Windows Analysis Report
http://1qm32p.axshare.com/id=jxmnwg&p=files_-_view&g=1

Overview

General Information

Sample URL:	http://1qm32p.axshare.com/id=jxmnwg&p=files_-_view&g=1
Analysis ID:	1545405

Detection

Score:	22
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Ask for current and new password

HTML body contains low number of good links

HTML body contains password input but no form action

HTML title does not match URL

Invalid 'forgot password' link found

Stores files to the Windows start menu directory

Classification

Signatures

Phishing

Ask for current and new password

Source: https://1qm32p.axshare.com/id=jxmnwg&p=files_-_view&g=1	HTTP Parser: Two password fields found
Source: https://1qm32p.axshare.com/id=jxmnwg&p=files_-_view&g=1	HTTP Parser: Two password fields found

HTML body contains low number of good links

Source: https://1qm32p.axshare.com/id=jxmnwg&p=files_-_view&g=1	HTTP Parser: Number of links: 1
Source: https://accounts.axure.com/app/login?redirect=https%3A%2F%2Fapp.axure.cloud%2Fuser%2Faxureauth%3Fredirect%3Dhttps%253A%252F%252Fapp.axure.cloud%252Fapp%252Flogin%253Fauth%253Dtrue%2526redirect%253D%25252Ffs%25252Fmanage	HTTP Parser: Number of links: 1

HTML body contains password input but no form action

Source: https://1qm32p.axshare.com/id=jxmnwg&p=files_-_view&g=1	HTTP Parser: <input type="password" .../> found but no <form action="...
Source: https://accounts.axure.com/app/login?redirect=https%3A%2F%2Fapp.axure.cloud%2Fuser%2Faxureauth%3Fredirect%3Dhttps%253A%252F%252Fapp.axure.cloud%252Fapp%252Flogin%253Fauth%253Dtrue%2526redirect%253D%25252Ffs%25252Fmanage	HTTP Parser: <input type="password" .../> found but no <form action="...

HTML title does not match URL

Source: https://1qm32p.axshare.com/id=jxmnwg&p=files_-_view&g=1

HTTP Parser: Title: Axure Cloud - Page Not Found does not match URL

Invalid 'forgot password' link found

Source: https://accounts.axure.com/app/login?redirect=https%3A%2F%2Fapp.axure.cloud%2Fuser%2Faxureauth%3Fredirect%3Dhttps%253A%252F%252Fapp.axure.cloud%252Fapp%252Flogin%253Fauth%253Dtrue%2526redirect%253D%25252Ffs%25252Fmanage

HTTP Parser: Invalid link: Forgot password?

Source: https://1qm32p.axshare.com/id=jxmnwg&p=files_-_view&g=1

HTTP Parser: Iframe src: https://td.doubleclick.net/td/ga/rul?tid=G-B3LZG100EH&gacid=471451652.1730294307&gtm=45je4as0v9117993818z8811142593za200zb811142593&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=101533422~101823848~101878899~101878944~101925629&z=1902777748

Source: https://1qm32p.axshare.com/id=jxmnwg&p=files_-_view&g=1	HTTP Parser: <input type="password" .../> found
Source: https://accounts.axure.com/app/login?redirect=https%3A%2F%2Fapp.axure.cloud%2Fuser%2Faxureauth%3Fredirect%3Dhttps%253A%252F%252Fapp.axure.cloud%252Fapp%252Flogin%253Fauth%253Dtrue%2526redirect%253D%25252Ffs%25252Fmanage	HTTP Parser: <input type="password" .../> found

Source: https://1qm32p.axshare.com/id=jxmnwg&p=files_-_view&g=1	HTTP Parser: No favicon
Source: https://1qm32p.axshare.com/id=jxmnwg&p=files_-_view&g=1	HTTP Parser: No favicon

Source: https://1qm32p.axshare.com/id=jxmnwg&p=files_-_view&g=1	HTTP Parser: No <meta name="author".. found
Source: https://1qm32p.axshare.com/id=jxmnwg&p=files_-_view&g=1	HTTP Parser: No <meta name="author".. found
Source: https://accounts.axure.com/app/login?redirect=https%3A%2F%2Fapp.axure.cloud%2Fuser%2Faxureauth%3Fredirect%3Dhttps%253A%252F%252Fapp.axure.cloud%252Fapp%252Flogin%253Fauth%253Dtrue%2526redirect%253D%25252Ffs%25252Fmanage	HTTP Parser: No <meta name="author".. found
Source: https://accounts.axure.com/app/login?redirect=https%3A%2F%2Fapp.axure.cloud%2Fuser%2Faxureauth%3Fredirect%3Dhttps%253A%252F%252Fapp.axure.cloud%252Fapp%252Flogin%253Fauth%253Dtrue%2526redirect%253D%25252Ffs%25252Fmanage	HTTP Parser: No <meta name="author".. found

Source: https://1qm32p.axshare.com/id=jxmnwg&p=files_-_view&g=1	HTTP Parser: No <meta name="copyright".. found
Source: https://1qm32p.axshare.com/id=jxmnwg&p=files_-_view&g=1	HTTP Parser: No <meta name="copyright".. found
Source: https://accounts.axure.com/app/login?redirect=https%3A%2F%2Fapp.axure.cloud%2Fuser%2Faxureauth%3Fredirect%3Dhttps%253A%252F%252Fapp.axure.cloud%252Fapp%252Flogin%253Fauth%253Dtrue%2526redirect%253D%25252Ffs%25252Fmanage	HTTP Parser: No <meta name="copyright".. found
Source: https://accounts.axure.com/app/login?redirect=https%3A%2F%2Fapp.axure.cloud%2Fuser%2Faxureauth%3Fredirect%3Dhttps%253A%252F%252Fapp.axure.cloud%252Fapp%252Flogin%253Fauth%253Dtrue%2526redirect%253D%25252Ffs%25252Fmanage	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.17:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.17:49811 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.2:443 -> 192.168.2.17:49814 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.209.143:443 -> 192.168.2.17:49818 version: TLS 1.2

Source: chrome.exe

Memory has grown: Private usage: 19MB later: 30MB

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27

Source: global traffic	DNS traffic detected: DNS query: 1qm32p.axshare.com
Source: global traffic	DNS traffic detected: DNS query: accounts.axure.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: analytics.google.com
Source: global traffic	DNS traffic detected: DNS query: stats.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: td.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: app.axure.cloud
Source: global traffic	DNS traffic detected: DNS query: js.hs-scripts.com
Source: global traffic	DNS traffic detected: DNS query: js.hs-banner.com
Source: global traffic	DNS traffic detected: DNS query: js.hscollectedforms.net
Source: global traffic	DNS traffic detected: DNS query: js.hsadspixel.net
Source: global traffic	DNS traffic detected: DNS query: js.hs-analytics.net
Source: global traffic	DNS traffic detected: DNS query: www.axure.com

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49691
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49691 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.17:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.17:49811 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.2:443 -> 192.168.2.17:49814 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.209.143:443 -> 192.168.2.17:49818 version: TLS 1.2

Source: classification engine

Classification label: sus22.phis.win@22/54@46/424

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=1980,i,17442641582903567275,16888314058662241411,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://1qm32p.axshare.com/id=jxmnwg&p=files_-_view&g=1"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=1980,i,17442641582903567275,16888314058662241411,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.68	www.google.com	United States	15169	GOOGLEUS	false
74.125.133.155	unknown	United States	15169	GOOGLEUS	false
142.250.185.206	unknown	United States	15169	GOOGLEUS	false
34.204.121.204	www.axure.com	United States	14618	AMAZON-AESUS	false
216.58.206.72	unknown	United States	15169	GOOGLEUS	false
142.250.185.200	unknown	United States	15169	GOOGLEUS	false
142.250.185.106	unknown	United States	15169	GOOGLEUS	false
52.57.229.137	1qm32p.axshare.com	United States	16509	AMAZON-02US	false
54.156.155.152	app.axure.cloud	United States	14618	AMAZON-AESUS	false
3.124.181.203	unknown	United States	16509	AMAZON-02US	false
150.171.28.10	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.64.147.16	js.hs-banner.com	United States	13335	CLOUDFLARENETUS	false
142.250.186.131	unknown	United States	15169	GOOGLEUS	false
104.16.111.254	js.hscollectedforms.net	United States	13335	CLOUDFLARENETUS	false
104.16.138.209	js.hs-scripts.com	United States	13335	CLOUDFLARENETUS	false
142.250.184.227	unknown	United States	15169	GOOGLEUS	false
142.250.184.206	unknown	United States	15169	GOOGLEUS	false
104.17.128.172	js.hsadspixel.net	United States	13335	CLOUDFLARENETUS	false
172.217.16.202	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
172.217.16.206	unknown	United States	15169	GOOGLEUS	false
142.250.184.194	td.doubleclick.net	United States	15169	GOOGLEUS	false
142.251.168.155	stats.g.doubleclick.net	United States	15169	GOOGLEUS	false
216.58.206.67	unknown	United States	15169	GOOGLEUS	false
104.16.137.209	unknown	United States	13335	CLOUDFLARENETUS	false
142.250.185.234	unknown	United States	15169	GOOGLEUS	false
142.250.185.238	analytics.google.com	United States	15169	GOOGLEUS	false
142.251.173.84	unknown	United States	15169	GOOGLEUS	false
150.171.27.10	ax-0001.ax-msedge.net	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
54.175.98.240	accounts.axure.com	United States	14618	AMAZON-AESUS	false
142.250.181.227	unknown	United States	15169	GOOGLEUS	false
104.17.175.201	js.hs-analytics.net	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.185.174	unknown	United States	15169	GOOGLEUS	false
52.22.148.188	unknown	United States	14618	AMAZON-AESUS	false
150.171.29.10	ax-0001.ax-dc-msedge.net	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.217.16.194	unknown	United States	15169	GOOGLEUS	false
142.250.186.40	unknown	United States	15169	GOOGLEUS	false
104.17.223.152	unknown	United States	13335	CLOUDFLARENETUS	false
34.200.95.216	unknown	United States	14618	AMAZON-AESUS	false
142.250.184.234	unknown	United States	15169	GOOGLEUS	false
172.217.16.131	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.17
192.168.2.18
192.168.2.4
192.168.2.6
192.168.2.22

Contacted Domains

Name	IP	Active
js.hs-banner.com	172.64.147.16	true
accounts.axure.com	54.175.98.240	true
ax-0001.ax-dc-msedge.net	150.171.29.10	true
js.hsadspixel.net	104.17.128.172	true
js.hs-analytics.net	104.17.175.201	true
ax-0001.ax-msedge.net	150.171.27.10	true
app.axure.cloud	54.156.155.152	true
stats.g.doubleclick.net	142.251.168.155	true
1qm32p.axshare.com	52.57.229.137	true
www.axure.com	34.204.121.204	true
js.hs-scripts.com	104.16.138.209	true
www.google.com	142.250.186.68	true
analytics.google.com	142.250.185.238	true
td.doubleclick.net	142.250.184.194	true
js.hscollectedforms.net	104.16.111.254	true

Contacted URLs

Name	Malicious	Reputation
https://app.axure.cloud/app/	false	unknown
https://1qm32p.axshare.com/id=jxmnwg&p=files_-_view&g=1	true	unknown
https://accounts.axure.com/app/login?redirect=https%3A%2F%2Fapp.axure.cloud%2Fuser%2Faxureauth%3Fredirect%3Dhttps%253A%252F%252Fapp.axure.cloud%252Fapp%252Flogin%253Fauth%253Dtrue%2526redirect%253D%25252Ffs%25252Fmanage	false	unknown

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 30 12:18:22 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	092617296B04A29F4A7218EE388BF0EE	8B81443AC1B0D86C484C3850C5CB602E599364CB	2E8A77969C5A86BB897A3936A3AFAFE0F8A3BC45B6287F55C5411E0360924BB7
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 30 12:18:21 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	79EC7D4A70D7DC45A3B1D12357C94951	27C5A89C71AB30E2EBF2329D8A940BDFA11B6BD6	E1FC583DF71A1D3FAA6E9204AD038D3646B86DCF5B578E3E94BF0F0C82419994
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:54:41 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	A35BC0ACA0C1412871552CB8F26E8944	380DDFE80FEBF2FB3B3C93BF48A77BD61D4E2051	959B199CCDED20794AF78CC1B4517BB65959A6D5415B4CEDB2E971EF0B5C3162
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 30 12:18:21 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	C2EB5329AAFAE3D88EF3A86E0B66DC37	B80514BF13747E7463FE238525A777E63FAC1B6A	1B7AE01D0ED3C8E6F313C2081EA9262EDEE8B5240EC0230AB904795D7ADD91FB
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 30 12:18:21 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	33859B8E8B9B16B154E4EFFB5457F9E3	49A4C5733874F8565C86A6706DAA272DABC0CE3A	C971EDD4EEC14D88750875710361781B8A9495DA48C3BDDEF183E55CA6A4152C
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 30 12:18:21 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	065930607FEC4EAC470B9A1E0FC09675	F2E110BF902FDCA15EE95B21F01B701687AFBB96	AFCBCEEC312DEBCCE60A8D895B88276F3C8408A60219677FBB536448754CBDD2
Chrome Cache Entry: 104	ASCII text, with very long lines (12586)	EA0C66555C75FB39C8DFB4DF175BA847	B0E0522F6AA1D4565B293795995C6DC3BAC29842	048C7D1CE70881A15D5F0EFA67F2157AE390ED66F932E0602483BD18A434A753
Chrome Cache Entry: 105	ASCII text, with very long lines (354)	3FE5EB111E14E9F9E456F48F2944940F	0DE837FC959D9E4396213BF11E3997C93A5E653B	EBDDF0CDDC6038DE9958FA8817677CAF882CB86B23EBF11FF5C3E001170FEDAB
Chrome Cache Entry: 106	ASCII text, with very long lines (6187)	0DF6051FB4E3E5C67B55DE874A5FE993	77091C6407BA83A23E483F4B23B0B16CBEED5068	F42615EE0D75D5AFD126F639E3F2AAED37B6AAF21BA13902DB3D7D8C331E6A9E
Chrome Cache Entry: 107	Unicode text, UTF-8 (with BOM) text	C40296B16201EF954579268F03E4FBE0	DAD64343A7F6F7B292710885DC07112ECBF9BF22	03B1EEC2E4370484304F594FE297D4DEABD71C7CAECE3767A026A824EE382415
Chrome Cache Entry: 108	ASCII text, with no line terminators	4A998718D7250FB5B990FD2314B0791C	1407BB218F602FCF6A007CA2836C321019D92A48	9CC0A27494077DBB867353A2D76B3192CC576C03906D6767EED7D0E1F1A8BE63
Chrome Cache Entry: 109	ASCII text, with CRLF line terminators	9C2160161305054AF467EA797A7C408F	8B427BC141874CC164E2BE3DB02079FCC99AF9ED	7F47F02C93D5DE5DE03DB0EBFFA39FE1060767437B086996E295C9818A05B2F2
Chrome Cache Entry: 110	ASCII text, with very long lines (55203)	119F47FD08054415BD1CE7D8D2F99876	32040BCFD32414683FDB47B97EC9A396363B248E	B924D523F2BCE5B39252EE978047585248BE9A41F5D347D2EA1F676450D2A838
Chrome Cache Entry: 111	HTML document, Unicode text, UTF-8 text, with very long lines (32769)	DDB84C1587287B2DF08966081EF063BF	9EB9AC595E9B5544E2DC79FFF7CD2D0B4B5EF71F	88171413FC76DDA23AB32BAA17B11E4FFF89141C633ECE737852445F1BA6C1BD
Chrome Cache Entry: 112	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 64x64, components 3	18878145443C387B30CD4D3E723D336E	2E6E3FCD5ED0A35A1F2D291D7A283C4AD9AB259A	401179D957AAAC4FC0CC46D37C54A6F5A70C2687369F87227AC59CB6DACBA93D
Chrome Cache Entry: 113	ASCII text, with very long lines (2343)	575B5480531DA4D14E7453E2016FE0BC	E5C5F3134FE29E60B591C87EA85951F0AEA36EE1	DE36E50194320A7D3EF1ACE9BD34A875A8BD458B253C061979DD628E9BF49AFD
Chrome Cache Entry: 119	HTML document, ASCII text, with CRLF line terminators	2E40045EFE5134ADA9942798C090D269	76F70F10F6B6A17B7CEC2D17C689F92C80F8BD56	8B73B6CCD7091D6D9D23ADAAB2BAAE3C4ABF6DE06DF8EFDD03215EE9376FA035
Chrome Cache Entry: 120	HTML document, ASCII text, with very long lines (8047), with CRLF, LF line terminators	00A608820428EB095052DD2E7DE927EA	65E15FBEDBEF902FE47C76ABD1338375CCD6B457	07D600848A5D42D98D98C339FCA0A1FDD73366154E0AD0CFD9D17C7FEA265CD4
Chrome Cache Entry: 122	ASCII text, with very long lines (12586)	49A384327682D5BA5654EBE26D06843A	FD6A18E922F8789398EEFAC79313FC45D1087969	90C43A54B1294C187866892D313B7DAD33DF62BCB0154A29D8B978019DE4F765
Chrome Cache Entry: 123	Unicode text, UTF-8 (with BOM) text	E98E6059D4CECE36DDC12DE0C611C23C	F80BA142EA8E2C5FED8344D639AC88D4A7CF6F4B	C252AA1DD3A62F8F7539E9A4156E9F3128BB4618CBBFEC2A817E245C54B12D37
Chrome Cache Entry: 125	ASCII text	B2CD6A4158725E87CFD5AA6AA6EF402C	C17345214DAA0690D1260E16DCE219127A4DCD7F	52D220AA3CB1A35F79C61CE41E40165C8D60576F6067D2083585F65444777D46
Chrome Cache Entry: 126	ASCII text, with very long lines (5945)	656A9DB3BB24E85092205A3D0F6A2B3B	E0F50BD60DF7E384EAD0AC16A7B9BCB3DC69C5C3	C0096A584CFFA3B58DFC7360C975E2DB3CFCA940DAA5E03887B4485AFAC78FB7
Chrome Cache Entry: 127	Web Open Font Format (Version 2), TrueType, length 14892, version 1.0	9EC6DEAF6BADA919E20B98F9F7B718B1	501D36403AD8205E4644532600019ECB10F5CB0A	7B348B30EA1FE43857E68FC462C29E5C6E63C97666AF75135C4396A272E54762
Chrome Cache Entry: 128	ASCII text, with very long lines (65191)	E45E2B7171EB8A36D0061B69EBDC2943	CC8036F296AEB2EC6977F312CC066B274B96C74F	F37F1FFC09A7E0DA3895E7BFB7A59AC420786EE6BACB63594D12918293156B2A
Chrome Cache Entry: 129	ASCII text, with very long lines (65270)	E806A974C9E110E01C16EC1E80C3A79D	F1D832A3C787D7D5B00C1E863528F2CA3426BF1A	2ACDB151C3F6EE2671BE9B84ABD0476FF011434AD873B6330B53B0A16606D56E
Chrome Cache Entry: 130	ASCII text	DBBE307324D346812D705307E7F89CDD	B454D99897AF476B9C11144053953DDE9CCCE123	8305F263E9BE63774D274C41E75898A7B29A09EE1F666BB5AB0A0E3E1AD0340B
Chrome Cache Entry: 131	HTML document, Unicode text, UTF-8 (with BOM) text	353041AD80B424164244BC141767E42C	0FF13C0D19625A0887641AF94627A11088B76E9D	2F8C13BA7265558A74DA3C0427F82499DDB2B0A1AB577D2E854974C23C99826B
Chrome Cache Entry: 132	ASCII text, with very long lines (1264)	E3B588D159705050173AE28B5C079567	3B3E56B2FB1DECCE969DCD26A62F9530A41D748A	3C55F4A417DADAEDB3945B5B89B75370701FF3AD05AF3A8575BE6177B3829F8B
Chrome Cache Entry: 134	ASCII text, with very long lines (5945)	A39F720046F1F5BA52B1AB87C7850F8B	634F612F0736D84E9BAE4F0261E8B4C3F545204A	6B138C70FE2688914C175D3D9362DC41723F023FA404508CD98BC84936BCDEDE
Chrome Cache Entry: 135	ASCII text, with very long lines (12586)	626FA0370F97831E3DE973CD51A81AD9	4E0D8702B8060F92EB287208EF259413EC9AE73A	8A131DCC2E9328038BC5AFDFC6F9F944E7EC271A3EF2E0E206D3DC56F88BFDD5
Chrome Cache Entry: 140	Unicode text, UTF-8 text, with very long lines (65533), with no line terminators	488FF7F8ADF3EAC2CBA0BC6F49BC7D10	7CA6843E5E73B07833A57BBE78189B0387DE1DB9	96D888D5D4DFEBCCC5DB425179DE9B9DB5D45DAB598FB13F073107BAA2F992F3
Chrome Cache Entry: 142	ASCII text	8ABC0D945148202F0641328FB3C5B959	4136F3AC5D357B88075BE0C33D2D8ED172939729	0A3977B87BC99F6EFB46C4F0805BB058F1ABF7DC75CFF21B486726539987AEB7
Chrome Cache Entry: 143	ASCII text, with very long lines (65274)	1BDFC7340A8AD3FDDE72BDA238D8EB45	677ED5BECFEE23DB33B43DFBDCFEF7A93084346B	3556341579680495ABFB2C473A51103B9573742B4AC7AC4C3E75AF30E89DFE2D
Chrome Cache Entry: 144	Web Open Font Format (Version 2), TrueType, length 14824, version 1.0	48598BAD30F08E1C3EB3D0E69B420BD5	28C2CF160273C2062F909A875C4B4C0541EE2F84	CA57B79A870BBF54700730858603A70D79743779C1B059922EC401BFDDC5ADC9
Chrome Cache Entry: 145	ASCII text, with very long lines (65536), with no line terminators	A17F86CDC13132D41B116E0A0A49E266	2B49E446F6C25CECDBE1E2CF34B690A3E4FC6BCB	031856949608354F57DBC83433AC3DDA9516E0931C6B11562158E207E60D8189
Chrome Cache Entry: 146	HTML document, ASCII text	BFA2831EAFCFA3FE272149BFC9771F60	7D520B557F258835D684ED8D3984E91F6306145D	0CB3DF5C188BA5CCAE9FB40942B293590E8547E13484A3021F19B1B31BD26DD2
Chrome Cache Entry: 147	Unicode text, UTF-8 (with BOM) text	8A9C46DA5EC9D9880FF6D16AFF1DD5F6	F9C408F3DB7D6C8A4016238DE7B30E2BECA10683	C70D68399852409C6A7BF3367C50A45EF6B71B32BDAFCB61339B9B2707AB9DCA
Chrome Cache Entry: 148	ASCII text	DCA14BDEAB9C0C88A5CA5919772AF4C6	BD8E54E467159ABD072E997DBC9B6DAA2E887E1E	35CB73002553ED1C5077C1E19E447A3A9F569B688A17C60AF11BCDC1B90950EF
Chrome Cache Entry: 151	PNG image data, 64 x 64, 8-bit colormap, non-interlaced	A3E2D050FB8F32B38A6CDEDDA694A48D	9F8E09738A5BBE1EBF5D1A052D9ED7B517D76D99	B06C436D474D1E2C46D7E0549182E3DBA661918074FBEEF0786687F94C2A5C52
Chrome Cache Entry: 152	ASCII text, with no line terminators	8655E6E39A323C2D37086E89B2B4C32C	8BCE13B1F6AF7B2FECB7947734A9378395EA15DB	43DF792A1AB31F6883F472FE7C991EDB7EE1013F20B18825795F93453A43A2B3
Chrome Cache Entry: 153	ASCII text, with very long lines (5945)	ECE51E3CE3D6B4E65BF7510A60C9DB0F	189CF35BBA6293360DDB335ECD6806023E727536	59BF2404A827C367B9F2F2E0BEEEB6B34F46B0F8E9E932424C8C357163EB4582
Chrome Cache Entry: 155	SVG Scalable Vector Graphics image	4B3F1B9469206BD37BFE2C03FBE09D12	0F966D0358556C4B2582F8881852B4F848DFBCB6	37384C73BDC8D2DB84EA7746C847181F9DEFD369DB72C2CDC83A48BFE1D0309F
Chrome Cache Entry: 157	ASCII text, with very long lines (539)	6116070CB82CCF929D066BCBF255CE18	0139F690DFFBD45C66A967B4812B3D5E7A9028D3	4AFA0A2F1B4F9EA01951222DF012FD547485843FBEC69163396EA3707C37D269
Chrome Cache Entry: 159	ASCII text	3EB6221EF7769345B19F3CF644AFB379	D96BDB2779BD0FA9D9F7BC90FC9A3B4D767E61A0	C6891A2CD582AC5E26D70AD065DB349C9E5F72C7D825C281C70D7C499E61B1B3
Chrome Cache Entry: 160	Java source, ASCII text, with very long lines (786)	8F9221C00AC3EE86EC6392A58AA2A450	2CB2DC5E6A3DA629357ECB1039881DF27375066A	B463F94F2055D8193CB9B02EC2101286454DAE4384634DFA2EFC03F8B342005B
Chrome Cache Entry: 162	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel	3AF364905254A0EBD60BC438A91F1539	68695998FA88C5E0C8EFAB5D593E0C60B029CB9B	842F27594E347F03636899BEC38368836109ABE78322479BF21551BEE2142E5A
Chrome Cache Entry: 164	ASCII text, with very long lines (12586)	9EB7C41F5EADC42C02B2CCDF1B3FC5D7	808493512FBF08C0298C8BEC212F278C192C5E38	AA793AF365E3F84F688DB657665849790A5C8CC6CF52A6604CBB40590A6FCD33
Chrome Cache Entry: 165	HTML document, ASCII text, with no line terminators	C83301425B2AD1D496473A5FF3D9ECCA	941EFB7368E46B27B937D34B07FC4D41DA01B002	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
Chrome Cache Entry: 166	HTML document, ASCII text	E63FEDCCD7B9EB9451067008A30E860F	210DBF2F2598685A133E4C494E7B1F9494E0EEEB	7405D50545300F18417048905EFCA30AA58B4C8A9D2047FBF00E7623BC7525B7
Chrome Cache Entry: 167	HTML document, ASCII text	326F16238F76707F71EE7C917A5EEC58	C50F7953226DA47D43193088AAF8B81CD68B8D07	7EA5C75EE805C92B33D730AD357EED8604FE16106D00A35BB9B468C577C0AD4B
Chrome Cache Entry: 169	Web Open Font Format (Version 2), TrueType, length 48444, version 1.0	8E433C0592F77BEB6DC527D7B90BE120	D7402416753AE1BB4CBD4B10D33A0C10517838BD	F052EE44C3728DFD23ABA8A4567150BC314D23903026FBB6AD089422C2DF56AF
Chrome Cache Entry: 170	Unicode text, UTF-8 text, with very long lines (51384), with no line terminators	6626C1362840EBFC8F48294E8F023E18	4EC0DFB37C3E536C1B5EC04B68C9846FDBAF9EEF	AABC88A6DB8B22022F96CA88E4F0A7BE426ABEF2B35169A71515A2D55246402A
Chrome Cache Entry: 172	ASCII text	9A0DEDCAD7551267EAE8B0238CDB8023	6936250AAD117D488DACF09190128D6C08ACA445	FFE41D54985AAF349599F21117A666B95512BF9F90C5B65D1632ACFE016A05FD
Chrome Cache Entry: 173	ASCII text	3658D2CFB11AF90166814BF7B81799D4	B1BE434A74355F17103DD40B523FDE9727E29FDD	FDBD38D7D1CC6A499DCFF7577E94457279C50EBD3A65CDEDE74ECDEB6F9CC3B4

Phishing

Ask for current and new password

Source: https://1qm32p.axshare.com/id=jxmnwg&p=files_-_view&g=1	HTTP Parser: Two password fields found
Source: https://1qm32p.axshare.com/id=jxmnwg&p=files_-_view&g=1	HTTP Parser: Two password fields found

HTML body contains low number of good links

Source: https://1qm32p.axshare.com/id=jxmnwg&p=files_-_view&g=1	HTTP Parser: Number of links: 1
Source: https://accounts.axure.com/app/login?redirect=https%3A%2F%2Fapp.axure.cloud%2Fuser%2Faxureauth%3Fredirect%3Dhttps%253A%252F%252Fapp.axure.cloud%252Fapp%252Flogin%253Fauth%253Dtrue%2526redirect%253D%25252Ffs%25252Fmanage	HTTP Parser: Number of links: 1

HTML body contains password input but no form action

Source: https://1qm32p.axshare.com/id=jxmnwg&p=files_-_view&g=1	HTTP Parser: <input type="password" .../> found but no <form action="...
Source: https://accounts.axure.com/app/login?redirect=https%3A%2F%2Fapp.axure.cloud%2Fuser%2Faxureauth%3Fredirect%3Dhttps%253A%252F%252Fapp.axure.cloud%252Fapp%252Flogin%253Fauth%253Dtrue%2526redirect%253D%25252Ffs%25252Fmanage	HTTP Parser: <input type="password" .../> found but no <form action="...

HTML title does not match URL

Source: https://1qm32p.axshare.com/id=jxmnwg&p=files_-_view&g=1

HTTP Parser: Title: Axure Cloud - Page Not Found does not match URL

Invalid 'forgot password' link found

HTTP Parser: Invalid link: Forgot password?

Source: https://1qm32p.axshare.com/id=jxmnwg&p=files_-_view&g=1

Source: https://1qm32p.axshare.com/id=jxmnwg&p=files_-_view&g=1	HTTP Parser: <input type="password" .../> found
Source: https://accounts.axure.com/app/login?redirect=https%3A%2F%2Fapp.axure.cloud%2Fuser%2Faxureauth%3Fredirect%3Dhttps%253A%252F%252Fapp.axure.cloud%252Fapp%252Flogin%253Fauth%253Dtrue%2526redirect%253D%25252Ffs%25252Fmanage	HTTP Parser: <input type="password" .../> found

Source: https://1qm32p.axshare.com/id=jxmnwg&p=files_-_view&g=1	HTTP Parser: No favicon
Source: https://1qm32p.axshare.com/id=jxmnwg&p=files_-_view&g=1	HTTP Parser: No favicon

Source: https://1qm32p.axshare.com/id=jxmnwg&p=files_-_view&g=1	HTTP Parser: No <meta name="author".. found
Source: https://1qm32p.axshare.com/id=jxmnwg&p=files_-_view&g=1	HTTP Parser: No <meta name="author".. found
Source: https://accounts.axure.com/app/login?redirect=https%3A%2F%2Fapp.axure.cloud%2Fuser%2Faxureauth%3Fredirect%3Dhttps%253A%252F%252Fapp.axure.cloud%252Fapp%252Flogin%253Fauth%253Dtrue%2526redirect%253D%25252Ffs%25252Fmanage	HTTP Parser: No <meta name="author".. found
Source: https://accounts.axure.com/app/login?redirect=https%3A%2F%2Fapp.axure.cloud%2Fuser%2Faxureauth%3Fredirect%3Dhttps%253A%252F%252Fapp.axure.cloud%252Fapp%252Flogin%253Fauth%253Dtrue%2526redirect%253D%25252Ffs%25252Fmanage	HTTP Parser: No <meta name="author".. found

Source: https://1qm32p.axshare.com/id=jxmnwg&p=files_-_view&g=1	HTTP Parser: No <meta name="copyright".. found
Source: https://1qm32p.axshare.com/id=jxmnwg&p=files_-_view&g=1	HTTP Parser: No <meta name="copyright".. found
Source: https://accounts.axure.com/app/login?redirect=https%3A%2F%2Fapp.axure.cloud%2Fuser%2Faxureauth%3Fredirect%3Dhttps%253A%252F%252Fapp.axure.cloud%252Fapp%252Flogin%253Fauth%253Dtrue%2526redirect%253D%25252Ffs%25252Fmanage	HTTP Parser: No <meta name="copyright".. found
Source: https://accounts.axure.com/app/login?redirect=https%3A%2F%2Fapp.axure.cloud%2Fuser%2Faxureauth%3Fredirect%3Dhttps%253A%252F%252Fapp.axure.cloud%252Fapp%252Flogin%253Fauth%253Dtrue%2526redirect%253D%25252Ffs%25252Fmanage	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.17:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.17:49811 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.2:443 -> 192.168.2.17:49814 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.209.143:443 -> 192.168.2.17:49818 version: TLS 1.2

Source: chrome.exe

Memory has grown: Private usage: 19MB later: 30MB

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27

Source: global traffic	DNS traffic detected: DNS query: 1qm32p.axshare.com
Source: global traffic	DNS traffic detected: DNS query: accounts.axure.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: analytics.google.com
Source: global traffic	DNS traffic detected: DNS query: stats.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: td.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: app.axure.cloud
Source: global traffic	DNS traffic detected: DNS query: js.hs-scripts.com
Source: global traffic	DNS traffic detected: DNS query: js.hs-banner.com
Source: global traffic	DNS traffic detected: DNS query: js.hscollectedforms.net
Source: global traffic	DNS traffic detected: DNS query: js.hsadspixel.net
Source: global traffic	DNS traffic detected: DNS query: js.hs-analytics.net
Source: global traffic	DNS traffic detected: DNS query: www.axure.com

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49691
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49691 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.17:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.17:49811 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.2:443 -> 192.168.2.17:49814 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.209.143:443 -> 192.168.2.17:49818 version: TLS 1.2

Source: classification engine

Classification label: sus22.phis.win@22/54@46/424

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=1980,i,17442641582903567275,16888314058662241411,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://1qm32p.axshare.com/id=jxmnwg&p=files_-_view&g=1"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=1980,i,17442641582903567275,16888314058662241411,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

ID:	1545405
Product:	CloudBasic
Start time:	14:17:45
Start date:	30.10.2024
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Windows Analysis Report
http://1qm32p.axshare.com/id=jxmnwg&p=files_-_view&g=1

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report http://1qm32p.axshare.com/id=jxmnwg&p=files_-_view&g=1

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
http://1qm32p.axshare.com/id=jxmnwg&p=files_-_view&g=1