Edit tour

Windows Analysis Report
44zg1cvu.msg

Overview

General Information

Sample name:	44zg1cvu.msg renamed because original name is a hash value
Original sample name:	FW BENEFITS OPEN ENROLLMENT 2024-2025 - PLEASE READ for Scott-electric Friday 28th of June 2024 m144zg1cvu.msg
Analysis ID:	1466358
MD5:	42b3b3e14a1c514a7647e2916c6f4cb5
SHA1:	b4db942f9d4ab74ee0c488433f083d273fad0c86
SHA256:	e66b870ef3fa0efb51d0912366587a5c2033a7b582088bac6e899c2cf366e897
Infos:

Detection

HTMLPhisher

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Snort IDS alert for network traffic

Yara detected HtmlPhish54

Performs DNS queries to domains with low reputation

Detected hidden input values containing email addresses (often used in phishing pages)

Found iframes

HTML body contains low number of good links

HTML page contains hidden URLs or javascript code

HTML title does not match URL

Queries the volume information (name, serial number etc) of a device

Sigma detected: Office Autorun Keys Modification

Sigma detected: Outlook Security Settings Updated - Registry

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

OUTLOOK.EXE (PID: 3964 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\44zg1cvu.msg" MD5: 91A5292942864110ED734005B7E005C0)

ai.exe (PID: 5752 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "94A4268F-64A9-402B-9D26-050228D3257E" "68CA683E-662B-479C-A333-B79E6B1D0F4B" "3964" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)

chrome.exe (PID: 6808 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\RKD4N0TN\LLZ-950309.htm MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 7000 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=1968,i,10276406539543630318,17323566579801720130,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 7324 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4616 --field-trial-handle=1968,i,10276406539543630318,17323566579801720130,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author
0.2.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
2.3.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
2.5.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
0.2.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
2.3.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
2.5.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
2.6.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
0.2.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
4.8.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
2.3.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
2.5.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
2.6.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
4.7.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
4.9.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
0.2.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
2.3.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
4.10.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
4.8.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
2.6.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
4.9.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
4.11.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
2.5.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
4.7.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
0.2.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
4.8.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
2.3.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
2.6.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
4.10.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
4.9.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
4.11.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
2.5.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
4.7.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
0.2.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
4.8.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
2.3.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
2.5.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
2.6.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
4.10.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
4.7.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
4.11.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
4.9.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
Click to see the 36 entries

Sigma Signatures

Sigma detected: Office Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 3964, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1

Sigma detected: Outlook Security Settings Updated - Registry

Source: Registry Key set

Author: frack113: Data: Details: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\RKD4N0TN\, EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 3964, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Security\OutlookSecureTempFolder

Snort Signatures

ETPRO CURRENT_EVENTS JS/PsyduckPockeball Payload Inbound - Source IP: 51.38.145.13 - Destination IP: 192.168.2.17

Timestamp:	07/02/24-20:22:04.124310
SID:	2857090
Source Port:	443
Destination Port:	49720
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected phishing page

Source: https://online.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz	LLM: Score: 9 brands: Microsoft Reasons: The URL 'https://online.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz' is highly suspicious. The domain name is not associated with Microsoft, which is the brand identified in the image. The legitimate domain for Microsoft is 'microsoft.com'. The presence of a prominent login form asking for a password without a CAPTCHA and the use of a misleading domain name are strong indicators of phishing. Social engineering techniques are evident as the page mimics the legitimate Microsoft login page to deceive users into entering their credentials. DOM: 2.6.pages.csv
Source: https://online.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz	LLM: Score: 9 brands: Microsoft Reasons: The URL 'https://online.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz' is highly suspicious due to its random string subdomain and the '.xyz' top-level domain, which is often used in phishing attacks. The webpage mimics Microsoft's login page, which is a common target for phishing. The presence of a prominent login form asking for a password without a captcha further raises suspicion. The legitimate domain for Microsoft is 'microsoft.com', and this URL does not match it. Additionally, the link for 'Forgot my password' and 'Sign in with another account' could be used to mislead users into providing their credentials. DOM: 4.7.pages.csv
Source: https://online.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz	LLM: Score: 9 brands: Microsoft Reasons: The URL 'https://online.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz' is highly suspicious due to its random string and unusual domain extension (.xyz), which is often used in phishing attacks. The page mimics a Microsoft login page, which is a common target for phishing. The presence of a prominent login form asking for a password without a CAPTCHA increases the risk. The legitimate domain for Microsoft is 'microsoft.com', and this URL does not match it. The use of social engineering techniques is evident as the page attempts to trick the user into entering their password by displaying a message about an incorrect password. Based on these factors, the site is determined to be a phishing site. DOM: 4.11.pages.csv

