Loading... Additional Content is being loaded

Windows Analysis Report
https://mailc.dps.texas.gov/module/semail.fe?fewReq=:B:JVw4MTIyOHBnc0NhdmttbD8wMiRwZ3NNYGhnYXY/Tm1hY25nJGd6cmtwZ112a29nPzM1MzYzNjQzMzIkYW1mZz81Z2BkZmAzZDQwO2NgZjswMTU1ZGBkYzM3YWZjYTQ2YGYwOzZjYTs2JHJjZWc/Y2F2a3RjdmttbCRrZj9xcC9hcHIsZ29hcUJsbWNjLGVtdCRuY2xlP2dsJHFnYXdwZ11hbWZnP3FwL2Fwcixnb2FxJzYybG1jY

Overview

General Information

Sample URL:	https://mailc.dps.texas.gov/module/semail.fe?fewReq=:B:JVw4MTIyOHBnc0NhdmttbD8wMiRwZ3NNYGhnYXY/Tm1hY25nJGd6cmtwZ112a29nPzM1MzYzNjQzMzIkYW1mZz81Z2BkZmAzZDQwO2NgZjswMTU1ZGBkYzM3YWZjYTQ2YGYwOzZjYTs2JHJjZ
Analysis ID:	1431905

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

HTML body contains low number of good links

HTML body contains password input but no form action

HTML title does not match URL

Stores files to the Windows start menu directory

Classification

Signatures

HTML body contains low number of good links

Source: https://mailc.dps.texas.gov/user/login

HTTP Parser: Number of links: 0

HTML body contains password input but no form action

Source: https://mailc.dps.texas.gov/user/login

HTTP Parser: <input type="password" .../> found but no <form action="...

HTML title does not match URL

Source: https://mailc.dps.texas.gov/user/login

HTTP Parser: Title: does not match URL

Source: https://mailc.dps.texas.gov/user/login

HTTP Parser: <input type="password" .../> found

Source: https://mailc.dps.texas.gov/module/semail.fe?fewReq=:B:JVw4MTIyOHBnc0NhdmttbD8wMiRwZ3NNYGhnYXY/Tm1hY25nJGd6cmtwZ112a29nPzM1MzYzNjQzMzIkYW1mZz81Z2BkZmAzZDQwO2NgZjswMTU1ZGBkYzM3YWZjYTQ2YGYwOzZjYTs2JHJjZWc/Y2F2a3RjdmttbCRrZj9xcC9hcHIsZ29hcUJsbWNjLGVtdCRuY2xlP2dsJHFnYXdwZ11hbWZnP3FwL2Fwcixnb2FxJzYybG1jYyxlbXQnMWM1Z2BkZmAzZDQwO2NgZjswMTU1ZGBkYzM3YWZjYTQ2YGYwOzZjYTs2JzFjMzUzNjM2NDMzMicxY3RncCcxYzAnMWMyMycxYzIzJzFjNTQzZDU1MzM7M2QzZmc6ZzdnMWM0YTU0MDA3Ojc6YGdhOmY6NjU6Mg==&c=E,1,rq5qGkAZhLyex9aXGJRXiwwAVCBBGb9rYT0lMs5k_20Sqz45p0qJgiUApbOJ8yAtxqJ1ztZoyOzLsVT27C4xAyI39WhYljd1P1E5Oi904DAR&typo=1	HTTP Parser: No favicon
Source: https://mailc.dps.texas.gov/user/	HTTP Parser: No favicon
Source: https://mailc.dps.texas.gov/user/login	HTTP Parser: No favicon

Source: https://mailc.dps.texas.gov/user/login

HTTP Parser: No <meta name="author".. found

Source: https://mailc.dps.texas.gov/user/login

HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 23.202.106.101:443 -> 192.168.2.16:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.202.106.101:443 -> 192.168.2.16:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.16:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.16:49731 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.106.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.106.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.106.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.106.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.106.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.106.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.106.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.106.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.106.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.106.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.106.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.106.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.106.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.106.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.106.101
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.106.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.106.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.106.101
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108

Source: global traffic	DNS traffic detected: DNS query: mailc.dps.texas.gov
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704

Source: unknown	HTTPS traffic detected: 23.202.106.101:443 -> 192.168.2.16:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.202.106.101:443 -> 192.168.2.16:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.16:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.16:49731 version: TLS 1.2

Source: classification engine

Classification label: clean2.win@14/20@6/104

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://mailc.dps.texas.gov/module/semail.fe?fewReq=:B:JVw4MTIyOHBnc0NhdmttbD8wMiRwZ3NNYGhnYXY/Tm1hY25nJGd6cmtwZ112a29nPzM1MzYzNjQzMzIkYW1mZz81Z2BkZmAzZDQwO2NgZjswMTU1ZGBkYzM3YWZjYTQ2YGYwOzZjYTs2JHJjZWc/Y2F2a3RjdmttbCRrZj9xcC9hcHIsZ29hcUJsbWNjLGVtdCRuY2xlP2dsJHFnYXdwZ11hbWZnP3FwL2Fwcixnb2FxJzYybG1jYyxlbXQnMWM1Z2BkZmAzZDQwO2NgZjswMTU1ZGBkYzM3YWZjYTQ2YGYwOzZjYTs2JzFjMzUzNjM2NDMzMicxY3RncCcxYzAnMWMyMycxYzIzJzFjNTQzZDU1MzM7M2QzZmc6ZzdnMWM0YTU0MDA3Ojc6YGdhOmY6NjU6Mg==&c=E,1,rq5qGkAZhLyex9aXGJRXiwwAVCBBGb9rYT0lMs5k_20Sqz45p0qJgiUApbOJ8yAtxqJ1ztZoyOzLsVT27C4xAyI39WhYljd1P1E5Oi904DAR&typo=1
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1828,i,12377642797320586305,2005524206607121371,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1828,i,12377642797320586305,2005524206607121371,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
192.178.50.67	unknown	United States		15169	GOOGLEUS	false
1.1.1.1	unknown	Australia		13335	CLOUDFLARENETUS	false
142.250.217.174	unknown	United States		15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved		unknown	unknown	false
172.217.165.195	unknown	United States		15169	GOOGLEUS	false
204.65.230.124	mailc.dps.texas.gov	United States		1761	TDIR-CAPNETUS	false
172.217.2.196	www.google.com	United States		15169	GOOGLEUS	false
74.125.141.84	unknown	United States		15169	GOOGLEUS	false
142.250.64.202	unknown	United States		15169	GOOGLEUS	false
142.250.64.238	unknown	United States		15169	GOOGLEUS	false

Private

IP
192.168.2.16

Contacted Domains

Name	IP	Active
mailc.dps.texas.gov	204.65.230.124	true
www.google.com	172.217.2.196	true

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://mailc.dps.texas.gov/user/	false		high
https://mailc.dps.texas.gov/module/semail.fe?fewReq=:B:JVw4MTIyOHBnc0NhdmttbD8wMiRwZ3NNYGhnYXY/Tm1hY25nJGd6cmtwZ112a29nPzM1MzYzNjQzMzIkYW1mZz81Z2BkZmAzZDQwO2NgZjswMTU1ZGBkYzM3YWZjYTQ2YGYwOzZjYTs2JHJjZWc/Y2F2a3RjdmttbCRrZj9xcC9hcHIsZ29hcUJsbWNjLGVtdCRuY2xlP2dsJHFnYXdwZ11hbWZnP3FwL2Fwcixnb2FxJzYybG1jYyxlbXQnMWM1Z2BkZmAzZDQwO2NgZjswMTU1ZGBkYzM3YWZjYTQ2YGYwOzZjYTs2JzFjMzUzNjM2NDMzMicxY3RncCcxYzAnMWMyMycxYzIzJzFjNTQzZDU1MzM7M2QzZmc6ZzdnMWM0YTU0MDA3Ojc6YGdhOmY6NjU6Mg==&c=E,1,rq5qGkAZhLyex9aXGJRXiwwAVCBBGb9rYT0lMs5k_20Sqz45p0qJgiUApbOJ8yAtxqJ1ztZoyOzLsVT27C4xAyI39WhYljd1P1E5Oi904DAR&typo=1	false		high
https://mailc.dps.texas.gov/user/login	false		high

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 21:14:37 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	61C52E2424CE7E92D1B8F0FB1AFA6518	E3DF9A7CEE055D6F50318C83ED7C1C9CB5CAA314	3E998F4C86C6DD2CB8E94D2F7E0D606680D878436B395CD98957112D7A0A96E4
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 21:14:37 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	A16CE26B3A37EA067BDA30C1A6E696D8	EE627C1F49A590D367E0F11B70C173E0C2EA2E26	E38CF91C96C5E768AE79AEAFC5E528B3B64B56AF860E74DD8E69016F90445415
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	164496AC2A726D377D2DDABB140E5687	85FFABE3362BCDA479EB8206AEB4040347EDA454	55E7DD039AB71BB6AE57040CBF9B519A7C2D9D4DC5BB1D6AA5F57638F12375A6
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 21:14:37 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	5D1540EA5C9B97490F47D6EF55129DA6	0C5C67793840B13750103BC28A61BE5471EBAEC4	B35DB1F2B4B1F0F61AE94B793676BF34AEF96AA56321AED4A0BBDA53B0217859
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 21:14:37 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	2A115A694271B2598922846C5C38C3B7	F7150E9D2D90AB3597AFEE3A03630DDA7769CF1D	F7E0A2B0F5B7AFAACD8435126A5923BABE9E2D4EDF48E28A1EE7021042C44E6D
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 21:14:37 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	B68D00D0D768513391D51E2B508E0434	ECB384ECCA03ED63EA43A05B9859C7A97CAB1EDD	42F644ABBE79D424E1FEF36012553A6E941BB47E38927375E1A2B84FC83C3A17
Chrome Cache Entry: 68	ASCII text, with very long lines (36862), with no line terminators	E0B49584D498DFA05DC2686516AF905D	B132CD4E6DC826CDA4BB684387AF77479747B659	E9B45AD1B6388911CFFAD87036105521EFA976FD343870243859F65269A55CF5
Chrome Cache Entry: 69	ASCII text, with no line terminators	A2432DC721D79CB02E73D270CE7E1EAA	5A3C7BE77E9108ACA1B39E6BCD336EAAE6A51080	CE43C8C02C05A92B3E20FAB138AAD31B9FD54B92848913449D09924E839BB80E
Chrome Cache Entry: 70	HTML document, ASCII text	ED60930759BCED79A926F5704973F1AA	C887CF80614EB82184BCC35E7A171C67F26DEB9F	25A5E53B2485605E7E6C41EE32FDD921CF8EFD5DB6E4D5975FBE4028EDA3CD91
Chrome Cache Entry: 71	ASCII text, with very long lines (65536), with no line terminators	3C9B243F0D9E2BF3BA23CD2B704A7356	B503835119641BAE6029EFB334F08DB4F242BA13	35A67FC17EF97028D0BF19E7FBCD9529C636CF154B1692F061A29763C4B72493
Chrome Cache Entry: 73	ASCII text, with very long lines (2353), with no line terminators	562D383AC12E13D967703FE1F45AADFC	3B440686D15B6A455F27C0EF37B405EC319EAEA8	90704EF73ABAD7BA0DF66A8AFB07C5F5C59988F5DD3F04C5E6FF27A8D3552724
Chrome Cache Entry: 74	ASCII text, with very long lines (65536), with no line terminators	0852F4FC2CB510C8D56C9B9EC8C34C7F	E9C78096C1166421385E93787999F0149E75EB3B	F3341A53A2B42BBAB6D4165BEB379A65C2B5F560A5F52E28E21FB8A2B702201C
Chrome Cache Entry: 75	MS Windows icon resource - 1 icon, 16x16, 16 colors	E462005902F81094AB3DE44E4381DE19	684D6A3783A92305592C4211412AD0E17D402195	D18B3C9FEB76C3C1CFDCC51C732F113327E3C33FB3F63B479951F7DA6ED1216F
Chrome Cache Entry: 76	ASCII text	E7E49A2E8C5A4CAFC9B677974AB0E7F9	ACA26F58D72EDD5FE14AD71E94E22C161060B47F	486E5EB6C2E6EB19871E68826D364998B0C9D86ABBCF4C35C64A5578BC3A550D
Chrome Cache Entry: 77	Web Open Font Format (Version 2), TrueType, length 27892, version 1.6816	F7FF2A6FF8699952646B5592DE084DFA	A63534A9FE94054BCFA4E96457871452AD9AB44D	2EE055921E5460E768980DA0E441063D23F4320EA15E232A4F77FFCBE5B4F74F
Chrome Cache Entry: 79	HTML document, ASCII text	6FC75309B3276186B5BAD3E9B58E09E4	F9910498ADF752B6F6FE0BF21FB1BAAF221286F9	DAEFCFA5B8FC9DB5CE8DEF0A26F07529DC39294735AFC5BC599D5DEE8AB38FDA
Chrome Cache Entry: 80	XML 1.0 document, ASCII text	3557F3BFDFDC1874AEA4C054FC65BD96	2A75675DAEBED5D434D6848719293F52093E3332	C4AF93D595A388EABA40099EC7B9A7F265F81945110793BA71C415A9C611FC10
Chrome Cache Entry: 81	ASCII text, with very long lines (65536), with no line terminators	49D37978044D00C9C3E6325FED7A82F9	69A8262B12D4339E9DB06677F5A976F344F495AC	3209118E5404DF800ED7512DC55E65FC814278FDFE94FB73FCC2E74F21017840
Chrome Cache Entry: 82	HTML document, ASCII text	01E827C1354A76896F62450476D29900	1C5D9DF21D59754A6A756C0847EEEBF9EA0B561C	7AD293D2A3998414908958B5DE29E8E6F096A3F4F541D862E6F6371BBDFDB867
Chrome Cache Entry: 83	JSON data	6C328D5D90EC293B60AA0E31265840A2	F399C0AD53E7BF29BB17163F15F480812FD0F75C	83AEB217E8E3FF429D35270307A15E79F1C29A8BA7A8EB12F89B071272C04DE4

HTML body contains low number of good links

Source: https://mailc.dps.texas.gov/user/login

HTTP Parser: Number of links: 0

HTML body contains password input but no form action

Source: https://mailc.dps.texas.gov/user/login

HTTP Parser: <input type="password" .../> found but no <form action="...

HTML title does not match URL

Source: https://mailc.dps.texas.gov/user/login

HTTP Parser: Title: does not match URL

Source: https://mailc.dps.texas.gov/user/login

HTTP Parser: <input type="password" .../> found

Source: https://mailc.dps.texas.gov/module/semail.fe?fewReq=:B:JVw4MTIyOHBnc0NhdmttbD8wMiRwZ3NNYGhnYXY/Tm1hY25nJGd6cmtwZ112a29nPzM1MzYzNjQzMzIkYW1mZz81Z2BkZmAzZDQwO2NgZjswMTU1ZGBkYzM3YWZjYTQ2YGYwOzZjYTs2JHJjZWc/Y2F2a3RjdmttbCRrZj9xcC9hcHIsZ29hcUJsbWNjLGVtdCRuY2xlP2dsJHFnYXdwZ11hbWZnP3FwL2Fwcixnb2FxJzYybG1jYyxlbXQnMWM1Z2BkZmAzZDQwO2NgZjswMTU1ZGBkYzM3YWZjYTQ2YGYwOzZjYTs2JzFjMzUzNjM2NDMzMicxY3RncCcxYzAnMWMyMycxYzIzJzFjNTQzZDU1MzM7M2QzZmc6ZzdnMWM0YTU0MDA3Ojc6YGdhOmY6NjU6Mg==&c=E,1,rq5qGkAZhLyex9aXGJRXiwwAVCBBGb9rYT0lMs5k_20Sqz45p0qJgiUApbOJ8yAtxqJ1ztZoyOzLsVT27C4xAyI39WhYljd1P1E5Oi904DAR&typo=1	HTTP Parser: No favicon
Source: https://mailc.dps.texas.gov/user/	HTTP Parser: No favicon
Source: https://mailc.dps.texas.gov/user/login	HTTP Parser: No favicon

Source: https://mailc.dps.texas.gov/user/login

HTTP Parser: No <meta name="author".. found

Source: https://mailc.dps.texas.gov/user/login

HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 23.202.106.101:443 -> 192.168.2.16:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.202.106.101:443 -> 192.168.2.16:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.16:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.16:49731 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.106.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.106.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.106.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.106.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.106.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.106.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.106.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.106.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.106.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.106.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.106.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.106.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.106.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.106.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.106.101
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.106.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.106.101
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.106.101
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108

Source: global traffic	DNS traffic detected: DNS query: mailc.dps.texas.gov
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704

Source: unknown	HTTPS traffic detected: 23.202.106.101:443 -> 192.168.2.16:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.202.106.101:443 -> 192.168.2.16:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.16:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.16:49731 version: TLS 1.2

Source: classification engine

Classification label: clean2.win@14/20@6/104

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://mailc.dps.texas.gov/module/semail.fe?fewReq=:B:JVw4MTIyOHBnc0NhdmttbD8wMiRwZ3NNYGhnYXY/Tm1hY25nJGd6cmtwZ112a29nPzM1MzYzNjQzMzIkYW1mZz81Z2BkZmAzZDQwO2NgZjswMTU1ZGBkYzM3YWZjYTQ2YGYwOzZjYTs2JHJjZWc/Y2F2a3RjdmttbCRrZj9xcC9hcHIsZ29hcUJsbWNjLGVtdCRuY2xlP2dsJHFnYXdwZ11hbWZnP3FwL2Fwcixnb2FxJzYybG1jYyxlbXQnMWM1Z2BkZmAzZDQwO2NgZjswMTU1ZGBkYzM3YWZjYTQ2YGYwOzZjYTs2JzFjMzUzNjM2NDMzMicxY3RncCcxYzAnMWMyMycxYzIzJzFjNTQzZDU1MzM7M2QzZmc6ZzdnMWM0YTU0MDA3Ojc6YGdhOmY6NjU6Mg==&c=E,1,rq5qGkAZhLyex9aXGJRXiwwAVCBBGb9rYT0lMs5k_20Sqz45p0qJgiUApbOJ8yAtxqJ1ztZoyOzLsVT27C4xAyI39WhYljd1P1E5Oi904DAR&typo=1
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1828,i,12377642797320586305,2005524206607121371,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1828,i,12377642797320586305,2005524206607121371,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk