Windows Analysis Report Jrsuarez-62643-5799-80-950985.HTM

AV Detection:

Antivirus detection for URL or domain

Source: https://page102.com/wp-admins/voice/audio/nhjz37ogtbyf0avkmp4sxri56w89qdl1ue2cgj026rilfkuxtq5hc1eosapd9m4wbv3zn7y8satg0jhw9cy1kox53linbd2rzqfu76m8p4ev?data=anJzdWFyZXpAaW5nZW5pYWdsb2JhbC5jbA==

SlashNext: Label: Fake Login Page type: Phishing & Social usering

Phishing:

Phishing site detected (based on favicon image match)

Source: https://page102.com/wp-admins/voice/audio/nhjz37ogtbyf0avkmp4sxri56w89qdl1ue2cgj026rilfkuxtq5hc1eosapd9m4wbv3zn7y8satg0jhw9cy1kox53linbd2rzqfu76m8p4ev?data=anJzdWFyZXpAaW5nZW5pYWdsb2JhbC5jbA==

Matcher: Template: microsoft matched with high similarity

Yara detected HtmlPhish10

Source: Yara match

File source: 84161.0.pages.csv, type: HTML

Yara detected Phisher

Source: Yara match

File source: Jrsuarez-62643-5799-80-950985.HTM, type: SAMPLE

Yara detected HtmlPhish3

Source: Yara match

File source: 84161.0.pages.csv, type: HTML

Compliance:

Creates license or readme file

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Temp\4568_306783134\LICENSE.txt

Jump to behavior

Creates a directory in C:\Program Files

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic			Jump to behavior

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 54.230.206.106:443 -> 192.168.2.6:49789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 69.49.234.122:443 -> 192.168.2.6:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 69.49.234.122:443 -> 192.168.2.6:49788 version: TLS 1.2

Networking:

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 239.255.255.250 239.255.255.250

Uses HTTPS

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49682 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49682
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49690 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49678
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789

Connects to IPs without corresponding DNS lookups

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 104.127.115.201
Source: unknown	TCP traffic detected without corresponding DNS query: 104.127.115.201
Source: unknown	TCP traffic detected without corresponding DNS query: 104.127.115.201
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 95.100.218.151
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.132
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.132
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.132
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.132
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.132
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.132
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.132
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.132
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.132
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.132
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.132
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.132
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.132
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.132
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.132
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.132
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.132
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.132
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.132
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.132
Source: unknown	TCP traffic detected without corresponding DNS query: 2.20.178.10
Source: unknown	TCP traffic detected without corresponding DNS query: 2.20.178.10
Source: unknown	TCP traffic detected without corresponding DNS query: 2.20.178.10
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.132
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.132
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.132
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.132
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.132
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.132
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.132
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.132
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.132

Found strings which match to known social media urls

Source: Filtering Rules.0.dr	String found in binary or memory: www.facebook.com/ajax/ads/ equals www.facebook.com (Facebook)
Source: Filtering Rules.0.dr	String found in binary or memory: www.facebook.com0 equals www.facebook.com (Facebook)

URLs found in memory or binary data

Source: pnacl_public_x86_64_pnacl_sz_nexe.0.dr	String found in binary or memory: http://llvm.org/):
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: http://tools.ietf.org/html/rfc1950
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01
Source: d21130df-af4c-4b7a-bf19-d7b4a08df9dc.tmp.1.dr, manifest.json3.0.dr	String found in binary or memory: https://accounts.google.com
Source: craw_window.js.0.dr	String found in binary or memory: https://accounts.google.com/MergeSession
Source: d21130df-af4c-4b7a-bf19-d7b4a08df9dc.tmp.1.dr, manifest.json3.0.dr	String found in binary or memory: https://apis.google.com
Source: pnacl_public_x86_64_libgcc_a.0.dr, pnacl_public_x86_64_crtend_o.0.dr	String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-clang.git
Source: pnacl_public_x86_64_libgcc_a.0.dr, pnacl_public_x86_64_crtend_o.0.dr	String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-llvm.git
Source: d21130df-af4c-4b7a-bf19-d7b4a08df9dc.tmp.1.dr	String found in binary or memory: https://clients2.google.com
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://clients2.google.com/cr/report
Source: manifest.json0.0.dr, manifest.json3.0.dr, manifest.json4.0.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: d21130df-af4c-4b7a-bf19-d7b4a08df9dc.tmp.1.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://clients6.google.com
Source: manifest.json3.0.dr	String found in binary or memory: https://content.googleapis.com
Source: LICENSE.txt.0.dr	String found in binary or memory: https://creativecommons.org/.
Source: LICENSE.txt.0.dr	String found in binary or memory: https://creativecommons.org/compatiblelicenses
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://creativecommons.org/publicdomain/zero/1.0/.
Source: Reporting and NEL.1.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/IdentityListAccountsHttp/external
Source: d21130df-af4c-4b7a-bf19-d7b4a08df9dc.tmp.1.dr, 98245724-4f3a-424a-8e55-44d009976c5d.tmp.1.dr	String found in binary or memory: https://dns.google
Source: LICENSE.txt.0.dr	String found in binary or memory: https://easylist.to/)
Source: manifest.json3.0.dr	String found in binary or memory: https://feedback.googleusercontent.com
Source: d21130df-af4c-4b7a-bf19-d7b4a08df9dc.tmp.1.dr	String found in binary or memory: https://fonts.googleapis.com
Source: manifest.json3.0.dr	String found in binary or memory: https://fonts.googleapis.com;
Source: d21130df-af4c-4b7a-bf19-d7b4a08df9dc.tmp.1.dr	String found in binary or memory: https://fonts.gstatic.com
Source: manifest.json3.0.dr	String found in binary or memory: https://fonts.gstatic.com;
Source: material_css_min.css.0.dr	String found in binary or memory: https://github.com/angular/material
Source: LICENSE.txt.0.dr	String found in binary or memory: https://github.com/easylist)
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://github.com/madler/zlib/blob/master/zlib.h
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://hangouts.clients6.google.com
Source: manifest.json3.0.dr	String found in binary or memory: https://hangouts.google.com/
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://hangouts.google.com/hangouts/_/logpref
Source: data_1.1.dr	String found in binary or memory: https://logo.clearbit.com/ingeniaglobal.cl
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://meetings.clients6.google.com
Source: Jrsuarez-62643-5799-80-950985.HTM, data_1.1.dr	String found in binary or memory: https://nevadaediblestogo.com/login/anJzdWFyZXpAaW5nZW5pYWdsb2JhbC5jbA==
Source: d21130df-af4c-4b7a-bf19-d7b4a08df9dc.tmp.1.dr	String found in binary or memory: https://ogs.google.com
Source: data_2.1.dr	String found in binary or memory: https://page102.com/wp-admins/voice/audio/anJzdWFyZXpAaW5nZW5pYWdsb2JhbC5jbA==
Source: data_2.1.dr	String found in binary or memory: https://page102.com/wp-admins/voice/audio/anJzdWFyZXpAaW5nZW5pYWdsb2JhbC5jbA==Content-Length:
Source: data_1.1.dr	String found in binary or memory: https://page102.com/wp-admins/voice/audio/css/conv.css
Source: data_1.1.dr	String found in binary or memory: https://page102.com/wp-admins/voice/audio/images/arrow_left.svg
Source: data_1.1.dr	String found in binary or memory: https://page102.com/wp-admins/voice/audio/images/ellipsis_grey.svg
Source: data_1.1.dr	String found in binary or memory: https://page102.com/wp-admins/voice/audio/images/ellipsis_grey.svgT
Source: data_1.1.dr	String found in binary or memory: https://page102.com/wp-admins/voice/audio/images/ellipsis_white.svg
Source: data_1.1.dr	String found in binary or memory: https://page102.com/wp-admins/voice/audio/images/ellipsis_white.svgMZ
Source: data_1.1.dr	String found in binary or memory: https://page102.com/wp-admins/voice/audio/images/enterpass.png
Source: data_1.1.dr	String found in binary or memory: https://page102.com/wp-admins/voice/audio/images/favicon.ico
Source: data_1.1.dr	String found in binary or memory: https://page102.com/wp-admins/voice/audio/images/forgetpass.png
Source: data_1.1.dr	String found in binary or memory: https://page102.com/wp-admins/voice/audio/images/inv-big-background.jpg
Source: data_1.1.dr	String found in binary or memory: https://page102.com/wp-admins/voice/audio/images/inv-small-background.jpg
Source: data_1.1.dr	String found in binary or memory: https://page102.com/wp-admins/voice/audio/images/passwrd.png
Source: data_1.1.dr	String found in binary or memory: https://page102.com/wp-admins/voice/audio/images/sigin.png
Source: Current Session.0.dr	String found in binary or memory: https://page102.com/wp-admins/voice/audio/nhjz37ogtbyf0avkmp4sxri56w89qdl1ue2cgj026rilfkuxtq5hc1eosa
Source: craw_window.js.0.dr	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://preprod-hangouts-googleapis.sandbox.google.com
Source: data_1.1.dr	String found in binary or memory: https://r4---sn-h0jeln7l.gvt1.com/edgedl/chrome/dict/en-us-9-0.bdic?cms_redirect=yes&mh=I2&mip=102.1
Source: data_1.1.dr	String found in binary or memory: https://redirector.gvt1.com/edgedl/chrome/dict/en-us-9-0.bdic
Source: craw_window.js.0.dr	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: d21130df-af4c-4b7a-bf19-d7b4a08df9dc.tmp.1.dr	String found in binary or memory: https://ssl.gstatic.com
Source: messages.json106.0.dr, feedback.html.0.dr	String found in binary or memory: https://support.google.com/chromecast/answer/2998456
Source: messages.json106.0.dr, feedback.html.0.dr	String found in binary or memory: https://support.google.com/chromecast/troubleshooter/2995236
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://www-googleapis-staging.sandbox.google.com
Source: d21130df-af4c-4b7a-bf19-d7b4a08df9dc.tmp.1.dr, manifest.json3.0.dr	String found in binary or memory: https://www.google.com
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/accounts/OAuthLogin?issueuberauth=1
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/cleardot.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/dot2.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/x2.gif
Source: craw_background.js.0.dr	String found in binary or memory: https://www.google.com/intl/en-US/chrome/blank.html
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://www.google.com/log?format=json&hasfast=true
Source: manifest.json3.0.dr	String found in binary or memory: https://www.google.com;
Source: d21130df-af4c-4b7a-bf19-d7b4a08df9dc.tmp.1.dr, craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://www.googleapis.com
Source: manifest.json3.0.dr	String found in binary or memory: https://www.googleapis.com/auth/calendar.readonly
Source: manifest.json3.0.dr	String found in binary or memory: https://www.googleapis.com/auth/cast-edu-messaging
Source: manifest.json3.0.dr	String found in binary or memory: https://www.googleapis.com/auth/clouddevices
Source: manifest.json3.0.dr	String found in binary or memory: https://www.googleapis.com/auth/hangouts
Source: manifest.json3.0.dr	String found in binary or memory: https://www.googleapis.com/auth/hangouts.readonly
Source: manifest.json3.0.dr	String found in binary or memory: https://www.googleapis.com/auth/meetings
Source: manifest.json3.0.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.peopleapi.readwrite
Source: manifest.json3.0.dr	String found in binary or memory: https://www.googleapis.com/auth/userinfo.email
Source: d21130df-af4c-4b7a-bf19-d7b4a08df9dc.tmp.1.dr	String found in binary or memory: https://www.gstatic.com
Source: manifest.json3.0.dr	String found in binary or memory: https://www.gstatic.com;

Posts data to webserver

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.27716.00; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4740Host: login.live.com

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: clients2.google.com

Downloads files from webservers via HTTP

Source: global traffic	HTTP traffic detected: GET /client/config?cc=US&setlang=en-US HTTP/1.1X-Search-CortanaAvailableCapabilities: CortanaExperience,SpeechLanguageX-Search-SafeSearch: ModerateAccept-Encoding: gzip, deflateX-Device-MachineId: {A2AB526A-D38D-4FC9-8BA0-E34B8D6354E8}X-UserAgeClass: UnknownX-BM-Market: USX-BM-DateFormat: M/d/yyyyX-CortanaAccessAboveLock: falseX-Device-OSSKU: 48X-BM-DTZ: -420X-BM-FirstEnabledTime: 132061387448759736X-DeviceID: 0100748C09001CEAX-Search-TimeZone: Bias=480; DaylightBias=-60; TimeZoneKeyName=Pacific Standard TimeX-BM-Theme: 000000;0078d7X-Search-RPSToken: t%3DEwDgAkR8BAAUW3WS0TDKGu2jEbBhB%2BXls4oNzBQAAadjnVI5cBcuI5Sb0vb/yQhRF2/dwVP9gLAUtsUMsEtAbj4TYJsxv5TtuX8yCxqvSYscFYINqBUPN4cIIv7H0sVCuiKDMgDIuPTNxO4sZPGjw0hnW8iuvaNej6RFYyvs1J6WHIKqwfyywn7/tI4HrVRT8Cw9lv2/A7fokyjwWMIxxMI0%2BPfOqtVuhX5Dy%2BFN%2B5Ox3Uc5HLcX%2B%2BrKKxGAnyoMP1rGRReuxQ7k4dNIaFxEyTGPZWb5ewqhYpwE5PnddJaStJy7I4PNrWGFatXSc1k3wc3DWJq9Cz1EajxZryfYjqqna55e3RTGJTBQ8%2Bh46ModYg13YP4M/c9hARKEHpcDZgAACKSbleF1VUPAsAExH6Vwe%2BiVFSqwx3odCBpIEvch5QEs4B0ZVFAn4Daht47AbKVRkEcY4YzunZO2s7UvNHYOHQY7qj6QSdN2cqTaTNtX/clETJaW2mRphSlmFaTNIz2T5YZKyaPjPy6NAtr5lzWegzjSM4vWpiQRh5KXr3P0uan3sUnkjnzxByKr5PRp4tJsVd9/nyUpUkyzlKobQneNYu9iDqyuGf2NYJ3waX5Oz1nHe4mq6BqQ6BS2NGZyYoWMc1H7tBpxOOSijQ1baKK/qX58jctLjHUVjul/s/dHoO%2B8p5p2HJtRVl3HUXlYVTAlQQDDA9apPdfkKVvoNS4VeuZoJunuvUiR%2BDVRPWFK8ezW0x24c5lwQgqFcfud96FCv0CXOubFVLztENp7e0r1XOTIWI0bIJbUwI7jIVGl1NLtT1g8D2cFkE8WbFieJgHNHSJnPPbb7Fm11Gflv%2BBRs/dSnGwZ1F6Lhw3/rCtqGDRURtiSdhaslV0Naxrzn/b/xxXtXDmZuYP015lo8WRLQYqL1s4AT36oi3uvLFIGyKL3svW36XLV4ts6xYSu8o2v%2Bw4ssR8XgFMU5jfYAQ%3D%3D%26p%3DX-Agent-DeviceId: 0100748C09001CEAX-BM-CBT: 1634173701User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.10.7.17134; 10.0.0.0.17134.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134X-Device-isOptin: trueAccept-language: en-US, enX-Device-Touch: falseX-Device-ClientSession: 591C58A4C27045438842E2ED2455F4E6X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-BM-ClientFeatures: pbitcpdisabled,AmbientWidescreen,rs1musicprod,CortanaSPAXamlHeaderHost: www.bing.comConnection: Keep-AliveCookie: MUID=54AD14FB4D1E4A6C815A867991009454
Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfmX-Goog-Update-Updater: chromecrx-85.0.4183.121Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /login/anJzdWFyZXpAaW5nZW5pYWdsb2JhbC5jbA== HTTP/1.1Host: nevadaediblestogo.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-admins/voice/audio/anJzdWFyZXpAaW5nZW5pYWdsb2JhbC5jbA== HTTP/1.1Host: page102.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-admins/voice/audio/nhjz37ogtbyf0avkmp4sxri56w89qdl1ue2cgj026rilfkuxtq5hc1eosapd9m4wbv3zn7y8satg0jhw9cy1kox53linbd2rzqfu76m8p4ev?data=anJzdWFyZXpAaW5nZW5pYWdsb2JhbC5jbA== HTTP/1.1Host: page102.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=7c4830865d60ba61101bc53abc220881
Source: global traffic	HTTP traffic detected: GET /crx/blobs/Acy1k0bLIjHsvnKaKN_oRpVaYYvFs25d7GKYF1WXrT6yizCMksBO0c_ggE0B6tx6HPRHe6q1GOEe3_NcIbSiGG8kXeLMUY0sAKVvC6R89zvKM13s5VqoAMZSmuUgjQL5vlygJuArQghXXE_qTL7NlQ/extension_8520_615_0_5.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ingeniaglobal.cl HTTP/1.1Host: logo.clearbit.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-admins/voice/audio/css/conv.css HTTP/1.1Host: page102.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=7c4830865d60ba61101bc53abc220881
Source: global traffic	HTTP traffic detected: GET /wp-admins/voice/audio/images/arrow_left.svg HTTP/1.1Host: page102.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=7c4830865d60ba61101bc53abc220881
Source: global traffic	HTTP traffic detected: GET /wp-admins/voice/audio/images/enterpass.png HTTP/1.1Host: page102.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=7c4830865d60ba61101bc53abc220881
Source: global traffic	HTTP traffic detected: GET /wp-admins/voice/audio/images/forgetpass.png HTTP/1.1Host: page102.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=7c4830865d60ba61101bc53abc220881
Source: global traffic	HTTP traffic detected: GET /wp-admins/voice/audio/images/ellipsis_grey.svg HTTP/1.1Host: page102.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=7c4830865d60ba61101bc53abc220881
Source: global traffic	HTTP traffic detected: GET /wp-admins/voice/audio/images/ellipsis_white.svg HTTP/1.1Host: page102.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=7c4830865d60ba61101bc53abc220881
Source: global traffic	HTTP traffic detected: GET /wp-admins/voice/audio/images/inv-small-background.jpg HTTP/1.1Host: page102.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://page102.com/wp-admins/voice/audio/nhjz37ogtbyf0avkmp4sxri56w89qdl1ue2cgj026rilfkuxtq5hc1eosapd9m4wbv3zn7y8satg0jhw9cy1kox53linbd2rzqfu76m8p4ev?data=anJzdWFyZXpAaW5nZW5pYWdsb2JhbC5jbA==Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=7c4830865d60ba61101bc53abc220881
Source: global traffic	HTTP traffic detected: GET /wp-admins/voice/audio/images/inv-big-background.jpg HTTP/1.1Host: page102.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://page102.com/wp-admins/voice/audio/nhjz37ogtbyf0avkmp4sxri56w89qdl1ue2cgj026rilfkuxtq5hc1eosapd9m4wbv3zn7y8satg0jhw9cy1kox53linbd2rzqfu76m8p4ev?data=anJzdWFyZXpAaW5nZW5pYWdsb2JhbC5jbA==Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=7c4830865d60ba61101bc53abc220881
Source: global traffic	HTTP traffic detected: GET /wp-admins/voice/audio/images/passwrd.png HTTP/1.1Host: page102.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=7c4830865d60ba61101bc53abc220881
Source: global traffic	HTTP traffic detected: GET /wp-admins/voice/audio/images/sigin.png HTTP/1.1Host: page102.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://page102.com/wp-admins/voice/audio/css/conv.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=7c4830865d60ba61101bc53abc220881
Source: global traffic	HTTP traffic detected: GET /wp-admins/voice/audio/images/favicon.ico HTTP/1.1Host: page102.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=7c4830865d60ba61101bc53abc220881
Source: global traffic	HTTP traffic detected: GET /ingeniaglobal.cl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: logo.clearbit.com
Source: global traffic	HTTP traffic detected: GET /wp-admins/voice/audio/images/favicon.ico HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: page102.com
Source: global traffic	HTTP traffic detected: GET /wp-admins/voice/audio/images/arrow_left.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: page102.com
Source: global traffic	HTTP traffic detected: GET /wp-admins/voice/audio/images/enterpass.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: page102.com
Source: global traffic	HTTP traffic detected: GET /wp-admins/voice/audio/images/forgetpass.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: page102.com
Source: global traffic	HTTP traffic detected: GET /wp-admins/voice/audio/images/ellipsis_white.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: page102.com
Source: global traffic	HTTP traffic detected: GET /wp-admins/voice/audio/images/ellipsis_grey.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: page102.com

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 54.230.206.106:443 -> 192.168.2.6:49789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 69.49.234.122:443 -> 192.168.2.6:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 69.49.234.122:443 -> 192.168.2.6:49788 version: TLS 1.2

System Summary:

Spawns processes

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --start-maximized --enable-automation 'C:\Users\user\Desktop\Jrsuarez-62643-5799-80-950985.HTM'
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1608,1399210297382139768,352261776352960377,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1924 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1608,1399210297382139768,352261776352960377,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1924 /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior

Creates files inside the program directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\Chrome\Application\Dictionaries

Jump to behavior

Creates files inside the user directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-61678316-11D8.pma

Jump to behavior

Creates temporary files

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Temp\b4aa0d80-3f00-4345-b433-2469d0df9ad5.tmp

Jump to behavior

Classification label

Source: classification engine

Classification label: mal80.phis.winHTM@37/257@8/14

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Creates a directory in C:\Program Files

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic			Jump to behavior

Data Obfuscation:

PE file contains an invalid checksum

Source: widevinecdm.dll.0.dr

Static PE information: real checksum: 0x9e9a16 should be:

PE file contains sections with non-standard names

Source: widevinecdm.dll.0.dr	Static PE information: section name: .00cfg
Source: widevinecdm.dll.0.dr	Static PE information: section name: .rodata
Source: widevinecdm.dll.0.dr	Static PE information: section name: _RDATA

Persistence and Installation Behavior:

Drops PE files

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Temp\4568_1086118591\_platform_specific\win_x64\widevinecdm.dll

Jump to dropped file

Creates license or readme file

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Temp\4568_306783134\LICENSE.txt

Jump to behavior