Yara detected HtmlPhish54

Source: Yara match	File source: 0.2.pages.csv, type: HTML
Source: Yara match	File source: 2.3.pages.csv, type: HTML
Source: Yara match	File source: 2.5.pages.csv, type: HTML
Source: Yara match	File source: 0.2.pages.csv, type: HTML
Source: Yara match	File source: 2.3.pages.csv, type: HTML
Source: Yara match	File source: 2.5.pages.csv, type: HTML
Source: Yara match	File source: 2.6.pages.csv, type: HTML
Source: Yara match	File source: 0.2.pages.csv, type: HTML
Source: Yara match	File source: 4.8.pages.csv, type: HTML
Source: Yara match	File source: 2.3.pages.csv, type: HTML
Source: Yara match	File source: 2.5.pages.csv, type: HTML
Source: Yara match	File source: 2.6.pages.csv, type: HTML
Source: Yara match	File source: 4.7.pages.csv, type: HTML
Source: Yara match	File source: 4.9.pages.csv, type: HTML
Source: Yara match	File source: 0.2.pages.csv, type: HTML
Source: Yara match	File source: 2.3.pages.csv, type: HTML
Source: Yara match	File source: 4.10.pages.csv, type: HTML
Source: Yara match	File source: 4.8.pages.csv, type: HTML
Source: Yara match	File source: 2.6.pages.csv, type: HTML
Source: Yara match	File source: 4.9.pages.csv, type: HTML
Source: Yara match	File source: 4.11.pages.csv, type: HTML
Source: Yara match	File source: 2.5.pages.csv, type: HTML
Source: Yara match	File source: 4.7.pages.csv, type: HTML
Source: Yara match	File source: 0.2.pages.csv, type: HTML
Source: Yara match	File source: 4.8.pages.csv, type: HTML
Source: Yara match	File source: 2.3.pages.csv, type: HTML
Source: Yara match	File source: 2.6.pages.csv, type: HTML
Source: Yara match	File source: 4.10.pages.csv, type: HTML
Source: Yara match	File source: 4.9.pages.csv, type: HTML
Source: Yara match	File source: 4.11.pages.csv, type: HTML
Source: Yara match	File source: 2.5.pages.csv, type: HTML
Source: Yara match	File source: 4.7.pages.csv, type: HTML
Source: Yara match	File source: 0.2.pages.csv, type: HTML
Source: Yara match	File source: 4.8.pages.csv, type: HTML
Source: Yara match	File source: 2.3.pages.csv, type: HTML
Source: Yara match	File source: 2.5.pages.csv, type: HTML
Source: Yara match	File source: 2.6.pages.csv, type: HTML
Source: Yara match	File source: 4.10.pages.csv, type: HTML
Source: Yara match	File source: 4.7.pages.csv, type: HTML
Source: Yara match	File source: 4.11.pages.csv, type: HTML
Source: Yara match	File source: 4.9.pages.csv, type: HTML

Source: https://online.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz/?zNUB6o=7wM0&username=melodi%40scott-electric.com&sso_reload=true

