Windows Analysis Report
https://pradeeprunner.com/auth.html

Overview

General Information

Sample URL:	https://pradeeprunner.com/auth.html
Analysis ID:	1466495
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected non-DNS traffic on DNS port

Classification

Signatures

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://pradeeprunner.com/auth.html	Avira URL Cloud: detection malicious, Label: malware
Source: https://pradeeprunner.com/auth.html	SlashNext: detection malicious, Label: Credential Stealing type: Phishing & Social Engineering

Antivirus detection for URL or domain

Source: https://pradeeprunner.com/files_meta/script.js	Avira URL Cloud: Label: phishing
Source: https://pradeeprunner.com/files_meta/Roboto-Regular.ttf	Avira URL Cloud: Label: phishing
Source: https://pradeeprunner.com/files_meta/EuclidCircularB-Bold-WebXL.ttf	Avira URL Cloud: Label: phishing
Source: https://pradeeprunner.com/files_meta/EuclidCircularB-Medium.ttf	Avira URL Cloud: Label: phishing
Source: https://pradeeprunner.com/images/icons/arrow-down.svg	Avira URL Cloud: Label: phishing
Source: https://pradeeprunner.com/metamask-fox.svg	Avira URL Cloud: Label: phishing
Source: https://pradeeprunner.com/files_meta/first_style.css	Avira URL Cloud: Label: phishing
Source: https://pradeeprunner.com/files_meta/EuclidCircularB-Regular-WebXL.ttf	Avira URL Cloud: Label: phishing
Source: https://pradeeprunner.com/files_meta/MetaMask_Fox.svg.png	Avira URL Cloud: Label: phishing
Source: https://pradeeprunner.com/files_meta/react-gallery/carousel.min.css	Avira URL Cloud: Label: phishing

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49742 version: TLS 1.2

Detected non-DNS traffic on DNS port

Source: global traffic

TCP traffic: 192.168.2.4:51380 -> 1.1.1.1:53

Source: unknown	TCP traffic detected without corresponding DNS query: 104.46.162.224
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /auth.html HTTP/1.1Host: pradeeprunner.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /files_meta/first_style.css HTTP/1.1Host: pradeeprunner.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://pradeeprunner.com/auth.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /files_meta/react-gallery/carousel.min.css HTTP/1.1Host: pradeeprunner.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://pradeeprunner.com/files_meta/first_style.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /files_meta/EuclidCircularB-Regular-WebXL.ttf HTTP/1.1Host: pradeeprunner.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://pradeeprunner.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://pradeeprunner.com/files_meta/first_style.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /files_meta/EuclidCircularB-Bold-WebXL.ttf HTTP/1.1Host: pradeeprunner.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://pradeeprunner.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://pradeeprunner.com/files_meta/first_style.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /files_meta/EuclidCircularB-Medium.ttf HTTP/1.1Host: pradeeprunner.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://pradeeprunner.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://pradeeprunner.com/files_meta/first_style.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /files_meta/script.js HTTP/1.1Host: pradeeprunner.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://pradeeprunner.com/auth.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/icons/arrow-down.svg HTTP/1.1Host: pradeeprunner.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://pradeeprunner.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: imageReferer: https://pradeeprunner.com/auth.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /metamask-fox.svg HTTP/1.1Host: pradeeprunner.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://pradeeprunner.com/auth.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /metamask-fox.svg HTTP/1.1Host: pradeeprunner.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /files_meta/Roboto-Regular.ttf HTTP/1.1Host: pradeeprunner.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://pradeeprunner.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://pradeeprunner.com/files_meta/first_style.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /files_meta/MetaMask_Fox.svg.png HTTP/1.1Host: pradeeprunner.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://pradeeprunner.com/auth.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /files_meta/MetaMask_Fox.svg.png HTTP/1.1Host: pradeeprunner.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: pradeeprunner.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Tue, 02 Jul 2024 22:38:28 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Tue, 02 Jul 2024 22:38:29 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: close

Source: chromecache_110.2.dr	String found in binary or memory: http://meyerweb.com/eric/tools/css/reset/
Source: chromecache_118.2.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: chromecache_118.2.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0Font
Source: chromecache_110.2.dr	String found in binary or memory: http://www.creativebloq.com/web-design/manage-large-css-projects-itcss-101517528
Source: chromecache_115.2.dr, chromecache_113.2.dr, chromecache_120.2.dr	String found in binary or memory: http://www.swisstypefaces.com/licensing/#retail-font-software-licence
Source: chromecache_115.2.dr	String found in binary or memory: http://www.swisstypefaces.com/licensing/#retail-font-software-licenceCopyright
Source: chromecache_115.2.dr	String found in binary or memory: http://www.swisstypefaces.com/licensing/#retail-font-software-licenceEuclid
Source: chromecache_115.2.dr, chromecache_113.2.dr, chromecache_120.2.dr	String found in binary or memory: http://www.swisstypefaces.comPlease
Source: chromecache_110.2.dr	String found in binary or memory: https://fontawesome.com
Source: chromecache_110.2.dr	String found in binary or memory: https://fontawesome.com/license/free
Source: chromecache_110.2.dr	String found in binary or memory: https://github.com/MetaMask/metamask-extension/issues/17670
Source: chromecache_110.2.dr	String found in binary or memory: https://metamask.github.io/metamask-storybook/?path=/docs/components-componentlibrary-text--default-
Source: chromecache_121.2.dr	String found in binary or memory: https://snapbuilder.com
Source: chromecache_110.2.dr	String found in binary or memory: https://www.xfive.co/blog/itcss-scalable-maintainable-css-architecture/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51384
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 51384 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49742 version: TLS 1.2

Source: classification engine

Classification label: mal56.win@21/22@6/5

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2448 --field-trial-handle=2256,i,15486898428901702737,16501120928016359988,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://pradeeprunner.com/auth.html"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2448 --field-trial-handle=2256,i,15486898428901702737,16501120928016359988,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
239.255.255.250	unknown	Reserved	unknown	unknown	false
91.215.85.65	pradeeprunner.com	Russian Federation	34665	PINDC-ASRU	false
142.250.74.196	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.4
192.168.2.6

Contacted Domains

Name	IP	Active
www.google.com	142.250.74.196	true
pradeeprunner.com	91.215.85.65	true
fp2e7a.wpc.phicdn.net	192.229.221.95	true

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://pradeeprunner.com/files_meta/Roboto-Regular.ttf	false	Avira URL Cloud: phishing	unknown
https://pradeeprunner.com/metamask-fox.svg	false	Avira URL Cloud: phishing	unknown
https://pradeeprunner.com/files_meta/EuclidCircularB-Medium.ttf	false	Avira URL Cloud: phishing	unknown
https://pradeeprunner.com/files_meta/script.js	false	Avira URL Cloud: phishing	unknown
https://pradeeprunner.com/files_meta/EuclidCircularB-Bold-WebXL.ttf	false	Avira URL Cloud: phishing	unknown
https://pradeeprunner.com/auth.html	true		unknown
https://pradeeprunner.com/images/icons/arrow-down.svg	false	Avira URL Cloud: phishing	unknown
https://pradeeprunner.com/files_meta/EuclidCircularB-Regular-WebXL.ttf	false	Avira URL Cloud: phishing	unknown
https://pradeeprunner.com/files_meta/first_style.css	false	Avira URL Cloud: phishing	unknown
https://pradeeprunner.com/files_meta/MetaMask_Fox.svg.png	false	Avira URL Cloud: phishing	unknown
https://pradeeprunner.com/files_meta/react-gallery/carousel.min.css	false	Avira URL Cloud: phishing	unknown

ID:	1466495
Product:	CloudBasic
Start time:	00:37:30
Start date:	03.07.2024
Cookbook:	browseurl.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
Chrome Cache Entry: 110	Unicode text, UTF-8 text, with CRLF line terminators	031D7970EF5FE6A450DD3CE27B700C64	56E23B85BB192D14108A2EB2C21CD601160A2BE2	68F0DE3A1E5A986B0641ED45D8FC5209673FC69A8AE729803DCE1E0785CA2289
Chrome Cache Entry: 111	PNG image data, 1200 x 1200, 8-bit/color RGBA, non-interlaced	D7ABFFE92AE7CACE6EB47C0C91530DF9	19C3754580996E50DAF37261462D9F5C01795D54	3E82A1B3D1148E4494EB72EE7008E7091823D90B0BD0D86EBF01A7E29484F540
Chrome Cache Entry: 112	HTML document, ASCII text	90F5F58560B98D8906749B8A28DC3F6B	C0A765C64FDCF78AC57A2E8BD41142D60540B897	659477C38A1C56435C96798183AA5033A3D7F87B3C265141C9BD8FF6F015223E
Chrome Cache Entry: 113	TrueType Font data, 19 tables, 1st "BASE", 16 names, Macintosh, language 0x2, type 1 string, otCopyright (c) 2018 Swiss Typefaces Sarl. All rights reserved.\266Version 3.001FontEuclid is a	CD393BE20ACCD12B36EFEFDE5BB590DB	DF1AC0DC8CC96D6EF9F5BE99FA7ADDF30984DBD8	DF4F17393ABC2D0E8EA15D6B55644CFDEE10D34445D6C26204F427554F3754DE
Chrome Cache Entry: 114	HTML document, ASCII text	90F5F58560B98D8906749B8A28DC3F6B	C0A765C64FDCF78AC57A2E8BD41142D60540B897	659477C38A1C56435C96798183AA5033A3D7F87B3C265141C9BD8FF6F015223E
Chrome Cache Entry: 115	TrueType Font data, digitally signed, 20 tables, 1st "BASE", 30 names, Macintosh, Copyright (c) 2018 Swiss Typefaces Sarl. All rights reserved.Euclid Circular BMediumSwiss Typefa	824367033BEA9F919389212D4A425CCE	C504C095643BD25E5AEBCE7D5007DE7B7A35484C	EA0E1DD82C6C8A9320A6F1D3D610884864EDC4BDCF9B57DCFBE2ABB3A511CA55
Chrome Cache Entry: 116	SVG Scalable Vector Graphics image	C06F3A3E804EBC7343949FDCA3FDD7F8	D96957B5A42C4F69E11A55E388234A26DAF4A039	B855851451C3EB7220BC7331D6CF7F19DAD4580EBC35610211F028848BA7FC34
Chrome Cache Entry: 117	PNG image data, 1200 x 1200, 8-bit/color RGBA, non-interlaced	D7ABFFE92AE7CACE6EB47C0C91530DF9	19C3754580996E50DAF37261462D9F5C01795D54	3E82A1B3D1148E4494EB72EE7008E7091823D90B0BD0D86EBF01A7E29484F540
Chrome Cache Entry: 118	TrueType Font data, 17 tables, 1st "GPOS", 27 names, Macintosh, Font data copyright Google 2012RobotoRegularGoogle:Roboto Regular:2013Roboto RegularVersion 1.10	54A91B0619CCF9373D525109268219DC	1D1D41FCADC571DECB6444211B7993B99CE926E2	B2EFABCA5EA4BC56EEA829713706B5CD0788B82ACA153BD4ADDE9B1573933B4F
Chrome Cache Entry: 119	SVG Scalable Vector Graphics image	C06F3A3E804EBC7343949FDCA3FDD7F8	D96957B5A42C4F69E11A55E388234A26DAF4A039	B855851451C3EB7220BC7331D6CF7F19DAD4580EBC35610211F028848BA7FC34
Chrome Cache Entry: 120	TrueType Font data, 19 tables, 1st "BASE", 16 names, Macintosh, language 0x2, type 1 string, otCopyright (c) 2018 Swiss Typefaces Sarl. All rights reserved.\266Version 3.001FontEuclid is a	D5AAC9E768D285A459E8B4EA0FF490BF	4347A5A09E8E4014EC4A13634F20FAFEB1C7B6C0	08B11E464AF41DC1764715793AEE5078E632B68606FEB061B996F3FF8BE7401C
Chrome Cache Entry: 121	HTML document, ASCII text, with very long lines (65001)	CD2C9C6DE4B2B7ADFA16DBAFA071CA39	5D64189416D95FE5F7DEF4133B548CCCA80F1C15	D4FA8F40063C76806CA3C7389FDAD51DDB0B6B4904F1FEBD357A592F86FECD6F

Windows Analysis Report
https://pradeeprunner.com/auth.html

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Compliance

Networking

System Summary

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report https://pradeeprunner.com/auth.html

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Compliance

Networking

System Summary

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
https://pradeeprunner.com/auth.html