Windows Analysis Report
https://lnkd.in/exwPeXjc

Overview

General Information

Sample URL:	https://lnkd.in/exwPeXjc
Analysis ID:	1466890
Infos:

Detection

HTMLPhisher

Score:	72
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Antivirus detection for URL or domain

Yara detected HtmlPhish10

Phishing site detected (based on image similarity)

Phishing site detected (based on logo match)

Drops files with a non-matching file extension (content does not match file extension)

HTML body contains low number of good links

HTML body contains password input but no form action

HTML body with high number of embedded images detected

HTML title does not match URL

HTTP GET or POST without a user agent

Stores files to the Windows start menu directory

Classification

Signatures

AV Detection

Antivirus detection for URL or domain

Source: https://a9d041c33434.wazo-biawalkeks.ru/s/f522420955	Avira URL Cloud: Label: malware
Source: https://a9d041c33434.wazo-biawalkeks.ru/p/89?session=be20ea5bbbe9ef456236afd95beaab99d2c85bfef4d89e6fa105930dad415426	Avira URL Cloud: Label: malware
Source: https://a9d041c33434.wazo-biawalkeks.ru	Avira URL Cloud: Label: malware
Source: https://a9d041c33434.wazo-biawalkeks.ru/r/17?session=be20ea5bbbe9ef456236afd95beaab99d2c85bfef4d89e6fa105930dad415426	Avira URL Cloud: Label: malware
Source: https://a9d041c33434.wazo-biawalkeks.ru/s/17?0	Avira URL Cloud: Label: malware

Phishing

AI detected phishing page

Source: https://document-display-verifycation-download-pdf.us-east-1.linodeobjects.com

LLM: Score: 9 brands: Microsoft, Adobe Reasons: The URL 'https://document-display-verifycation-download-pdf.us-east-1.linodeobjects.com' is highly suspicious. It uses a long and complex subdomain structure that is not associated with the legitimate domains of Microsoft or Adobe. The use of 'verifycation' (misspelled 'verification') is a common tactic in phishing URLs. The page prominently asks for a Microsoft email address for document verification, which is a common phishing technique to harvest credentials. The legitimate domains for Microsoft and Adobe are 'microsoft.com' and 'adobe.com', respectively. The presence of logos for both Microsoft and Adobe is an attempt to build trust and mislead users. There is no CAPTCHA present, which is often used in legitimate sites to prevent automated attacks. Overall, the combination of these factors strongly indicates that this is a phishing site. DOM: 3.4.pages.csv

Yara detected HtmlPhish10

Source: Yara match	File source: 4.8.pages.csv, type: HTML
Source: Yara match	File source: 4.7.pages.csv, type: HTML

Phishing site detected (based on image similarity)

Source: https://new-pdf-document-approval.us-lax-1.linodeobjects.com/app.html#john.smith@outlook.com

Matcher: Found strong image similarity, brand: MICROSOFT

Phishing site detected (based on logo match)

Source: https://document-display-verifycation-download-pdf.us-east-1.linodeobjects.com/safe.html	Matcher: Template: microsoft matched
Source: https://document-display-verifycation-download-pdf.us-east-1.linodeobjects.com/safe.html	Matcher: Template: microsoft matched
Source: https://new-pdf-document-approval.us-lax-1.linodeobjects.com/app.html#john.smith@outlook.com	Matcher: Template: microsoft matched

HTML body contains low number of good links

Source: https://document-display-verifycation-download-pdf.us-east-1.linodeobjects.com/safe.html	HTTP Parser: Number of links: 0
Source: https://new-pdf-document-approval.us-lax-1.linodeobjects.com/app.html#john.smith@outlook.com	HTTP Parser: Number of links: 0

HTML body contains password input but no form action

Source: https://new-pdf-document-approval.us-lax-1.linodeobjects.com/app.html#john.smith@outlook.com

HTTP Parser: <input type="password" .../> found but no <form action="...

HTML body with high number of embedded images detected

Source: https://new-pdf-document-approval.us-lax-1.linodeobjects.com/app.html#john.smith@outlook.com

HTTP Parser: Total embedded image size: 18628

HTML title does not match URL

Source: https://document-display-verifycation-download-pdf.us-east-1.linodeobjects.com/safe.html	HTTP Parser: Title: Verification Defender Associate does not match URL
Source: https://new-pdf-document-approval.us-lax-1.linodeobjects.com/app.html#john.smith@outlook.com	HTTP Parser: Title: Sign in to Best Productivity Provider does not match URL

Source: https://new-pdf-document-approval.us-lax-1.linodeobjects.com/app.html#john.smith@outlook.com

HTTP Parser: <input type="password" .../> found

Source: https://media.licdn.com/dms/document/media/D4E1FAQHFhtSoZc3ecA/feedshare-document-pdf-analyzed/0/1719999064861?e=1720656000&v=beta&t=LBGMvkRjVKeHwsuNkcV3IvRRVllumgKht0mdUo0Jks4	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: https://document-display-verifycation-download-pdf.us-east-1.linodeobjects.com/safe.html	HTTP Parser: No favicon
Source: https://document-display-verifycation-download-pdf.us-east-1.linodeobjects.com/safe.html	HTTP Parser: No favicon
Source: https://new-pdf-document-approval.us-lax-1.linodeobjects.com/app.html#john.smith@outlook.com	HTTP Parser: No favicon

Source: https://document-display-verifycation-download-pdf.us-east-1.linodeobjects.com/safe.html	HTTP Parser: No <meta name="author".. found
Source: https://document-display-verifycation-download-pdf.us-east-1.linodeobjects.com/safe.html	HTTP Parser: No <meta name="author".. found
Source: https://new-pdf-document-approval.us-lax-1.linodeobjects.com/app.html#john.smith@outlook.com	HTTP Parser: No <meta name="author".. found
Source: https://new-pdf-document-approval.us-lax-1.linodeobjects.com/app.html#john.smith@outlook.com	HTTP Parser: No <meta name="author".. found

Source: https://document-display-verifycation-download-pdf.us-east-1.linodeobjects.com/safe.html	HTTP Parser: No <meta name="copyright".. found
Source: https://document-display-verifycation-download-pdf.us-east-1.linodeobjects.com/safe.html	HTTP Parser: No <meta name="copyright".. found
Source: https://new-pdf-document-approval.us-lax-1.linodeobjects.com/app.html#john.smith@outlook.com	HTTP Parser: No <meta name="copyright".. found
Source: https://new-pdf-document-approval.us-lax-1.linodeobjects.com/app.html#john.smith@outlook.com	HTTP Parser: No <meta name="copyright".. found