HTTP Parser: melodi@scott-electric.com

Source: https://online.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz/?zNUB6o=7wM0&username=melodi%40scott-electric.com&sso_reload=true	HTTP Parser: Iframe src: https://f0ec7674-83151dbc.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz/Prefetch/Prefetch.aspx
Source: https://online.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz/?zNUB6o=7wM0&username=melodi%40scott-electric.com&sso_reload=true	HTTP Parser: Iframe src: https://f0ec7674-83151dbc.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz/Prefetch/Prefetch.aspx
Source: https://online.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz/?zNUB6o=7wM0&username=melodi%40scott-electric.com&sso_reload=true	HTTP Parser: Iframe src: https://f0ec7674-83151dbc.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz/Prefetch/Prefetch.aspx
Source: https://online.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz/common/login	HTTP Parser: Iframe src: https://f0ec7674-83151dbc.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz/Prefetch/Prefetch.aspx
Source: https://online.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz/common/login	HTTP Parser: Iframe src: https://f0ec7674-83151dbc.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz/Prefetch/Prefetch.aspx
Source: https://online.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz/common/login	HTTP Parser: Iframe src: https://f0ec7674-83151dbc.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz/Prefetch/Prefetch.aspx
Source: https://online.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz/common/login	HTTP Parser: Iframe src: https://f0ec7674-83151dbc.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz/Prefetch/Prefetch.aspx

Source: https://online.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz/?zNUB6o=7wM0&username=melodi%40scott-electric.com&sso_reload=true	HTTP Parser: Number of links: 0
Source: https://online.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz/common/login	HTTP Parser: Number of links: 0
Source: https://288682c1-83151dbc.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz/?ru=https%3a%2f%2fonline.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz%2fcommon%2freprocess%3fctx%3drQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuASYnjUkdz1qcmpUS4jSD905fRWjMmEj9C8wMr5gZJzEJJmbmpOfkulQnJxfUqKbmpOaXFKUmQxScotJ0L8o3TMlvNgtNSW1KLEkMz_vETNu9RdYBF6x8BgwW3FwcAkwSDAoMPxgYVzECnThp24vduH1ot57E6O9TDsmMZxi1Q91yjGISI7IDjP3MClMz_I1jczONAuyCDb3yPKqckvRjvL3DsqKjEoJKfa0NbEynMAmNIGN6RQbwwc2lg52hlnsDAc4GQ_wMvzgO3avY9W-G8veebzi13H28bUoDC4v9U4NztA39wvOSDIId_U2TTJJ9oyyyAv1KAzLSQ4OdK8ILHO03SDA8ECAAQA1&mkt=en-US&hosted=0&device_platform=Windows+10&username=melodi%40scott-electric.com	HTTP Parser: Number of links: 0

Source: https://online.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz/?zNUB6o=7wM0&username=melodi%40scott-electric.com

HTTP Parser: Base64 decoded: a[href="http://www.salidzini.lv/"][style="display: block; width: 120px; height: 40px; overflow: hidden; position: relative;"]

Source: https://online.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz/?zNUB6o=7wM0&username=melodi%40scott-electric.com&sso_reload=true	HTTP Parser: Title: Sign in to your account does not match URL
Source: https://online.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz/common/login	HTTP Parser: Title: Sign in to your account does not match URL
Source: https://288682c1-83151dbc.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz/?ru=https%3a%2f%2fonline.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz%2fcommon%2freprocess%3fctx%3drQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuASYnjUkdz1qcmpUS4jSD905fRWjMmEj9C8wMr5gZJzEJJmbmpOfkulQnJxfUqKbmpOaXFKUmQxScotJ0L8o3TMlvNgtNSW1KLEkMz_vETNu9RdYBF6x8BgwW3FwcAkwSDAoMPxgYVzECnThp24vduH1ot57E6O9TDsmMZxi1Q91yjGISI7IDjP3MClMz_I1jczONAuyCDb3yPKqckvRjvL3DsqKjEoJKfa0NbEynMAmNIGN6RQbwwc2lg52hlnsDAc4GQ_wMvzgO3avY9W-G8veebzi13H28bUoDC4v9U4NztA39wvOSDIId_U2TTJJ9oyyyAv1KAzLSQ4OdK8ILHO03SDA8ECAAQA1&mkt=en-US&hosted=0&device_platform=Windows+10&username=melodi%40scott-electric.com	HTTP Parser: Title: Microsoft Online Password Reset does not match URL

