Windows Analysis Report
https://docs.google.com/presentation/d/e/2PACX-1vRA7cYu2pjKyfaCRROgTu4J2OpPGWE_raEqtGhCVl21QDvJzZsVPQtIU_FG6khcCjqxbwzOTOoBBBx6/pub?start=false&loop=false&delayms=3000&slide=id.p

Overview

General Information

Sample URL:	https://docs.google.com/presentation/d/e/2PACX-1vRA7cYu2pjKyfaCRROgTu4J2OpPGWE_raEqtGhCVl21QDvJzZsVPQtIU_FG6khcCjqxbwzOTOoBBBx6/pub?start=false&loop=false&delayms=3000&slide=id.p
Analysis ID:	1431489
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Phishing site or detected (based on various text indicators)

Stores files to the Windows start menu directory

Uses insecure TLS / SSL version for HTTPS connection

Classification

Signatures

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://docs.google.com/presentation/d/e/2PACX-1vRA7cYu2pjKyfaCRROgTu4J2OpPGWE_raEqtGhCVl21QDvJzZsVPQtIU_FG6khcCjqxbwzOTOoBBBx6/pub?start=false&loop=false&delayms=3000&slide=id.p

SlashNext: detection malicious, Label: Credential Stealing type: Phishing & Social Engineering

Phishing

Phishing site or detected (based on various text indicators)

Source: Chrome DOM: 0.1

OCR Text: US. SECURITIES AND EXCHANGE COMMISSION Welcome to the SEC.GOV Secure Message Portal Date: Tuesday, April 23 2024 File Type: PDF Document via Docusign Pro Reference: CODE VIOLATION NOTICE PREVIEW OR DOWNLOAD DOCUMENT HERE U

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown	HTTPS traffic detected: 64.233.185.132:443 -> 192.168.2.5:49747 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49758 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 23.46.200.91:443 -> 192.168.2.5:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.46.200.91:443 -> 192.168.2.5:49731 version: TLS 1.2

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown	HTTPS traffic detected: 64.233.185.132:443 -> 192.168.2.5:49747 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49758 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.105.132
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.105.132
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.105.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132

