Analysis Report Fax_Doc#01_5.html

Overview

General Information

Sample Name: Fax_Doc#01_5.html
Analysis ID: 432882
MD5: 0e73957b74aa54a969a21c7ab6710515
SHA1: c1456fda553cd4023654729634a60816ed52212a
SHA256: ecc2656e7f58af1c48ebc553c0f648d4981c7757454657113f4c812958de0588
Infos:

Most interesting Screenshot:

Detection

HTMLPhisher
Score: 88
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Phishing site detected (based on favicon image match)
Yara detected HtmlPhish10
Yara detected HtmlPhish3
Yara detected Phisher
Phishing site detected (based on image similarity)
Phishing site detected (based on logo template match)
HTML body contains low number of good links
HTML title does not match URL
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware

Classification

AV Detection:

barindex
Antivirus detection for URL or domain
Source: https://etrafficsolution.com/cdm/0ffice/onclqt97wz5rs6x3ji8pvk1aueh0f4gbd2my7vwaf5icskeoh9qjpr36u4dz8t1mgnyxl02b39zs2b1qgmr64phwknli7atdj0vfx8ceyu5o?data=Y2FsaUBubS1yZWFsdHkuY29t SlashNext: Label: Fake Login Page type: Phishing & Social Engineering

Phishing:

barindex
Phishing site detected (based on favicon image match)
Source: https://etrafficsolution.com/cdm/0ffice/onclqt97wz5rs6x3ji8pvk1aueh0f4gbd2my7vwaf5icskeoh9qjpr36u4dz8t1mgnyxl02b39zs2b1qgmr64phwknli7atdj0vfx8ceyu5o?data=Y2FsaUBubS1yZWFsdHkuY29t Matcher: Template: microsoft matched with high similarity
Yara detected HtmlPhish10
Source: Yara match File source: 21604.pages.csv, type: HTML
Yara detected HtmlPhish3
Source: Yara match File source: 21604.pages.csv, type: HTML
Yara detected Phisher
Source: Yara match File source: Fax_Doc#01_5.html, type: SAMPLE
Phishing site detected (based on image similarity)
Source: https://etrafficsolution.com/cdm/0ffice/onclqt97wz5rs6x3ji8pvk1aueh0f4gbd2my7vwaf5icskeoh9qjpr36u4dz8t1mgnyxl02b39zs2b1qgmr64phwknli7atdj0vfx8ceyu5o?data=Y2FsaUBubS1yZWFsdHkuY29t Matcher: Found strong image similarity, brand: Microsoft image: 21604.img.1.gfk.csv EE5C8D9FB6248C938FD0DC19370E90BD
Phishing site detected (based on logo template match)
Source: https://etrafficsolution.com/cdm/0ffice/onclqt97wz5rs6x3ji8pvk1aueh0f4gbd2my7vwaf5icskeoh9qjpr36u4dz8t1mgnyxl02b39zs2b1qgmr64phwknli7atdj0vfx8ceyu5o?data=Y2FsaUBubS1yZWFsdHkuY29t Matcher: Template: microsoft matched
HTML body contains low number of good links
Source: https://etrafficsolution.com/cdm/0ffice/onclqt97wz5rs6x3ji8pvk1aueh0f4gbd2my7vwaf5icskeoh9qjpr36u4dz8t1mgnyxl02b39zs2b1qgmr64phwknli7atdj0vfx8ceyu5o?data=Y2FsaUBubS1yZWFsdHkuY29t HTTP Parser: Number of links: 0
Source: https://etrafficsolution.com/cdm/0ffice/onclqt97wz5rs6x3ji8pvk1aueh0f4gbd2my7vwaf5icskeoh9qjpr36u4dz8t1mgnyxl02b39zs2b1qgmr64phwknli7atdj0vfx8ceyu5o?data=Y2FsaUBubS1yZWFsdHkuY29t HTTP Parser: Number of links: 0
HTML title does not match URL
Source: https://etrafficsolution.com/cdm/0ffice/onclqt97wz5rs6x3ji8pvk1aueh0f4gbd2my7vwaf5icskeoh9qjpr36u4dz8t1mgnyxl02b39zs2b1qgmr64phwknli7atdj0vfx8ceyu5o?data=Y2FsaUBubS1yZWFsdHkuY29t HTTP Parser: Title: confirm your login does not match URL
Source: https://etrafficsolution.com/cdm/0ffice/onclqt97wz5rs6x3ji8pvk1aueh0f4gbd2my7vwaf5icskeoh9qjpr36u4dz8t1mgnyxl02b39zs2b1qgmr64phwknli7atdj0vfx8ceyu5o?data=Y2FsaUBubS1yZWFsdHkuY29t HTTP Parser: Title: confirm your login does not match URL
Source: https://etrafficsolution.com/cdm/0ffice/onclqt97wz5rs6x3ji8pvk1aueh0f4gbd2my7vwaf5icskeoh9qjpr36u4dz8t1mgnyxl02b39zs2b1qgmr64phwknli7atdj0vfx8ceyu5o?data=Y2FsaUBubS1yZWFsdHkuY29t HTTP Parser: No <meta name="author".. found
Source: https://etrafficsolution.com/cdm/0ffice/onclqt97wz5rs6x3ji8pvk1aueh0f4gbd2my7vwaf5icskeoh9qjpr36u4dz8t1mgnyxl02b39zs2b1qgmr64phwknli7atdj0vfx8ceyu5o?data=Y2FsaUBubS1yZWFsdHkuY29t HTTP Parser: No <meta name="author".. found
Source: https://etrafficsolution.com/cdm/0ffice/onclqt97wz5rs6x3ji8pvk1aueh0f4gbd2my7vwaf5icskeoh9qjpr36u4dz8t1mgnyxl02b39zs2b1qgmr64phwknli7atdj0vfx8ceyu5o?data=Y2FsaUBubS1yZWFsdHkuY29t HTTP Parser: No <meta name="copyright".. found
Source: https://etrafficsolution.com/cdm/0ffice/onclqt97wz5rs6x3ji8pvk1aueh0f4gbd2my7vwaf5icskeoh9qjpr36u4dz8t1mgnyxl02b39zs2b1qgmr64phwknli7atdj0vfx8ceyu5o?data=Y2FsaUBubS1yZWFsdHkuY29t HTTP Parser: No <meta name="copyright".. found
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Local\Temp\5856_493172788\LICENSE.txt Jump to behavior
Source: unknown HTTPS traffic detected: 162.241.7.171:443 -> 192.168.2.3:49748 version: TLS 1.2
Source: unknown HTTPS traffic detected: 162.241.7.171:443 -> 192.168.2.3:49749 version: TLS 1.2