Source: https://online.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz/?zNUB6o=7wM0&username=melodi%40scott-electric.com&sso_reload=true	HTTP Parser: <input type="password" .../> found
Source: https://online.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz/common/login	HTTP Parser: <input type="password" .../> found

Source: https://online.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz/?zNUB6o=7wM0&username=melodi%40scott-electric.com	HTTP Parser: No favicon
Source: https://f0ec7674-83151dbc.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz/Prefetch/Prefetch.aspx	HTTP Parser: No favicon

Source: https://online.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz/?zNUB6o=7wM0&username=melodi%40scott-electric.com&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://online.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz/?zNUB6o=7wM0&username=melodi%40scott-electric.com&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://online.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz/?zNUB6o=7wM0&username=melodi%40scott-electric.com&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://online.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz/common/login	HTTP Parser: No <meta name="author".. found
Source: https://online.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz/common/login	HTTP Parser: No <meta name="author".. found
Source: https://online.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz/common/login	HTTP Parser: No <meta name="author".. found
Source: https://online.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz/common/login	HTTP Parser: No <meta name="author".. found
Source: https://online.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz/common/login	HTTP Parser: No <meta name="author".. found
Source: https://288682c1-83151dbc.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz/?ru=https%3a%2f%2fonline.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz%2fcommon%2freprocess%3fctx%3drQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuASYnjUkdz1qcmpUS4jSD905fRWjMmEj9C8wMr5gZJzEJJmbmpOfkulQnJxfUqKbmpOaXFKUmQxScotJ0L8o3TMlvNgtNSW1KLEkMz_vETNu9RdYBF6x8BgwW3FwcAkwSDAoMPxgYVzECnThp24vduH1ot57E6O9TDsmMZxi1Q91yjGISI7IDjP3MClMz_I1jczONAuyCDb3yPKqckvRjvL3DsqKjEoJKfa0NbEynMAmNIGN6RQbwwc2lg52hlnsDAc4GQ_wMvzgO3avY9W-G8veebzi13H28bUoDC4v9U4NztA39wvOSDIId_U2TTJJ9oyyyAv1KAzLSQ4OdK8ILHO03SDA8ECAAQA1&mkt=en-US&hosted=0&device_platform=Windows+10&username=melodi%40scott-electric.com	HTTP Parser: No <meta name="author".. found