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries

Jump to behavior

Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.17:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.2:443 -> 192.168.2.17:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.209.130:443 -> 192.168.2.17:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.17:49752 version: TLS 1.2

HTTP GET or POST without a user agent

Source: global traffic

HTTP traffic detected: GET /ab HTTP/1.1Host: evoke-windowsservices-tas.msedge.netCache-Control: no-store, no-cacheX-PHOTOS-CALLERID: 9NMPJ99VJBWVX-EVOKE-RING: X-WINNEXT-RING: PublicX-WINNEXT-TELEMETRYLEVEL: BasicX-WINNEXT-OSVERSION: 10.0.19045.0X-WINNEXT-APPVERSION: 1.23082.131.0X-WINNEXT-PLATFORM: DesktopX-WINNEXT-CANTAILOR: FalseX-MSEDGE-CLIENTID: {c1afbad7-f7da-40f2-92f9-8846a91d69bd}X-WINNEXT-PUBDEVICEID: dbfen2nYS7HW6ON4OdOknKxxv2CCI5LJBTojzDztjwI=If-None-Match: 2056388360_-1434155563Accept-Encoding: gzip, deflate, br

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108

Source: global traffic	HTTP traffic detected: GET /exwPeXjc HTTP/1.1Host: lnkd.inConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dms/document/media/D4E1FAQHFhtSoZc3ecA/feedshare-document-pdf-analyzed/0/1719999064861?e=1720656000&v=beta&t=LBGMvkRjVKeHwsuNkcV3IvRRVllumgKht0mdUo0Jks4 HTTP/1.1Host: media.licdn.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: media.licdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://media.licdn.com/dms/document/media/D4E1FAQHFhtSoZc3ecA/feedshare-document-pdf-analyzed/0/1719999064861?e=1720656000&v=beta&t=LBGMvkRjVKeHwsuNkcV3IvRRVllumgKht0mdUo0Jks4Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dms/document/media/D4E1FAQHFhtSoZc3ecA/feedshare-document-pdf-analyzed/0/1719999064861?e=1720656000&v=beta&t=LBGMvkRjVKeHwsuNkcV3IvRRVllumgKht0mdUo0Jks4 HTTP/1.1Host: media.licdn.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /justintime.png HTTP/1.1Host: 4454275f.rwnbqwuligbumyzvpodsthfkaftacy.pages.devConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://document-display-verifycation-download-pdf.us-east-1.linodeobjects.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /justintime.png HTTP/1.1Host: 4454275f.rwnbqwuligbumyzvpodsthfkaftacy.pages.devConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=OlzVxePTb23C3OT&MD=9w8h8RrU HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /s/f522420955 HTTP/1.1Host: a9d041c33434.wazo-biawalkeks.ruConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://new-pdf-document-approval.us-lax-1.linodeobjects.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://new-pdf-document-approval.us-lax-1.linodeobjects.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/17?0 HTTP/1.1Host: a9d041c33434.wazo-biawalkeks.ruConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://new-pdf-document-approval.us-lax-1.linodeobjects.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://a9d041c33434.wazo-biawalkeks.ru/s/f522420955Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /botd/v1 HTTP/1.1Host: openfpcdn.ioConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://new-pdf-document-approval.us-lax-1.linodeobjects.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://a9d041c33434.wazo-biawalkeks.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.1.1.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://new-pdf-document-approval.us-lax-1.linodeobjects.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/font-awesome/4.7.0/css/font-awesome.css HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://new-pdf-document-approval.us-lax-1.linodeobjects.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://new-pdf-document-approval.us-lax-1.linodeobjects.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_verify_call_fe87496cc7a44412f7893a72099c120a.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://new-pdf-document-approval.us-lax-1.linodeobjects.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_verify_sms_27a6d18b56f46818420e60a773c36d4e.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://new-pdf-document-approval.us-lax-1.linodeobjects.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_verify_fluent_authenticator_b59c16ca9bf156438a8a96d45e33db64.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://new-pdf-document-approval.us-lax-1.linodeobjects.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /r/17?session=be20ea5bbbe9ef456236afd95beaab99d2c85bfef4d89e6fa105930dad415426 HTTP/1.1Host: a9d041c33434.wazo-biawalkeks.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /p/89?session=be20ea5bbbe9ef456236afd95beaab99d2c85bfef4d89e6fa105930dad415426 HTTP/1.1Host: a9d041c33434.wazo-biawalkeks.ruConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://new-pdf-document-approval.us-lax-1.linodeobjects.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Sec-WebSocket-Key: 7x3gqcbaZBYMUlF+bnK4Yg==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_verify_call_fe87496cc7a44412f7893a72099c120a.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_verify_fluent_authenticator_b59c16ca9bf156438a8a96d45e33db64.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_verify_sms_27a6d18b56f46818420e60a773c36d4e.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ab HTTP/1.1Host: evoke-windowsservices-tas.msedge.netCache-Control: no-store, no-cacheX-PHOTOS-CALLERID: 9NMPJ99VJBWVX-EVOKE-RING: X-WINNEXT-RING: PublicX-WINNEXT-TELEMETRYLEVEL: BasicX-WINNEXT-OSVERSION: 10.0.19045.0X-WINNEXT-APPVERSION: 1.23082.131.0X-WINNEXT-PLATFORM: DesktopX-WINNEXT-CANTAILOR: FalseX-MSEDGE-CLIENTID: {c1afbad7-f7da-40f2-92f9-8846a91d69bd}X-WINNEXT-PUBDEVICEID: dbfen2nYS7HW6ON4OdOknKxxv2CCI5LJBTojzDztjwI=If-None-Match: 2056388360_-1434155563Accept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: GET /client/config?cc=CH&setlang=en-CH HTTP/1.1X-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateAccept-Encoding: gzip, deflateX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-UserAgeClass: UnknownX-BM-Market: CHX-BM-DateFormat: dd/MM/yyyyX-Device-OSSKU: 48X-BM-DTZ: -240X-DeviceID: 01000A41090080B6X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66EX-Search-TimeZone: Bias=300; DaylightBias=-60; TimeZoneKeyName=Eastern Standard TimeX-BM-Theme: 000000;0078d7X-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAdf6fx9Ji7Ej/SPij2SabLpuatSulvQrFHbHjzXYKWlT81vOBNVMDXbv8%2BrPztM6ApAs0yKf9ctGXGjbbqq6BQu1GleUx8WhS7xy5qv2mz0hDlwkfdA%2BFhupjTdwQAcqvcUmhAdwiLxJJgzYywpjkRiuBlQ6H8ucPfXwny%2BuKke5BoPYRC1AFyq/Q4ehNlZecXBhLbm67oAtaQrwXTf%2BAssBYa5XywrKXHtJJQkrv/w5xcIEbed/OYBL3nSugQomRkrKa9WGMfRmHUPkNex5DLMprR/Au/liwcM5hEEStGRx7oP/pMetXVKkITE7lTkAU1LTorfT6Qx/HomyUwX5lTYDZgAACCVgyePhTEjDqAEaAXVKheVUI%2BqIejcKVap9Fnb2igk0RATZBzah/n9XslmuQgPBoDJF8TmcB%2BdHpKpggj8d4oj1GHXhyL%2BriMIIvBKZboFLX9YxMur31%2BIM8rivxWSUEdbcynky%2BIJaWAi21MtQIIlUxazwX5w1OtJLp7jZhFWY9pphddmqXd6aROlp1QxONyqeLkO8TC2tmN0BZxxycK%2BZf0pJyDyddIZAg%2B4m5Us7vDEEYn1CsGbwNXpSg%2BySabLDPthZ%2BaLzycnplybWuz3UjH9uwq11QCkBrzwf%2Bl2raTZmXZJzQCFH9uFRYXIr1iRLpJoPWpI7Y4GhJU%2Be7TULTpBenzShA1i541EiGy/Ca7PoVFXzNZ6IHDlF18duuViRkuZMz2kwYQa2l0cF0DPod%2BzLYq/ok3upAHUy47%2BoAxo7nRaJC/xgsbJLaOaUwexi8NKag0FApMBKRpKyi6Lqcv5mX/Jn4aDTBsNUSHjlIG1ARLNGzqvpICrolvA6DOadtpcc2rwo4k6sA%2BosZpzeCNPWQBuFSNIuFQg1e1I2nPGElq0g3eSoIyLPcM/wlN7%2B1wE%3D%26p%3DX-Agent-DeviceId: 01000A41090080B6X-BM-CBT: 1720010721User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045X-Device-isOptin: falseAccept-language: en-GB, en, en-USX-Device-Touch: falseX-Device-ClientSession: 0EBF33E7864C42C090258436551F98DAX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIHost: www.bing.comConnection: Keep-AliveCookie: SRCHUID=V=2&GUID=C4EAB6C130004333A34B5668AE4E4D10&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=en; MUID=4590362BB5CF472B95BBEDB3112D4B7B; MUIDB=4590362BB5CF472B95BBEDB3112D4B7B
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=OlzVxePTb23C3OT&MD=9w8h8RrU HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /justintime.png HTTP/1.1Host: 4454275f.rwnbqwuligbumyzvpodsthfkaftacy.pages.devConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://document-display-verifycation-download-pdf.us-east-1.linodeobjects.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "1e93fa2a5bb96f4623b72a752697c906"
Source: global traffic	HTTP traffic detected: GET /justintime.png HTTP/1.1Host: 4454275f.rwnbqwuligbumyzvpodsthfkaftacy.pages.devConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "1e93fa2a5bb96f4623b72a752697c906"

Source: global traffic	DNS traffic detected: DNS query: lnkd.in
Source: global traffic	DNS traffic detected: DNS query: media.licdn.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: document-display-verifycation-download-pdf.us-east-1.linodeobjects.com
Source: global traffic	DNS traffic detected: DNS query: 4454275f.rwnbqwuligbumyzvpodsthfkaftacy.pages.dev
Source: global traffic	DNS traffic detected: DNS query: new-pdf-document-approval.us-lax-1.linodeobjects.com
Source: global traffic	DNS traffic detected: DNS query: a9d041c33434.wazo-biawalkeks.ru
Source: global traffic	DNS traffic detected: DNS query: openfpcdn.io
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com

Source: unknown

HTTP traffic detected: POST /r/17?session=be20ea5bbbe9ef456236afd95beaab99d2c85bfef4d89e6fa105930dad415426 HTTP/1.1Host: a9d041c33434.wazo-biawalkeks.ruConnection: keep-aliveContent-Length: 373sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryZEm0rXC0d59U2uLtAccept: */*Origin: https://new-pdf-document-approval.us-lax-1.linodeobjects.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://new-pdf-document-approval.us-lax-1.linodeobjects.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundAccept-Ranges: bytesAccess-Control-Allow-Origin: Age: 6Cache-Control: max-age=604800Content-Type: text/htmlDate: Wed, 03 Jul 2024 12:44:38 GMTExpires: Wed, 10 Jul 2024 12:44:38 GMTLast-Modified: Wed, 03 Jul 2024 12:44:32 GMTServer: ECAcc (lhc/7955)Timing-Allow-Origin: X-Cache: 404-HITX-CDN: ECSTX-CDN-CLIENT-IP-VERSION: IPV4X-CDN-Proto: HTTP1X-Content-Type-Options: nosniffX-Li-Fabric: prod-lva1X-Li-Pop: prod-lva1-xX-LI-Proto: http/1.1X-LI-UUID: AAYcVzEerX/ygtonZOq/zA==Content-Length: 364780Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 03 Jul 2024 12:45:20 GMTContent-Type: application/jsonContent-Length: 22Connection: closeCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EBOJqpl80hCkrROfCJi%2Bw%2F8FRzQ9kiSPWPaNQ8xUxs1Mfq6jdbjH%2FJNxS33taFrtEXbLW04mOTQG3OM1SmakOOJHjD4IWpDM05KNO0Ctw%2BLOzdrcVr6ilt8OjcA7vcf4JwEqtggXT6ilnXIbGG3pL4oj"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 89d6f8dbf8cb0fa7-EWRalt-svc: h3=":443"; ma=86400

Source: chromecache_85.1.dr	String found in binary or memory: http://fontawesome.io
Source: chromecache_85.1.dr	String found in binary or memory: http://fontawesome.io/license
Source: chromecache_80.1.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php)
Source: chromecache_76.1.dr	String found in binary or memory: https://4454275f.rwnbqwuligbumyzvpodsthfkaftacy.pages.dev/justintime.png
Source: chromecache_82.1.dr	String found in binary or memory: https://a9d041c33434.wazo-biawalkeks.ru
Source: chromecache_78.1.dr	String found in binary or memory: https://a9d041c33434.wazo-biawalkeks.ru/s/f522420955
Source: chromecache_80.1.dr, chromecache_83.1.dr	String found in binary or memory: https://fingerprint.com)
Source: chromecache_83.1.dr	String found in binary or memory: https://mariadb.com/bsl11/
Source: chromecache_92.1.dr, chromecache_76.1.dr	String found in binary or memory: https://new-pdf-document-approval.us-lax-1.linodeobjects.com/app.html
Source: chromecache_82.1.dr	String found in binary or memory: https://openfpcdn.io/botd/v1
Source: chromecache_83.1.dr	String found in binary or memory: https://opensource.org/license/mit/

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49690
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49690 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.17:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.2:443 -> 192.168.2.17:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.209.130:443 -> 192.168.2.17:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.17:49752 version: TLS 1.2

Source: classification engine

Classification label: mal72.phis.win@28/50@28/13

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\Chrome\Application\Dictionaries

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://lnkd.in/exwPeXjc
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 --field-trial-handle=1928,i,3036787709100133626,7959615547617459310,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 --field-trial-handle=1928,i,3036787709100133626,7959615547617459310,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries

Jump to behavior

Drops files with a non-matching file extension (content does not match file extension)

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 94
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 94			Jump to dropped file

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.17.24.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
13.107.246.42	s-part-0014.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
152.199.21.118	cs1404.wpc.epsiloncdn.net	United States	15133	EDGECASTUS	false
104.21.44.57	a9d041c33434.wazo-biawalkeks.ru	United States	13335	CLOUDFLARENETUS	false
13.32.99.33	openfpcdn.io	United States	16509	AMAZON-02US	false
13.107.42.14	lnkd.in	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
188.114.97.3	4454275f.rwnbqwuligbumyzvpodsthfkaftacy.pages.dev	European Union	13335	CLOUDFLARENETUS	false
142.250.185.164	www.google.com	United States	15169	GOOGLEUS	false
188.114.96.3	unknown	European Union	13335	CLOUDFLARENETUS	false
151.101.194.137	code.jquery.com	United States	54113	FASTLYUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.17

Contacted Domains

Name	IP	Active
lnkd.in	13.107.42.14	true
openfpcdn.io	13.32.99.33	true
s-part-0014.t-0009.t-msedge.net	13.107.246.42	true
a9d041c33434.wazo-biawalkeks.ru	104.21.44.57	true
a.nel.cloudflare.com	35.190.80.1	true
4454275f.rwnbqwuligbumyzvpodsthfkaftacy.pages.dev	188.114.97.3	true
code.jquery.com	151.101.194.137	true
cdnjs.cloudflare.com	104.17.24.14	true
cs1404.wpc.epsiloncdn.net	152.199.21.118	true
www.google.com	142.250.185.164	true
document-display-verifycation-download-pdf.us-east-1.linodeobjects.com	unknown	unknown
media.licdn.com	unknown	unknown
new-pdf-document-approval.us-lax-1.linodeobjects.com	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://4454275f.rwnbqwuligbumyzvpodsthfkaftacy.pages.dev/justintime.png	false	Avira URL Cloud: safe	unknown
https://a9d041c33434.wazo-biawalkeks.ru/p/89?session=be20ea5bbbe9ef456236afd95beaab99d2c85bfef4d89e6fa105930dad415426	false	Avira URL Cloud: malware	unknown
https://a9d041c33434.wazo-biawalkeks.ru/s/f522420955	false	Avira URL Cloud: malware	unknown
https://new-pdf-document-approval.us-lax-1.linodeobjects.com/app.html#john.smith@outlook.com	true		unknown
https://lnkd.in/exwPeXjc	false		unknown
https://a9d041c33434.wazo-biawalkeks.ru/r/17?session=be20ea5bbbe9ef456236afd95beaab99d2c85bfef4d89e6fa105930dad415426	false	Avira URL Cloud: malware	unknown
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.css	false	Avira URL Cloud: safe	unknown
https://media.licdn.com/favicon.ico	false	Avira URL Cloud: safe	unknown
https://code.jquery.com/jquery-3.1.1.min.js	false	URL Reputation: safe	unknown
https://document-display-verifycation-download-pdf.us-east-1.linodeobjects.com/safe.html	true		unknown
file:///C:/Users/user/Downloads/downloaded.pdf	false	Avira URL Cloud: safe	unknown
https://a9d041c33434.wazo-biawalkeks.ru/s/17?0	false	Avira URL Cloud: malware	unknown
about:blank	false	Avira URL Cloud: safe	unknown
https://a.nel.cloudflare.com/report/v4?s=nrKzxdK6ZWtiB360dfcgyfHlEyQrmcteEszO2SGLLfo%2BWTBTqD5nD2LJw3uYAZoDVdYoYw0VIFG%2BykgplEJ7ziwW4QVub3UEYQePbdig3sSEGaNiOrII630vnzkYOXSd2ll%2FzHuhGhVFdlUIhPf32re2	false	Avira URL Cloud: safe	unknown
https://openfpcdn.io/botd/v1	false	Avira URL Cloud: safe	unknown
https://media.licdn.com/dms/document/media/D4E1FAQHFhtSoZc3ecA/feedshare-document-pdf-analyzed/0/1719999064861?e=1720656000&v=beta&t=LBGMvkRjVKeHwsuNkcV3IvRRVllumgKht0mdUo0Jks4	false		unknown

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jul 3 11:44:36 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	7D3B1119F29165B7C9926EAEC5B9D18F	0B42B696D26CFD0D6137BE25B4FF9FE724F2D82A	4884E133DD4C3A54E73B360DA8D73AC2567B79954683C4FD4044A593348B1CB2
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jul 3 11:44:36 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	08B6FEF16F485982C71401D84D69C4FD	A758DA0E5882A2A9801DC3DB46115EFB5D046E37	4DB4367B3AC1E31FCFE0511FFE2E01C9CD5C1F1D9D0DD7E80B03A2B80E78B235
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:54:41 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	D357F968B20AD9345898E31DAC661C26	93AFDFCD832D8B06C6CA89951B12E60C46F1B5F1	47F3D1C23EC50C3B0D091CA638D59B60DE92D61A824E9DCA0ED5361D07919C73
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jul 3 11:44:36 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	280675D317A901CA98235B39B994A501	F01BBA70D5A019200390E937BB30E26D5B4E0E4D	42954E4FFD856178F54C796E3DCC7F3033DBB52D091AA0A3F047F460DB617F5F
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jul 3 11:44:36 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	E8A7FF0A6C3438869AB4CF33B32FDE79	E92C883C52347BE5BE9967A51DB69BE1FCC4AA1D	BA2F2066983F29434295C6476758B5B0D76E9A47998635477C2842F3E27F7D8E
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jul 3 11:44:36 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	959F7D4E1BAD3EF481DDFD300E4CB131	91DE82F77A976256256C3C75D96589BB4A437A7F	F50D65999F745A267142EB6D8F523A9E0727FE48459531BF4A9AEC89BE067C74
C:\Users\user\Downloads\a5c98876-310a-45db-9c1e-4c2240b847f8.tmp	PDF document, version 1.5	06B689C78B093A72D4494EEE9548A4B6	7EB387795082C59BDB7AF1D4A92D70A03B6E2E65	C1326A7CEEBF653DEFD925CF0BB2F26312C78A46BDC9526E5DB0A3F00073838F
C:\Users\user\Downloads\downloaded.pdf (copy)	PDF document, version 1.5	06B689C78B093A72D4494EEE9548A4B6	7EB387795082C59BDB7AF1D4A92D70A03B6E2E65	C1326A7CEEBF653DEFD925CF0BB2F26312C78A46BDC9526E5DB0A3F00073838F
C:\Users\user\Downloads\downloaded.pdf.crdownload	PDF document, version 1.5	06B689C78B093A72D4494EEE9548A4B6	7EB387795082C59BDB7AF1D4A92D70A03B6E2E65	C1326A7CEEBF653DEFD925CF0BB2F26312C78A46BDC9526E5DB0A3F00073838F
C:\Users\user\Downloads\f01c7ac1-a3d5-4eaf-8e0b-1f16ebf5e4d9.tmp	PDF document, version 1.5	07C43C9FF67D414BF175E63BFC8B606B	3D33C699CC746EA75129753014578373E88A006E	DAB6697ACA3A9A0A430DA6CC88006DE67D25A5F5C0B35C9039C69D9DBD746DC1
Chrome Cache Entry: 76	HTML document, ASCII text	69B80ED9E556CFA4763274BEE32EA076	875C9293B496DE1CC874673C286E515610225A01	0D5F02B6DF2D7EC20071F86212842628C51EB7C10EF12D3BD6FC0295568E591B
Chrome Cache Entry: 77	ASCII text, with no line terminators	E721A00697623C97B9360AE4D2F2D43F	760C2B7BEFEE736065EF81F68A038EE9E1007980	04E9057CC4683CAE4DED77AC87229A550D2283B9C31972C2EDC8C07CC07DE501
Chrome Cache Entry: 78	HTML document, ASCII text, with no line terminators	3C1E93918DED52F0C4EE90C77751FCC9	265760C97139D6DE3CC6D96D6C08B3B0F326FDD9	4E38FE6EA52CE4D0F69086FAA9C279F522E35D454C65CEFE55EB2F45633F4890
Chrome Cache Entry: 79	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 250	21B761F2B1FD37F587D7222023B09276	F7A416C8907424F9A9644753E3A93D4D63AE640E	72D4161C18A46D85C5566273567F791976431EFEF49510A0E3DD76FEC92D9393
Chrome Cache Entry: 80	ASCII text, with very long lines (15005)	234A8C1C15DF9B03C65E9E14C82FC872	E5CA36727846AEDE7DFBC07E88B2B025EB0CAE90	29CB26E06F2A4A877F1134A46480D9B78F8B6E0E6F9B0FE67E34307C312B5A89
Chrome Cache Entry: 81	PNG image data, 1948 x 1230, 8-bit/color RGBA, non-interlaced	BF7AEE84A41C88708A18221BCF7C1428	1E9DDA8B110F30F3CA6AFFC3AF36B0872B40703A	41D646F27C876D849AB773465DB351020D26FB91A63593F1A6C6A33807927710
Chrome Cache Entry: 82	HTML document, ASCII text, with very long lines (3341)	A9248BE79292499688FA4928835CC026	568E9E115946F45B21D4E5A5090931923E20C9C9	06F1434ED3EA39E4CDEFD8F7FAC294F01699C16A4340F6CC6FB73C8010CA2C88
Chrome Cache Entry: 83	Unicode text, UTF-8 text, with very long lines (39376)	D922769A1B20F5D8AB13E3066F7700CF	60F2B9F44DF88577051DABED59DF27F176B5B759	5FE11E86F4D67026C24489DFAD8649C78F7E538F4B447BA98773AD189BC2E934
Chrome Cache Entry: 84	ASCII text, with no line terminators	854D2C6CF8BB258FB9ED2965A3DAC0AD	D219F1F860D6F7B74542725770099A208046C789	76E50552AEB7B7EC1C2F49A2AC413B1310FAF57581FAA43AA559694B1908A0C7
Chrome Cache Entry: 85	troff or preprocessor input, ASCII text, with very long lines (372)	C495654869785BC3DF60216616814AD1	0140952C64E3F2B74EF64E050F2FE86EAB6624C8	36E0A7E08BEE65774168528938072C536437669C1B7458AC77976EC788E4439C
Chrome Cache Entry: 86	XML 1.0 document, ASCII text, with no line terminators	5EB02CEF2444509E9E4B15BE6D2442D6	E78A26D3A4FE357C0A5A56F6A50D00ECF23B92C6	0BADFC852F81395E0CFC76F23C6542C313ED07F87A2F3C1AA334085C8AF022C5
Chrome Cache Entry: 87	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 250	21B761F2B1FD37F587D7222023B09276	F7A416C8907424F9A9644753E3A93D4D63AE640E	72D4161C18A46D85C5566273567F791976431EFEF49510A0E3DD76FEC92D9393
Chrome Cache Entry: 88	ASCII text, with very long lines (32030)	E071ABDA8FE61194711CFC2AB99FE104	F647A6D37DC4CA055CED3CF64BBC1F490070ACBA	85556761A8800D14CED8FCD41A6B8B26BF012D44A318866C0D81A62092EFD9BF
Chrome Cache Entry: 89	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 2905	5C7ACF60A2ACAA5C54BF2B2EC6D484D8	F1837FD5DB6DAD498148D7D77438DE693114B042	EE21196A4F5EF64135B7998E58F1E7210608674E3FDF97B328C1C237E3B184DB
Chrome Cache Entry: 90	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 2905	5C7ACF60A2ACAA5C54BF2B2EC6D484D8	F1837FD5DB6DAD498148D7D77438DE693114B042	EE21196A4F5EF64135B7998E58F1E7210608674E3FDF97B328C1C237E3B184DB
Chrome Cache Entry: 91	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 7390	9D372E951D45A26EDE2DC8B417AAE4F8	84F97A777B6C33E2947E6D0BD2BFCFFEC601785A	4E9C9141705E9A4D83514CEE332148E1E92126376D049DAED9079252FA9F9212
Chrome Cache Entry: 92	HTML document, ASCII text	69B80ED9E556CFA4763274BEE32EA076	875C9293B496DE1CC874673C286E515610225A01	0D5F02B6DF2D7EC20071F86212842628C51EB7C10EF12D3BD6FC0295568E591B
Chrome Cache Entry: 93	PNG image data, 1948 x 1230, 8-bit/color RGBA, non-interlaced	BF7AEE84A41C88708A18221BCF7C1428	1E9DDA8B110F30F3CA6AFFC3AF36B0872B40703A	41D646F27C876D849AB773465DB351020D26FB91A63593F1A6C6A33807927710
Chrome Cache Entry: 94	PDF document, version 1.5	06B689C78B093A72D4494EEE9548A4B6	7EB387795082C59BDB7AF1D4A92D70A03B6E2E65	C1326A7CEEBF653DEFD925CF0BB2F26312C78A46BDC9526E5DB0A3F00073838F
Chrome Cache Entry: 95	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 7390	9D372E951D45A26EDE2DC8B417AAE4F8	84F97A777B6C33E2947E6D0BD2BFCFFEC601785A	4E9C9141705E9A4D83514CEE332148E1E92126376D049DAED9079252FA9F9212
Chrome Cache Entry: 96	JSON data	2D7D30EA1C6F925302D2C3ABED382951	5BA6BBC5670C4AF1125CF9AC0AA1CA2811E744D1	83C09BA9A8DAEDB136F90B17A294CAA90AD471A016E430DF6E229ACB5A81E100
Chrome Cache Entry: 97	HTML document, ASCII text, with very long lines (62292)	3C0924DB960B771361381ADA025756A5	667CD37E9F469FF2B560F6948FD65120B72B9DEC	FA8A3156A9DE35EEE8787A01D6AD2AAEA2F99FFAE0D3A097C237C925FBA1CA0F
Chrome Cache Entry: 98	XML 1.0 document, ASCII text, with no line terminators	844B1528CDAF7A4E6DD51E143A8B09C6	EC37CB11DDF6E5CD3D2FA45D941F0C6D2A8BC29C	224F74BEBA09041D4CB037B7144DDF26DE08CA43ED846E068DFD39C55B3D8F8B

AV Detection

Antivirus detection for URL or domain

Source: https://a9d041c33434.wazo-biawalkeks.ru/s/f522420955	Avira URL Cloud: Label: malware
Source: https://a9d041c33434.wazo-biawalkeks.ru/p/89?session=be20ea5bbbe9ef456236afd95beaab99d2c85bfef4d89e6fa105930dad415426	Avira URL Cloud: Label: malware
Source: https://a9d041c33434.wazo-biawalkeks.ru	Avira URL Cloud: Label: malware
Source: https://a9d041c33434.wazo-biawalkeks.ru/r/17?session=be20ea5bbbe9ef456236afd95beaab99d2c85bfef4d89e6fa105930dad415426	Avira URL Cloud: Label: malware
Source: https://a9d041c33434.wazo-biawalkeks.ru/s/17?0	Avira URL Cloud: Label: malware

Phishing

AI detected phishing page

Source: https://document-display-verifycation-download-pdf.us-east-1.linodeobjects.com

Yara detected HtmlPhish10

Source: Yara match	File source: 4.8.pages.csv, type: HTML
Source: Yara match	File source: 4.7.pages.csv, type: HTML

Phishing site detected (based on image similarity)

Source: https://new-pdf-document-approval.us-lax-1.linodeobjects.com/app.html#john.smith@outlook.com

Matcher: Found strong image similarity, brand: MICROSOFT

Phishing site detected (based on logo match)

Source: https://document-display-verifycation-download-pdf.us-east-1.linodeobjects.com/safe.html	Matcher: Template: microsoft matched
Source: https://document-display-verifycation-download-pdf.us-east-1.linodeobjects.com/safe.html	Matcher: Template: microsoft matched
Source: https://new-pdf-document-approval.us-lax-1.linodeobjects.com/app.html#john.smith@outlook.com	Matcher: Template: microsoft matched

HTML body contains low number of good links

Source: https://document-display-verifycation-download-pdf.us-east-1.linodeobjects.com/safe.html	HTTP Parser: Number of links: 0
Source: https://new-pdf-document-approval.us-lax-1.linodeobjects.com/app.html#john.smith@outlook.com	HTTP Parser: Number of links: 0

HTML body contains password input but no form action

Source: https://new-pdf-document-approval.us-lax-1.linodeobjects.com/app.html#john.smith@outlook.com

HTTP Parser: <input type="password" .../> found but no <form action="...

HTML body with high number of embedded images detected

Source: https://new-pdf-document-approval.us-lax-1.linodeobjects.com/app.html#john.smith@outlook.com

HTTP Parser: Total embedded image size: 18628

HTML title does not match URL

Source: https://document-display-verifycation-download-pdf.us-east-1.linodeobjects.com/safe.html	HTTP Parser: Title: Verification Defender Associate does not match URL
Source: https://new-pdf-document-approval.us-lax-1.linodeobjects.com/app.html#john.smith@outlook.com	HTTP Parser: Title: Sign in to Best Productivity Provider does not match URL

Source: https://new-pdf-document-approval.us-lax-1.linodeobjects.com/app.html#john.smith@outlook.com

HTTP Parser: <input type="password" .../> found

Source: https://media.licdn.com/dms/document/media/D4E1FAQHFhtSoZc3ecA/feedshare-document-pdf-analyzed/0/1719999064861?e=1720656000&v=beta&t=LBGMvkRjVKeHwsuNkcV3IvRRVllumgKht0mdUo0Jks4	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: https://document-display-verifycation-download-pdf.us-east-1.linodeobjects.com/safe.html	HTTP Parser: No favicon
Source: https://document-display-verifycation-download-pdf.us-east-1.linodeobjects.com/safe.html	HTTP Parser: No favicon
Source: https://new-pdf-document-approval.us-lax-1.linodeobjects.com/app.html#john.smith@outlook.com	HTTP Parser: No favicon

Source: https://document-display-verifycation-download-pdf.us-east-1.linodeobjects.com/safe.html	HTTP Parser: No <meta name="author".. found
Source: https://document-display-verifycation-download-pdf.us-east-1.linodeobjects.com/safe.html	HTTP Parser: No <meta name="author".. found
Source: https://new-pdf-document-approval.us-lax-1.linodeobjects.com/app.html#john.smith@outlook.com	HTTP Parser: No <meta name="author".. found
Source: https://new-pdf-document-approval.us-lax-1.linodeobjects.com/app.html#john.smith@outlook.com	HTTP Parser: No <meta name="author".. found

Source: https://document-display-verifycation-download-pdf.us-east-1.linodeobjects.com/safe.html	HTTP Parser: No <meta name="copyright".. found
Source: https://document-display-verifycation-download-pdf.us-east-1.linodeobjects.com/safe.html	HTTP Parser: No <meta name="copyright".. found
Source: https://new-pdf-document-approval.us-lax-1.linodeobjects.com/app.html#john.smith@outlook.com	HTTP Parser: No <meta name="copyright".. found
Source: https://new-pdf-document-approval.us-lax-1.linodeobjects.com/app.html#john.smith@outlook.com	HTTP Parser: No <meta name="copyright".. found

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries

Jump to behavior

Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.17:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.2:443 -> 192.168.2.17:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.209.130:443 -> 192.168.2.17:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.17:49752 version: TLS 1.2

HTTP GET or POST without a user agent

Source: global traffic

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108

Source: global traffic	HTTP traffic detected: GET /exwPeXjc HTTP/1.1Host: lnkd.inConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dms/document/media/D4E1FAQHFhtSoZc3ecA/feedshare-document-pdf-analyzed/0/1719999064861?e=1720656000&v=beta&t=LBGMvkRjVKeHwsuNkcV3IvRRVllumgKht0mdUo0Jks4 HTTP/1.1Host: media.licdn.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: media.licdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://media.licdn.com/dms/document/media/D4E1FAQHFhtSoZc3ecA/feedshare-document-pdf-analyzed/0/1719999064861?e=1720656000&v=beta&t=LBGMvkRjVKeHwsuNkcV3IvRRVllumgKht0mdUo0Jks4Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dms/document/media/D4E1FAQHFhtSoZc3ecA/feedshare-document-pdf-analyzed/0/1719999064861?e=1720656000&v=beta&t=LBGMvkRjVKeHwsuNkcV3IvRRVllumgKht0mdUo0Jks4 HTTP/1.1Host: media.licdn.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /justintime.png HTTP/1.1Host: 4454275f.rwnbqwuligbumyzvpodsthfkaftacy.pages.devConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://document-display-verifycation-download-pdf.us-east-1.linodeobjects.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /justintime.png HTTP/1.1Host: 4454275f.rwnbqwuligbumyzvpodsthfkaftacy.pages.devConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=OlzVxePTb23C3OT&MD=9w8h8RrU HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /s/f522420955 HTTP/1.1Host: a9d041c33434.wazo-biawalkeks.ruConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://new-pdf-document-approval.us-lax-1.linodeobjects.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://new-pdf-document-approval.us-lax-1.linodeobjects.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/17?0 HTTP/1.1Host: a9d041c33434.wazo-biawalkeks.ruConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://new-pdf-document-approval.us-lax-1.linodeobjects.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://a9d041c33434.wazo-biawalkeks.ru/s/f522420955Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /botd/v1 HTTP/1.1Host: openfpcdn.ioConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://new-pdf-document-approval.us-lax-1.linodeobjects.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://a9d041c33434.wazo-biawalkeks.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.1.1.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://new-pdf-document-approval.us-lax-1.linodeobjects.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/font-awesome/4.7.0/css/font-awesome.css HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://new-pdf-document-approval.us-lax-1.linodeobjects.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://new-pdf-document-approval.us-lax-1.linodeobjects.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_verify_call_fe87496cc7a44412f7893a72099c120a.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://new-pdf-document-approval.us-lax-1.linodeobjects.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_verify_sms_27a6d18b56f46818420e60a773c36d4e.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://new-pdf-document-approval.us-lax-1.linodeobjects.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_verify_fluent_authenticator_b59c16ca9bf156438a8a96d45e33db64.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://new-pdf-document-approval.us-lax-1.linodeobjects.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /r/17?session=be20ea5bbbe9ef456236afd95beaab99d2c85bfef4d89e6fa105930dad415426 HTTP/1.1Host: a9d041c33434.wazo-biawalkeks.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /p/89?session=be20ea5bbbe9ef456236afd95beaab99d2c85bfef4d89e6fa105930dad415426 HTTP/1.1Host: a9d041c33434.wazo-biawalkeks.ruConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://new-pdf-document-approval.us-lax-1.linodeobjects.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Sec-WebSocket-Key: 7x3gqcbaZBYMUlF+bnK4Yg==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_verify_call_fe87496cc7a44412f7893a72099c120a.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_verify_fluent_authenticator_b59c16ca9bf156438a8a96d45e33db64.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_verify_sms_27a6d18b56f46818420e60a773c36d4e.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ab HTTP/1.1Host: evoke-windowsservices-tas.msedge.netCache-Control: no-store, no-cacheX-PHOTOS-CALLERID: 9NMPJ99VJBWVX-EVOKE-RING: X-WINNEXT-RING: PublicX-WINNEXT-TELEMETRYLEVEL: BasicX-WINNEXT-OSVERSION: 10.0.19045.0X-WINNEXT-APPVERSION: 1.23082.131.0X-WINNEXT-PLATFORM: DesktopX-WINNEXT-CANTAILOR: FalseX-MSEDGE-CLIENTID: {c1afbad7-f7da-40f2-92f9-8846a91d69bd}X-WINNEXT-PUBDEVICEID: dbfen2nYS7HW6ON4OdOknKxxv2CCI5LJBTojzDztjwI=If-None-Match: 2056388360_-1434155563Accept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: GET /client/config?cc=CH&setlang=en-CH HTTP/1.1X-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateAccept-Encoding: gzip, deflateX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-UserAgeClass: UnknownX-BM-Market: CHX-BM-DateFormat: dd/MM/yyyyX-Device-OSSKU: 48X-BM-DTZ: -240X-DeviceID: 01000A41090080B6X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66EX-Search-TimeZone: Bias=300; DaylightBias=-60; TimeZoneKeyName=Eastern Standard TimeX-BM-Theme: 000000;0078d7X-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAdf6fx9Ji7Ej/SPij2SabLpuatSulvQrFHbHjzXYKWlT81vOBNVMDXbv8%2BrPztM6ApAs0yKf9ctGXGjbbqq6BQu1GleUx8WhS7xy5qv2mz0hDlwkfdA%2BFhupjTdwQAcqvcUmhAdwiLxJJgzYywpjkRiuBlQ6H8ucPfXwny%2BuKke5BoPYRC1AFyq/Q4ehNlZecXBhLbm67oAtaQrwXTf%2BAssBYa5XywrKXHtJJQkrv/w5xcIEbed/OYBL3nSugQomRkrKa9WGMfRmHUPkNex5DLMprR/Au/liwcM5hEEStGRx7oP/pMetXVKkITE7lTkAU1LTorfT6Qx/HomyUwX5lTYDZgAACCVgyePhTEjDqAEaAXVKheVUI%2BqIejcKVap9Fnb2igk0RATZBzah/n9XslmuQgPBoDJF8TmcB%2BdHpKpggj8d4oj1GHXhyL%2BriMIIvBKZboFLX9YxMur31%2BIM8rivxWSUEdbcynky%2BIJaWAi21MtQIIlUxazwX5w1OtJLp7jZhFWY9pphddmqXd6aROlp1QxONyqeLkO8TC2tmN0BZxxycK%2BZf0pJyDyddIZAg%2B4m5Us7vDEEYn1CsGbwNXpSg%2BySabLDPthZ%2BaLzycnplybWuz3UjH9uwq11QCkBrzwf%2Bl2raTZmXZJzQCFH9uFRYXIr1iRLpJoPWpI7Y4GhJU%2Be7TULTpBenzShA1i541EiGy/Ca7PoVFXzNZ6IHDlF18duuViRkuZMz2kwYQa2l0cF0DPod%2BzLYq/ok3upAHUy47%2BoAxo7nRaJC/xgsbJLaOaUwexi8NKag0FApMBKRpKyi6Lqcv5mX/Jn4aDTBsNUSHjlIG1ARLNGzqvpICrolvA6DOadtpcc2rwo4k6sA%2BosZpzeCNPWQBuFSNIuFQg1e1I2nPGElq0g3eSoIyLPcM/wlN7%2B1wE%3D%26p%3DX-Agent-DeviceId: 01000A41090080B6X-BM-CBT: 1720010721User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045X-Device-isOptin: falseAccept-language: en-GB, en, en-USX-Device-Touch: falseX-Device-ClientSession: 0EBF33E7864C42C090258436551F98DAX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIHost: www.bing.comConnection: Keep-AliveCookie: SRCHUID=V=2&GUID=C4EAB6C130004333A34B5668AE4E4D10&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=en; MUID=4590362BB5CF472B95BBEDB3112D4B7B; MUIDB=4590362BB5CF472B95BBEDB3112D4B7B
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=OlzVxePTb23C3OT&MD=9w8h8RrU HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /justintime.png HTTP/1.1Host: 4454275f.rwnbqwuligbumyzvpodsthfkaftacy.pages.devConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://document-display-verifycation-download-pdf.us-east-1.linodeobjects.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "1e93fa2a5bb96f4623b72a752697c906"
Source: global traffic	HTTP traffic detected: GET /justintime.png HTTP/1.1Host: 4454275f.rwnbqwuligbumyzvpodsthfkaftacy.pages.devConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "1e93fa2a5bb96f4623b72a752697c906"

Source: global traffic	DNS traffic detected: DNS query: lnkd.in
Source: global traffic	DNS traffic detected: DNS query: media.licdn.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: document-display-verifycation-download-pdf.us-east-1.linodeobjects.com
Source: global traffic	DNS traffic detected: DNS query: 4454275f.rwnbqwuligbumyzvpodsthfkaftacy.pages.dev
Source: global traffic	DNS traffic detected: DNS query: new-pdf-document-approval.us-lax-1.linodeobjects.com
Source: global traffic	DNS traffic detected: DNS query: a9d041c33434.wazo-biawalkeks.ru
Source: global traffic	DNS traffic detected: DNS query: openfpcdn.io
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com

Source: unknown

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundAccept-Ranges: bytesAccess-Control-Allow-Origin: Age: 6Cache-Control: max-age=604800Content-Type: text/htmlDate: Wed, 03 Jul 2024 12:44:38 GMTExpires: Wed, 10 Jul 2024 12:44:38 GMTLast-Modified: Wed, 03 Jul 2024 12:44:32 GMTServer: ECAcc (lhc/7955)Timing-Allow-Origin: X-Cache: 404-HITX-CDN: ECSTX-CDN-CLIENT-IP-VERSION: IPV4X-CDN-Proto: HTTP1X-Content-Type-Options: nosniffX-Li-Fabric: prod-lva1X-Li-Pop: prod-lva1-xX-LI-Proto: http/1.1X-LI-UUID: AAYcVzEerX/ygtonZOq/zA==Content-Length: 364780Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 03 Jul 2024 12:45:20 GMTContent-Type: application/jsonContent-Length: 22Connection: closeCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EBOJqpl80hCkrROfCJi%2Bw%2F8FRzQ9kiSPWPaNQ8xUxs1Mfq6jdbjH%2FJNxS33taFrtEXbLW04mOTQG3OM1SmakOOJHjD4IWpDM05KNO0Ctw%2BLOzdrcVr6ilt8OjcA7vcf4JwEqtggXT6ilnXIbGG3pL4oj"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 89d6f8dbf8cb0fa7-EWRalt-svc: h3=":443"; ma=86400

Source: chromecache_85.1.dr	String found in binary or memory: http://fontawesome.io
Source: chromecache_85.1.dr	String found in binary or memory: http://fontawesome.io/license
Source: chromecache_80.1.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php)
Source: chromecache_76.1.dr	String found in binary or memory: https://4454275f.rwnbqwuligbumyzvpodsthfkaftacy.pages.dev/justintime.png
Source: chromecache_82.1.dr	String found in binary or memory: https://a9d041c33434.wazo-biawalkeks.ru
Source: chromecache_78.1.dr	String found in binary or memory: https://a9d041c33434.wazo-biawalkeks.ru/s/f522420955
Source: chromecache_80.1.dr, chromecache_83.1.dr	String found in binary or memory: https://fingerprint.com)
Source: chromecache_83.1.dr	String found in binary or memory: https://mariadb.com/bsl11/
Source: chromecache_92.1.dr, chromecache_76.1.dr	String found in binary or memory: https://new-pdf-document-approval.us-lax-1.linodeobjects.com/app.html
Source: chromecache_82.1.dr	String found in binary or memory: https://openfpcdn.io/botd/v1
Source: chromecache_83.1.dr	String found in binary or memory: https://opensource.org/license/mit/

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49690
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49690 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.17:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.2:443 -> 192.168.2.17:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.209.130:443 -> 192.168.2.17:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.17:49752 version: TLS 1.2

Source: classification engine

Classification label: mal72.phis.win@28/50@28/13

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\Chrome\Application\Dictionaries

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://lnkd.in/exwPeXjc
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 --field-trial-handle=1928,i,3036787709100133626,7959615547617459310,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 --field-trial-handle=1928,i,3036787709100133626,7959615547617459310,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries

Jump to behavior

Drops files with a non-matching file extension (content does not match file extension)

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 94
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 94			Jump to dropped file

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

ID:	1466890
Product:	CloudBasic
Start time:	14:44:06
Start date:	03.07.2024
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Windows Analysis Report
https://lnkd.in/exwPeXjc

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Persistence and Installation Behavior

Boot Survival

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report https://lnkd.in/exwPeXjc

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Persistence and Installation Behavior

Boot Survival

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
https://lnkd.in/exwPeXjc