Source: global traffic	HTTP traffic detected: GET /presentation/d/e/2PACX-1vRA7cYu2pjKyfaCRROgTu4J2OpPGWE_raEqtGhCVl21QDvJzZsVPQtIU_FG6khcCjqxbwzOTOoBBBx6/pub?start=false&loop=false&delayms=3000&slide=id.p HTTP/1.1Host: docs.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/presentation/client/css/417472571-viewer_css_ltr.css HTTP/1.1Host: docs.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://docs.google.com/presentation/d/e/2PACX-1vRA7cYu2pjKyfaCRROgTu4J2OpPGWE_raEqtGhCVl21QDvJzZsVPQtIU_FG6khcCjqxbwzOTOoBBBx6/pub?start=false&loop=false&delayms=3000&slide=id.pAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=513=bSyLsqrZt5ZrvEJz2WNNyr1EjelSd99OTZFhrxBPBXOMUKzbT0Nred3AcWmoB2Ay3zddWjCXUOoYmKZ2s2mLrVAMyChOz_uiKVD5ekO9n9-7niKBrbZAnuD5DzeLZMF5fNDNiqXcpHI8s6L9JHVxejfpe_JwiX4hS3PA3TgOSoM; GFE_RTT=256
Source: global traffic	HTTP traffic detected: GET /static/presentation/client/js/351906967-viewer_integrated_core.js HTTP/1.1Host: docs.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://docs.google.com/presentation/d/e/2PACX-1vRA7cYu2pjKyfaCRROgTu4J2OpPGWE_raEqtGhCVl21QDvJzZsVPQtIU_FG6khcCjqxbwzOTOoBBBx6/pub?start=false&loop=false&delayms=3000&slide=id.pAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=513=bSyLsqrZt5ZrvEJz2WNNyr1EjelSd99OTZFhrxBPBXOMUKzbT0Nred3AcWmoB2Ay3zddWjCXUOoYmKZ2s2mLrVAMyChOz_uiKVD5ekO9n9-7niKBrbZAnuD5DzeLZMF5fNDNiqXcpHI8s6L9JHVxejfpe_JwiX4hS3PA3TgOSoM; GFE_RTT=256
Source: global traffic	HTTP traffic detected: GET /XOX9_Lw9xH70gLXU68NDzupHxgKy89O3Pw3-JR0tDxsOAjbBL64GOyTkzg0wvlAV6_h_c5z_vdeaZtbv8dsl5yKyOPqTuA6D_WbsRajPuZYRefXeZ79xtLOO8vbjKn7ibcHEJQZFissVFCzjgPQ=s2048 HTTP/1.1Host: lh7-us.googleusercontent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://docs.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /u-Mp9F5A6LU_P1ibOIfVu26KbsQ8Raw8fYLP4nmUSBBxF22V6GYSfubrL6rV-579eC-GU2rN9MdJvdAWtxoVgK-zpH4yiFfbZThA_S-sUf9_xd3_W8Y-YE3sOqwwIg-RuEfNHJHMyUNq3GRH2os=s2048 HTTP/1.1Host: lh7-us.googleusercontent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://docs.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /XOX9_Lw9xH70gLXU68NDzupHxgKy89O3Pw3-JR0tDxsOAjbBL64GOyTkzg0wvlAV6_h_c5z_vdeaZtbv8dsl5yKyOPqTuA6D_WbsRajPuZYRefXeZ79xtLOO8vbjKn7ibcHEJQZFissVFCzjgPQ=s2048 HTTP/1.1Host: lh7-us.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/presentation/client/js/2291844029-punch_viewer_worker_binary_viewercore.js HTTP/1.1Host: docs.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=513=bSyLsqrZt5ZrvEJz2WNNyr1EjelSd99OTZFhrxBPBXOMUKzbT0Nred3AcWmoB2Ay3zddWjCXUOoYmKZ2s2mLrVAMyChOz_uiKVD5ekO9n9-7niKBrbZAnuD5DzeLZMF5fNDNiqXcpHI8s6L9JHVxejfpe_JwiX4hS3PA3TgOSoM
Source: global traffic	HTTP traffic detected: GET /u-Mp9F5A6LU_P1ibOIfVu26KbsQ8Raw8fYLP4nmUSBBxF22V6GYSfubrL6rV-579eC-GU2rN9MdJvdAWtxoVgK-zpH4yiFfbZThA_S-sUf9_xd3_W8Y-YE3sOqwwIg-RuEfNHJHMyUNq3GRH2os=s2048 HTTP/1.1Host: lh7-us.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/presentation/client/js/3305320739-viewer_integrated_app.js HTTP/1.1Host: docs.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://docs.google.com/presentation/d/e/2PACX-1vRA7cYu2pjKyfaCRROgTu4J2OpPGWE_raEqtGhCVl21QDvJzZsVPQtIU_FG6khcCjqxbwzOTOoBBBx6/pub?start=false&loop=false&delayms=3000&slide=id.pAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=513=bSyLsqrZt5ZrvEJz2WNNyr1EjelSd99OTZFhrxBPBXOMUKzbT0Nred3AcWmoB2Ay3zddWjCXUOoYmKZ2s2mLrVAMyChOz_uiKVD5ekO9n9-7niKBrbZAnuD5DzeLZMF5fNDNiqXcpHI8s6L9JHVxejfpe_JwiX4hS3PA3TgOSoM
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /static/presentation/client/js/2047568700-viewer_integrated_help.js HTTP/1.1Host: docs.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://docs.google.com/presentation/d/e/2PACX-1vRA7cYu2pjKyfaCRROgTu4J2OpPGWE_raEqtGhCVl21QDvJzZsVPQtIU_FG6khcCjqxbwzOTOoBBBx6/pub?start=false&loop=false&delayms=3000&slide=id.pAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=513=bSyLsqrZt5ZrvEJz2WNNyr1EjelSd99OTZFhrxBPBXOMUKzbT0Nred3AcWmoB2Ay3zddWjCXUOoYmKZ2s2mLrVAMyChOz_uiKVD5ekO9n9-7niKBrbZAnuD5DzeLZMF5fNDNiqXcpHI8s6L9JHVxejfpe_JwiX4hS3PA3TgOSoM
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=513=k_N8-2MXIBXzC-ElcSOc8YRCyhM1uK_i_bi6MEzu6WBNEC6Saf-jncc3I9OLNLryWRkeYWfJZve3rZ_3AGGAtOg-9smtI0Uu0uUWV69ANkQYn4_0vFXM2C5NwY9k_1AJs0tdZU_U_CSPdNTm34t4-E-hWYlNiFZRF48bqzlP39o
Source: global traffic	HTTP traffic detected: GET /presentation/manifest.json HTTP/1.1Host: docs.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: manifestReferer: https://docs.google.com/presentation/d/e/2PACX-1vRA7cYu2pjKyfaCRROgTu4J2OpPGWE_raEqtGhCVl21QDvJzZsVPQtIU_FG6khcCjqxbwzOTOoBBBx6/pub?start=false&loop=false&delayms=3000&slide=id.pAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=513=k_N8-2MXIBXzC-ElcSOc8YRCyhM1uK_i_bi6MEzu6WBNEC6Saf-jncc3I9OLNLryWRkeYWfJZve3rZ_3AGGAtOg-9smtI0Uu0uUWV69ANkQYn4_0vFXM2C5NwY9k_1AJs0tdZU_U_CSPdNTm34t4-E-hWYlNiFZRF48bqzlP39o
Source: global traffic	HTTP traffic detected: GET /XOX9_Lw9xH70gLXU68NDzupHxgKy89O3Pw3-JR0tDxsOAjbBL64GOyTkzg0wvlAV6_h_c5z_vdeaZtbv8dsl5yKyOPqTuA6D_WbsRajPuZYRefXeZ79xtLOO8vbjKn7ibcHEJQZFissVFCzjgPQ=s2048 HTTP/1.1Accept: /User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35 Safari/537.36Host: lh7-us.googleusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=513=k_N8-2MXIBXzC-ElcSOc8YRCyhM1uK_i_bi6MEzu6WBNEC6Saf-jncc3I9OLNLryWRkeYWfJZve3rZ_3AGGAtOg-9smtI0Uu0uUWV69ANkQYn4_0vFXM2C5NwY9k_1AJs0tdZU_U_CSPdNTm34t4-E-hWYlNiFZRF48bqzlP39o
Source: global traffic	HTTP traffic detected: GET /u-Mp9F5A6LU_P1ibOIfVu26KbsQ8Raw8fYLP4nmUSBBxF22V6GYSfubrL6rV-579eC-GU2rN9MdJvdAWtxoVgK-zpH4yiFfbZThA_S-sUf9_xd3_W8Y-YE3sOqwwIg-RuEfNHJHMyUNq3GRH2os=s2048 HTTP/1.1Accept: /User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35 Safari/537.36Host: lh7-us.googleusercontent.com
Source: global traffic	HTTP traffic detected: GET /DocuSign/index.html HTTP/1.1Host: enw-shared-doc.s3.eu-north-1.amazonaws.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://docs.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: enw-shared-doc.s3.eu-north-1.amazonaws.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://enw-shared-doc.s3.eu-north-1.amazonaws.com/DocuSign/index.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=513=k_N8-2MXIBXzC-ElcSOc8YRCyhM1uK_i_bi6MEzu6WBNEC6Saf-jncc3I9OLNLryWRkeYWfJZve3rZ_3AGGAtOg-9smtI0Uu0uUWV69ANkQYn4_0vFXM2C5NwY9k_1AJs0tdZU_U_CSPdNTm34t4-E-hWYlNiFZRF48bqzlP39o

Source: chromecache_92.2.dr	String found in binary or memory: Mg="height",Ng="help",Og="hidden",Pg="hide",Qg="highlight",Rg="hint",Sg="horizontal",Tg="href",Ug="http",dfa="http://www.w3.org/1999/xlink",efa="http://www.w3.org/2000/svg",Vg="https",Wg="https:",Xg="https://",ffa="https://play.google.com/log?format=json&hasfast=true",gfa="https://youtube.googleapis.com",hfa="https://youtube.googleapis.com/iframe_api",Yg="iPad",Zg="icon",$g="icso",ah="id",bh="ifload",ifa="image-generation-18",ch="img",dh="incident",jfa="ink-pen-filled-22",eh="input",kfa="insert-text-18x18", equals www.youtube.com (Youtube)
Source: chromecache_92.2.dr	String found in binary or memory: function gZa(a,c){hZa(a);var d=new BL(c,a.o);5==c?a.l.callback(d):(a.j.onload=h(),a.j.onerror=h(),eo(a.j),3<=a.o?a.l.callback(d):fZa(a))}function hZa(a){clearTimeout(a.v);a.v=null;clearTimeout(a.B);a.B=null}dZa.prototype.getStatus=function(){return this.l&&Uta(this.l)?this.l.getValue():new BL(1,this.o)};var iZa=Ek(["https://www.youtube.com/iframe_api"]),jZa=Ek([hfa]);function CL(a){this.B=a=void 0===a?this.C:a;this.v=kZa;this.l=this.B(this.v);this.j=0;this.o=[]}function lZa(a){for(var c=0;c<a.o.length;c++)a.o[c].callback(a.l.getStatus());a.o=[]}function mZa(a,c){2===a.j&&c.callback(a.l.getStatus());a.o.push(c);1!==a.j&&(a.l=a.B(a.v),a.j=1,eZa(a.l).Aa(function(d){2!==d.xh()&&(a.j=3,lZa(a))}))}CL.prototype.C=function(a){return new dZa(a)}; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: docs.google.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: enw-shared-doc.s3.eu-north-1.amazonaws.com

Source: unknown

HTTP traffic detected: POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 4782sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Content-Type: text/plain;charset=UTF-8X-Goog-AuthUser: 0sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: https://docs.google.comX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://docs.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=513=bSyLsqrZt5ZrvEJz2WNNyr1EjelSd99OTZFhrxBPBXOMUKzbT0Nred3AcWmoB2Ay3zddWjCXUOoYmKZ2s2mLrVAMyChOz_uiKVD5ekO9n9-7niKBrbZAnuD5DzeLZMF5fNDNiqXcpHI8s6L9JHVxejfpe_JwiX4hS3PA3TgOSoM

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 Forbiddenx-amz-request-id: VAP6YD1R1FVCN77Px-amz-id-2: JMSdVQDYzhnsXMBlJ3pQDoUj+t8SeAGLdPmR4lOeToWJsODn9gH6hGr3w+rv3HSqQvhyFefJNthsv3zOpIs+uohJE0DN3h35Content-Type: application/xmlTransfer-Encoding: chunkedDate: Thu, 25 Apr 2024 08:07:45 GMTServer: AmazonS3Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 Forbiddenx-amz-request-id: VAP5TD7WE259QBM9x-amz-id-2: rL6i+LnsAS6Cq64ddCK6dF2HqzWP423yrY/HnhpXkAZNEBM5LjPWQQCE/SPoPv08jQuEPNcwQE7QWxYF8WJ24tllCwph00LvContent-Type: application/xmlTransfer-Encoding: chunkedDate: Thu, 25 Apr 2024 08:07:46 GMTServer: AmazonS3Connection: close

Source: chromecache_92.2.dr	String found in binary or memory: http://csi.gstatic.com/csi
Source: chromecache_92.2.dr	String found in binary or memory: https://accounts.google.com/ServiceLogin
Source: chromecache_107.2.dr	String found in binary or memory: https://angular.io/license
Source: chromecache_92.2.dr	String found in binary or memory: https://apis.google.com/js/api.js
Source: chromecache_92.2.dr	String found in binary or memory: https://csi.gstatic.com/csi
Source: chromecache_103.2.dr	String found in binary or memory: https://fonts.google.com/license/googlerestricted
Source: chromecache_92.2.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Roboto:300
Source: chromecache_103.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/googlesans/v58/4Ua_rENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RF
Source: chromecache_88.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4WxKOzY.woff2)
Source: chromecache_88.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2)
Source: chromecache_88.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu5mxKOzY.woff2)
Source: chromecache_88.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu72xKOzY.woff2)
Source: chromecache_88.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu7GxKOzY.woff2)
Source: chromecache_88.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu7WxKOzY.woff2)
Source: chromecache_88.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu7mxKOzY.woff2)
Source: chromecache_92.2.dr	String found in binary or memory: https://itunes.apple.com/app/apple-store/id842842640?pt=9008&ct=docs_mo&mt=8
Source: chromecache_92.2.dr	String found in binary or memory: https://itunes.apple.com/app/apple-store/id842849113?pt=9008&ct=sheets_mo&mt=8
Source: chromecache_92.2.dr	String found in binary or memory: https://itunes.apple.com/app/apple-store/id879478102?pt=9008&ct=slides_mo&mt=8
Source: chromecache_91.2.dr	String found in binary or memory: https://play.google.com
Source: chromecache_91.2.dr	String found in binary or memory: https://policies.google.com/privacy?hl=en
Source: chromecache_91.2.dr	String found in binary or memory: https://policies.google.com/terms?hl=en
Source: chromecache_91.2.dr	String found in binary or memory: https://support.google.com
Source: chromecache_91.2.dr	String found in binary or memory: https://support.google.com/
Source: chromecache_91.2.dr	String found in binary or memory: https://support.google.com/docs/answer/1696717?hl=en
Source: chromecache_91.2.dr	String found in binary or memory: https://support.google.com/drive/?hl=en
Source: chromecache_92.2.dr	String found in binary or memory: https://uberproxy-pen-redirect.corp.google.com/uberproxy/pen?url=
Source: chromecache_91.2.dr	String found in binary or memory: https://www.google.com
Source: chromecache_92.2.dr	String found in binary or memory: https://www.google.com/recaptcha/api.js?trustedtypes=true&render=
Source: chromecache_91.2.dr	String found in binary or memory: https://www.google.com/tools/feedback
Source: chromecache_91.2.dr	String found in binary or memory: https://www.gstatic.com/feedback/js/help/prod/service/lazy.min.js
Source: chromecache_91.2.dr	String found in binary or memory: https://www.gstatic.com/uservoice/feedback/client/web/
Source: chromecache_92.2.dr	String found in binary or memory: https://www.youtube.com/iframe_api

Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746

Source: unknown	HTTPS traffic detected: 23.46.200.91:443 -> 192.168.2.5:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.46.200.91:443 -> 192.168.2.5:49731 version: TLS 1.2

Source: classification engine

Classification label: mal52.phis.win@17/50@10/8

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 --field-trial-handle=2008,i,2733582830013525161,16242531286462161692,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://docs.google.com/presentation/d/e/2PACX-1vRA7cYu2pjKyfaCRROgTu4J2OpPGWE_raEqtGhCVl21QDvJzZsVPQtIU_FG6khcCjqxbwzOTOoBBBx6/pub?start=false&loop=false&delayms=3000&slide=id.p"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 --field-trial-handle=2008,i,2733582830013525161,16242531286462161692,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.217.215.100	unknown	United States	15169	GOOGLEUS	false
172.253.124.132	unknown	United States	15169	GOOGLEUS	false
172.217.215.147	www.google.com	United States	15169	GOOGLEUS	false
172.217.215.139	docs.google.com	United States	15169	GOOGLEUS	false
142.250.105.132	unknown	United States	15169	GOOGLEUS	false
3.5.218.63	s3-r-w.eu-north-1.amazonaws.com	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false

Private

IP
192.168.2.5

Contacted Domains

Name	IP	Active
docs.google.com	172.217.215.139	true
bg.microsoft.map.fastly.net	199.232.214.172	true
s3-r-w.eu-north-1.amazonaws.com	3.5.218.63	true
play.google.com	172.217.215.139	true
www.google.com	172.217.215.147	true
fp2e7a.wpc.phicdn.net	192.229.211.108	true
enw-shared-doc.s3.eu-north-1.amazonaws.com	unknown	unknown

Contacted URLs

Name	Malicious	Reputation
https://lh7-us.googleusercontent.com/u-Mp9F5A6LU_P1ibOIfVu26KbsQ8Raw8fYLP4nmUSBBxF22V6GYSfubrL6rV-579eC-GU2rN9MdJvdAWtxoVgK-zpH4yiFfbZThA_S-sUf9_xd3_W8Y-YE3sOqwwIg-RuEfNHJHMyUNq3GRH2os=s2048	false	high
https://docs.google.com/static/presentation/client/css/417472571-viewer_css_ltr.css	false	high
https://docs.google.com/presentation/d/e/2PACX-1vRA7cYu2pjKyfaCRROgTu4J2OpPGWE_raEqtGhCVl21QDvJzZsVPQtIU_FG6khcCjqxbwzOTOoBBBx6/pub?start=false&loop=false&delayms=3000&slide=id.p	false	high
https://docs.google.com/presentation/manifest.json	false	high
https://docs.google.com/static/presentation/client/js/2047568700-viewer_integrated_help.js	false	high
https://enw-shared-doc.s3.eu-north-1.amazonaws.com/DocuSign/index.html	false	high
https://lh7-us.googleusercontent.com/XOX9_Lw9xH70gLXU68NDzupHxgKy89O3Pw3-JR0tDxsOAjbBL64GOyTkzg0wvlAV6_h_c5z_vdeaZtbv8dsl5yKyOPqTuA6D_WbsRajPuZYRefXeZ79xtLOO8vbjKn7ibcHEJQZFissVFCzjgPQ=s2048	false	high
https://docs.google.com/static/presentation/client/js/2291844029-punch_viewer_worker_binary_viewercore.js	false	high
https://play.google.com/log?format=json&hasfast=true&authuser=0	false	high
https://docs.google.com/static/presentation/client/js/351906967-viewer_integrated_core.js	false	high
https://enw-shared-doc.s3.eu-north-1.amazonaws.com/favicon.ico	false	high
https://docs.google.com/static/presentation/client/js/3305320739-viewer_integrated_app.js	false	high

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 07:07:24 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	28C4F287A3E923E7A6168D4D340A39CD	B279D32A714B9106A0AD055E5F2BEF088AF01D69	03A3B0DDD701FE064A181857D475C335348A81331122BA8728EE3F30B369FE8B
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 07:07:24 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	FC66E447A60C752E61B3961B26480B76	2E13D69D7FC58F76DD08985299C46D53D58EFEC6	6FBC79C7F096D795F4503B90F861946363DC97633D5959C29D0A63911DEDF755
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	3B6644458D5DF5C2A53E73BBB8C00B92	3E4C509C51009ADB4A3B69ACC77448EA8D15743E	452565EB66B6652B7498B79F0890BB4588B3A96F4B8A25E00BAFB915272B4744
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 07:07:24 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	50A06514C2D3B39BA236F6C018C415B0	7472147BBBBBDE2BDBF97ED092ECC4D1D4A4D17F	483E8DBE8CB07FA7DD1DAA6B9B2D4185E5A51B2F32792DA5E508531324A804B6
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 07:07:24 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	E8865A821EC3651AACF476FD71658FF0	FBCD0589F88374EA247FF7DB55D699E3907200F8	6F44BD371F933A227492A7A5E1943CE961B21214249982F4FF84FE5D8461D6CF
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 07:07:24 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	B17ED6049964EEF9323F723D23D8732A	F3342524CD0F55E7082D75C836B58B716CBB2ECF	472B852DC474CC960F74EF7E485E92B7D6C0A26F7CF2BD7624B099AC9B57CBD8
Chrome Cache Entry: 100	PNG image data, 225 x 225, 8-bit colormap, non-interlaced	3A6B877A4CFCD18AF03D70FF63937821	7005019D2CCD4B27C2F4F8ED5AE9FCCFE2446083	2B54327D2E123D64F4D85627B35A0C273FC9C6587D9CF2DACB6CC4740336E9A3
Chrome Cache Entry: 101	HTML document, Unicode text, UTF-8 text, with very long lines (1136)	FBE36EB2EECF1B90451A3A72701E49D2	AE56EA57C52D1153CEC33CEF91CF935D2D3AF14D	E8F2DED5D74C0EE5F427A20B6715E65BC79ED5C4FC67FB00D89005515C8EFE63
Chrome Cache Entry: 102	Web Open Font Format (Version 2), TrueType, length 15552, version 1.0	285467176F7FE6BB6A9C6873B3DAD2CC	EA04E4FF5142DDD69307C183DEF721A160E0A64E	5A8C1E7681318CAA29E9F44E8A6E271F6A4067A2703E9916DFD4FE9099241DB7
Chrome Cache Entry: 103	ASCII text	A1316684E5829DF29FE33143253E8F59	793DD3B27AAB82DEA62420836D90874CD42739F7	C4F9C8E8BC991879BEAC20D773034E76BF154576B50D177B0575836AE9BE52C6
Chrome Cache Entry: 104	Web Open Font Format (Version 2), TrueType, length 15344, version 1.0	5D4AEB4E5F5EF754E307D7FFAEF688BD	06DB651CDF354C64A7383EA9C77024EF4FB4CEF8	3E253B66056519AA065B00A453BAC37AC5ED8F3E6FE7B542E93A9DCDCC11D0BC
Chrome Cache Entry: 105	SVG Scalable Vector Graphics image	B13911FE3DEE5B24E33B6DB093D2F92F	FBF22083144CF1971D88CB897A01C6062B1E1DD2	D9955DE358E85AA81E1C72D29ED7F168628AF4E3F474FBEC9A6DF00FD2D5FCD7
Chrome Cache Entry: 106	SVG Scalable Vector Graphics image	9556918BC6DC794275B3F24BAE3EF8DC	0EFC6D4886FFD39DC1FF993A0563C25601B31699	8195D4EE53F853A6EFFF850D16F629CFFF9F6938FB7684998F50B471D9F63BDB
Chrome Cache Entry: 107	ASCII text, with very long lines (2042)	E10D40CC905226D70529DD7441B6DFEE	F2D70F81E3D71C8A68728A6FA4F121924C7F5D86	C0B8CF9FBE9DFFB45F888367A2353554A8757BCF1BEBEFA459CA8A94B3523380
Chrome Cache Entry: 82	SVG Scalable Vector Graphics image	9556918BC6DC794275B3F24BAE3EF8DC	0EFC6D4886FFD39DC1FF993A0563C25601B31699	8195D4EE53F853A6EFFF850D16F629CFFF9F6938FB7684998F50B471D9F63BDB
Chrome Cache Entry: 83	ASCII text, with very long lines (6767)	5CC7C630BD4AB3D54D023D75ACB98907	28C7B14D34FE5F487D70AB0F0A1B718AD9EA8BD7	9289E77AF53130DC4AC672B2504FF27B0900E3C2B9F1B27A084E24890A5871AE
Chrome Cache Entry: 84	PNG image data, 856 x 242, 8-bit/color RGBA, non-interlaced	7A230B1B3C2083F1DCDAE3496ADE12F2	5E917BA75E1DE51107E92340549721A85CFA0ED5	B868F3C9F385F203A15B77414ECF53EF0F1147628237047E3DBF5D2E8A930C19
Chrome Cache Entry: 85	MS Windows icon resource - 4 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel	5A0EB0DCD9EE0EECD82FB9A75AC67677	99C103FF8EFFC753757E90F14AE73526F4124F66	1D2B1BF6C2921393F0EEB1B21613BB9E1C9144DFDA918306EF99DBF0D9D2AEE4
Chrome Cache Entry: 86	XML 1.0 document, ASCII text	FA96296922C4924BAA9388450FE471F1	17656F4E874A3DF45317382884F571D25DF6ADD8	7BBBCE1DE9ABBDA1C68E31BE2E0EB5B72CB3ADF97695BD6849C1DB6FE4131FB8
Chrome Cache Entry: 87	PNG image data, 225 x 225, 8-bit colormap, non-interlaced	3A6B877A4CFCD18AF03D70FF63937821	7005019D2CCD4B27C2F4F8ED5AE9FCCFE2446083	2B54327D2E123D64F4D85627B35A0C273FC9C6587D9CF2DACB6CC4740336E9A3
Chrome Cache Entry: 88	ASCII text	E90E36C9FCF4283439F0C2BB5BB96254	ABE9B8FEEFFCBFF899A67603CDCCB93065C0480D	44004199012159C073F8C965213F9E0AECD633DFE1D58641D7F497D3C7423A61
Chrome Cache Entry: 89	PNG image data, 21 x 21, 8-bit/color RGBA, non-interlaced	E6D4B60D1F1070F9C70E11E181BD4821	54860D1365CB29C657E6B3066FE9B081F8A15609	C4529BB647D07FBC3A858BD39FE0AFF051DD7B5CCBA99C7CEA5A307FDD7F4241
Chrome Cache Entry: 90	SVG Scalable Vector Graphics image	B13911FE3DEE5B24E33B6DB093D2F92F	FBF22083144CF1971D88CB897A01C6062B1E1DD2	D9955DE358E85AA81E1C72D29ED7F168628AF4E3F474FBEC9A6DF00FD2D5FCD7
Chrome Cache Entry: 91	ASCII text, with very long lines (2097)	04BD57EBEE76866A9EC1AEFE8F02D02C	CF866860190BDBC399FB60837E94D76B92897088	E741DFF8C9C93A0CE196DC5E1EC0C33CE06D20A0CF6FCD6804AFC86F1F9F576E
Chrome Cache Entry: 92	HTML document, ASCII text, with very long lines (2231)	91589878BC31D3A8372EE9C38E6ED154	4572C806EB387EA3078814EA683C215B2A0DBDD3	F20A1579DDC345524AD42DD4C0EAC207CB2A8DB87ADCE3FEF07123E2241FACBC
Chrome Cache Entry: 93	XML 1.0 document, ASCII text	8D6556ABDAA629AB6FAAAFBE9EAEB4F9	0C7CB04E382530FB9BBD15BD2F5842C977A95D9B	055EB3CF4EF51DB8546207B904D1E6D531DADEF0941E769BF78995F567D1D67A
Chrome Cache Entry: 94	PNG image data, 21 x 21, 8-bit/color RGBA, non-interlaced	E6D4B60D1F1070F9C70E11E181BD4821	54860D1365CB29C657E6B3066FE9B081F8A15609	C4529BB647D07FBC3A858BD39FE0AFF051DD7B5CCBA99C7CEA5A307FDD7F4241
Chrome Cache Entry: 95	PNG image data, 144 x 144, 8-bit colormap, non-interlaced	0D15D393DAC5E0236D6EF35C65E9597C	54A8C64CC47BC346E4F2E1C615FD5117A95852EE	1B001080D4B135431DC6E7377B1697C564ABBFB0BA3518DFFFCA00470C644464
Chrome Cache Entry: 96	ASCII text, with very long lines (65536), with no line terminators	C70DD6B16B4AC3C82D288990ECF03DB6	60D4C160FF27938BC55CAD10466D38FC5E6C2BEA	1BC393767D72B2987DD141840F01509D14C4958A7A94B4AB4376C0C55BC9D0D5
Chrome Cache Entry: 97	PNG image data, 856 x 242, 8-bit/color RGBA, non-interlaced	7A230B1B3C2083F1DCDAE3496ADE12F2	5E917BA75E1DE51107E92340549721A85CFA0ED5	B868F3C9F385F203A15B77414ECF53EF0F1147628237047E3DBF5D2E8A930C19
Chrome Cache Entry: 98	MS Windows icon resource - 4 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel	5A0EB0DCD9EE0EECD82FB9A75AC67677	99C103FF8EFFC753757E90F14AE73526F4124F66	1D2B1BF6C2921393F0EEB1B21613BB9E1C9144DFDA918306EF99DBF0D9D2AEE4
Chrome Cache Entry: 99	PNG image data, 144 x 144, 8-bit colormap, non-interlaced	0D15D393DAC5E0236D6EF35C65E9597C	54A8C64CC47BC346E4F2E1C615FD5117A95852EE	1B001080D4B135431DC6E7377B1697C564ABBFB0BA3518DFFFCA00470C644464

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://docs.google.com/presentation/d/e/2PACX-1vRA7cYu2pjKyfaCRROgTu4J2OpPGWE_raEqtGhCVl21QDvJzZsVPQtIU_FG6khcCjqxbwzOTOoBBBx6/pub?start=false&loop=false&delayms=3000&slide=id.p

SlashNext: detection malicious, Label: Credential Stealing type: Phishing & Social Engineering

Phishing

Phishing site or detected (based on various text indicators)

Source: Chrome DOM: 0.1

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown	HTTPS traffic detected: 64.233.185.132:443 -> 192.168.2.5:49747 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49758 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 23.46.200.91:443 -> 192.168.2.5:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.46.200.91:443 -> 192.168.2.5:49731 version: TLS 1.2

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown	HTTPS traffic detected: 64.233.185.132:443 -> 192.168.2.5:49747 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49758 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.105.132
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.105.132
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.105.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.253.124.132

Source: global traffic	HTTP traffic detected: GET /presentation/d/e/2PACX-1vRA7cYu2pjKyfaCRROgTu4J2OpPGWE_raEqtGhCVl21QDvJzZsVPQtIU_FG6khcCjqxbwzOTOoBBBx6/pub?start=false&loop=false&delayms=3000&slide=id.p HTTP/1.1Host: docs.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/presentation/client/css/417472571-viewer_css_ltr.css HTTP/1.1Host: docs.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://docs.google.com/presentation/d/e/2PACX-1vRA7cYu2pjKyfaCRROgTu4J2OpPGWE_raEqtGhCVl21QDvJzZsVPQtIU_FG6khcCjqxbwzOTOoBBBx6/pub?start=false&loop=false&delayms=3000&slide=id.pAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=513=bSyLsqrZt5ZrvEJz2WNNyr1EjelSd99OTZFhrxBPBXOMUKzbT0Nred3AcWmoB2Ay3zddWjCXUOoYmKZ2s2mLrVAMyChOz_uiKVD5ekO9n9-7niKBrbZAnuD5DzeLZMF5fNDNiqXcpHI8s6L9JHVxejfpe_JwiX4hS3PA3TgOSoM; GFE_RTT=256
Source: global traffic	HTTP traffic detected: GET /static/presentation/client/js/351906967-viewer_integrated_core.js HTTP/1.1Host: docs.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://docs.google.com/presentation/d/e/2PACX-1vRA7cYu2pjKyfaCRROgTu4J2OpPGWE_raEqtGhCVl21QDvJzZsVPQtIU_FG6khcCjqxbwzOTOoBBBx6/pub?start=false&loop=false&delayms=3000&slide=id.pAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=513=bSyLsqrZt5ZrvEJz2WNNyr1EjelSd99OTZFhrxBPBXOMUKzbT0Nred3AcWmoB2Ay3zddWjCXUOoYmKZ2s2mLrVAMyChOz_uiKVD5ekO9n9-7niKBrbZAnuD5DzeLZMF5fNDNiqXcpHI8s6L9JHVxejfpe_JwiX4hS3PA3TgOSoM; GFE_RTT=256
Source: global traffic	HTTP traffic detected: GET /XOX9_Lw9xH70gLXU68NDzupHxgKy89O3Pw3-JR0tDxsOAjbBL64GOyTkzg0wvlAV6_h_c5z_vdeaZtbv8dsl5yKyOPqTuA6D_WbsRajPuZYRefXeZ79xtLOO8vbjKn7ibcHEJQZFissVFCzjgPQ=s2048 HTTP/1.1Host: lh7-us.googleusercontent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://docs.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /u-Mp9F5A6LU_P1ibOIfVu26KbsQ8Raw8fYLP4nmUSBBxF22V6GYSfubrL6rV-579eC-GU2rN9MdJvdAWtxoVgK-zpH4yiFfbZThA_S-sUf9_xd3_W8Y-YE3sOqwwIg-RuEfNHJHMyUNq3GRH2os=s2048 HTTP/1.1Host: lh7-us.googleusercontent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://docs.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /XOX9_Lw9xH70gLXU68NDzupHxgKy89O3Pw3-JR0tDxsOAjbBL64GOyTkzg0wvlAV6_h_c5z_vdeaZtbv8dsl5yKyOPqTuA6D_WbsRajPuZYRefXeZ79xtLOO8vbjKn7ibcHEJQZFissVFCzjgPQ=s2048 HTTP/1.1Host: lh7-us.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/presentation/client/js/2291844029-punch_viewer_worker_binary_viewercore.js HTTP/1.1Host: docs.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=513=bSyLsqrZt5ZrvEJz2WNNyr1EjelSd99OTZFhrxBPBXOMUKzbT0Nred3AcWmoB2Ay3zddWjCXUOoYmKZ2s2mLrVAMyChOz_uiKVD5ekO9n9-7niKBrbZAnuD5DzeLZMF5fNDNiqXcpHI8s6L9JHVxejfpe_JwiX4hS3PA3TgOSoM
Source: global traffic	HTTP traffic detected: GET /u-Mp9F5A6LU_P1ibOIfVu26KbsQ8Raw8fYLP4nmUSBBxF22V6GYSfubrL6rV-579eC-GU2rN9MdJvdAWtxoVgK-zpH4yiFfbZThA_S-sUf9_xd3_W8Y-YE3sOqwwIg-RuEfNHJHMyUNq3GRH2os=s2048 HTTP/1.1Host: lh7-us.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/presentation/client/js/3305320739-viewer_integrated_app.js HTTP/1.1Host: docs.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://docs.google.com/presentation/d/e/2PACX-1vRA7cYu2pjKyfaCRROgTu4J2OpPGWE_raEqtGhCVl21QDvJzZsVPQtIU_FG6khcCjqxbwzOTOoBBBx6/pub?start=false&loop=false&delayms=3000&slide=id.pAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=513=bSyLsqrZt5ZrvEJz2WNNyr1EjelSd99OTZFhrxBPBXOMUKzbT0Nred3AcWmoB2Ay3zddWjCXUOoYmKZ2s2mLrVAMyChOz_uiKVD5ekO9n9-7niKBrbZAnuD5DzeLZMF5fNDNiqXcpHI8s6L9JHVxejfpe_JwiX4hS3PA3TgOSoM
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /static/presentation/client/js/2047568700-viewer_integrated_help.js HTTP/1.1Host: docs.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://docs.google.com/presentation/d/e/2PACX-1vRA7cYu2pjKyfaCRROgTu4J2OpPGWE_raEqtGhCVl21QDvJzZsVPQtIU_FG6khcCjqxbwzOTOoBBBx6/pub?start=false&loop=false&delayms=3000&slide=id.pAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=513=bSyLsqrZt5ZrvEJz2WNNyr1EjelSd99OTZFhrxBPBXOMUKzbT0Nred3AcWmoB2Ay3zddWjCXUOoYmKZ2s2mLrVAMyChOz_uiKVD5ekO9n9-7niKBrbZAnuD5DzeLZMF5fNDNiqXcpHI8s6L9JHVxejfpe_JwiX4hS3PA3TgOSoM
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=513=k_N8-2MXIBXzC-ElcSOc8YRCyhM1uK_i_bi6MEzu6WBNEC6Saf-jncc3I9OLNLryWRkeYWfJZve3rZ_3AGGAtOg-9smtI0Uu0uUWV69ANkQYn4_0vFXM2C5NwY9k_1AJs0tdZU_U_CSPdNTm34t4-E-hWYlNiFZRF48bqzlP39o
Source: global traffic	HTTP traffic detected: GET /presentation/manifest.json HTTP/1.1Host: docs.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: manifestReferer: https://docs.google.com/presentation/d/e/2PACX-1vRA7cYu2pjKyfaCRROgTu4J2OpPGWE_raEqtGhCVl21QDvJzZsVPQtIU_FG6khcCjqxbwzOTOoBBBx6/pub?start=false&loop=false&delayms=3000&slide=id.pAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=513=k_N8-2MXIBXzC-ElcSOc8YRCyhM1uK_i_bi6MEzu6WBNEC6Saf-jncc3I9OLNLryWRkeYWfJZve3rZ_3AGGAtOg-9smtI0Uu0uUWV69ANkQYn4_0vFXM2C5NwY9k_1AJs0tdZU_U_CSPdNTm34t4-E-hWYlNiFZRF48bqzlP39o
Source: global traffic	HTTP traffic detected: GET /XOX9_Lw9xH70gLXU68NDzupHxgKy89O3Pw3-JR0tDxsOAjbBL64GOyTkzg0wvlAV6_h_c5z_vdeaZtbv8dsl5yKyOPqTuA6D_WbsRajPuZYRefXeZ79xtLOO8vbjKn7ibcHEJQZFissVFCzjgPQ=s2048 HTTP/1.1Accept: /User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35 Safari/537.36Host: lh7-us.googleusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=513=k_N8-2MXIBXzC-ElcSOc8YRCyhM1uK_i_bi6MEzu6WBNEC6Saf-jncc3I9OLNLryWRkeYWfJZve3rZ_3AGGAtOg-9smtI0Uu0uUWV69ANkQYn4_0vFXM2C5NwY9k_1AJs0tdZU_U_CSPdNTm34t4-E-hWYlNiFZRF48bqzlP39o
Source: global traffic	HTTP traffic detected: GET /u-Mp9F5A6LU_P1ibOIfVu26KbsQ8Raw8fYLP4nmUSBBxF22V6GYSfubrL6rV-579eC-GU2rN9MdJvdAWtxoVgK-zpH4yiFfbZThA_S-sUf9_xd3_W8Y-YE3sOqwwIg-RuEfNHJHMyUNq3GRH2os=s2048 HTTP/1.1Accept: /User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35 Safari/537.36Host: lh7-us.googleusercontent.com
Source: global traffic	HTTP traffic detected: GET /DocuSign/index.html HTTP/1.1Host: enw-shared-doc.s3.eu-north-1.amazonaws.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://docs.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: enw-shared-doc.s3.eu-north-1.amazonaws.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://enw-shared-doc.s3.eu-north-1.amazonaws.com/DocuSign/index.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=513=k_N8-2MXIBXzC-ElcSOc8YRCyhM1uK_i_bi6MEzu6WBNEC6Saf-jncc3I9OLNLryWRkeYWfJZve3rZ_3AGGAtOg-9smtI0Uu0uUWV69ANkQYn4_0vFXM2C5NwY9k_1AJs0tdZU_U_CSPdNTm34t4-E-hWYlNiFZRF48bqzlP39o

Source: chromecache_92.2.dr	String found in binary or memory: Mg="height",Ng="help",Og="hidden",Pg="hide",Qg="highlight",Rg="hint",Sg="horizontal",Tg="href",Ug="http",dfa="http://www.w3.org/1999/xlink",efa="http://www.w3.org/2000/svg",Vg="https",Wg="https:",Xg="https://",ffa="https://play.google.com/log?format=json&hasfast=true",gfa="https://youtube.googleapis.com",hfa="https://youtube.googleapis.com/iframe_api",Yg="iPad",Zg="icon",$g="icso",ah="id",bh="ifload",ifa="image-generation-18",ch="img",dh="incident",jfa="ink-pen-filled-22",eh="input",kfa="insert-text-18x18", equals www.youtube.com (Youtube)
Source: chromecache_92.2.dr	String found in binary or memory: function gZa(a,c){hZa(a);var d=new BL(c,a.o);5==c?a.l.callback(d):(a.j.onload=h(),a.j.onerror=h(),eo(a.j),3<=a.o?a.l.callback(d):fZa(a))}function hZa(a){clearTimeout(a.v);a.v=null;clearTimeout(a.B);a.B=null}dZa.prototype.getStatus=function(){return this.l&&Uta(this.l)?this.l.getValue():new BL(1,this.o)};var iZa=Ek(["https://www.youtube.com/iframe_api"]),jZa=Ek([hfa]);function CL(a){this.B=a=void 0===a?this.C:a;this.v=kZa;this.l=this.B(this.v);this.j=0;this.o=[]}function lZa(a){for(var c=0;c<a.o.length;c++)a.o[c].callback(a.l.getStatus());a.o=[]}function mZa(a,c){2===a.j&&c.callback(a.l.getStatus());a.o.push(c);1!==a.j&&(a.l=a.B(a.v),a.j=1,eZa(a.l).Aa(function(d){2!==d.xh()&&(a.j=3,lZa(a))}))}CL.prototype.C=function(a){return new dZa(a)}; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: docs.google.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: enw-shared-doc.s3.eu-north-1.amazonaws.com

Source: unknown

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 Forbiddenx-amz-request-id: VAP6YD1R1FVCN77Px-amz-id-2: JMSdVQDYzhnsXMBlJ3pQDoUj+t8SeAGLdPmR4lOeToWJsODn9gH6hGr3w+rv3HSqQvhyFefJNthsv3zOpIs+uohJE0DN3h35Content-Type: application/xmlTransfer-Encoding: chunkedDate: Thu, 25 Apr 2024 08:07:45 GMTServer: AmazonS3Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 Forbiddenx-amz-request-id: VAP5TD7WE259QBM9x-amz-id-2: rL6i+LnsAS6Cq64ddCK6dF2HqzWP423yrY/HnhpXkAZNEBM5LjPWQQCE/SPoPv08jQuEPNcwQE7QWxYF8WJ24tllCwph00LvContent-Type: application/xmlTransfer-Encoding: chunkedDate: Thu, 25 Apr 2024 08:07:46 GMTServer: AmazonS3Connection: close

Source: chromecache_92.2.dr	String found in binary or memory: http://csi.gstatic.com/csi
Source: chromecache_92.2.dr	String found in binary or memory: https://accounts.google.com/ServiceLogin
Source: chromecache_107.2.dr	String found in binary or memory: https://angular.io/license
Source: chromecache_92.2.dr	String found in binary or memory: https://apis.google.com/js/api.js
Source: chromecache_92.2.dr	String found in binary or memory: https://csi.gstatic.com/csi
Source: chromecache_103.2.dr	String found in binary or memory: https://fonts.google.com/license/googlerestricted
Source: chromecache_92.2.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Roboto:300
Source: chromecache_103.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/googlesans/v58/4Ua_rENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RF
Source: chromecache_88.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4WxKOzY.woff2)
Source: chromecache_88.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2)
Source: chromecache_88.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu5mxKOzY.woff2)
Source: chromecache_88.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu72xKOzY.woff2)
Source: chromecache_88.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu7GxKOzY.woff2)
Source: chromecache_88.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu7WxKOzY.woff2)
Source: chromecache_88.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu7mxKOzY.woff2)
Source: chromecache_92.2.dr	String found in binary or memory: https://itunes.apple.com/app/apple-store/id842842640?pt=9008&ct=docs_mo&mt=8
Source: chromecache_92.2.dr	String found in binary or memory: https://itunes.apple.com/app/apple-store/id842849113?pt=9008&ct=sheets_mo&mt=8
Source: chromecache_92.2.dr	String found in binary or memory: https://itunes.apple.com/app/apple-store/id879478102?pt=9008&ct=slides_mo&mt=8
Source: chromecache_91.2.dr	String found in binary or memory: https://play.google.com
Source: chromecache_91.2.dr	String found in binary or memory: https://policies.google.com/privacy?hl=en
Source: chromecache_91.2.dr	String found in binary or memory: https://policies.google.com/terms?hl=en
Source: chromecache_91.2.dr	String found in binary or memory: https://support.google.com
Source: chromecache_91.2.dr	String found in binary or memory: https://support.google.com/
Source: chromecache_91.2.dr	String found in binary or memory: https://support.google.com/docs/answer/1696717?hl=en
Source: chromecache_91.2.dr	String found in binary or memory: https://support.google.com/drive/?hl=en
Source: chromecache_92.2.dr	String found in binary or memory: https://uberproxy-pen-redirect.corp.google.com/uberproxy/pen?url=
Source: chromecache_91.2.dr	String found in binary or memory: https://www.google.com
Source: chromecache_92.2.dr	String found in binary or memory: https://www.google.com/recaptcha/api.js?trustedtypes=true&render=
Source: chromecache_91.2.dr	String found in binary or memory: https://www.google.com/tools/feedback
Source: chromecache_91.2.dr	String found in binary or memory: https://www.gstatic.com/feedback/js/help/prod/service/lazy.min.js
Source: chromecache_91.2.dr	String found in binary or memory: https://www.gstatic.com/uservoice/feedback/client/web/
Source: chromecache_92.2.dr	String found in binary or memory: https://www.youtube.com/iframe_api

Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746

Source: unknown	HTTPS traffic detected: 23.46.200.91:443 -> 192.168.2.5:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.46.200.91:443 -> 192.168.2.5:49731 version: TLS 1.2

Source: classification engine

Classification label: mal52.phis.win@17/50@10/8

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 --field-trial-handle=2008,i,2733582830013525161,16242531286462161692,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://docs.google.com/presentation/d/e/2PACX-1vRA7cYu2pjKyfaCRROgTu4J2OpPGWE_raEqtGhCVl21QDvJzZsVPQtIU_FG6khcCjqxbwzOTOoBBBx6/pub?start=false&loop=false&delayms=3000&slide=id.p"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 --field-trial-handle=2008,i,2733582830013525161,16242531286462161692,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

ID:	1431489
Product:	CloudBasic
Start time:	10:06:33
Start date:	25.04.2024
Cookbook:	browseurl.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Windows Analysis Report
https://docs.google.com/presentation/d/e/2PACX-1vRA7cYu2pjKyfaCRROgTu4J2OpPGWE_raEqtGhCVl21QDvJzZsVPQtIU_FG6khcCjqxbwzOTOoBBBx6/pub?start=false&loop=false&delayms=3000&slide=id.p

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report https://docs.google.com/presentation/d/e/2PACX-1vRA7cYu2pjKyfaCRROgTu4J2OpPGWE_raEqtGhCVl21QDvJzZsVPQtIU_FG6khcCjqxbwzOTOoBBBx6/pub?start=false&loop=false&delayms=3000&slide=id.p

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
https://docs.google.com/presentation/d/e/2PACX-1vRA7cYu2pjKyfaCRROgTu4J2OpPGWE_raEqtGhCVl21QDvJzZsVPQtIU_FG6khcCjqxbwzOTOoBBBx6/pub?start=false&loop=false&delayms=3000&slide=id.p