTFkLTgzZjEtY2JjYjdmYWU0MmFkM2FjNGZmNTgtYzE4ZS00OTdiLWI3YmQtMzYyN2QyYWE3YzQ3&ui_locales=en-US&mkt=en-US&client-request-id=7f6a4a2d-3946-41ec-a768-6c7489204929&state=_8lnvJ63qLjJneAiCy1oZzPSNsgOznxWiF5-Y01jRiR1l4p31sjLky1FEFKWCWumlNFZ4KHXKrekIQePEbG-cjLcrJ5K6y3Nb40-C0vLC64xidX4HGQUITB8Atmn0wIH_eD4eK0GsVF2-EtjS_0XnT4OxTLar-2zXTpZZX8r2EUwGb5YNdL74kkIrBOhaTxkUDlb5FIrgKxLUnKUFeJU8DzjweaF5gKlKQomO8BZFKBGOScVnWusqD1fzuiFdtdd9XB8Adcq08djjwMDwf5n4g&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0	HTTP Parser: No favicon

Source: https://wildcardservice.crownicastle.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2F0ffice.crownicastle.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2F0ffice.crownicastle.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638495915178333267.YzBhMDY0OTEtNzMyMi00NTFkLTgzZjEtY2JjYjdmYWU0MmFkM2FjNGZmNTgtYzE4ZS00OTdiLWI3YmQtMzYyN2QyYWE3YzQ3&ui_locales=en-US&mkt=en-US&client-request-id=7f6a4a2d-3946-41ec-a768-6c7489204929&state=_8lnvJ63qLjJneAiCy1oZzPSNsgOznxWiF5-Y01jRiR1l4p31sjLky1FEFKWCWumlNFZ4KHXKrekIQePEbG-cjLcrJ5K6y3Nb40-C0vLC64xidX4HGQUITB8Atmn0wIH_eD4eK0GsVF2-EtjS_0XnT4OxTLar-2zXTpZZX8r2EUwGb5YNdL74kkIrBOhaTxkUDlb5FIrgKxLUnKUFeJU8DzjweaF5gKlKQomO8BZFKBGOScVnWusqD1fzuiFdtdd9XB8Adcq08djjwMDwf5n4g&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://wildcardservice.crownicastle.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2F0ffice.crownicastle.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2F0ffice.crownicastle.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638495915178333267.YzBhMDY0OTEtNzMyMi00NTFkLTgzZjEtY2JjYjdmYWU0MmFkM2FjNGZmNTgtYzE4ZS00OTdiLWI3YmQtMzYyN2QyYWE3YzQ3&ui_locales=en-US&mkt=en-US&client-request-id=7f6a4a2d-3946-41ec-a768-6c7489204929&state=_8lnvJ63qLjJneAiCy1oZzPSNsgOznxWiF5-Y01jRiR1l4p31sjLky1FEFKWCWumlNFZ4KHXKrekIQePEbG-cjLcrJ5K6y3Nb40-C0vLC64xidX4HGQUITB8Atmn0wIH_eD4eK0GsVF2-EtjS_0XnT4OxTLar-2zXTpZZX8r2EUwGb5YNdL74kkIrBOhaTxkUDlb5FIrgKxLUnKUFeJU8DzjweaF5gKlKQomO8BZFKBGOScVnWusqD1fzuiFdtdd9XB8Adcq08djjwMDwf5n4g&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0&sso_reload=true	HTTP Parser: No <meta name="author".. found