Source: https://288682c1-83151dbc.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz/?ru=https%3a%2f%2fonline.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz%2fcommon%2freprocess%3fctx%3drQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuASYnjUkdz1qcmpUS4jSD905fRWjMmEj9C8wMr5gZJzEJJmbmpOfkulQnJxfUqKbmpOaXFKUmQxScotJ0L8o3TMlvNgtNSW1KLEkMz_vETNu9RdYBF6x8BgwW3FwcAkwSDAoMPxgYVzECnThp24vduH1ot57E6O9TDsmMZxi1Q91yjGISI7IDjP3MClMz_I1jczONAuyCDb3yPKqckvRjvL3DsqKjEoJKfa0NbEynMAmNIGN6RQbwwc2lg52hlnsDAc4GQ_wMvzgO3avY9W-G8veebzi13H28bUoDC4v9U4NztA39wvOSDIId_U2TTJJ9oyyyAv1KAzLSQ4OdK8ILHO03SDA8ECAAQA1&mkt=en-US&hosted=0&device_platform=Windows+10&username=melodi%40scott-electric.com	HTTP Parser: No <meta name="author".. found
Source: https://288682c1-83151dbc.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz/?ru=https%3a%2f%2fonline.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz%2fcommon%2freprocess%3fctx%3drQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuASYnjUkdz1qcmpUS4jSD905fRWjMmEj9C8wMr5gZJzEJJmbmpOfkulQnJxfUqKbmpOaXFKUmQxScotJ0L8o3TMlvNgtNSW1KLEkMz_vETNu9RdYBF6x8BgwW3FwcAkwSDAoMPxgYVzECnThp24vduH1ot57E6O9TDsmMZxi1Q91yjGISI7IDjP3MClMz_I1jczONAuyCDb3yPKqckvRjvL3DsqKjEoJKfa0NbEynMAmNIGN6RQbwwc2lg52hlnsDAc4GQ_wMvzgO3avY9W-G8veebzi13H28bUoDC4v9U4NztA39wvOSDIId_U2TTJJ9oyyyAv1KAzLSQ4OdK8ILHO03SDA8ECAAQA1&mkt=en-US&hosted=0&device_platform=Windows+10&username=melodi%40scott-electric.com	HTTP Parser: No <meta name="author".. found
Source: https://288682c1-83151dbc.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz/?ru=https%3a%2f%2fonline.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz%2fcommon%2freprocess%3fctx%3drQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuASYnjUkdz1qcmpUS4jSD905fRWjMmEj9C8wMr5gZJzEJJmbmpOfkulQnJxfUqKbmpOaXFKUmQxScotJ0L8o3TMlvNgtNSW1KLEkMz_vETNu9RdYBF6x8BgwW3FwcAkwSDAoMPxgYVzECnThp24vduH1ot57E6O9TDsmMZxi1Q91yjGISI7IDjP3MClMz_I1jczONAuyCDb3yPKqckvRjvL3DsqKjEoJKfa0NbEynMAmNIGN6RQbwwc2lg52hlnsDAc4GQ_wMvzgO3avY9W-G8veebzi13H28bUoDC4v9U4NztA39wvOSDIId_U2TTJJ9oyyyAv1KAzLSQ4OdK8ILHO03SDA8ECAAQA1&mkt=en-US&hosted=0&device_platform=Windows+10&username=melodi%40scott-electric.com	HTTP Parser: No <meta name="author".. found
Source: https://288682c1-83151dbc.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz/?ru=https%3a%2f%2fonline.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz%2fcommon%2freprocess%3fctx%3drQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuASYnjUkdz1qcmpUS4jSD905fRWjMmEj9C8wMr5gZJzEJJmbmpOfkulQnJxfUqKbmpOaXFKUmQxScotJ0L8o3TMlvNgtNSW1KLEkMz_vETNu9RdYBF6x8BgwW3FwcAkwSDAoMPxgYVzECnThp24vduH1ot57E6O9TDsmMZxi1Q91yjGISI7IDjP3MClMz_I1jczONAuyCDb3yPKqckvRjvL3DsqKjEoJKfa0NbEynMAmNIGN6RQbwwc2lg52hlnsDAc4GQ_wMvzgO3avY9W-G8veebzi13H28bUoDC4v9U4NztA39wvOSDIId_U2TTJJ9oyyyAv1KAzLSQ4OdK8ILHO03SDA8ECAAQA1&mkt=en-US&hosted=0&device_platform=Windows+10&username=melodi%40scott-electric.com	HTTP Parser: No <meta name="author".. found

Source: https://online.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz/?zNUB6o=7wM0&username=melodi%40scott-electric.com&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://online.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz/?zNUB6o=7wM0&username=melodi%40scott-electric.com&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://online.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz/?zNUB6o=7wM0&username=melodi%40scott-electric.com&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://online.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz/common/login	HTTP Parser: No <meta name="copyright".. found
Source: https://online.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz/common/login	HTTP Parser: No <meta name="copyright".. found
Source: https://online.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz/common/login	HTTP Parser: No <meta name="copyright".. found
Source: https://online.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz/common/login	HTTP Parser: No <meta name="copyright".. found
Source: https://online.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz/common/login	HTTP Parser: No <meta name="copyright".. found
Source: https://288682c1-83151dbc.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz/?ru=https%3a%2f%2fonline.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz%2fcommon%2freprocess%3fctx%3drQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuASYnjUkdz1qcmpUS4jSD905fRWjMmEj9C8wMr5gZJzEJJmbmpOfkulQnJxfUqKbmpOaXFKUmQxScotJ0L8o3TMlvNgtNSW1KLEkMz_vETNu9RdYBF6x8BgwW3FwcAkwSDAoMPxgYVzECnThp24vduH1ot57E6O9TDsmMZxi1Q91yjGISI7IDjP3MClMz_I1jczONAuyCDb3yPKqckvRjvL3DsqKjEoJKfa0NbEynMAmNIGN6RQbwwc2lg52hlnsDAc4GQ_wMvzgO3avY9W-G8veebzi13H28bUoDC4v9U4NztA39wvOSDIId_U2TTJJ9oyyyAv1KAzLSQ4OdK8ILHO03SDA8ECAAQA1&mkt=en-US&hosted=0&device_platform=Windows+10&username=melodi%40scott-electric.com	HTTP Parser: No <meta name="copyright".. found
Source: https://288682c1-83151dbc.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz/?ru=https%3a%2f%2fonline.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz%2fcommon%2freprocess%3fctx%3drQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuASYnjUkdz1qcmpUS4jSD905fRWjMmEj9C8wMr5gZJzEJJmbmpOfkulQnJxfUqKbmpOaXFKUmQxScotJ0L8o3TMlvNgtNSW1KLEkMz_vETNu9RdYBF6x8BgwW3FwcAkwSDAoMPxgYVzECnThp24vduH1ot57E6O9TDsmMZxi1Q91yjGISI7IDjP3MClMz_I1jczONAuyCDb3yPKqckvRjvL3DsqKjEoJKfa0NbEynMAmNIGN6RQbwwc2lg52hlnsDAc4GQ_wMvzgO3avY9W-G8veebzi13H28bUoDC4v9U4NztA39wvOSDIId_U2TTJJ9oyyyAv1KAzLSQ4OdK8ILHO03SDA8ECAAQA1&mkt=en-US&hosted=0&device_platform=Windows+10&username=melodi%40scott-electric.com	HTTP Parser: No <meta name="copyright".. found
Source: https://288682c1-83151dbc.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz/?ru=https%3a%2f%2fonline.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz%2fcommon%2freprocess%3fctx%3drQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuASYnjUkdz1qcmpUS4jSD905fRWjMmEj9C8wMr5gZJzEJJmbmpOfkulQnJxfUqKbmpOaXFKUmQxScotJ0L8o3TMlvNgtNSW1KLEkMz_vETNu9RdYBF6x8BgwW3FwcAkwSDAoMPxgYVzECnThp24vduH1ot57E6O9TDsmMZxi1Q91yjGISI7IDjP3MClMz_I1jczONAuyCDb3yPKqckvRjvL3DsqKjEoJKfa0NbEynMAmNIGN6RQbwwc2lg52hlnsDAc4GQ_wMvzgO3avY9W-G8veebzi13H28bUoDC4v9U4NztA39wvOSDIId_U2TTJJ9oyyyAv1KAzLSQ4OdK8ILHO03SDA8ECAAQA1&mkt=en-US&hosted=0&device_platform=Windows+10&username=melodi%40scott-electric.com	HTTP Parser: No <meta name="copyright".. found
Source: https://288682c1-83151dbc.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz/?ru=https%3a%2f%2fonline.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz%2fcommon%2freprocess%3fctx%3drQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuASYnjUkdz1qcmpUS4jSD905fRWjMmEj9C8wMr5gZJzEJJmbmpOfkulQnJxfUqKbmpOaXFKUmQxScotJ0L8o3TMlvNgtNSW1KLEkMz_vETNu9RdYBF6x8BgwW3FwcAkwSDAoMPxgYVzECnThp24vduH1ot57E6O9TDsmMZxi1Q91yjGISI7IDjP3MClMz_I1jczONAuyCDb3yPKqckvRjvL3DsqKjEoJKfa0NbEynMAmNIGN6RQbwwc2lg52hlnsDAc4GQ_wMvzgO3avY9W-G8veebzi13H28bUoDC4v9U4NztA39wvOSDIId_U2TTJJ9oyyyAv1KAzLSQ4OdK8ILHO03SDA8ECAAQA1&mkt=en-US&hosted=0&device_platform=Windows+10&username=melodi%40scott-electric.com	HTTP Parser: No <meta name="copyright".. found
Source: https://288682c1-83151dbc.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz/?ru=https%3a%2f%2fonline.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz%2fcommon%2freprocess%3fctx%3drQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuASYnjUkdz1qcmpUS4jSD905fRWjMmEj9C8wMr5gZJzEJJmbmpOfkulQnJxfUqKbmpOaXFKUmQxScotJ0L8o3TMlvNgtNSW1KLEkMz_vETNu9RdYBF6x8BgwW3FwcAkwSDAoMPxgYVzECnThp24vduH1ot57E6O9TDsmMZxi1Q91yjGISI7IDjP3MClMz_I1jczONAuyCDb3yPKqckvRjvL3DsqKjEoJKfa0NbEynMAmNIGN6RQbwwc2lg52hlnsDAc4GQ_wMvzgO3avY9W-G8veebzi13H28bUoDC4v9U4NztA39wvOSDIId_U2TTJJ9oyyyAv1KAzLSQ4OdK8ILHO03SDA8ECAAQA1&mkt=en-US&hosted=0&device_platform=Windows+10&username=melodi%40scott-electric.com	HTTP Parser: No <meta name="copyright".. found