Networking:

barindex
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 239.255.255.250 239.255.255.250
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
Source: Ruleset Data.0.dr String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: Ruleset Data.0.dr String found in binary or memory: www.facebook.com/ajax/ads/ equals www.facebook.com (Facebook)
Source: unknown DNS traffic detected: queries for: quantlab.sutherlandresearch.com
Source: 77EC63BDA74BD0D0E0426DC8F8008506.1.dr String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: b3316109-df59-433c-b3d0-81ed1dc0d086.tmp.1.dr, manifest.json0.0.dr, 729f9522-9f32-48c4-a3da-98fa5f8a891a.tmp.1.dr String found in binary or memory: https://accounts.google.com
Source: b3316109-df59-433c-b3d0-81ed1dc0d086.tmp.1.dr, manifest.json0.0.dr, 729f9522-9f32-48c4-a3da-98fa5f8a891a.tmp.1.dr String found in binary or memory: https://apis.google.com
Source: b3316109-df59-433c-b3d0-81ed1dc0d086.tmp.1.dr, 729f9522-9f32-48c4-a3da-98fa5f8a891a.tmp.1.dr String found in binary or memory: https://clients2.google.com
Source: manifest.json0.0.dr String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: b3316109-df59-433c-b3d0-81ed1dc0d086.tmp.1.dr, 729f9522-9f32-48c4-a3da-98fa5f8a891a.tmp.1.dr String found in binary or memory: https://clients2.googleusercontent.com
Source: manifest.json0.0.dr String found in binary or memory: https://content.googleapis.com
Source: Reporting and NEL.1.dr String found in binary or memory: https://csp.withgoogle.com/csp/report-to/IdentityListAccountsHttp/external
Source: b3316109-df59-433c-b3d0-81ed1dc0d086.tmp.1.dr, 729f9522-9f32-48c4-a3da-98fa5f8a891a.tmp.1.dr, b9227181-1a84-46fd-9bd9-5855d3519a29.tmp.1.dr, 650fd7f0-0481-4e99-bacf-87408dcaf3e0.tmp.1.dr String found in binary or memory: https://dns.google
Source: Favicons.0.dr String found in binary or memory: https://etrafficsolution.com/cdm/0ffice/Y2FsaUBubS1yZWFsdHkuY29t
Source: Favicons.0.dr String found in binary or memory: https://etrafficsolution.com/cdm/0ffice/Y2FsaUBubS1yZWFsdHkuY29t6
Source: History.0.dr String found in binary or memory: https://etrafficsolution.com/cdm/0ffice/Y2FsaUBubS1yZWFsdHkuY29tconfirm
Source: Favicons.0.dr String found in binary or memory: https://etrafficsolution.com/cdm/0ffice/images/favicon.ico
Source: History.0.dr String found in binary or memory: https://etrafficsolution.com/cdm/0ffice/onclqt97wz5rs6x3ji8pvk1aueh0f4gbd2my7vwaf5icskeoh9qjpr36u4dz
Source: manifest.json0.0.dr String found in binary or memory: https://feedback.googleusercontent.com
Source: b3316109-df59-433c-b3d0-81ed1dc0d086.tmp.1.dr String found in binary or memory: https://fonts.googleapis.com
Source: manifest.json0.0.dr String found in binary or memory: https://fonts.googleapis.com;
Source: b3316109-df59-433c-b3d0-81ed1dc0d086.tmp.1.dr, 729f9522-9f32-48c4-a3da-98fa5f8a891a.tmp.1.dr String found in binary or memory: https://fonts.gstatic.com
Source: manifest.json0.0.dr String found in binary or memory: https://fonts.gstatic.com;
Source: manifest.json0.0.dr String found in binary or memory: https://hangouts.google.com/
Source: b3316109-df59-433c-b3d0-81ed1dc0d086.tmp.1.dr, 729f9522-9f32-48c4-a3da-98fa5f8a891a.tmp.1.dr String found in binary or memory: https://ogs.google.com
Source: manifest.json.0.dr String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: b3316109-df59-433c-b3d0-81ed1dc0d086.tmp.1.dr, 729f9522-9f32-48c4-a3da-98fa5f8a891a.tmp.1.dr String found in binary or memory: https://play.google.com
Source: Current Session.0.dr String found in binary or memory: https://quantlab.sutherlandresearch.com
Source: History.0.dr String found in binary or memory: https://quantlab.sutherlandresearch.com/cgdin/v4/cali
Source: 729f9522-9f32-48c4-a3da-98fa5f8a891a.tmp.1.dr String found in binary or memory: https://r8---sn-n02xgoxufvg3-2gbl.gvt1.com
Source: 729f9522-9f32-48c4-a3da-98fa5f8a891a.tmp.1.dr String found in binary or memory: https://redirector.gvt1.com
Source: manifest.json.0.dr String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: b3316109-df59-433c-b3d0-81ed1dc0d086.tmp.1.dr, 729f9522-9f32-48c4-a3da-98fa5f8a891a.tmp.1.dr String found in binary or memory: https://ssl.gstatic.com
Source: messages.json41.0.dr String found in binary or memory: https://support.google.com/chromecast/answer/2998456
Source: messages.json41.0.dr String found in binary or memory: https://support.google.com/chromecast/troubleshooter/2995236