Source: https://wildcardservice.crownicastle.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2F0ffice.crownicastle.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2F0ffice.crownicastle.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638495915178333267.YzBhMDY0OTEtNzMyMi00NTFkLTgzZjEtY2JjYjdmYWU0MmFkM2FjNGZmNTgtYzE4ZS00OTdiLWI3YmQtMzYyN2QyYWE3YzQ3&ui_locales=en-US&mkt=en-US&client-request-id=7f6a4a2d-3946-41ec-a768-6c7489204929&state=_8lnvJ63qLjJneAiCy1oZzPSNsgOznxWiF5-Y01jRiR1l4p31sjLky1FEFKWCWumlNFZ4KHXKrekIQePEbG-cjLcrJ5K6y3Nb40-C0vLC64xidX4HGQUITB8Atmn0wIH_eD4eK0GsVF2-EtjS_0XnT4OxTLar-2zXTpZZX8r2EUwGb5YNdL74kkIrBOhaTxkUDlb5FIrgKxLUnKUFeJU8DzjweaF5gKlKQomO8BZFKBGOScVnWusqD1fzuiFdtdd9XB8Adcq08djjwMDwf5n4g&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://wildcardservice.crownicastle.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2F0ffice.crownicastle.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2F0ffice.crownicastle.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638495915178333267.YzBhMDY0OTEtNzMyMi00NTFkLTgzZjEtY2JjYjdmYWU0MmFkM2FjNGZmNTgtYzE4ZS00OTdiLWI3YmQtMzYyN2QyYWE3YzQ3&ui_locales=en-US&mkt=en-US&client-request-id=7f6a4a2d-3946-41ec-a768-6c7489204929&state=_8lnvJ63qLjJneAiCy1oZzPSNsgOznxWiF5-Y01jRiR1l4p31sjLky1FEFKWCWumlNFZ4KHXKrekIQePEbG-cjLcrJ5K6y3Nb40-C0vLC64xidX4HGQUITB8Atmn0wIH_eD4eK0GsVF2-EtjS_0XnT4OxTLar-2zXTpZZX8r2EUwGb5YNdL74kkIrBOhaTxkUDlb5FIrgKxLUnKUFeJU8DzjweaF5gKlKQomO8BZFKBGOScVnWusqD1fzuiFdtdd9XB8Adcq08djjwMDwf5n4g&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 23.1.102.27:443 -> 192.168.2.16:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.1.102.27:443 -> 192.168.2.16:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.16:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.16:49786 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.102.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.102.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.102.27
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.102.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.102.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.102.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.102.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.102.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.102.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.102.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.102.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.102.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.102.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.102.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.102.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.102.27
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.102.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.102.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.102.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103

Source: global traffic	DNS traffic detected: DNS query: clickme.thryv.com
Source: global traffic	DNS traffic detected: DNS query: totopurel.com
Source: global traffic	DNS traffic detected: DNS query: google.com
Source: global traffic	DNS traffic detected: DNS query: wildcardservice.crownicastle.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: 0ffice.crownicastle.com
Source: global traffic	DNS traffic detected: DNS query: ff1b4edf-0ccd67d1.crownicastle.com
Source: global traffic	DNS traffic detected: DNS query: 5c7fbd0c-0ccd67d1.crownicastle.com
Source: global traffic	DNS traffic detected: DNS query: cdc7d173-0ccd67d1.crownicastle.com
Source: global traffic	DNS traffic detected: DNS query: l1ve.crownicastle.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49696
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443

Source: unknown	HTTPS traffic detected: 23.1.102.27:443 -> 192.168.2.16:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.1.102.27:443 -> 192.168.2.16:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.16:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.16:49786 version: TLS 1.2

Source: classification engine

Classification label: mal56.phis.win@19/48@28/147

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://clickme.thryv.com/ls/click?upn=u001.5dsdCa4YiGVzoib36gWoSPyltUaWCsyFq200Ntb2JspVnELOGgvw66FVBJMc1CsMmns0_-2BOVhbrxcsvz9veeoLEglpD8RiEh0AaH1ow0Lk-2FKx9DGH2EA0fWhnrHZ-2FmlnIJ5UhAxXtDoOWXX-2FPyG5rVAl4UI7bgryXtRxONxX47M69Zs408-2BvnAL8-2FwQfC38J0vo-2BNPuXd9ZQRl3mVPkcpfDB8fFzO8k72NDbDigQEVVlq88Cbyd-2FspyzvoVJPR1h-2FbZ7QQ6McqmPE9-2BcpXmxMjtiMnlH5y7my6ciUJ8oawjrr8uTV2VFCUnRz-2BYajHpdlo-2BdijTTWoN6XIqzSzzn9raVdyCv6yrtMzJIVFFK229s6J0zoOHuRdvwd4zEdpENbxbzehqnKQ8Yk3LeuEYUlsDIufaiekHtd-2BWbkmha56OPiK-2BI-3D
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1908,i,4342423110262873997,6879490936910367082,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1908,i,4342423110262873997,6879490936910367082,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

ID:	1431366
Product:	CloudBasic
Start time:	23:37:10
Start date:	24.04.2024
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs