Windows Analysis Report https://u24446853.ct.sendgrid.net/ls/click?upn=2uaNz-2FYjiscZpiutVe517e1jlr3lepEnrnsWNCPAOwkCCTXQeXr-2BepbdfLnt25C-2FIpGIpmBWJIGrGI7WTghaHYbzg4YPxvCdg3xu75rKS5Z2dWj-2BwSmMRg34ICZ8ja8fHD8I_kEclMa76Gh3cVzwZQhAnSe3K0XLsCUjXxFgNkspkWtxOoIRO696T7loAgXlV1fQeo1r4IGHI7gZO7Q-2B7Wf386LPWKE4j1-2Bc5-2Fm0r-2BYto7ntGbibabQUAIufAXApvWOajwe84D0s1aeXv3ZLXcvEwsx-2B15P3e1GldBbfHsodO-2FN22e-2BuVkMRTdrcV05bYTaxJ32HhzbBwK7tH99O7QgCkhLLBEM7J-2FRKwNmANA-2FnTiZYeQJHgZP9NamfB-2B4QxAz5qLCNhSBSd71T5mmEm9aAwn-2Fb7-2BhEPvbCOanNtcY22SYCG4Cw9CFSGE2VeVA1JLBHoba8KwaGYRgBFr-2FeSMfVZrL6Yev7-2BB-2BjC-2FGLBtU-2Fba-2Bk1V0rT35pyYq6lC20GCteOOn6sf1oo-2F-2FJvIl5jwKFxuS2ELtvjiwKdbWt3Y0WC66t4KhQNwFHtevHRPNr3tqbe36wj9MvC46XfPd-2FJxAeIK6iJWsV7K2ArOrNvW7zSS87IFMGinq4g7dS-2FM0SDzSJ098QQeJADirLBUhRDX1eQ4GzwDGjp-2FMwCDu24D18aD2-2Bl-2BCex5oLDpyelAJmPjz8sGQOYguay3GWxdtkVNROgUlIYD-2F-2FWnWcK5eFCJPj2JruJodGVfRXWpXotlhnJAuZb74DVzPeoycMdCUnuZyzDYBojQcCt4APV8zkE-2F8JBMX5-2BCW2P3dOcWG-2FvW-2F6bH9c6X5SMfq-2BQFhotTNO0-2BCPMPlBZEbUkOSThv7Bo37a2bwxZQ8XADBXCWUzDbpUO0CiOVj10FsjlksA-2B3ove-2BVVIVKGnHw53y2wl5FfP8Wmt5KNwaLGhyKy0kcqTApKSiPJqtynExy5awEjETFhGMlS2lBtvIp1q5HApJYSsaMh2gMQDVc8ZHhfjt7ODK3QHtTOQTruvo-2Bz5Zu49ytPbtvrFag-3D-3D

AV Detection:

Antivirus / Scanner detection for submitted sample

Source: https://u24446853.ct.sendgrid.net/ls/click?upn=2uaNz-2FYjiscZpiutVe517e1jlr3lepEnrnsWNCPAOwkCCTXQeXr-2BepbdfLnt25C-2FIpGIpmBWJIGrGI7WTghaHYbzg4YPxvCdg3xu75rKS5Z2dWj-2BwSmMRg34ICZ8ja8fHD8I_kEclMa76Gh3cVzwZQhAnSe3K0XLsCUjXxFgNkspkWtxOoIRO696T7loAgXlV1fQeo1r4IGHI7gZO7Q-2B7Wf386LPWKE4j1-2Bc5-2Fm0r-2BYto7ntGbibabQUAIufAXApvWOajwe84D0s1aeXv3ZLXcvEwsx-2B15P3e1GldBbfHsodO-2FN22e-2BuVkMRTdrcV05bYTaxJ32HhzbBwK7tH99O7QgCkhLLBEM7J-2FRKwNmANA-2FnTiZYeQJHgZP9NamfB-2B4QxAz5qLCNhSBSd71T5mmEm9aAwn-2Fb7-2BhEPvbCOanNtcY22SYCG4Cw9CFSGE2VeVA1JLBHoba8KwaGYRgBFr-2FeSMfVZrL6Yev7-2BB-2BjC-2FGLBtU-2Fba-2Bk1V0rT35pyYq6lC20GCteOOn6sf1oo-2F-2FJvIl5jwKFxuS2ELtvjiwKdbWt3Y0WC66t4KhQNwFHtevHRPNr3tqbe36wj9MvC46XfPd-2FJxAeIK6iJWsV7K2ArOrNvW7zSS87IFMGinq4g7dS-2FM0SDzSJ098QQeJADirLBUhRDX1eQ4GzwDGjp-2FMwCDu24D18aD2-2Bl-2BCex5oLDpyelAJmPjz8sGQOYguay3GWxdtkVNROgUlIYD-2F-2FWnWcK5eFCJPj2JruJodGVfRXWpXotlhnJAuZb74DVzPeoycMdCUnuZyzDYBojQcCt4APV8zkE-2F8JBMX5-2BCW2P3dOcWG-2FvW-2F6bH9c6X5SMfq-2BQFhotTNO0-2BCPMPlBZEbUkOSThv7Bo37a2bwxZQ8XADBXCWUzDbpUO0CiOVj10FsjlksA-2B3ove-2BVVIVKGnHw53y2wl5FfP8Wmt5KNwaLGhyKy0kcqTApKSiPJqtynExy5awEjETFhGMlS2lBtvIp1q5HApJYSsaMh2gMQDVc8ZHhfjt7ODK3QHtTOQTruvo-2Bz5Zu49ytPbtvrFag-3D-3D

SlashNext: detection malicious, Label: Fake Login Page type: Phishing & Social Engineering

Antivirus detection for URL or domain

Source: https://635028.selcdn.ru/msoffice/index2.html#miranda_muscente@condenast.com

SlashNext: Label: Fake Login Page type: Phishing & Social Engineering

Multi AV Scanner detection for domain / URL

Source: https://app.forexliteoptions.com/core/database/xero/css/hover.css

Virustotal: Detection: 7%

Perma Link

Phishing:

Yara detected HtmlPhish10

Source: Yara match	File source: 72453.0.pages.csv, type: HTML
Source: Yara match	File source: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache\data_3, type: DROPPED

Phishing site detected (based on logo template match)

Source: https://635028.selcdn.ru/msoffice/index2.html#miranda_muscente@condenast.com

Matcher: Template: microsoft matched

Invalid 'forgot password' link found

Source: https://635028.selcdn.ru/msoffice/index2.html#miranda_muscente@condenast.com	HTTP Parser: Invalid link: Forgot password?
Source: https://635028.selcdn.ru/msoffice/index2.html#miranda_muscente@condenast.com	HTTP Parser: Invalid link: Forgot password?

No HTML title found

Source: https://635028.selcdn.ru/msoffice/index2.html#miranda_muscente@condenast.com	HTTP Parser: HTML title missing
Source: https://635028.selcdn.ru/msoffice/index2.html#miranda_muscente@condenast.com	HTTP Parser: HTML title missing
Source: https://account.live.com/ResetPassword.aspx?wreply=https://login.live.com/login.srf%3fwa%3dwsignin1.0%26rpsnv%3d13%26ct%3d1594824447%26rver%3d7.0.6737.0%26wp%3dMBI_SSL%26wreply%3dhttps%253a%252f%252foutlook.live.com%252fowa%252f%253fnlp%253d1%2526RpsCsrfState%253d096991c0-c96c-6a4e-6fe9-e91b0da948f1%26id%3d292841%26aadredir%3d1%26CBCXT%3dout%26lw%3d1%26fl%3ddob%252cflname%252cwld%26cobrandid%3d90015%26contextid%3d2C688CEDDDA7EE22%26bk%3d1594880420&id=292841&uiflavor=web&cobrandid=90015&uaid=657745d4db72409899b7bb19b09796de&mkt=EN-GB&lc=2057&bk=1594880420#	HTTP Parser: HTML title missing
Source: https://account.live.com/ResetPassword.aspx?wreply=https://login.live.com/login.srf%3fwa%3dwsignin1.0%26rpsnv%3d13%26ct%3d1594824447%26rver%3d7.0.6737.0%26wp%3dMBI_SSL%26wreply%3dhttps%253a%252f%252foutlook.live.com%252fowa%252f%253fnlp%253d1%2526RpsCsrfState%253d096991c0-c96c-6a4e-6fe9-e91b0da948f1%26id%3d292841%26aadredir%3d1%26CBCXT%3dout%26lw%3d1%26fl%3ddob%252cflname%252cwld%26cobrandid%3d90015%26contextid%3d2C688CEDDDA7EE22%26bk%3d1594880420&id=292841&uiflavor=web&cobrandid=90015&uaid=657745d4db72409899b7bb19b09796de&mkt=EN-GB&lc=2057&bk=1594880420#	HTTP Parser: HTML title missing

HTML body contains low number of good links

Source: https://635028.selcdn.ru/msoffice/index2.html#miranda_muscente@condenast.com	HTTP Parser: Number of links: 0
Source: https://635028.selcdn.ru/msoffice/index2.html#miranda_muscente@condenast.com	HTTP Parser: Number of links: 0
Source: https://account.live.com/ResetPassword.aspx?wreply=https://login.live.com/login.srf%3fwa%3dwsignin1.0%26rpsnv%3d13%26ct%3d1594824447%26rver%3d7.0.6737.0%26wp%3dMBI_SSL%26wreply%3dhttps%253a%252f%252foutlook.live.com%252fowa%252f%253fnlp%253d1%2526RpsCsrfState%253d096991c0-c96c-6a4e-6fe9-e91b0da948f1%26id%3d292841%26aadredir%3d1%26CBCXT%3dout%26lw%3d1%26fl%3ddob%252cflname%252cwld%26cobrandid%3d90015%26contextid%3d2C688CEDDDA7EE22%26bk%3d1594880420&id=292841&uiflavor=web&cobrandid=90015&uaid=657745d4db72409899b7bb19b09796de&mkt=EN-GB&lc=2057&bk=1594880420#	HTTP Parser: Number of links: 0
Source: https://account.live.com/ResetPassword.aspx?wreply=https://login.live.com/login.srf%3fwa%3dwsignin1.0%26rpsnv%3d13%26ct%3d1594824447%26rver%3d7.0.6737.0%26wp%3dMBI_SSL%26wreply%3dhttps%253a%252f%252foutlook.live.com%252fowa%252f%253fnlp%253d1%2526RpsCsrfState%253d096991c0-c96c-6a4e-6fe9-e91b0da948f1%26id%3d292841%26aadredir%3d1%26CBCXT%3dout%26lw%3d1%26fl%3ddob%252cflname%252cwld%26cobrandid%3d90015%26contextid%3d2C688CEDDDA7EE22%26bk%3d1594880420&id=292841&uiflavor=web&cobrandid=90015&uaid=657745d4db72409899b7bb19b09796de&mkt=EN-GB&lc=2057&bk=1594880420#	HTTP Parser: Number of links: 0

Submit button contains javascript call

Source: https://account.live.com/ResetPassword.aspx?wreply=https://login.live.com/login.srf%3fwa%3dwsignin1.0%26rpsnv%3d13%26ct%3d1594824447%26rver%3d7.0.6737.0%26wp%3dMBI_SSL%26wreply%3dhttps%253a%252f%252foutlook.live.com%252fowa%252f%253fnlp%253d1%2526RpsCsrfState%253d096991c0-c96c-6a4e-6fe9-e91b0da948f1%26id%3d292841%26aadredir%3d1%26CBCXT%3dout%26lw%3d1%26fl%3ddob%252cflname%252cwld%26cobrandid%3d90015%26contextid%3d2C688CEDDDA7EE22%26bk%3d1594880420&id=292841&uiflavor=web&cobrandid=90015&uaid=657745d4db72409899b7bb19b09796de&mkt=EN-GB&lc=2057&bk=1594880420#	HTTP Parser: On click: HOSTUI.evt_inlineBack_onclick();
Source: https://account.live.com/ResetPassword.aspx?wreply=https://login.live.com/login.srf%3fwa%3dwsignin1.0%26rpsnv%3d13%26ct%3d1594824447%26rver%3d7.0.6737.0%26wp%3dMBI_SSL%26wreply%3dhttps%253a%252f%252foutlook.live.com%252fowa%252f%253fnlp%253d1%2526RpsCsrfState%253d096991c0-c96c-6a4e-6fe9-e91b0da948f1%26id%3d292841%26aadredir%3d1%26CBCXT%3dout%26lw%3d1%26fl%3ddob%252cflname%252cwld%26cobrandid%3d90015%26contextid%3d2C688CEDDDA7EE22%26bk%3d1594880420&id=292841&uiflavor=web&cobrandid=90015&uaid=657745d4db72409899b7bb19b09796de&mkt=EN-GB&lc=2057&bk=1594880420#	HTTP Parser: On click: HOSTUI.evt_inlineBack_onclick();
Source: https://account.live.com/ResetPassword.aspx?wreply=https://login.live.com/login.srf%3fwa%3dwsignin1.0%26rpsnv%3d13%26ct%3d1594824447%26rver%3d7.0.6737.0%26wp%3dMBI_SSL%26wreply%3dhttps%253a%252f%252foutlook.live.com%252fowa%252f%253fnlp%253d1%2526RpsCsrfState%253d096991c0-c96c-6a4e-6fe9-e91b0da948f1%26id%3d292841%26aadredir%3d1%26CBCXT%3dout%26lw%3d1%26fl%3ddob%252cflname%252cwld%26cobrandid%3d90015%26contextid%3d2C688CEDDDA7EE22%26bk%3d1594880420&id=292841&uiflavor=web&cobrandid=90015&uaid=657745d4db72409899b7bb19b09796de&mkt=EN-GB&lc=2057&bk=1594880420#	HTTP Parser: On click: HOSTUI.evt_inlineBack_onclick();
Source: https://account.live.com/ResetPassword.aspx?wreply=https://login.live.com/login.srf%3fwa%3dwsignin1.0%26rpsnv%3d13%26ct%3d1594824447%26rver%3d7.0.6737.0%26wp%3dMBI_SSL%26wreply%3dhttps%253a%252f%252foutlook.live.com%252fowa%252f%253fnlp%253d1%2526RpsCsrfState%253d096991c0-c96c-6a4e-6fe9-e91b0da948f1%26id%3d292841%26aadredir%3d1%26CBCXT%3dout%26lw%3d1%26fl%3ddob%252cflname%252cwld%26cobrandid%3d90015%26contextid%3d2C688CEDDDA7EE22%26bk%3d1594880420&id=292841&uiflavor=web&cobrandid=90015&uaid=657745d4db72409899b7bb19b09796de&mkt=EN-GB&lc=2057&bk=1594880420#	HTTP Parser: On click: HOSTUI.evt_inlineBack_onclick();

META author tag missing

Source: https://635028.selcdn.ru/msoffice/index2.html#miranda_muscente@condenast.com	HTTP Parser: No <meta name="author".. found
Source: https://635028.selcdn.ru/msoffice/index2.html#miranda_muscente@condenast.com	HTTP Parser: No <meta name="author".. found
Source: https://account.live.com/ResetPassword.aspx?wreply=https://login.live.com/login.srf%3fwa%3dwsignin1.0%26rpsnv%3d13%26ct%3d1594824447%26rver%3d7.0.6737.0%26wp%3dMBI_SSL%26wreply%3dhttps%253a%252f%252foutlook.live.com%252fowa%252f%253fnlp%253d1%2526RpsCsrfState%253d096991c0-c96c-6a4e-6fe9-e91b0da948f1%26id%3d292841%26aadredir%3d1%26CBCXT%3dout%26lw%3d1%26fl%3ddob%252cflname%252cwld%26cobrandid%3d90015%26contextid%3d2C688CEDDDA7EE22%26bk%3d1594880420&id=292841&uiflavor=web&cobrandid=90015&uaid=657745d4db72409899b7bb19b09796de&mkt=EN-GB&lc=2057&bk=1594880420#	HTTP Parser: No <meta name="author".. found
Source: https://account.live.com/ResetPassword.aspx?wreply=https://login.live.com/login.srf%3fwa%3dwsignin1.0%26rpsnv%3d13%26ct%3d1594824447%26rver%3d7.0.6737.0%26wp%3dMBI_SSL%26wreply%3dhttps%253a%252f%252foutlook.live.com%252fowa%252f%253fnlp%253d1%2526RpsCsrfState%253d096991c0-c96c-6a4e-6fe9-e91b0da948f1%26id%3d292841%26aadredir%3d1%26CBCXT%3dout%26lw%3d1%26fl%3ddob%252cflname%252cwld%26cobrandid%3d90015%26contextid%3d2C688CEDDDA7EE22%26bk%3d1594880420&id=292841&uiflavor=web&cobrandid=90015&uaid=657745d4db72409899b7bb19b09796de&mkt=EN-GB&lc=2057&bk=1594880420#	HTTP Parser: No <meta name="author".. found

META copyright tag missing

Source: https://635028.selcdn.ru/msoffice/index2.html#miranda_muscente@condenast.com	HTTP Parser: No <meta name="copyright".. found
Source: https://635028.selcdn.ru/msoffice/index2.html#miranda_muscente@condenast.com	HTTP Parser: No <meta name="copyright".. found
Source: https://account.live.com/ResetPassword.aspx?wreply=https://login.live.com/login.srf%3fwa%3dwsignin1.0%26rpsnv%3d13%26ct%3d1594824447%26rver%3d7.0.6737.0%26wp%3dMBI_SSL%26wreply%3dhttps%253a%252f%252foutlook.live.com%252fowa%252f%253fnlp%253d1%2526RpsCsrfState%253d096991c0-c96c-6a4e-6fe9-e91b0da948f1%26id%3d292841%26aadredir%3d1%26CBCXT%3dout%26lw%3d1%26fl%3ddob%252cflname%252cwld%26cobrandid%3d90015%26contextid%3d2C688CEDDDA7EE22%26bk%3d1594880420&id=292841&uiflavor=web&cobrandid=90015&uaid=657745d4db72409899b7bb19b09796de&mkt=EN-GB&lc=2057&bk=1594880420#	HTTP Parser: No <meta name="copyright".. found
Source: https://account.live.com/ResetPassword.aspx?wreply=https://login.live.com/login.srf%3fwa%3dwsignin1.0%26rpsnv%3d13%26ct%3d1594824447%26rver%3d7.0.6737.0%26wp%3dMBI_SSL%26wreply%3dhttps%253a%252f%252foutlook.live.com%252fowa%252f%253fnlp%253d1%2526RpsCsrfState%253d096991c0-c96c-6a4e-6fe9-e91b0da948f1%26id%3d292841%26aadredir%3d1%26CBCXT%3dout%26lw%3d1%26fl%3ddob%252cflname%252cwld%26cobrandid%3d90015%26contextid%3d2C688CEDDDA7EE22%26bk%3d1594880420&id=292841&uiflavor=web&cobrandid=90015&uaid=657745d4db72409899b7bb19b09796de&mkt=EN-GB&lc=2057&bk=1594880420#	HTTP Parser: No <meta name="copyright".. found

Compliance:

Creates a directory in C:\Program Files

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic			Jump to behavior

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 152.199.21.175:443 -> 192.168.2.5:49840 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.21.175:443 -> 192.168.2.5:49841 version: TLS 1.2

Networking:

Uses HTTPS

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822

Tries to download or post to a non-existing HTTP route (HTTP/1.1 404 Not Found / 503 Service Unavailable / 403 Forbidden)

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundkeep-alive: timeout=5, max=100content-type: text/htmltransfer-encoding: chunkeddate: Thu, 02 Dec 2021 16:51:28 GMTserver: LiteSpeedx-turbo-charged-by: LiteSpeedconnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: X-Backend-Timestamp, Etag, Last-Modified, X-Object-Manifest, X-TimestampContent-Length: 70Content-Type: text/htmlDate: Thu, 02 Dec 2021 16:51:24 GMTExpires: Thu, 02 Dec 2021 16:52:24 GMTAge: 5Connection: close

URLs found in memory or binary data

Source: angular.js.0.dr	String found in binary or memory: http://angularjs.org
Source: data_3.2.dr	String found in binary or memory: http://crl.pki.goog/gsr1/gsr1.crl0;
Source: data_3.2.dr	String found in binary or memory: http://crl.pki.goog/gtsr1/gtsr1.crl0W
Source: data_3.2.dr	String found in binary or memory: http://crls.pki.goog/gts1c3/moVDfISia2k.crl0
Source: angular.js.0.dr	String found in binary or memory: http://errors.angularjs.org/1.6.4-local
Source: pnacl_public_x86_64_pnacl_sz_nexe.0.dr	String found in binary or memory: http://llvm.org/):
Source: data_3.2.dr	String found in binary or memory: http://ocsp.pki.goog/gsr10)
Source: data_3.2.dr	String found in binary or memory: http://ocsp.pki.goog/gts1c301
Source: data_3.2.dr	String found in binary or memory: http://ocsp.pki.goog/gtsr100
Source: data_3.2.dr	String found in binary or memory: http://pki.goog/gsr1/gsr1.crt02
Source: data_3.2.dr	String found in binary or memory: http://pki.goog/repo/certs/gts1c3.der0
Source: data_3.2.dr	String found in binary or memory: http://pki.goog/repo/certs/gtsr1.der04
Source: Current Session.0.dr	String found in binary or memory: https://635028.selcdn.ru
Source: data_1.2.dr	String found in binary or memory: https://635028.selcdn.ru/favicon.ico
Source: data_1.2.dr	String found in binary or memory: https://635028.selcdn.ru/favicon.icoChIKBw1TVYG1GgAKBw2MV9u3GgA=
Source: data_1.2.dr	String found in binary or memory: https://635028.selcdn.ru/msoffice/index2.html
Source: Current Session.0.dr	String found in binary or memory: https://635028.selcdn.ru/msoffice/index2.html#
Source: History.0.dr	String found in binary or memory: https://635028.selcdn.ru/msoffice/index2.html#miranda_muscente
Source: data_1.2.dr	String found in binary or memory: https://635028.selcdn.ru/msoffice/index2.htmlM
Source: data_1.2.dr	String found in binary or memory: https://635028.selcdn.ru/msoffice/jquery.min.v2.js
Source: data_1.2.dr	String found in binary or memory: https://635028.selcdn.ru/msoffice/r.html
Source: History.0.dr	String found in binary or memory: https://635028.selcdn.ru/msoffice/r.html#miranda_muscente
Source: Reporting and NEL.2.dr	String found in binary or memory: https://a.nel.cloudflare.com/report/v3?s=Mv7kpnB9XBHXWPxF04Nn3UQelYcsJiE2Ph9zggIq4mds9xJATEd07ejKNGN
Source: Reporting and NEL.2.dr	String found in binary or memory: https://a.nel.cloudflare.com/report/v3?s=UZEov5stylofvQeTvi6FdBRF92t9kWFo6Mur%2FZPLYvDuKXws2P0vCg%2F
Source: Reporting and NEL.2.dr	String found in binary or memory: https://a.nel.cloudflare.com/report/v3?s=ePMy7Z%2FT1vT33SwDWMkjBU51pHPGYVk9nGn5qA7jTw1DkR5B%2BcXoZVJ
Source: History.0.dr	String found in binary or memory: https://account.live.com/ResetPassword.aspx?wreply=https://login.live.com/login.srf%3fwa%3dwsignin1.
Source: data_1.2.dr	String found in binary or memory: https://account.live.com/Resources/images/2_vD0yppaJX3jBnfbHF1hqXQ2.svg
Source: data_1.2.dr	String found in binary or memory: https://account.live.com/Resources/images/AppCentipede/AppCentipede_Microsoft_HFeToeM4u6fzMQF_f_rQ5Q
Source: data_1.2.dr	String found in binary or memory: https://account.live.com/Resources/images/AppCentipede/AppCentipede_Microsoft_white_ufRYlllWOw4YyDRi
Source: data_1.2.dr	String found in binary or memory: https://account.live.com/Resources/images/Microsoft_Logotype_Gray_X-qkgtg8KmnQEvm_9mDTcw2.svg
Source: data_1.2.dr	String found in binary or memory: https://account.live.com/Resources/images/Microsoft_Logotype_Gray_X-qkgtg8KmnQEvm_9mDTcw2.svg5x
Source: data_1.2.dr	String found in binary or memory: https://account.live.com/Resources/images/Microsoft_Logotype_White_4MYDQRab31HKDWWN-1HafA2.svg
Source: data_1.2.dr	String found in binary or memory: https://account.live.com/Resources/images/favicon.ico
Source: data_1.2.dr	String found in binary or memory: https://account.live.com/Resources/images/favicon.ico4
Source: data_1.2.dr	String found in binary or memory: https://account.live.com/Resources/images/microsoft_logo_7lyNn7YkjJOP0NwZNw6QvQ2.svg
Source: Current Session.0.dr	String found in binary or memory: https://account.live.com/password/reset
Source: 778ac3b2-2ab8-45de-b205-14c7086cf6d7.tmp.2.dr, manifest.json0.0.dr, 29bc34f5-ae61-4202-89cb-7e973df930ea.tmp.2.dr	String found in binary or memory: https://accounts.google.com
Source: craw_window.js.0.dr	String found in binary or memory: https://accounts.google.com/MergeSession
Source: data_1.2.dr	String found in binary or memory: https://acctcdn.msauth.net/accountcorepackage_UH__VcmA5_qVhPpsKA_TNQ2.js?v=1
Source: data_1.2.dr	String found in binary or memory: https://acctcdn.msauth.net/bootstrapcomponentshim_yGKy8jAx8RL2bLqmBF063w2.js?v=1
Source: data_1.2.dr	String found in binary or memory: https://acctcdn.msauth.net/bootstrapcomponentshim_yGKy8jAx8RL2bLqmBF063w2.js?v=1$
Source: data_1.2.dr	String found in binary or memory: https://acctcdn.msauth.net/bootstrapshim_IX6xrWCoGcREOsbbsQ1Yvg2.js?v=1
Source: data_1.2.dr	String found in binary or memory: https://acctcdn.msauth.net/converged_ux_v2_kGcCYmU0rW3A6Zc7U1O8nw2.css?v=1
Source: data_1.2.dr	String found in binary or memory: https://acctcdn.msauth.net/datarequestpackage_h-_7C7UzwdefXJT9njDBTQ2.js
Source: data_1.2.dr	String found in binary or memory: https://acctcdn.msauth.net/images/2_vD0yppaJX3jBnfbHF1hqXQ2.svg
Source: data_1.2.dr	String found in binary or memory: https://acctcdn.msauth.net/images/2_vD0yppaJX3jBnfbHF1hqXQ2.svgw
Source: data_1.2.dr	String found in binary or memory: https://acctcdn.msauth.net/images/dropdown_caret_KXSZjGsyILZaoTf0sI9X-A2.svg
Source: data_1.2.dr, Favicons.0.dr	String found in binary or memory: https://acctcdn.msauth.net/images/favicon.ico?v=2
Source: data_1.2.dr	String found in binary or memory: https://acctcdn.msauth.net/images/microsoft_logo_7lyNn7YkjJOP0NwZNw6QvQ2.svg
Source: data_1.2.dr	String found in binary or memory: https://acctcdn.msauth.net/jqueryshim_tGLkJ9mWEbN2n0ToVG2gvQ2.js?v=1
Source: data_1.2.dr	String found in binary or memory: https://acctcdn.msauth.net/jqueryshim_tGLkJ9mWEbN2n0ToVG2gvQ2.js?v=1:.
Source: data_1.2.dr	String found in binary or memory: https://acctcdn.msauth.net/knockout_old_GJ62c6D9R5HuKFdkoO8XYw2.js?v=1
Source: data_1.2.dr	String found in binary or memory: https://acctcdn.msauth.net/oneds_EMWt_lK9fDTY6ZqY6xYrUA2.js?v=1
Source: data_1.2.dr	String found in binary or memory: https://acctcdn.msauth.net/resetpasswordpackage_L8Ee0uN0GOAyvurXVgtE8g2.js?v=1
Source: data_1.2.dr	String found in binary or memory: https://acctcdn.msauth.net/resetpasswordpackage_L8Ee0uN0GOAyvurXVgtE8g2.js?v=1a
Source: data_1.2.dr	String found in binary or memory: https://acctcdn.msauth.net/wlivepackagefull_2169QIWB52Tqqm3jo5_AUA2.js?v=1
Source: 29bc34f5-ae61-4202-89cb-7e973df930ea.tmp.2.dr	String found in binary or memory: https://ajax.googleapis.com
Source: data_3.2.dr, data_1.2.dr	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
Source: 778ac3b2-2ab8-45de-b205-14c7086cf6d7.tmp.2.dr, manifest.json0.0.dr, 29bc34f5-ae61-4202-89cb-7e973df930ea.tmp.2.dr	String found in binary or memory: https://apis.google.com
Source: data_3.2.dr	String found in binary or memory: https://app.forexliteoptions.com/core/database/xero/css/hover.css
Source: data_3.2.dr, data_1.2.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js
Source: data_1.2.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.jskf
Source: pnacl_public_x86_64_libpnacl_irt_shim_dummy_a.0.dr	String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-clang.git
Source: pnacl_public_x86_64_libpnacl_irt_shim_dummy_a.0.dr	String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-llvm.git
Source: 778ac3b2-2ab8-45de-b205-14c7086cf6d7.tmp.2.dr, 29bc34f5-ae61-4202-89cb-7e973df930ea.tmp.2.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.0.dr, manifest.json.0.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 778ac3b2-2ab8-45de-b205-14c7086cf6d7.tmp.2.dr, 29bc34f5-ae61-4202-89cb-7e973df930ea.tmp.2.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: data_3.2.dr, data_1.2.dr	String found in binary or memory: https://code.jquery.com/jquery-3.1.1.min.js
Source: data_1.2.dr	String found in binary or memory: https://code.jquery.com/jquery-3.1.1.min.js&
Source: data_3.2.dr, data_1.2.dr	String found in binary or memory: https://code.jquery.com/jquery-3.2.1.slim.min.js
Source: data_1.2.dr	String found in binary or memory: https://code.jquery.com/jquery-3.2.1.slim.min.jsy
Source: data_3.2.dr	String found in binary or memory: https://code.jquery.com/jquery-3.3.1.js
Source: 29bc34f5-ae61-4202-89cb-7e973df930ea.tmp.2.dr	String found in binary or memory: https://content-autofill.googleapis.com
Source: data_1.2.dr	String found in binary or memory: https://content-autofill.googleapis.com/v1/pages/Chc2LjEuMTcxNS4xNDQyL2VuIChHR0xMKRIfCVrtyn9pyUatEgk
Source: data_1.2.dr	String found in binary or memory: https://content-autofill.googleapis.com/v1/pages/Chc2LjEuMTcxNS4xNDQyL2VuIChHR0xMKRIfCZ1PG8T4iKcFEgk
Source: manifest.json0.0.dr	String found in binary or memory: https://content.googleapis.com
Source: common.js.0.dr	String found in binary or memory: https://crash.corp.google.com/samples?reportid=&q=
Source: data_3.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/hosted-libraries-pushers
Source: data_3.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/hosted-libraries-pushersCross-Origin-Resource-Policy:
Source: Reporting and NEL.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/IdentityListAccountsHttp/external
Source: data_3.2.dr, Reporting and NEL.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers
Source: f93d8e45-faf5-491c-9138-e9c96212eb0a.tmp.2.dr, 778ac3b2-2ab8-45de-b205-14c7086cf6d7.tmp.2.dr, 7e6b36eb-98aa-4434-8749-4a693a5e1731.tmp.2.dr, 29bc34f5-ae61-4202-89cb-7e973df930ea.tmp.2.dr	String found in binary or memory: https://dns.google
Source: manifest.json0.0.dr	String found in binary or memory: https://feedback.googleusercontent.com
Source: 778ac3b2-2ab8-45de-b205-14c7086cf6d7.tmp.2.dr, 29bc34f5-ae61-4202-89cb-7e973df930ea.tmp.2.dr	String found in binary or memory: https://fonts.googleapis.com
Source: data_3.2.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Yellowtail&display=swap
Source: data_1.2.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Yellowtail&display=swap
Source: manifest.json0.0.dr	String found in binary or memory: https://fonts.googleapis.com;
Source: data_3.2.dr, 29bc34f5-ae61-4202-89cb-7e973df930ea.tmp.2.dr	String found in binary or memory: https://fonts.gstatic.com
Source: data_1.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/yellowtail/v11/OZpGg_pnoDtINPfRIlLohlvHwQ.woff2)
Source: manifest.json0.0.dr	String found in binary or memory: https://fonts.gstatic.com;
Source: angular.js.0.dr	String found in binary or memory: https://github.com/angular/material
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p
Source: data_2.2.dr	String found in binary or memory: https://gyazo.com
Source: data_2.2.dr	String found in binary or memory: https://gyazo.comAge:
Source: manifest.json0.0.dr	String found in binary or memory: https://hangouts.google.com/
Source: data_1.2.dr	String found in binary or memory: https://i.gyazo.com/214d89a26f0ac918a09f216a1b0f97b4.png
Source: data_3.2.dr	String found in binary or memory: https://i.gyazo.com/214d89a26f0ac918a09f216a1b0f97b4.png);
Source: data_3.2.dr	String found in binary or memory: https://ka-f.fontawesome.com
Source: data_1.2.dr	String found in binary or memory: https://ka-f.fontawesome.com/releases/v5.15.4/css/free-v4-shims.min.css?token=585b051251
Source: data_1.2.dr	String found in binary or memory: https://ka-f.fontawesome.com/releases/v5.15.4/css/free.min.css?token=585b051251
Source: data_3.2.dr, data_1.2.dr	String found in binary or memory: https://kit-free.fontawesome.com/releases/latest/css/free-v4-shims.min.css
Source: data_1.2.dr	String found in binary or memory: https://kit-free.fontawesome.com/releases/latest/css/free-v4-shims.min.css/
Source: data_3.2.dr, data_1.2.dr	String found in binary or memory: https://kit-free.fontawesome.com/releases/latest/css/free.min.css
Source: data_3.2.dr	String found in binary or memory: https://kit.fontawesome.com
Source: data_3.2.dr, data_1.2.dr	String found in binary or memory: https://kit.fontawesome.com/585b051251.js
Source: data_1.2.dr	String found in binary or memory: https://kit.fontawesome.com/585b051251.jsG4
Source: data_3.2.dr	String found in binary or memory: https://login.microsoftonline.com/?username=
Source: data_1.2.dr	String found in binary or memory: https://logincdn.msauth.net/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90b
Source: data_3.2.dr, data_1.2.dr	String found in binary or memory: https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css
Source: data_3.2.dr, data_1.2.dr	String found in binary or memory: https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js
Source: 778ac3b2-2ab8-45de-b205-14c7086cf6d7.tmp.2.dr, 29bc34f5-ae61-4202-89cb-7e973df930ea.tmp.2.dr	String found in binary or memory: https://ogs.google.com
Source: craw_window.js.0.dr, manifest.json.0.dr	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: data_3.2.dr	String found in binary or memory: https://pki.goog/repository/0
Source: 29bc34f5-ae61-4202-89cb-7e973df930ea.tmp.2.dr	String found in binary or memory: https://r4---sn-h0jelnes.gvt1.com
Source: data_3.2.dr, data_1.2.dr	String found in binary or memory: https://r4---sn-h0jelnes.gvt1.com/edgedl/chrome/dict/en-us-9-0.bdic?cms_redirect=yes&mh=I2&mip=84.17
Source: 29bc34f5-ae61-4202-89cb-7e973df930ea.tmp.2.dr	String found in binary or memory: https://redirector.gvt1.com
Source: data_1.2.dr	String found in binary or memory: https://redirector.gvt1.com/edgedl/chrome/dict/en-us-9-0.bdic
Source: data_1.2.dr	String found in binary or memory: https://redirector.gvt1.com/edgedl/chrome/dict/en-us-9-0.bdicd
Source: craw_window.js.0.dr, manifest.json.0.dr	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: data_1.2.dr	String found in binary or memory: https://slender-distinct-direction.glitch.me
Source: 778ac3b2-2ab8-45de-b205-14c7086cf6d7.tmp.2.dr, 29bc34f5-ae61-4202-89cb-7e973df930ea.tmp.2.dr	String found in binary or memory: https://ssl.gstatic.com
Source: data_3.2.dr, data_1.2.dr	String found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js
Source: data_1.2.dr	String found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.jsI
Source: feedback.html.0.dr	String found in binary or memory: https://support.google.com/chromecast/answer/2998456
Source: feedback.html.0.dr	String found in binary or memory: https://support.google.com/chromecast/troubleshooter/2995236
Source: History.0.dr	String found in binary or memory: https://u24446853.ct.sendgrid.net/ls/click?upn=2uaNz-2FYjiscZpiutVe517e1jlr3lepEnrnsWNCPAOwkCCTXQeXr
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://www-googleapis-staging.sandbox.google.com
Source: 778ac3b2-2ab8-45de-b205-14c7086cf6d7.tmp.2.dr, manifest.json0.0.dr, 29bc34f5-ae61-4202-89cb-7e973df930ea.tmp.2.dr	String found in binary or memory: https://www.google.com
Source: manifest.json.0.dr	String found in binary or memory: https://www.google.com/
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/accounts/OAuthLogin?issueuberauth=1
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/cleardot.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/dot2.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/x2.gif
Source: craw_background.js.0.dr	String found in binary or memory: https://www.google.com/intl/en-US/chrome/blank.html
Source: data_3.2.dr	String found in binary or memory: https://www.google.com/s2/favicons?domain=
Source: feedback_script.js.0.dr	String found in binary or memory: https://www.google.com/tools/feedback
Source: manifest.json0.0.dr	String found in binary or memory: https://www.google.com;
Source: 778ac3b2-2ab8-45de-b205-14c7086cf6d7.tmp.2.dr, craw_window.js.0.dr, craw_background.js.0.dr, 29bc34f5-ae61-4202-89cb-7e973df930ea.tmp.2.dr	String found in binary or memory: https://www.googleapis.com
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/calendar.readonly
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/cast-edu-messaging
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/clouddevices
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/hangouts
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/hangouts.readonly
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/meetings
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.peopleapi.readwrite
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/userinfo.email
Source: 778ac3b2-2ab8-45de-b205-14c7086cf6d7.tmp.2.dr, 29bc34f5-ae61-4202-89cb-7e973df930ea.tmp.2.dr	String found in binary or memory: https://www.gstatic.com
Source: common.js.0.dr	String found in binary or memory: https://www.gstatic.com/hangouts_echo_detector/release/%
Source: manifest.json0.0.dr	String found in binary or memory: https://www.gstatic.com;

Posts data to webserver

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: clients2.google.com

Downloads files from webservers via HTTP

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfmX-Goog-Update-Updater: chromecrx-85.0.4183.121Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ls/click?upn=2uaNz-2FYjiscZpiutVe517e1jlr3lepEnrnsWNCPAOwkCCTXQeXr-2BepbdfLnt25C-2FIpGIpmBWJIGrGI7WTghaHYbzg4YPxvCdg3xu75rKS5Z2dWj-2BwSmMRg34ICZ8ja8fHD8I_kEclMa76Gh3cVzwZQhAnSe3K0XLsCUjXxFgNkspkWtxOoIRO696T7loAgXlV1fQeo1r4IGHI7gZO7Q-2B7Wf386LPWKE4j1-2Bc5-2Fm0r-2BYto7ntGbibabQUAIufAXApvWOajwe84D0s1aeXv3ZLXcvEwsx-2B15P3e1GldBbfHsodO-2FN22e-2BuVkMRTdrcV05bYTaxJ32HhzbBwK7tH99O7QgCkhLLBEM7J-2FRKwNmANA-2FnTiZYeQJHgZP9NamfB-2B4QxAz5qLCNhSBSd71T5mmEm9aAwn-2Fb7-2BhEPvbCOanNtcY22SYCG4Cw9CFSGE2VeVA1JLBHoba8KwaGYRgBFr-2FeSMfVZrL6Yev7-2BB-2BjC-2FGLBtU-2Fba-2Bk1V0rT35pyYq6lC20GCteOOn6sf1oo-2F-2FJvIl5jwKFxuS2ELtvjiwKdbWt3Y0WC66t4KhQNwFHtevHRPNr3tqbe36wj9MvC46XfPd-2FJxAeIK6iJWsV7K2ArOrNvW7zSS87IFMGinq4g7dS-2FM0SDzSJ098QQeJADirLBUhRDX1eQ4GzwDGjp-2FMwCDu24D18aD2-2Bl-2BCex5oLDpyelAJmPjz8sGQOYguay3GWxdtkVNROgUlIYD-2F-2FWnWcK5eFCJPj2JruJodGVfRXWpXotlhnJAuZb74DVzPeoycMdCUnuZyzDYBojQcCt4APV8zkE-2F8JBMX5-2BCW2P3dOcWG-2FvW-2F6bH9c6X5SMfq-2BQFhotTNO0-2BCPMPlBZEbUkOSThv7Bo37a2bwxZQ8XADBXCWUzDbpUO0CiOVj10FsjlksA-2B3ove-2BVVIVKGnHw53y2wl5FfP8Wmt5KNwaLGhyKy0kcqTApKSiPJqtynExy5awEjETFhGMlS2lBtvIp1q5HApJYSsaMh2gMQDVc8ZHhfjt7ODK3QHtTOQTruvo-2Bz5Zu49ytPbtvrFag-3D-3D HTTP/1.1Host: u24446853.ct.sendgrid.netConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /msoffice/r.html HTTP/1.1Host: 635028.selcdn.ruConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /msoffice/index2.html HTTP/1.1Host: 635028.selcdn.ruConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://635028.selcdn.ru/msoffice/r.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrap/4.0.0/css/bootstrap.min.css HTTP/1.1Host: maxcdn.bootstrapcdn.comConnection: keep-aliveOrigin: https://635028.selcdn.ruUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,*/*;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://635028.selcdn.ru/msoffice/index2.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /msoffice/jquery.min.v2.js HTTP/1.1Host: 635028.selcdn.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://635028.selcdn.ru/msoffice/index2.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrap/4.0.0/js/bootstrap.min.js HTTP/1.1Host: maxcdn.bootstrapcdn.comConnection: keep-aliveOrigin: https://635028.selcdn.ruUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://635028.selcdn.ru/msoffice/index2.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrap/4.1.3/js/bootstrap.min.js HTTP/1.1Host: stackpath.bootstrapcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://635028.selcdn.ru/msoffice/index2.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/popper.js/1.12.9/umd/popper.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveOrigin: https://635028.selcdn.ruUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://635028.selcdn.ru/msoffice/index2.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /core/database/xero/css/hover.css HTTP/1.1Host: app.forexliteoptions.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,*/*;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://635028.selcdn.ru/msoffice/index2.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg HTTP/1.1Host: logincdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://635028.selcdn.ru/msoffice/index2.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /214d89a26f0ac918a09f216a1b0f97b4.png HTTP/1.1Host: i.gyazo.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://635028.selcdn.ru/msoffice/index2.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: 635028.selcdn.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://635028.selcdn.ru/msoffice/index2.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /converged_ux_v2_kGcCYmU0rW3A6Zc7U1O8nw2.css?v=1 HTTP/1.1Host: acctcdn.msauth.netConnection: keep-aliveOrigin: https://account.live.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,*/*;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://account.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jqueryshim_tGLkJ9mWEbN2n0ToVG2gvQ2.js?v=1 HTTP/1.1Host: acctcdn.msauth.netConnection: keep-aliveOrigin: https://account.live.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://account.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrapshim_IX6xrWCoGcREOsbbsQ1Yvg2.js?v=1 HTTP/1.1Host: acctcdn.msauth.netConnection: keep-aliveOrigin: https://account.live.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://account.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrapcomponentshim_yGKy8jAx8RL2bLqmBF063w2.js?v=1 HTTP/1.1Host: acctcdn.msauth.netConnection: keep-aliveOrigin: https://account.live.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://account.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wlivepackagefull_2169QIWB52Tqqm3jo5_AUA2.js?v=1 HTTP/1.1Host: acctcdn.msauth.netConnection: keep-aliveOrigin: https://account.live.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://account.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /knockout_old_GJ62c6D9R5HuKFdkoO8XYw2.js?v=1 HTTP/1.1Host: acctcdn.msauth.netConnection: keep-aliveOrigin: https://account.live.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://account.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /accountcorepackage_UH__VcmA5_qVhPpsKA_TNQ2.js?v=1 HTTP/1.1Host: acctcdn.msauth.netConnection: keep-aliveOrigin: https://account.live.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://account.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /resetpasswordpackage_L8Ee0uN0GOAyvurXVgtE8g2.js?v=1 HTTP/1.1Host: acctcdn.msauth.netConnection: keep-aliveOrigin: https://account.live.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://account.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/microsoft_logo_7lyNn7YkjJOP0NwZNw6QvQ2.svg HTTP/1.1Host: acctcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://account.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/dropdown_caret_KXSZjGsyILZaoTf0sI9X-A2.svg HTTP/1.1Host: acctcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://account.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/favicon.ico?v=2 HTTP/1.1Host: acctcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://account.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /oneds_EMWt_lK9fDTY6ZqY6xYrUA2.js?v=1 HTTP/1.1Host: acctcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /datarequestpackage_h-_7C7UzwdefXJT9njDBTQ2.js HTTP/1.1Host: acctcdn.msauth.netConnection: keep-aliveOrigin: https://account.live.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://account.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/2_vD0yppaJX3jBnfbHF1hqXQ2.svg HTTP/1.1Host: acctcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://account.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/dropdown_caret_KXSZjGsyILZaoTf0sI9X-A2.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: acctcdn.msauth.net
Source: global traffic	HTTP traffic detected: GET /images/microsoft_logo_7lyNn7YkjJOP0NwZNw6QvQ2.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: acctcdn.msauth.net
Source: global traffic	HTTP traffic detected: GET /images/favicon.ico?v=2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: acctcdn.msauth.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/Acy1k0bLIjHsvnKaKN_oRpVaYYvFs25d7GKYF1WXrT6yizCMksBO0c_ggE0B6tx6HPRHe6q1GOEe3_NcIbSiGG8kXeLMUY0sAKVvC6R89zvKM13s5VqoAMZSmuUgjQL5vlygJuArQghXXE_qTL7NlQ/extension_8520_615_0_5.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 152.199.21.175:443 -> 192.168.2.5:49840 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.21.175:443 -> 192.168.2.5:49841 version: TLS 1.2

System Summary:

Spawns processes

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "https://u24446853.ct.sendgrid.net/ls/click?upn=2uaNz-2FYjiscZpiutVe517e1jlr3lepEnrnsWNCPAOwkCCTXQeXr-2BepbdfLnt25C-2FIpGIpmBWJIGrGI7WTghaHYbzg4YPxvCdg3xu75rKS5Z2dWj-2BwSmMRg34ICZ8ja8fHD8I_kEclMa76Gh3cVzwZQhAnSe3K0XLsCUjXxFgNkspkWtxOoIRO696T7loAgXlV1fQeo1r4IGHI7gZO7Q-2B7Wf386LPWKE4j1-2Bc5-2Fm0r-2BYto7ntGbibabQUAIufAXApvWOajwe84D0s1aeXv3ZLXcvEwsx-2B15P3e1GldBbfHsodO-2FN22e-2BuVkMRTdrcV05bYTaxJ32HhzbBwK7tH99O7QgCkhLLBEM7J-2FRKwNmANA-2FnTiZYeQJHgZP9NamfB-2B4QxAz5qLCNhSBSd71T5mmEm9aAwn-2Fb7-2BhEPvbCOanNtcY22SYCG4Cw9CFSGE2VeVA1JLBHoba8KwaGYRgBFr-2FeSMfVZrL6Yev7-2BB-2BjC-2FGLBtU-2Fba-2Bk1V0rT35pyYq6lC20GCteOOn6sf1oo-2F-2FJvIl5jwKFxuS2ELtvjiwKdbWt3Y0WC66t4KhQNwFHtevHRPNr3tqbe36wj9MvC46XfPd-2FJxAeIK6iJWsV7K2ArOrNvW7zSS87IFMGinq4g7dS-2FM0SDzSJ098QQeJADirLBUhRDX1eQ4GzwDGjp-2FMwCDu24D18aD2-2Bl-2BCex5oLDpyelAJmPjz8sGQOYguay3GWxdtkVNROgUlIYD-2F-2FWnWcK5eFCJPj2JruJodGVfRXWpXotlhnJAuZb74DVzPeoycMdCUnuZyzDYBojQcCt4APV8zkE-2F8JBMX5-2BCW2P3dOcWG-2FvW-2F6bH9c6X5SMfq-2BQFhotTNO0-2BCPMPlBZEbUkOSThv7Bo37a2bwxZQ8XADBXCWUzDbpUO0CiOVj10FsjlksA-2B3ove-2BVVIVKGnHw53y2wl5FfP8Wmt5KNwaLGhyKy0kcqTApKSiPJqtynExy5awEjETFhGMlS2lBtvIp1q5HApJYSsaMh2gMQDVc8ZHhfjt7ODK3QHtTOQTruvo-2Bz5Zu49ytPbtvrFag-3D-3D
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1528,6543888065847324446,5589979798800107218,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1948 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1528,6543888065847324446,5589979798800107218,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1948 /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior

Creates files inside the program directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\Chrome\Application\Dictionaries

Jump to behavior

Creates files inside the user directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-61A9781C-15D8.pma

Jump to behavior

Creates temporary files

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Temp\19d878a5-c6a3-4793-8c33-3d2098c2f1f0.tmp

Jump to behavior

Classification label

Source: classification engine

Classification label: mal76.phis.win@30/226@19/15

Found GUI installer (many successful clicks)

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Creates a directory in C:\Program Files

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic			Jump to behavior