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries

Source: unknown	HTTPS traffic detected: 20.190.159.4:443 -> 192.168.2.17:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.17:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.4:443 -> 192.168.2.17:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.17:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.209.148:443 -> 192.168.2.17:49765 version: TLS 1.2

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 32MB

Networking

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2857090 ETPRO CURRENT_EVENTS JS/PsyduckPockeball Payload Inbound 51.38.145.13:443 -> 192.168.2.17:49720

Performs DNS queries to domains with low reputation

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: online.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: online.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: a638d5a3-83151dbc.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: a638d5a3-83151dbc.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: a14bf615-83151dbc.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: a14bf615-83151dbc.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: l1ve.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: l1ve.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: f0ec7674-83151dbc.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: f0ec7674-83151dbc.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: a638d5a3-83151dbc.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: a638d5a3-83151dbc.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: 371098e6-83151dbc.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: 371098e6-83151dbc.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: 288682c1-83151dbc.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: 288682c1-83151dbc.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: 288682c1-83151dbc.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: 288682c1-83151dbc.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: 2ac4b5bb-83151dbc.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: 2ac4b5bb-83151dbc.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: 78d704d5-83151dbc.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: 78d704d5-83151dbc.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: 288682c1-83151dbc.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: 288682c1-83151dbc.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: 78d704d5-83151dbc.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: 78d704d5-83151dbc.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.4
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.4
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.4
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.4

Source: global traffic	DNS traffic detected: DNS query: online.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: a638d5a3-83151dbc.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz
Source: global traffic	DNS traffic detected: DNS query: a14bf615-83151dbc.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz
Source: global traffic	DNS traffic detected: DNS query: l1ve.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz
Source: global traffic	DNS traffic detected: DNS query: f0ec7674-83151dbc.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz
Source: global traffic	DNS traffic detected: DNS query: 371098e6-83151dbc.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz
Source: global traffic	DNS traffic detected: DNS query: 288682c1-83151dbc.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz
Source: global traffic	DNS traffic detected: DNS query: 2ac4b5bb-83151dbc.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz
Source: global traffic	DNS traffic detected: DNS query: 78d704d5-83151dbc.msjdfkm2jfjqk8bqylav5rrbg2uhuksp5d.xyz

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49691
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49691 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443

Source: unknown	HTTPS traffic detected: 20.190.159.4:443 -> 192.168.2.17:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.17:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.4:443 -> 192.168.2.17:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.17:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.209.148:443 -> 192.168.2.17:49765 version: TLS 1.2

Source: classification engine

Classification label: mal68.phis.troj.winMSG@20/67@28/148

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\Chrome\Application\Dictionaries