Windows Analysis Report
https://21pr-bh.pages.dev/

Overview

General Information

Sample URL:	https://21pr-bh.pages.dev/
Analysis ID:	1447749
Infos:

Errors URL not reachable

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Stores files to the Windows start menu directory

Uses insecure TLS / SSL version for HTTPS connection

Classification

Signatures

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://21pr-bh.pages.dev/	Avira URL Cloud: detection malicious, Label: phishing
Source: https://21pr-bh.pages.dev/	SlashNext: detection malicious, Label: Credential Stealing type: Phishing & Social Engineering

Multi AV Scanner detection for submitted file

Source: https://21pr-bh.pages.dev/

Virustotal: Detection: 16%

Perma Link

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49756 version: TLS 1.0

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49756 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 21pr-bh.pages.devConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/I/11EIQ5IGqaL._RC%7C01e5ncglxyL.css,01lF2n-pPaL.css,41SwWPpN5yL.css,31+Z83i6adL.css,01IWMurvs8L.css,01ToTiqCP7L.css,01qPl4hxayL.css,01ITNc8rK9L.css,413Vvv3GONL.css,11TIuySqr6L.css,01Rw4F+QU6L.css,11j54vTBQxL.css,01pbKJp5dbL.css,01IdKcBuAdL.css,01y-XAlI+2L.css,213SZJ8Z+PL.css,01oDR3IULNL.css,51qPa7JG96L.css,01XPHJk60-L.css,01dmkcyJuIL.css,01B9+-hVWxL.css,21Ol27dM9tL.css,11JRZ3s9niL.css,21wA+jAxKjL.css,11U8GXfhueL.css,01CFUgsA-YL.css,316CD+csp-L.css,116t+WD27UL.css,11uWFHlOmWL.css,11v8YDG4ifL.css,11otOAnaYoL.css,01FwL+mJQOL.css,11NDsgnHEZL.css,21RE+gQIxcL.css,11CLXYZ6DRL.css,012f1fcyibL.css,21w-O41p+SL.css,11XH+76vMZL.css,11hvENnYNUL.css,11FRI-QT39L.css,01890+Vwk8L.css,01864Lq457L.css,01cbS3UK11L.css,21F85am0yFL.css,016Sx2kF1+L.css_.css?AUIClients/AmazonUI HTTP/1.1Host: m.media-amazon.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://21pr-bh.pages.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/I/41-WpIOxHtL._RC%7C71WcWayc12L.css,41dpoO9BIuL.css,111mRDKcFfL.css,31ZORydBM5L.css,31YZpDCYJPL.css,21pkK7OQMnL.css,41yQj5y2obL.css,110Nj+wUGYL.css,31OvHRW+XiL.css,01R53xsjpjL.css,11EKggV-DlL.css,41yKpEQVJkL.css,11qTzxZ0Y5L.css_.css?AUIClients/NavDesktopUberAsset&pmUWguIX HTTP/1.1Host: images-na.ssl-images-amazon.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://21pr-bh.pages.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/I/4171sdbgqbL.css?AUIClients/AmazonGatewayAuiAssets HTTP/1.1Host: images-na.ssl-images-amazon.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://21pr-bh.pages.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/I/61IlupYtztL._SX1500_.jpg HTTP/1.1Host: m.media-amazon.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://21pr-bh.pages.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/G/01/gno/sprites/nav-sprite-global-1x-reorg-privacy._CB587940754_.png HTTP/1.1Host: m.media-amazon.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://21pr-bh.pages.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/G/01/PLF/Daily_Ritual/2020/SPRING-DRIVERS/DAILY-RITUAL-COTTON-PUFF-SLEEVE_DT_CC_379x304_1x._SY304_CB410865121_.jpg HTTP/1.1Host: images-na.ssl-images-amazon.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://21pr-bh.pages.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/G/01/gno/sprites/nav-sprite-global-1x-reorg-privacy._CB587940754_.png HTTP/1.1Host: m.media-amazon.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/I/61IlupYtztL._SX1500_.jpg HTTP/1.1Host: m.media-amazon.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/G/01/AMAZON_FASHION/2020/journeys/NTE3Zjc1NTEt/NTE3Zjc1NTEt-ZWVhMjc2YjAt-w186._SY116_CB410473316_.jpg HTTP/1.1Host: images-na.ssl-images-amazon.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://21pr-bh.pages.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/G/01/AMAZON_FASHION/2020/journeys/NTE3Zjc1NTEt/NTE3Zjc1NTEt-N2IwYmQwNGIt-w186._SY116_CB428347147_.jpg HTTP/1.1Host: images-na.ssl-images-amazon.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://21pr-bh.pages.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/G/01/PLF/Daily_Ritual/2020/SPRING-DRIVERS/DAILY-RITUAL-COTTON-PUFF-SLEEVE_DT_CC_379x304_1x._SY304_CB410865121_.jpg HTTP/1.1Host: images-na.ssl-images-amazon.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/G/01/AMAZON_FASHION/2020/journeys/NTE3Zjc1NTEt/NTE3Zjc1NTEt-ZWVhMjc2YjAt-w186._SY116_CB410473316_.jpg HTTP/1.1Host: images-na.ssl-images-amazon.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /1/batch/1/OP/ATVPDKIKX0DER:130-6094456-2209015:VBJMAZKYKCEXVRP5R475$uedata=s:%2Frd%2Fuedata%3Fstaticb%26id%3DVBJMAZKYKCEXVRP5R475:0 HTTP/1.1Host: fls-na.amazon.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://21pr-bh.pages.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/G/01/AMAZON_FASHION/2020/journeys/NTE3Zjc1NTEt/NTE3Zjc1NTEt-MzBhMzU0M2Mt-w186._SY116_CB428347144_.jpg HTTP/1.1Host: images-na.ssl-images-amazon.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://21pr-bh.pages.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/G/01/AMAZON_FASHION/2020/journeys/NTE3Zjc1NTEt/NTE3Zjc1NTEt-N2IwYmQwNGIt-w186._SY116_CB428347147_.jpg HTTP/1.1Host: images-na.ssl-images-amazon.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/G/01/AMAZON_FASHION/2020/journeys/NTE3Zjc1NTEt/NTE3Zjc1NTEt-YjliNzM1M2Mt-w186._SY116_CB428347147_.jpg HTTP/1.1Host: images-na.ssl-images-amazon.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://21pr-bh.pages.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /1/batch/1/OP/ATVPDKIKX0DER:130-6094456-2209015:VBJMAZKYKCEXVRP5R475$uedata=s:%2Frd%2Fuedata%3Fstaticb%26id%3DVBJMAZKYKCEXVRP5R475:0 HTTP/1.1Host: fls-na.amazon.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/G/01/AmazonServices/Site/US/Product/FBA/Outlet/Merchandising/Outlet_GW_BS_DSC_379x304._SY304_CB409178716_.jpg HTTP/1.1Host: images-na.ssl-images-amazon.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://21pr-bh.pages.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/G/01/AMAZON_FASHION/2020/journeys/NTE3Zjc1NTEt/NTE3Zjc1NTEt-MzBhMzU0M2Mt-w186._SY116_CB428347144_.jpg HTTP/1.1Host: images-na.ssl-images-amazon.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/G/01/AMAZON_FASHION/2020/journeys/NTE3Zjc1NTEt/NTE3Zjc1NTEt-YjliNzM1M2Mt-w186._SY116_CB428347147_.jpg HTTP/1.1Host: images-na.ssl-images-amazon.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/G/01/img18/home/journeys/OWFhYjJmNGIt/OWFhYjJmNGIt-NzIwODU5ZmIt-w379._SY304_CB405958196_.jpg HTTP/1.1Host: images-na.ssl-images-amazon.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://21pr-bh.pages.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/G/01/kindle/journeys/YjAwMjVmYjUt/YjAwMjVmYjUt-YmMzZGJjMzYt-w379._SY304_CB410321238_.jpg HTTP/1.1Host: images-na.ssl-images-amazon.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://21pr-bh.pages.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/G/01/AmazonServices/Site/US/Product/FBA/Outlet/Merchandising/Outlet_GW_BS_DSC_379x304._SY304_CB409178716_.jpg HTTP/1.1Host: images-na.ssl-images-amazon.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/G/01/img18/home/journeys/OWFhYjJmNGIt/OWFhYjJmNGIt-NzIwODU5ZmIt-w379._SY304_CB405958196_.jpg HTTP/1.1Host: images-na.ssl-images-amazon.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/G/01/img18/home/journeys/MjJkZGVlZDYt/MjJkZGVlZDYt-OGRmN2JmYWEt-w379._SY304_CB410698465_.jpg HTTP/1.1Host: images-na.ssl-images-amazon.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://21pr-bh.pages.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/G/01/softlines/shopbop/ingress/2020/CategoryCards/mp_20200604_fashion_desktopsinglecategory_desktop_379x304._SY304_CB430707313_.jpg HTTP/1.1Host: images-na.ssl-images-amazon.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://21pr-bh.pages.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/G/01/img18/home/journeys/MjJkZGVlZDYt/MjJkZGVlZDYt-OGRmN2JmYWEt-w379._SY304_CB410698465_.jpg HTTP/1.1Host: images-na.ssl-images-amazon.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/G/01/kindle/journeys/YjAwMjVmYjUt/YjAwMjVmYjUt-YmMzZGJjMzYt-w379._SY304_CB410321238_.jpg HTTP/1.1Host: images-na.ssl-images-amazon.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/G/01/personalization/ybh/loading-4x-gray._CB485916920_.gif HTTP/1.1Host: m.media-amazon.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://21pr-bh.pages.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/G/01/personalization/ybh/loading-4x-gray._CB485916920_.gif HTTP/1.1Host: m.media-amazon.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/G/01/softlines/shopbop/ingress/2020/CategoryCards/mp_20200604_fashion_desktopsinglecategory_desktop_379x304._SY304_CB430707313_.jpg HTTP/1.1Host: images-na.ssl-images-amazon.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: 21pr-bh.pages.dev
Source: global traffic	DNS traffic detected: DNS query: images-na.ssl-images-amazon.com
Source: global traffic	DNS traffic detected: DNS query: m.media-amazon.com
Source: global traffic	DNS traffic detected: DNS query: completion.amazon.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: fls-na.amazon.com

Source: unknown

HTTP traffic detected: POST /report/v4?s=AKS00UEIHuqEG5fXVVL4FlkSPhzfvfTF8CtWo2zXbjyiEZkXKkdNFUptzwD8fO3kuxzhvM30g8XV3YnFtPVGRUmpaP%2F1dT85z9bwlu1VproBZemzvXliBq76%2BaEIU2q%2FYXKFQg%3D%3D HTTP/1.1Host: a.nel.cloudflare.comConnection: keep-aliveContent-Length: 427Content-Type: application/reports+jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: chromecache_71.2.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/-0k$2FlUkg9tyD3.png)
Source: chromecache_71.2.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/-NcRiM84u1IwoUa.gif)
Source: chromecache_77.2.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/16Ce0wZkrsCr$en.png)
Source: chromecache_71.2.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/2SazJx$EeTHfhMN.woff2)
Source: chromecache_77.2.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/5uJUWEszo9hoRiT.png);background-size:contain
Source: chromecache_77.2.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/7Nf$80pr8M8iP8U.png)
Source: chromecache_71.2.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/CKWYNOHAO2meoCm.png)
Source: chromecache_71.2.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/CjbL$jCCegyfqZ7.woff)
Source: chromecache_71.2.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/Dv1WQ5DdeMS5qP7.woff2)
Source: chromecache_77.2.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/GfikJ0xvVSRQIzY.png)
Source: chromecache_71.2.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/JJsp0ZvgpfwzJM6.woff)
Source: chromecache_71.2.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/JT89MwO$JunoYts.png)
Source: chromecache_71.2.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/KFPk-9IF4FqAqY-.woff2)
Source: chromecache_71.2.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/KwhNPG8Jz-Vz2X7.woff2)
Source: chromecache_71.2.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/McBZv0ZvnbehkIx.png);background-repeat:no-repeat;background
Source: chromecache_77.2.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/MzBlK1UBudXJetO.png)
Source: chromecache_71.2.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/VjTR4RqBzY0mUYx.woff2)
Source: chromecache_71.2.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/WOnTLzkiaEccV7F.woff2)
Source: chromecache_71.2.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/XIvhNCZAsrT80Wz.woff)
Source: chromecache_71.2.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/YAEPfuhs1l-argd.woff)
Source: chromecache_71.2.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/e0LnMbFWJC-TMQz.woff)
Source: chromecache_71.2.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/fe7v9cZH5dQOFva.png)
Source: chromecache_71.2.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/fo5c7019B0Hy4wH.png);-webkit-background-size:512px
Source: chromecache_77.2.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/hmVNTQDah1G18pL.png)
Source: chromecache_77.2.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/jkRuHu16eujI0WC.png)
Source: chromecache_71.2.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/kfKKBuoqcD$AUKL.woff)
Source: chromecache_71.2.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/mzVbGSgvdBfRLX9.woff)
Source: chromecache_71.2.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/ozb5-CLHQWI6Soc.woff2)
Source: chromecache_71.2.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/pDxWAF1pBB0dzGB.woff2)
Source: chromecache_71.2.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/prp2-N9d2Q$gDX5.gif)
Source: chromecache_71.2.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/twzZHebXjCHBb6v.woff)
Source: chromecache_71.2.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/ydDD9hnRfziI$y7.png)

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: classification engine

Classification label: mal56.win@16/54@20/9

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 --field-trial-handle=1988,i,18011644174194857254,6384242748714115494,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://21pr-bh.pages.dev/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 --field-trial-handle=1988,i,18011644174194857254,6384242748714115494,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.66.44.147	21pr-bh.pages.dev	United States	13335	CLOUDFLARENETUS	false
151.101.1.16	media.amazon.map.fastly.net	United States	54113	FASTLYUS	false
18.239.85.223	c.media-amazon.com	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
44.193.44.0	unknown	United States	14618	AMAZON-AESUS	false
34.232.218.19	endpoint.prod.us-east-1.forester.a2z.com	United States	14618	AMAZON-AESUS	false
142.250.74.196	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.5

Contacted Domains

Name	IP	Active
completion.amazon.com	44.215.142.139	true
bg.microsoft.map.fastly.net	199.232.214.172	true
a.nel.cloudflare.com	35.190.80.1	true
21pr-bh.pages.dev	172.66.44.147	true
www.google.com	142.250.74.196	true
c.media-amazon.com	18.239.85.223	true
media.amazon.map.fastly.net	151.101.1.16	true
fp2e7a.wpc.phicdn.net	192.229.221.95	true
endpoint.prod.us-east-1.forester.a2z.com	34.232.218.19	true
m.media-amazon.com	unknown	unknown
images-na.ssl-images-amazon.com	unknown	unknown
fls-na.amazon.com	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://fls-na.amazon.com/1/batch/1/OP/ATVPDKIKX0DER:130-6094456-2209015:VBJMAZKYKCEXVRP5R475$uedata=s:%2Frd%2Fuedata%3Fstaticb%26id%3DVBJMAZKYKCEXVRP5R475:0	false	Avira URL Cloud: safe	unknown
https://images-na.ssl-images-amazon.com/images/G/01/PLF/Daily_Ritual/2020/SPRING-DRIVERS/DAILY-RITUAL-COTTON-PUFF-SLEEVE_DT_CC_379x304_1x._SY304_CB410865121_.jpg	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://images-na.ssl-images-amazon.com/images/G/01/AMAZON_FASHION/2020/journeys/NTE3Zjc1NTEt/NTE3Zjc1NTEt-YjliNzM1M2Mt-w186._SY116_CB428347147_.jpg	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://images-na.ssl-images-amazon.com/images/G/01/AmazonServices/Site/US/Product/FBA/Outlet/Merchandising/Outlet_GW_BS_DSC_379x304._SY304_CB409178716_.jpg	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://21pr-bh.pages.dev/	true		unknown
https://images-na.ssl-images-amazon.com/images/G/01/softlines/shopbop/ingress/2020/CategoryCards/mp_20200604_fashion_desktopsinglecategory_desktop_379x304._SY304_CB430707313_.jpg	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://images-na.ssl-images-amazon.com/images/G/01/AMAZON_FASHION/2020/journeys/NTE3Zjc1NTEt/NTE3Zjc1NTEt-MzBhMzU0M2Mt-w186._SY116_CB428347144_.jpg	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://m.media-amazon.com/images/G/01/personalization/ybh/loading-4x-gray._CB485916920_.gif	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://images-na.ssl-images-amazon.com/images/G/01/img18/home/journeys/MjJkZGVlZDYt/MjJkZGVlZDYt-OGRmN2JmYWEt-w379._SY304_CB410698465_.jpg	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://images-na.ssl-images-amazon.com/images/G/01/img18/home/journeys/OWFhYjJmNGIt/OWFhYjJmNGIt-NzIwODU5ZmIt-w379._SY304_CB405958196_.jpg	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://m.media-amazon.com/images/G/01/gno/sprites/nav-sprite-global-1x-reorg-privacy._CB587940754_.png	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://images-na.ssl-images-amazon.com/images/G/01/kindle/journeys/YjAwMjVmYjUt/YjAwMjVmYjUt-YmMzZGJjMzYt-w379._SY304_CB410321238_.jpg	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://m.media-amazon.com/images/I/61IlupYtztL._SX1500_.jpg	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://images-na.ssl-images-amazon.com/images/I/4171sdbgqbL.css?AUIClients/AmazonGatewayAuiAssets	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://images-na.ssl-images-amazon.com/images/I/41-WpIOxHtL._RC%7C71WcWayc12L.css,41dpoO9BIuL.css,111mRDKcFfL.css,31ZORydBM5L.css,31YZpDCYJPL.css,21pkK7OQMnL.css,41yQj5y2obL.css,110Nj+wUGYL.css,31OvHRW+XiL.css,01R53xsjpjL.css,11EKggV-DlL.css,41yKpEQVJkL.css,11qTzxZ0Y5L.css_.css?AUIClients/NavDesktopUberAsset&pmUWguIX	false	Avira URL Cloud: safe	unknown
https://images-na.ssl-images-amazon.com/images/G/01/AMAZON_FASHION/2020/journeys/NTE3Zjc1NTEt/NTE3Zjc1NTEt-ZWVhMjc2YjAt-w186._SY116_CB410473316_.jpg	false	Avira URL Cloud: safe	unknown
https://images-na.ssl-images-amazon.com/images/G/01/AMAZON_FASHION/2020/journeys/NTE3Zjc1NTEt/NTE3Zjc1NTEt-N2IwYmQwNGIt-w186._SY116_CB428347147_.jpg	false	Avira URL Cloud: safe	unknown
https://a.nel.cloudflare.com/report/v4?s=AKS00UEIHuqEG5fXVVL4FlkSPhzfvfTF8CtWo2zXbjyiEZkXKkdNFUptzwD8fO3kuxzhvM30g8XV3YnFtPVGRUmpaP%2F1dT85z9bwlu1VproBZemzvXliBq76%2BaEIU2q%2FYXKFQg%3D%3D	false	Avira URL Cloud: safe	unknown

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun May 26 21:42:19 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	FF91A1B5B7CA2178B3A74C5B395D335C	B95755C0A60BCD09F0386CF735489905B358FD06	3762AAE8564076DB25D1F92F4064A6C30E3888B543C95A876C60B51EF1BB1C2A
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun May 26 21:42:19 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	6B143F78748EAE8E07C7A7345AA83658	66F513701F428543F89108583AB0581377D3F581	D1EC388C3F0A12EBD8DAA9DBD8B5E3556A837FBB88DED4A2D1222FC538BB6295
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	EE2CB566004C00350610DA0ABAD5734A	8809FE8A161FF3C0A850AB47FA4851B7E819EF19	F537D304646145C2C3197CB05126457605CEF3EBD261F1EB4C05CC8BFDAE4AF9
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun May 26 21:42:19 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	E4B5F44A4BA4032E596EB3BE9C59C26B	5FEC26A154114EA1F4155FFFCF0A1321761ABA7F	8AAD0E3A382AFF4B81CBA5A0BA3A5B90E764219B1191231B4B1A0857C4D99EC7
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun May 26 21:42:19 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	1B3920908F6DB92B4EA152DABA38D430	E302E3F6AFC749441C0BBD3A113232378F22E5E4	460A494297653AA4F8DD66A4E1D91B3950382E38D346F1615C94C01715EB9FC8
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun May 26 21:42:19 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	9D062E5CEA379C193C6F0C39256E9405	E9164AAEBA395E1AE911D1CBFA85A39D18EF3999	49ACE13C58BAC2F948090046B6DBDCD60ADF4171B560C2643E44F63AFA4A37F2
Chrome Cache Entry: 58	GIF image data, version 89a, 64 x 64	B05B81750794CA693E9589C0A171634F	FA91375275E3E1C8FCD8F79BCAE5D85593A33C67	FF24D4B094AB1896672F4C8D387150C74BBB2493F7D01BEA7C87247AA0AB3BB5
Chrome Cache Entry: 59	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 379x304, components 3	979EA6E11B8FB659A236347797C50443	7E23CDB56BB47CD6C69E9BA89488BED7A43726A2	7E42AE04A2EF109FBB814EB852A5D4E30F3B20C996E434987F746A82C80645B8
Chrome Cache Entry: 60	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1500x600, components 3	57FB83C4E9A07B1F401C45E43638864B	CC75E5B04209AD59991785387E097A22DF90DED9	415CFA5BD1ADBFC09A74A0652A306406342CB3B5CE4AA881BFEF4F1C6AC6A88D
Chrome Cache Entry: 61	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 186x116, components 3	E07A01407BE7CC20FB908A154CF4095C	C8440DF0AC0C84A7CA17A982B7C19B4A599682CE	8416D10567DE48E02FB65ADBCCF8A0C5B52F69088FC52B0845FB6769786483FD
Chrome Cache Entry: 62	PNG image data, 350 x 450, 8-bit colormap, non-interlaced	64224EC939AC0B3487645C4E109030D5	B5AC2A7BC2AF1C9226987439F34BA8D4A79FBF0B	2818F0BCCC7DDAA8E893C4655473D82589146DCC6E7AA6F78CEB9B3D4440C809
Chrome Cache Entry: 63	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 186x116, components 3	74DF82C3C019695980EEF3997FFE5EBD	7569B6C8E810DC8C19BD030F3E3FDDA0F48AD13B	7ACA53C298DD372C5B0644F3920CADEA56DCDEAF1E3E7043994F140902AC7E3F
Chrome Cache Entry: 64	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 186x116, components 3	E46D1375948B1FDF8B2C1D16ECA92EAF	A37BB5185AD7BDA2D46398D2957F2B7D6985C603	3E47A2CE975CC19A404D5426B0A8E3BAB59EDBAE8098BC1FFF336AA6C7598740
Chrome Cache Entry: 65	GIF image data, version 89a, 1 x 1	E68CC604CAB69BF03B8CD228D940F5EF	15C0C62C4C7C917B5DD82A8E1E439211A44B9E98	A3A64AEA2E96EC58A163DDB8D4CF86CF236178ED2D225B8F44154BC1B010DDCE
Chrome Cache Entry: 66	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 379x304, components 3	7C437DAF04C2C4819DE059B5501C9CFA	EAAAA642A0BBC04A80ADD2BDCAFDAAE5198BF04C	89A0E74545DB3CC46BCE8F6F3DD8924D19B3A38465C85D3768F4D23F2EF5564A
Chrome Cache Entry: 67	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1500x600, components 3	57FB83C4E9A07B1F401C45E43638864B	CC75E5B04209AD59991785387E097A22DF90DED9	415CFA5BD1ADBFC09A74A0652A306406342CB3B5CE4AA881BFEF4F1C6AC6A88D
Chrome Cache Entry: 68	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 379x304, components 3	72909BD639043C2884C392662D3B48AC	03BF32AB0F6C6930B6AC76C226C7D482CA006BCA	FE18337CADBEB83F6B32E198E644EF381D7630EA9F525B02AA9BBBA2DEE9FE07
Chrome Cache Entry: 69	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 186x116, components 3	74DF82C3C019695980EEF3997FFE5EBD	7569B6C8E810DC8C19BD030F3E3FDDA0F48AD13B	7ACA53C298DD372C5B0644F3920CADEA56DCDEAF1E3E7043994F140902AC7E3F
Chrome Cache Entry: 70	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 379x304, components 3	7C437DAF04C2C4819DE059B5501C9CFA	EAAAA642A0BBC04A80ADD2BDCAFDAAE5198BF04C	89A0E74545DB3CC46BCE8F6F3DD8924D19B3A38465C85D3768F4D23F2EF5564A
Chrome Cache Entry: 71	ASCII text, with very long lines (23136)	DD3A9DEF5C15A45D1FB0FF2D0AED1AE1	61A7D6AE14F1315D11BA162F061A51351FAA5BA6	F1674B4BB0FDB594CE2A0D828E178951AD5588BCB5F569808675CDAE82D2ABA7
Chrome Cache Entry: 72	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 379x304, components 3	979EA6E11B8FB659A236347797C50443	7E23CDB56BB47CD6C69E9BA89488BED7A43726A2	7E42AE04A2EF109FBB814EB852A5D4E30F3B20C996E434987F746A82C80645B8
Chrome Cache Entry: 73	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 379x304, components 3	124122CBF246958DF9B12F70B50AD0D2	F29682E8701BBEA179D69E919EBD7246AF939BEA	D1806B23FD34A09F24A929C96B05A9AFB91C8898FB3BE0AD4CE062D709D32572
Chrome Cache Entry: 74	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 186x116, components 3	E07A01407BE7CC20FB908A154CF4095C	C8440DF0AC0C84A7CA17A982B7C19B4A599682CE	8416D10567DE48E02FB65ADBCCF8A0C5B52F69088FC52B0845FB6769786483FD
Chrome Cache Entry: 75	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=1], baseline, precision 8, 379x304, components 3	40F76ADA03583975F73D64DB9B77F3EF	6B1552FDBA3D3F596FF387AD837C8DCCF00C87AE	E0A316F186E58B3F9769AF4B91A4A6FB0D6FBC4FEA1677EAB4E358B621526208
Chrome Cache Entry: 76	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 186x116, components 3	33803793A18D00C350217EF8EA3A0219	56404C68C783CF49A5DC04243A78B3023C4BF97C	0D4F4CD65F3FDF506E0E2709A433ED22D1F39AF18334B1A57B4EF2A069898901
Chrome Cache Entry: 77	ASCII text, with very long lines (37608)	EDEF7696DC1DD15ECE6E49B375603515	A2D21EC6970B7A5570287EDB7DDB31B501C46718	B2E846E5F8449794FDFA16DE8DE5055F7184D05411ECDBE65A96C184C54A9423
Chrome Cache Entry: 78	GIF image data, version 89a, 64 x 64	B05B81750794CA693E9589C0A171634F	FA91375275E3E1C8FCD8F79BCAE5D85593A33C67	FF24D4B094AB1896672F4C8D387150C74BBB2493F7D01BEA7C87247AA0AB3BB5
Chrome Cache Entry: 79	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 186x116, components 3	E46D1375948B1FDF8B2C1D16ECA92EAF	A37BB5185AD7BDA2D46398D2957F2B7D6985C603	3E47A2CE975CC19A404D5426B0A8E3BAB59EDBAE8098BC1FFF336AA6C7598740
Chrome Cache Entry: 80	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=1], baseline, precision 8, 379x304, components 3	40F76ADA03583975F73D64DB9B77F3EF	6B1552FDBA3D3F596FF387AD837C8DCCF00C87AE	E0A316F186E58B3F9769AF4B91A4A6FB0D6FBC4FEA1677EAB4E358B621526208
Chrome Cache Entry: 81	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 186x116, components 3	33803793A18D00C350217EF8EA3A0219	56404C68C783CF49A5DC04243A78B3023C4BF97C	0D4F4CD65F3FDF506E0E2709A433ED22D1F39AF18334B1A57B4EF2A069898901
Chrome Cache Entry: 82	PNG image data, 350 x 450, 8-bit colormap, non-interlaced	64224EC939AC0B3487645C4E109030D5	B5AC2A7BC2AF1C9226987439F34BA8D4A79FBF0B	2818F0BCCC7DDAA8E893C4655473D82589146DCC6E7AA6F78CEB9B3D4440C809
Chrome Cache Entry: 83	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=1], baseline, precision 8, 379x304, components 3	4C27A447AC14027A2A0159A2E06DB48B	24F0E8B323F503D7AB7EB4CFBDB3454BFB1A4D1D	C5459F4ADCFA29FD848D3C6033A03070E8A07016534C53E88327848C24452BBA
Chrome Cache Entry: 84	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 379x304, components 3	124122CBF246958DF9B12F70B50AD0D2	F29682E8701BBEA179D69E919EBD7246AF939BEA	D1806B23FD34A09F24A929C96B05A9AFB91C8898FB3BE0AD4CE062D709D32572
Chrome Cache Entry: 85	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 379x304, components 3	72909BD639043C2884C392662D3B48AC	03BF32AB0F6C6930B6AC76C226C7D482CA006BCA	FE18337CADBEB83F6B32E198E644EF381D7630EA9F525B02AA9BBBA2DEE9FE07
Chrome Cache Entry: 86	ASCII text, with very long lines (18042), with no line terminators	7A31517472D9E15DE87647BA9C3090E7	A00D074C05864013A589873CA7F857001E17A27E	520F46DDAB60693E4643B402BA33A71C6CFEC2C908C32F821796BC1150B4FA60
Chrome Cache Entry: 87	GIF image data, version 89a, 1 x 1	E68CC604CAB69BF03B8CD228D940F5EF	15C0C62C4C7C917B5DD82A8E1E439211A44B9E98	A3A64AEA2E96EC58A163DDB8D4CF86CF236178ED2D225B8F44154BC1B010DDCE
Chrome Cache Entry: 88	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=1], baseline, precision 8, 379x304, components 3	4C27A447AC14027A2A0159A2E06DB48B	24F0E8B323F503D7AB7EB4CFBDB3454BFB1A4D1D	C5459F4ADCFA29FD848D3C6033A03070E8A07016534C53E88327848C24452BBA

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://21pr-bh.pages.dev/	Avira URL Cloud: detection malicious, Label: phishing
Source: https://21pr-bh.pages.dev/	SlashNext: detection malicious, Label: Credential Stealing type: Phishing & Social Engineering

Multi AV Scanner detection for submitted file

Source: https://21pr-bh.pages.dev/

Virustotal: Detection: 16%

Perma Link

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49756 version: TLS 1.0

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49756 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 21pr-bh.pages.devConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/I/11EIQ5IGqaL._RC%7C01e5ncglxyL.css,01lF2n-pPaL.css,41SwWPpN5yL.css,31+Z83i6adL.css,01IWMurvs8L.css,01ToTiqCP7L.css,01qPl4hxayL.css,01ITNc8rK9L.css,413Vvv3GONL.css,11TIuySqr6L.css,01Rw4F+QU6L.css,11j54vTBQxL.css,01pbKJp5dbL.css,01IdKcBuAdL.css,01y-XAlI+2L.css,213SZJ8Z+PL.css,01oDR3IULNL.css,51qPa7JG96L.css,01XPHJk60-L.css,01dmkcyJuIL.css,01B9+-hVWxL.css,21Ol27dM9tL.css,11JRZ3s9niL.css,21wA+jAxKjL.css,11U8GXfhueL.css,01CFUgsA-YL.css,316CD+csp-L.css,116t+WD27UL.css,11uWFHlOmWL.css,11v8YDG4ifL.css,11otOAnaYoL.css,01FwL+mJQOL.css,11NDsgnHEZL.css,21RE+gQIxcL.css,11CLXYZ6DRL.css,012f1fcyibL.css,21w-O41p+SL.css,11XH+76vMZL.css,11hvENnYNUL.css,11FRI-QT39L.css,01890+Vwk8L.css,01864Lq457L.css,01cbS3UK11L.css,21F85am0yFL.css,016Sx2kF1+L.css_.css?AUIClients/AmazonUI HTTP/1.1Host: m.media-amazon.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://21pr-bh.pages.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/I/41-WpIOxHtL._RC%7C71WcWayc12L.css,41dpoO9BIuL.css,111mRDKcFfL.css,31ZORydBM5L.css,31YZpDCYJPL.css,21pkK7OQMnL.css,41yQj5y2obL.css,110Nj+wUGYL.css,31OvHRW+XiL.css,01R53xsjpjL.css,11EKggV-DlL.css,41yKpEQVJkL.css,11qTzxZ0Y5L.css_.css?AUIClients/NavDesktopUberAsset&pmUWguIX HTTP/1.1Host: images-na.ssl-images-amazon.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://21pr-bh.pages.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/I/4171sdbgqbL.css?AUIClients/AmazonGatewayAuiAssets HTTP/1.1Host: images-na.ssl-images-amazon.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://21pr-bh.pages.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/I/61IlupYtztL._SX1500_.jpg HTTP/1.1Host: m.media-amazon.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://21pr-bh.pages.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/G/01/gno/sprites/nav-sprite-global-1x-reorg-privacy._CB587940754_.png HTTP/1.1Host: m.media-amazon.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://21pr-bh.pages.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/G/01/PLF/Daily_Ritual/2020/SPRING-DRIVERS/DAILY-RITUAL-COTTON-PUFF-SLEEVE_DT_CC_379x304_1x._SY304_CB410865121_.jpg HTTP/1.1Host: images-na.ssl-images-amazon.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://21pr-bh.pages.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/G/01/gno/sprites/nav-sprite-global-1x-reorg-privacy._CB587940754_.png HTTP/1.1Host: m.media-amazon.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/I/61IlupYtztL._SX1500_.jpg HTTP/1.1Host: m.media-amazon.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/G/01/AMAZON_FASHION/2020/journeys/NTE3Zjc1NTEt/NTE3Zjc1NTEt-ZWVhMjc2YjAt-w186._SY116_CB410473316_.jpg HTTP/1.1Host: images-na.ssl-images-amazon.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://21pr-bh.pages.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/G/01/AMAZON_FASHION/2020/journeys/NTE3Zjc1NTEt/NTE3Zjc1NTEt-N2IwYmQwNGIt-w186._SY116_CB428347147_.jpg HTTP/1.1Host: images-na.ssl-images-amazon.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://21pr-bh.pages.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/G/01/PLF/Daily_Ritual/2020/SPRING-DRIVERS/DAILY-RITUAL-COTTON-PUFF-SLEEVE_DT_CC_379x304_1x._SY304_CB410865121_.jpg HTTP/1.1Host: images-na.ssl-images-amazon.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/G/01/AMAZON_FASHION/2020/journeys/NTE3Zjc1NTEt/NTE3Zjc1NTEt-ZWVhMjc2YjAt-w186._SY116_CB410473316_.jpg HTTP/1.1Host: images-na.ssl-images-amazon.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /1/batch/1/OP/ATVPDKIKX0DER:130-6094456-2209015:VBJMAZKYKCEXVRP5R475$uedata=s:%2Frd%2Fuedata%3Fstaticb%26id%3DVBJMAZKYKCEXVRP5R475:0 HTTP/1.1Host: fls-na.amazon.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://21pr-bh.pages.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/G/01/AMAZON_FASHION/2020/journeys/NTE3Zjc1NTEt/NTE3Zjc1NTEt-MzBhMzU0M2Mt-w186._SY116_CB428347144_.jpg HTTP/1.1Host: images-na.ssl-images-amazon.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://21pr-bh.pages.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/G/01/AMAZON_FASHION/2020/journeys/NTE3Zjc1NTEt/NTE3Zjc1NTEt-N2IwYmQwNGIt-w186._SY116_CB428347147_.jpg HTTP/1.1Host: images-na.ssl-images-amazon.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/G/01/AMAZON_FASHION/2020/journeys/NTE3Zjc1NTEt/NTE3Zjc1NTEt-YjliNzM1M2Mt-w186._SY116_CB428347147_.jpg HTTP/1.1Host: images-na.ssl-images-amazon.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://21pr-bh.pages.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /1/batch/1/OP/ATVPDKIKX0DER:130-6094456-2209015:VBJMAZKYKCEXVRP5R475$uedata=s:%2Frd%2Fuedata%3Fstaticb%26id%3DVBJMAZKYKCEXVRP5R475:0 HTTP/1.1Host: fls-na.amazon.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/G/01/AmazonServices/Site/US/Product/FBA/Outlet/Merchandising/Outlet_GW_BS_DSC_379x304._SY304_CB409178716_.jpg HTTP/1.1Host: images-na.ssl-images-amazon.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://21pr-bh.pages.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/G/01/AMAZON_FASHION/2020/journeys/NTE3Zjc1NTEt/NTE3Zjc1NTEt-MzBhMzU0M2Mt-w186._SY116_CB428347144_.jpg HTTP/1.1Host: images-na.ssl-images-amazon.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/G/01/AMAZON_FASHION/2020/journeys/NTE3Zjc1NTEt/NTE3Zjc1NTEt-YjliNzM1M2Mt-w186._SY116_CB428347147_.jpg HTTP/1.1Host: images-na.ssl-images-amazon.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/G/01/img18/home/journeys/OWFhYjJmNGIt/OWFhYjJmNGIt-NzIwODU5ZmIt-w379._SY304_CB405958196_.jpg HTTP/1.1Host: images-na.ssl-images-amazon.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://21pr-bh.pages.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/G/01/kindle/journeys/YjAwMjVmYjUt/YjAwMjVmYjUt-YmMzZGJjMzYt-w379._SY304_CB410321238_.jpg HTTP/1.1Host: images-na.ssl-images-amazon.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://21pr-bh.pages.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/G/01/AmazonServices/Site/US/Product/FBA/Outlet/Merchandising/Outlet_GW_BS_DSC_379x304._SY304_CB409178716_.jpg HTTP/1.1Host: images-na.ssl-images-amazon.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/G/01/img18/home/journeys/OWFhYjJmNGIt/OWFhYjJmNGIt-NzIwODU5ZmIt-w379._SY304_CB405958196_.jpg HTTP/1.1Host: images-na.ssl-images-amazon.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/G/01/img18/home/journeys/MjJkZGVlZDYt/MjJkZGVlZDYt-OGRmN2JmYWEt-w379._SY304_CB410698465_.jpg HTTP/1.1Host: images-na.ssl-images-amazon.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://21pr-bh.pages.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/G/01/softlines/shopbop/ingress/2020/CategoryCards/mp_20200604_fashion_desktopsinglecategory_desktop_379x304._SY304_CB430707313_.jpg HTTP/1.1Host: images-na.ssl-images-amazon.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://21pr-bh.pages.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/G/01/img18/home/journeys/MjJkZGVlZDYt/MjJkZGVlZDYt-OGRmN2JmYWEt-w379._SY304_CB410698465_.jpg HTTP/1.1Host: images-na.ssl-images-amazon.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/G/01/kindle/journeys/YjAwMjVmYjUt/YjAwMjVmYjUt-YmMzZGJjMzYt-w379._SY304_CB410321238_.jpg HTTP/1.1Host: images-na.ssl-images-amazon.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/G/01/personalization/ybh/loading-4x-gray._CB485916920_.gif HTTP/1.1Host: m.media-amazon.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://21pr-bh.pages.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/G/01/personalization/ybh/loading-4x-gray._CB485916920_.gif HTTP/1.1Host: m.media-amazon.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/G/01/softlines/shopbop/ingress/2020/CategoryCards/mp_20200604_fashion_desktopsinglecategory_desktop_379x304._SY304_CB430707313_.jpg HTTP/1.1Host: images-na.ssl-images-amazon.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: 21pr-bh.pages.dev
Source: global traffic	DNS traffic detected: DNS query: images-na.ssl-images-amazon.com
Source: global traffic	DNS traffic detected: DNS query: m.media-amazon.com
Source: global traffic	DNS traffic detected: DNS query: completion.amazon.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: fls-na.amazon.com

Source: unknown

Source: chromecache_71.2.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/-0k$2FlUkg9tyD3.png)
Source: chromecache_71.2.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/-NcRiM84u1IwoUa.gif)
Source: chromecache_77.2.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/16Ce0wZkrsCr$en.png)
Source: chromecache_71.2.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/2SazJx$EeTHfhMN.woff2)
Source: chromecache_77.2.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/5uJUWEszo9hoRiT.png);background-size:contain
Source: chromecache_77.2.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/7Nf$80pr8M8iP8U.png)
Source: chromecache_71.2.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/CKWYNOHAO2meoCm.png)
Source: chromecache_71.2.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/CjbL$jCCegyfqZ7.woff)
Source: chromecache_71.2.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/Dv1WQ5DdeMS5qP7.woff2)
Source: chromecache_77.2.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/GfikJ0xvVSRQIzY.png)
Source: chromecache_71.2.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/JJsp0ZvgpfwzJM6.woff)
Source: chromecache_71.2.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/JT89MwO$JunoYts.png)
Source: chromecache_71.2.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/KFPk-9IF4FqAqY-.woff2)
Source: chromecache_71.2.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/KwhNPG8Jz-Vz2X7.woff2)
Source: chromecache_71.2.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/McBZv0ZvnbehkIx.png);background-repeat:no-repeat;background
Source: chromecache_77.2.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/MzBlK1UBudXJetO.png)
Source: chromecache_71.2.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/VjTR4RqBzY0mUYx.woff2)
Source: chromecache_71.2.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/WOnTLzkiaEccV7F.woff2)
Source: chromecache_71.2.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/XIvhNCZAsrT80Wz.woff)
Source: chromecache_71.2.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/YAEPfuhs1l-argd.woff)
Source: chromecache_71.2.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/e0LnMbFWJC-TMQz.woff)
Source: chromecache_71.2.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/fe7v9cZH5dQOFva.png)
Source: chromecache_71.2.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/fo5c7019B0Hy4wH.png);-webkit-background-size:512px
Source: chromecache_77.2.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/hmVNTQDah1G18pL.png)
Source: chromecache_77.2.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/jkRuHu16eujI0WC.png)
Source: chromecache_71.2.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/kfKKBuoqcD$AUKL.woff)
Source: chromecache_71.2.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/mzVbGSgvdBfRLX9.woff)
Source: chromecache_71.2.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/ozb5-CLHQWI6Soc.woff2)
Source: chromecache_71.2.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/pDxWAF1pBB0dzGB.woff2)
Source: chromecache_71.2.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/prp2-N9d2Q$gDX5.gif)
Source: chromecache_71.2.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/twzZHebXjCHBb6v.woff)
Source: chromecache_71.2.dr	String found in binary or memory: https://m.media-amazon.com/images/S/sash/ydDD9hnRfziI$y7.png)

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: classification engine

Classification label: mal56.win@16/54@20/9

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 --field-trial-handle=1988,i,18011644174194857254,6384242748714115494,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://21pr-bh.pages.dev/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 --field-trial-handle=1988,i,18011644174194857254,6384242748714115494,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

ID:	1447749
Product:	CloudBasic
Start time:	00:41:29
Start date:	27.05.2024
Cookbook:	browseurl.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Windows Analysis Report
https://21pr-bh.pages.dev/

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Compliance

Networking

System Summary

Boot Survival

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report https://21pr-bh.pages.dev/

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Compliance

Networking

System Summary

Boot Survival

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
https://21pr-bh.pages.dev/