Source: b3316109-df59-433c-b3d0-81ed1dc0d086.tmp.1.dr, manifest.json0.0.dr, 729f9522-9f32-48c4-a3da-98fa5f8a891a.tmp.1.dr String found in binary or memory: https://www.google.com
Source: manifest.json.0.dr String found in binary or memory: https://www.google.com/
Source: manifest.json0.0.dr String found in binary or memory: https://www.google.com;
Source: b3316109-df59-433c-b3d0-81ed1dc0d086.tmp.1.dr, 729f9522-9f32-48c4-a3da-98fa5f8a891a.tmp.1.dr String found in binary or memory: https://www.googleapis.com
Source: manifest.json.0.dr String found in binary or memory: https://www.googleapis.com/
Source: manifest.json0.0.dr String found in binary or memory: https://www.googleapis.com/auth/calendar.readonly
Source: manifest.json0.0.dr String found in binary or memory: https://www.googleapis.com/auth/cast-edu-messaging
Source: manifest.json.0.dr String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json.0.dr String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json0.0.dr String found in binary or memory: https://www.googleapis.com/auth/clouddevices
Source: manifest.json0.0.dr String found in binary or memory: https://www.googleapis.com/auth/hangouts
Source: manifest.json0.0.dr String found in binary or memory: https://www.googleapis.com/auth/hangouts.readonly
Source: manifest.json0.0.dr String found in binary or memory: https://www.googleapis.com/auth/meetings
Source: manifest.json0.0.dr String found in binary or memory: https://www.googleapis.com/auth/plus.peopleapi.readwrite
Source: manifest.json.0.dr String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json.0.dr String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: manifest.json0.0.dr String found in binary or memory: https://www.googleapis.com/auth/userinfo.email
Source: b3316109-df59-433c-b3d0-81ed1dc0d086.tmp.1.dr, 729f9522-9f32-48c4-a3da-98fa5f8a891a.tmp.1.dr String found in binary or memory: https://www.gstatic.com
Source: manifest.json0.0.dr String found in binary or memory: https://www.gstatic.com;
Source: unknown Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown HTTPS traffic detected: 162.241.7.171:443 -> 192.168.2.3:49748 version: TLS 1.2
Source: unknown HTTPS traffic detected: 162.241.7.171:443 -> 192.168.2.3:49749 version: TLS 1.2
Source: classification engine Classification label: mal88.phis.winHTML@36/183@6/6
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Program Files\Google\Chrome\Application\Dictionaries Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-60C2E98C-16E0.pma Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Local\Temp\c36e5fdc-b716-4885-8177-214453b337fc.tmp Jump to behavior
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --start-maximized --enable-automation 'C:\Users\user\Desktop\Fax_Doc#01_5.html'
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1600,13519744996372922803,2498414373330437516,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1708 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1600,13519744996372922803,2498414373330437516,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1708 /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Automated click: Confirm
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Automated click: Confirm
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Automated click: Confirm
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Automated click: Confirm
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Automated click: Confirm
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Automated click: Confirm
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Automated click: Confirm
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Automated click: Confirm
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Automated click: Confirm
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Automated click: Confirm
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Automated click: Confirm
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Automated click: Confirm
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Automated click: Confirm
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Automated click: Confirm
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Automated click: Confirm
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Local\Temp\5856_493172788\LICENSE.txt Jump to behavior
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs