Windows Analysis Report
https://covid19.auth-verify.com/XUXIrOHR6RjhQNXRDVW5iWmFYNTZaZlB0Z1ZnZHBzcVhlTW1qdU04ZXpTUXRDVmJVWGZzaSsxd05aQUF3emJmeFZyVkhKN3RPM2cwU3NDMWkrMFhSbTcwSEh5N09lN256QnJjRG9sWklQRy9KZm14M1JhMER1NzVYVjFlZUxmeTZnQVc4Z0t1T2pTTnJ5dHN3NVNSTFljQzlxOFJRb2NraUtMVVZ4ckN0eVF1WTFCS3VqVnNZazlaSlUrK3ZjUE1PcVM1eFhrQT0

Overview

General Information

Sample URL:	https://covid19.auth-verify.com/XUXIrOHR6RjhQNXRDVW5iWmFYNTZaZlB0Z1ZnZHBzcVhlTW1qdU04ZXpTUXRDVmJVWGZzaSsxd05aQUF3emJmeFZyVkhKN3RPM2cwU3NDMWkrMFhSbTcwSEh5N09lN256QnJjRG9sWklQRy9KZm14M1JhMER1NzVYVjFlZUx
Analysis ID:	1559459
Infos:

Detection

KnowBe4

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected KnowBe4 simulated phishing

AI detected landing page (webpage, office document or email)

AI detected suspicious URL

Stores files to the Windows start menu directory

Classification

Signatures

Phishing

Yara detected KnowBe4 simulated phishing

Source: Yara match	File source: 1.1.pages.csv, type: HTML
Source: Yara match	File source: 1.0.pages.csv, type: HTML
Source: Yara match	File source: dropped/chromecache_67, type: DROPPED

AI detected landing page (webpage, office document or email)

Source: https://secure.encryptedconnection.net/pages/5dcf267a4ff2/XUXIrOHR6RjhQNXRDVW5iWmFYNTZaZlB0Z1ZnZHBzcVhlTW1qdU04ZXpTUXRDVmJVWGZzaSsxd05aQUF3emJmeFZyVkhKN3RPM2cwU3NDMWkrMFhSbTcwSEh5N09lN256QnJjRG9sWklQRy9KZm14M1JhMER1NzVYVjFlZUxmeTZnQVc4Z0t1T2pTTnJ5dHN3NVNSTFljQzlxOFJRb2NraUtMVVZ4ckN0eVF1WTFCS3VqVnNZazlaSlUrK3ZjUE1PcVM1eFhrQT0tLUs1UUpQQ3gzcDZ1VzRKVVEtLW44eGZTZUNwWmFkTnlqMFJCODNDZUE9PQ==	Joe Sandbox AI: Page contains button: 'View Document' Source: '1.0.pages.csv'
Source: https://secure.encryptedconnection.net/pages/5dcf267a4ff2/XUXIrOHR6RjhQNXRDVW5iWmFYNTZaZlB0Z1ZnZHBzcVhlTW1qdU04ZXpTUXRDVmJVWGZzaSsxd05aQUF3emJmeFZyVkhKN3RPM2cwU3NDMWkrMFhSbTcwSEh5N09lN256QnJjRG9sWklQRy9KZm14M1JhMER1NzVYVjFlZUxmeTZnQVc4Z0t1T2pTTnJ5dHN3NVNSTFljQzlxOFJRb2NraUtMVVZ4ckN0eVF1WTFCS3VqVnNZazlaSlUrK3ZjUE1PcVM1eFhrQT0tLUs1UUpQQ3gzcDZ1VzRKVVEtLW44eGZTZUNwWmFkTnlqMFJCODNDZUE9PQ==	Joe Sandbox AI: Page contains button: 'View Document' Source: '1.1.pages.csv'

AI detected suspicious URL

Source: Email

Joe Sandbox AI: AI detected Brand spoofing attempt in URL: https://covid19.auth-verify.com

Source: https://secure.encryptedconnection.net/pages/5dcf267a4ff2/XUXIrOHR6RjhQNXRDVW5iWmFYNTZaZlB0Z1ZnZHBzcVhlTW1qdU04ZXpTUXRDVmJVWGZzaSsxd05aQUF3emJmeFZyVkhKN3RPM2cwU3NDMWkrMFhSbTcwSEh5N09lN256QnJjRG9sWklQRy9KZm14M1JhMER1NzVYVjFlZUxmeTZnQVc4Z0t1T2pTTnJ5dHN3NVNSTFljQzlxOFJRb2NraUtMVVZ4ckN0eVF1WTFCS3VqVnNZazlaSlUrK3ZjUE1PcVM1eFhrQT0tLUs1UUpQQ3gzcDZ1VzRKVVEtLW44eGZTZUNwWmFkTnlqMFJCODNDZUE9PQ==	HTTP Parser: No favicon
Source: https://secure.encryptedconnection.net/pages/5dcf267a4ff2/XUXIrOHR6RjhQNXRDVW5iWmFYNTZaZlB0Z1ZnZHBzcVhlTW1qdU04ZXpTUXRDVmJVWGZzaSsxd05aQUF3emJmeFZyVkhKN3RPM2cwU3NDMWkrMFhSbTcwSEh5N09lN256QnJjRG9sWklQRy9KZm14M1JhMER1NzVYVjFlZUxmeTZnQVc4Z0t1T2pTTnJ5dHN3NVNSTFljQzlxOFJRb2NraUtMVVZ4ckN0eVF1WTFCS3VqVnNZazlaSlUrK3ZjUE1PcVM1eFhrQT0tLUs1UUpQQ3gzcDZ1VzRKVVEtLW44eGZTZUNwWmFkTnlqMFJCODNDZUE9PQ==	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.8:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.8:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.8:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.8:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.8:49738 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63

Source: global traffic	HTTP traffic detected: GET /XUXIrOHR6RjhQNXRDVW5iWmFYNTZaZlB0Z1ZnZHBzcVhlTW1qdU04ZXpTUXRDVmJVWGZzaSsxd05aQUF3emJmeFZyVkhKN3RPM2cwU3NDMWkrMFhSbTcwSEh5N09lN256QnJjRG9sWklQRy9KZm14M1JhMER1NzVYVjFlZUxmeTZnQVc4Z0t1T2pTTnJ5dHN3NVNSTFljQzlxOFJRb2NraUtMVVZ4ckN0eVF1WTFCS3VqVnNZazlaSlUrK3ZjUE1PcVM1eFhrQT0tLUs1UUpQQ3gzcDZ1VzRKVVEtLW44eGZTZUNwWmFkTnlqMFJCODNDZUE9PQ==?cid=289532680 HTTP/1.1Host: covid19.auth-verify.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pages/5dcf267a4ff2/XUXIrOHR6RjhQNXRDVW5iWmFYNTZaZlB0Z1ZnZHBzcVhlTW1qdU04ZXpTUXRDVmJVWGZzaSsxd05aQUF3emJmeFZyVkhKN3RPM2cwU3NDMWkrMFhSbTcwSEh5N09lN256QnJjRG9sWklQRy9KZm14M1JhMER1NzVYVjFlZUxmeTZnQVc4Z0t1T2pTTnJ5dHN3NVNSTFljQzlxOFJRb2NraUtMVVZ4ckN0eVF1WTFCS3VqVnNZazlaSlUrK3ZjUE1PcVM1eFhrQT0tLUs1UUpQQ3gzcDZ1VzRKVVEtLW44eGZTZUNwWmFkTnlqMFJCODNDZUE9PQ== HTTP/1.1Host: secure.encryptedconnection.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://covid19.auth-verify.com/XUXIrOHR6RjhQNXRDVW5iWmFYNTZaZlB0Z1ZnZHBzcVhlTW1qdU04ZXpTUXRDVmJVWGZzaSsxd05aQUF3emJmeFZyVkhKN3RPM2cwU3NDMWkrMFhSbTcwSEh5N09lN256QnJjRG9sWklQRy9KZm14M1JhMER1NzVYVjFlZUxmeTZnQVc4Z0t1T2pTTnJ5dHN3NVNSTFljQzlxOFJRb2NraUtMVVZ4ckN0eVF1WTFCS3VqVnNZazlaSlUrK3ZjUE1PcVM1eFhrQT0tLUs1UUpQQ3gzcDZ1VzRKVVEtLW44eGZTZUNwWmFkTnlqMFJCODNDZUE9PQ==?cid=289532680Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /assets/landing-watermark-8487e36eef1bec74f06631f19fea0aa171c208e2976373cda5bd0a4b9e230903.css HTTP/1.1Host: secure.encryptedconnection.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://secure.encryptedconnection.net/pages/5dcf267a4ff2/XUXIrOHR6RjhQNXRDVW5iWmFYNTZaZlB0Z1ZnZHBzcVhlTW1qdU04ZXpTUXRDVmJVWGZzaSsxd05aQUF3emJmeFZyVkhKN3RPM2cwU3NDMWkrMFhSbTcwSEh5N09lN256QnJjRG9sWklQRy9KZm14M1JhMER1NzVYVjFlZUxmeTZnQVc4Z0t1T2pTTnJ5dHN3NVNSTFljQzlxOFJRb2NraUtMVVZ4ckN0eVF1WTFCS3VqVnNZazlaSlUrK3ZjUE1PcVM1eFhrQT0tLUs1UUpQQ3gzcDZ1VzRKVVEtLW44eGZTZUNwWmFkTnlqMFJCODNDZUE9PQ==Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/sei-styles-1837e0b6e1baaf1af90438028a176241b70a365a8a09ff4bf668cf3bf9e3c759.css HTTP/1.1Host: secure.encryptedconnection.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://secure.encryptedconnection.net/pages/5dcf267a4ff2/XUXIrOHR6RjhQNXRDVW5iWmFYNTZaZlB0Z1ZnZHBzcVhlTW1qdU04ZXpTUXRDVmJVWGZzaSsxd05aQUF3emJmeFZyVkhKN3RPM2cwU3NDMWkrMFhSbTcwSEh5N09lN256QnJjRG9sWklQRy9KZm14M1JhMER1NzVYVjFlZUxmeTZnQVc4Z0t1T2pTTnJ5dHN3NVNSTFljQzlxOFJRb2NraUtMVVZ4ckN0eVF1WTFCS3VqVnNZazlaSlUrK3ZjUE1PcVM1eFhrQT0tLUs1UUpQQ3gzcDZ1VzRKVVEtLW44eGZTZUNwWmFkTnlqMFJCODNDZUE9PQ==Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/application-237cb5c4f318687625f8ccf2f42de3fc20238bfe267384653491a6bba8c8f6f5.js HTTP/1.1Host: secure.encryptedconnection.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://secure.encryptedconnection.net/pages/5dcf267a4ff2/XUXIrOHR6RjhQNXRDVW5iWmFYNTZaZlB0Z1ZnZHBzcVhlTW1qdU04ZXpTUXRDVmJVWGZzaSsxd05aQUF3emJmeFZyVkhKN3RPM2cwU3NDMWkrMFhSbTcwSEh5N09lN256QnJjRG9sWklQRy9KZm14M1JhMER1NzVYVjFlZUxmeTZnQVc4Z0t1T2pTTnJ5dHN3NVNSTFljQzlxOFJRb2NraUtMVVZ4ckN0eVF1WTFCS3VqVnNZazlaSlUrK3ZjUE1PcVM1eFhrQT0tLUs1UUpQQ3gzcDZ1VzRKVVEtLW44eGZTZUNwWmFkTnlqMFJCODNDZUE9PQ==Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /hubfs/241394/html_file/files/img/KB4-logo.png HTTP/1.1Host: cdn2.hubspot.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://secure.encryptedconnection.net/pages/5dcf267a4ff2/XUXIrOHR6RjhQNXRDVW5iWmFYNTZaZlB0Z1ZnZHBzcVhlTW1qdU04ZXpTUXRDVmJVWGZzaSsxd05aQUF3emJmeFZyVkhKN3RPM2cwU3NDMWkrMFhSbTcwSEh5N09lN256QnJjRG9sWklQRy9KZm14M1JhMER1NzVYVjFlZUxmeTZnQVc4Z0t1T2pTTnJ5dHN3NVNSTFljQzlxOFJRb2NraUtMVVZ4ckN0eVF1WTFCS3VqVnNZazlaSlUrK3ZjUE1PcVM1eFhrQT0tLUs1UUpQQ3gzcDZ1VzRKVVEtLW44eGZTZUNwWmFkTnlqMFJCODNDZUE9PQ==Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Eav6yS1hyZwo3x2&MD=4vYWh4rf HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /hubfs/241394/html_file/files/img/KB4-logo.png HTTP/1.1Host: cdn2.hubspot.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/sei-flag-90af55d793544fe1893f26677661a4252761afbe811fab0eced85c67bc82f984.png HTTP/1.1Host: secure.encryptedconnection.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://secure.encryptedconnection.net/assets/sei-styles-1837e0b6e1baaf1af90438028a176241b70a365a8a09ff4bf668cf3bf9e3c759.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/application-237cb5c4f318687625f8ccf2f42de3fc20238bfe267384653491a6bba8c8f6f5.js HTTP/1.1Host: secure.encryptedconnection.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: secure.encryptedconnection.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://secure.encryptedconnection.net/pages/5dcf267a4ff2/XUXIrOHR6RjhQNXRDVW5iWmFYNTZaZlB0Z1ZnZHBzcVhlTW1qdU04ZXpTUXRDVmJVWGZzaSsxd05aQUF3emJmeFZyVkhKN3RPM2cwU3NDMWkrMFhSbTcwSEh5N09lN256QnJjRG9sWklQRy9KZm14M1JhMER1NzVYVjFlZUxmeTZnQVc4Z0t1T2pTTnJ5dHN3NVNSTFljQzlxOFJRb2NraUtMVVZ4ckN0eVF1WTFCS3VqVnNZazlaSlUrK3ZjUE1PcVM1eFhrQT0tLUs1UUpQQ3gzcDZ1VzRKVVEtLW44eGZTZUNwWmFkTnlqMFJCODNDZUE9PQ==Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/sei-flag-90af55d793544fe1893f26677661a4252761afbe811fab0eced85c67bc82f984.png HTTP/1.1Host: secure.encryptedconnection.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: secure.encryptedconnection.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Eav6yS1hyZwo3x2&MD=4vYWh4rf HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net

Source: global traffic	DNS traffic detected: DNS query: covid19.auth-verify.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: secure.encryptedconnection.net
Source: global traffic	DNS traffic detected: DNS query: cdn2.hubspot.net
Source: global traffic	DNS traffic detected: DNS query: preview.eu.knowbe4.com

Source: chromecache_67.2.dr	String found in binary or memory: http://preview.eu.knowbe4.com/XYU5xVWFIRkxUYzNvSCtxS1JlRHNMdndXU1ZQWmJtYjBBSGd4andEaWdlQXVSMnJaMUV2R
Source: chromecache_70.2.dr, chromecache_63.2.dr	String found in binary or memory: http://www.day.com/dam/1.0
Source: chromecache_70.2.dr, chromecache_63.2.dr	String found in binary or memory: http://www.day.com/jcr/cq/1.0
Source: chromecache_67.2.dr	String found in binary or memory: https://cdn2.hubspot.net/hubfs/241394/html_file/files/img/KB4-logo.png
Source: chromecache_74.2.dr	String found in binary or memory: https://secure.encryptedconnection.net/pages/5dcf267a4ff2/XUXIrOHR6RjhQNXRDVW5iWmFYNTZaZlB0Z1ZnZHBzc

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746

Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.8:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.8:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.8:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.8:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.8:49738 version: TLS 1.2

Source: classification engine

Classification label: mal56.phis.win@17/26@14/7

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=1904,i,1799070922863384488,5680841517388367676,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://covid19.auth-verify.com/XUXIrOHR6RjhQNXRDVW5iWmFYNTZaZlB0Z1ZnZHBzcVhlTW1qdU04ZXpTUXRDVmJVWGZzaSsxd05aQUF3emJmeFZyVkhKN3RPM2cwU3NDMWkrMFhSbTcwSEh5N09lN256QnJjRG9sWklQRy9KZm14M1JhMER1NzVYVjFlZUxmeTZnQVc4Z0t1T2pTTnJ5dHN3NVNSTFljQzlxOFJRb2NraUtMVVZ4ckN0eVF1WTFCS3VqVnNZazlaSlUrK3ZjUE1PcVM1eFhrQT0tLUs1UUpQQ3gzcDZ1VzRKVVEtLW44eGZTZUNwWmFkTnlqMFJCODNDZUE9PQ==?cid=289532680"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=1904,i,1799070922863384488,5680841517388367676,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.18.87.62	cdn2.hubspot.net	United States	13335	CLOUDFLARENETUS	false
18.165.220.3	preview.eu.knowbe4.com	United States	3	MIT-GATEWAYSUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
54.194.166.37	unknown	United States	16509	AMAZON-02US	false
52.209.169.238	landing.eu.knowbe4.com	United States	16509	AMAZON-02US	false
142.250.181.68	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.8

Contacted Domains

Name	IP	Active
cdn2.hubspot.net	104.18.87.62	true
landing.eu.knowbe4.com	52.209.169.238	true
preview.eu.knowbe4.com	18.165.220.3	true
www.google.com	142.250.181.68	true
covid19.auth-verify.com	unknown	unknown
secure.encryptedconnection.net	unknown	unknown

Contacted URLs

Name	Malicious	Reputation
https://secure.encryptedconnection.net/assets/landing-watermark-8487e36eef1bec74f06631f19fea0aa171c208e2976373cda5bd0a4b9e230903.css	false	high
https://secure.encryptedconnection.net/assets/application-237cb5c4f318687625f8ccf2f42de3fc20238bfe267384653491a6bba8c8f6f5.js	false	high
https://secure.encryptedconnection.net/assets/sei-flag-90af55d793544fe1893f26677661a4252761afbe811fab0eced85c67bc82f984.png	false	high
https://secure.encryptedconnection.net/assets/sei-styles-1837e0b6e1baaf1af90438028a176241b70a365a8a09ff4bf668cf3bf9e3c759.css	false	high
https://cdn2.hubspot.net/hubfs/241394/html_file/files/img/KB4-logo.png	false	high
https://secure.encryptedconnection.net/favicon.ico	false	high

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Nov 20 13:09:20 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	B3B66C21883A16DCE76DF7C05B014D0D	EE73DFD446609EF552435B4C4E3702298D355488	81A04DE0DCAD6C76420210AC66778236165D9CE1E972C46A3BDF9E1E5D3E36FE
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Nov 20 13:09:20 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	325995A4BA20E99B7E648020047EBB3F	45ADB78D7435EC0BBDADDF25C3A3743775E5D7FA	844110607661120FEFCBFD7CC2458493EEA624861A9823788F266F8E908FC6E2
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 5 07:00:51 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	1CA67B3839B39C11BBC1C6E0368A0921	EEFEDD58285263331CCD48961BA0190E2C079935	F164B43F5284CD4B9943E88DBDB200A754BA1E49E9D745200199CE731C891DC4
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Nov 20 13:09:20 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	67BEFC18349F1F881A226274374B3A56	55092927434F90D1B2F36725777A37965B01907A	2350882D3A303A0FD9518CFE6BF4A2EB8967311BCED29531BB64C3A89EE3BDBB
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Nov 20 13:09:20 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	8077F1626E68C4214AE4A5AE80906E42	3A4561501D932F30A53E3585CC01747AC5245CD3	8F41EB17301F80A707EC9F4C00EDF88F4EE7F9C6B987BD23E5BEF419B0BF58A9
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Nov 20 13:09:20 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	C7FF957A09261E9879E89E3493E2B7CC	3470A3DF3339DDCECDD05445F5F4ADB62970FDF5	BFA5C9D40AB634B08C2DBCC526744F180D44D42A1ACB9C878881F5F8616D3E7A
Chrome Cache Entry: 63	PNG image data, 78 x 128, 8-bit colormap, non-interlaced	4D49A54984F70D683CFD7B47E5983896	8AB9E2A631A51C6D0AF0DA13599E99AAE2E63544	01A36B68B4C22545FDA334D8A73014D2B7ADE040E85A1A33B45072F7BA25AB97
Chrome Cache Entry: 64	ASCII text	134D934420B13974981A9634B7380865	18C01D3711CF8C21C1CD0CF544002358C1C929C6	B3C447F15FCE33DFA869B9D2190364509EDE3937AE05B51BA394A78E28C244BA
Chrome Cache Entry: 65	ASCII text	15E89F9684B18EC43EE51F8D62A787C3	9CBAAACEAE96845ECD3497F41EE3B02588ABEC11	16F13E16A7EF02FB6F94250AA1931DED83DBEE5D9FAD278E33DD5792D085194F
Chrome Cache Entry: 66	PNG image data, 240 x 240, 8-bit/color RGBA, non-interlaced	A907E6E737788176B026FA71DFE8AFFE	6844236F638CEDCD652EB0A805476A1A13376CF5	FC5E7621BA0E98C5C6728E3B2BDF802311C0A0953A05E60A7551CB0C7BED00A9
Chrome Cache Entry: 67	HTML document, Unicode text, UTF-8 text, with very long lines (792), with CRLF, LF line terminators	EE7E325973D4F9F0596CF0DC842BB0C3	861F2FD1E81BE43C30A96EBA891C59ACE09DF7A9	E8040DB3D6EDBF8AD840430AB7B824BF0585FA259C0F5617AECE18B7F92A16CC
Chrome Cache Entry: 68	RIFF (little-endian) data, Web/P image	402214A564EAB22101571DF8C6E30B79	D5E452981A5C325383F92BFB964BA28ECEA6FFA6	8D63A7ED00572C8B418FF91F5B2E5CD667AA7226CE280E48FC8FE9D58A4D98AC
Chrome Cache Entry: 69	PNG image data, 240 x 240, 8-bit/color RGBA, non-interlaced	A907E6E737788176B026FA71DFE8AFFE	6844236F638CEDCD652EB0A805476A1A13376CF5	FC5E7621BA0E98C5C6728E3B2BDF802311C0A0953A05E60A7551CB0C7BED00A9
Chrome Cache Entry: 70	PNG image data, 78 x 128, 8-bit colormap, non-interlaced	4D49A54984F70D683CFD7B47E5983896	8AB9E2A631A51C6D0AF0DA13599E99AAE2E63544	01A36B68B4C22545FDA334D8A73014D2B7ADE040E85A1A33B45072F7BA25AB97
Chrome Cache Entry: 71	ASCII text, with very long lines (65447)	67A0C4DBD69561F3226243034423F1ED	88C1B5C7EBBFA24D8196290206BF544F28EEB406	74B9F1CFE7CAD31AE1C1901200890B76676E6D92AC817641F5EF9BFD552F2110
Chrome Cache Entry: 72	ASCII text, with very long lines (65447)	67A0C4DBD69561F3226243034423F1ED	88C1B5C7EBBFA24D8196290206BF544F28EEB406	74B9F1CFE7CAD31AE1C1901200890B76676E6D92AC817641F5EF9BFD552F2110
Chrome Cache Entry: 73	PNG image data, 200 x 38, 8-bit/color RGBA, non-interlaced	E154B58FD2CD3F1F2E2C6C810BB1E65B	CAEF301E8550A910909ECE9471669DA0C32EA6F0	E8C5A2C9860C1A6CC7C949B9D7C793E5E435D75996DEBEB295A959F3D09831C0
Chrome Cache Entry: 74	HTML document, ASCII text, with very long lines (436)	09E381BA4858725A6DF7AD1713D82E16	312DB2AAC4E6D2CB966D6188D16A1D4D5819FAF3	2C3FDD9C01A839C9DA114E2F68D483D9C883540B4579D5BB12E117B93A2C14B5

Phishing

Yara detected KnowBe4 simulated phishing

Source: Yara match	File source: 1.1.pages.csv, type: HTML
Source: Yara match	File source: 1.0.pages.csv, type: HTML
Source: Yara match	File source: dropped/chromecache_67, type: DROPPED

AI detected landing page (webpage, office document or email)

Source: https://secure.encryptedconnection.net/pages/5dcf267a4ff2/XUXIrOHR6RjhQNXRDVW5iWmFYNTZaZlB0Z1ZnZHBzcVhlTW1qdU04ZXpTUXRDVmJVWGZzaSsxd05aQUF3emJmeFZyVkhKN3RPM2cwU3NDMWkrMFhSbTcwSEh5N09lN256QnJjRG9sWklQRy9KZm14M1JhMER1NzVYVjFlZUxmeTZnQVc4Z0t1T2pTTnJ5dHN3NVNSTFljQzlxOFJRb2NraUtMVVZ4ckN0eVF1WTFCS3VqVnNZazlaSlUrK3ZjUE1PcVM1eFhrQT0tLUs1UUpQQ3gzcDZ1VzRKVVEtLW44eGZTZUNwWmFkTnlqMFJCODNDZUE9PQ==	Joe Sandbox AI: Page contains button: 'View Document' Source: '1.0.pages.csv'
Source: https://secure.encryptedconnection.net/pages/5dcf267a4ff2/XUXIrOHR6RjhQNXRDVW5iWmFYNTZaZlB0Z1ZnZHBzcVhlTW1qdU04ZXpTUXRDVmJVWGZzaSsxd05aQUF3emJmeFZyVkhKN3RPM2cwU3NDMWkrMFhSbTcwSEh5N09lN256QnJjRG9sWklQRy9KZm14M1JhMER1NzVYVjFlZUxmeTZnQVc4Z0t1T2pTTnJ5dHN3NVNSTFljQzlxOFJRb2NraUtMVVZ4ckN0eVF1WTFCS3VqVnNZazlaSlUrK3ZjUE1PcVM1eFhrQT0tLUs1UUpQQ3gzcDZ1VzRKVVEtLW44eGZTZUNwWmFkTnlqMFJCODNDZUE9PQ==	Joe Sandbox AI: Page contains button: 'View Document' Source: '1.1.pages.csv'

AI detected suspicious URL

Source: Email

Joe Sandbox AI: AI detected Brand spoofing attempt in URL: https://covid19.auth-verify.com

Source: https://secure.encryptedconnection.net/pages/5dcf267a4ff2/XUXIrOHR6RjhQNXRDVW5iWmFYNTZaZlB0Z1ZnZHBzcVhlTW1qdU04ZXpTUXRDVmJVWGZzaSsxd05aQUF3emJmeFZyVkhKN3RPM2cwU3NDMWkrMFhSbTcwSEh5N09lN256QnJjRG9sWklQRy9KZm14M1JhMER1NzVYVjFlZUxmeTZnQVc4Z0t1T2pTTnJ5dHN3NVNSTFljQzlxOFJRb2NraUtMVVZ4ckN0eVF1WTFCS3VqVnNZazlaSlUrK3ZjUE1PcVM1eFhrQT0tLUs1UUpQQ3gzcDZ1VzRKVVEtLW44eGZTZUNwWmFkTnlqMFJCODNDZUE9PQ==	HTTP Parser: No favicon
Source: https://secure.encryptedconnection.net/pages/5dcf267a4ff2/XUXIrOHR6RjhQNXRDVW5iWmFYNTZaZlB0Z1ZnZHBzcVhlTW1qdU04ZXpTUXRDVmJVWGZzaSsxd05aQUF3emJmeFZyVkhKN3RPM2cwU3NDMWkrMFhSbTcwSEh5N09lN256QnJjRG9sWklQRy9KZm14M1JhMER1NzVYVjFlZUxmeTZnQVc4Z0t1T2pTTnJ5dHN3NVNSTFljQzlxOFJRb2NraUtMVVZ4ckN0eVF1WTFCS3VqVnNZazlaSlUrK3ZjUE1PcVM1eFhrQT0tLUs1UUpQQ3gzcDZ1VzRKVVEtLW44eGZTZUNwWmFkTnlqMFJCODNDZUE9PQ==	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.8:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.8:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.8:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.8:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.8:49738 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63

Source: global traffic	HTTP traffic detected: GET /XUXIrOHR6RjhQNXRDVW5iWmFYNTZaZlB0Z1ZnZHBzcVhlTW1qdU04ZXpTUXRDVmJVWGZzaSsxd05aQUF3emJmeFZyVkhKN3RPM2cwU3NDMWkrMFhSbTcwSEh5N09lN256QnJjRG9sWklQRy9KZm14M1JhMER1NzVYVjFlZUxmeTZnQVc4Z0t1T2pTTnJ5dHN3NVNSTFljQzlxOFJRb2NraUtMVVZ4ckN0eVF1WTFCS3VqVnNZazlaSlUrK3ZjUE1PcVM1eFhrQT0tLUs1UUpQQ3gzcDZ1VzRKVVEtLW44eGZTZUNwWmFkTnlqMFJCODNDZUE9PQ==?cid=289532680 HTTP/1.1Host: covid19.auth-verify.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pages/5dcf267a4ff2/XUXIrOHR6RjhQNXRDVW5iWmFYNTZaZlB0Z1ZnZHBzcVhlTW1qdU04ZXpTUXRDVmJVWGZzaSsxd05aQUF3emJmeFZyVkhKN3RPM2cwU3NDMWkrMFhSbTcwSEh5N09lN256QnJjRG9sWklQRy9KZm14M1JhMER1NzVYVjFlZUxmeTZnQVc4Z0t1T2pTTnJ5dHN3NVNSTFljQzlxOFJRb2NraUtMVVZ4ckN0eVF1WTFCS3VqVnNZazlaSlUrK3ZjUE1PcVM1eFhrQT0tLUs1UUpQQ3gzcDZ1VzRKVVEtLW44eGZTZUNwWmFkTnlqMFJCODNDZUE9PQ== HTTP/1.1Host: secure.encryptedconnection.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://covid19.auth-verify.com/XUXIrOHR6RjhQNXRDVW5iWmFYNTZaZlB0Z1ZnZHBzcVhlTW1qdU04ZXpTUXRDVmJVWGZzaSsxd05aQUF3emJmeFZyVkhKN3RPM2cwU3NDMWkrMFhSbTcwSEh5N09lN256QnJjRG9sWklQRy9KZm14M1JhMER1NzVYVjFlZUxmeTZnQVc4Z0t1T2pTTnJ5dHN3NVNSTFljQzlxOFJRb2NraUtMVVZ4ckN0eVF1WTFCS3VqVnNZazlaSlUrK3ZjUE1PcVM1eFhrQT0tLUs1UUpQQ3gzcDZ1VzRKVVEtLW44eGZTZUNwWmFkTnlqMFJCODNDZUE9PQ==?cid=289532680Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /assets/landing-watermark-8487e36eef1bec74f06631f19fea0aa171c208e2976373cda5bd0a4b9e230903.css HTTP/1.1Host: secure.encryptedconnection.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://secure.encryptedconnection.net/pages/5dcf267a4ff2/XUXIrOHR6RjhQNXRDVW5iWmFYNTZaZlB0Z1ZnZHBzcVhlTW1qdU04ZXpTUXRDVmJVWGZzaSsxd05aQUF3emJmeFZyVkhKN3RPM2cwU3NDMWkrMFhSbTcwSEh5N09lN256QnJjRG9sWklQRy9KZm14M1JhMER1NzVYVjFlZUxmeTZnQVc4Z0t1T2pTTnJ5dHN3NVNSTFljQzlxOFJRb2NraUtMVVZ4ckN0eVF1WTFCS3VqVnNZazlaSlUrK3ZjUE1PcVM1eFhrQT0tLUs1UUpQQ3gzcDZ1VzRKVVEtLW44eGZTZUNwWmFkTnlqMFJCODNDZUE9PQ==Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/sei-styles-1837e0b6e1baaf1af90438028a176241b70a365a8a09ff4bf668cf3bf9e3c759.css HTTP/1.1Host: secure.encryptedconnection.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://secure.encryptedconnection.net/pages/5dcf267a4ff2/XUXIrOHR6RjhQNXRDVW5iWmFYNTZaZlB0Z1ZnZHBzcVhlTW1qdU04ZXpTUXRDVmJVWGZzaSsxd05aQUF3emJmeFZyVkhKN3RPM2cwU3NDMWkrMFhSbTcwSEh5N09lN256QnJjRG9sWklQRy9KZm14M1JhMER1NzVYVjFlZUxmeTZnQVc4Z0t1T2pTTnJ5dHN3NVNSTFljQzlxOFJRb2NraUtMVVZ4ckN0eVF1WTFCS3VqVnNZazlaSlUrK3ZjUE1PcVM1eFhrQT0tLUs1UUpQQ3gzcDZ1VzRKVVEtLW44eGZTZUNwWmFkTnlqMFJCODNDZUE9PQ==Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/application-237cb5c4f318687625f8ccf2f42de3fc20238bfe267384653491a6bba8c8f6f5.js HTTP/1.1Host: secure.encryptedconnection.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://secure.encryptedconnection.net/pages/5dcf267a4ff2/XUXIrOHR6RjhQNXRDVW5iWmFYNTZaZlB0Z1ZnZHBzcVhlTW1qdU04ZXpTUXRDVmJVWGZzaSsxd05aQUF3emJmeFZyVkhKN3RPM2cwU3NDMWkrMFhSbTcwSEh5N09lN256QnJjRG9sWklQRy9KZm14M1JhMER1NzVYVjFlZUxmeTZnQVc4Z0t1T2pTTnJ5dHN3NVNSTFljQzlxOFJRb2NraUtMVVZ4ckN0eVF1WTFCS3VqVnNZazlaSlUrK3ZjUE1PcVM1eFhrQT0tLUs1UUpQQ3gzcDZ1VzRKVVEtLW44eGZTZUNwWmFkTnlqMFJCODNDZUE9PQ==Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /hubfs/241394/html_file/files/img/KB4-logo.png HTTP/1.1Host: cdn2.hubspot.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://secure.encryptedconnection.net/pages/5dcf267a4ff2/XUXIrOHR6RjhQNXRDVW5iWmFYNTZaZlB0Z1ZnZHBzcVhlTW1qdU04ZXpTUXRDVmJVWGZzaSsxd05aQUF3emJmeFZyVkhKN3RPM2cwU3NDMWkrMFhSbTcwSEh5N09lN256QnJjRG9sWklQRy9KZm14M1JhMER1NzVYVjFlZUxmeTZnQVc4Z0t1T2pTTnJ5dHN3NVNSTFljQzlxOFJRb2NraUtMVVZ4ckN0eVF1WTFCS3VqVnNZazlaSlUrK3ZjUE1PcVM1eFhrQT0tLUs1UUpQQ3gzcDZ1VzRKVVEtLW44eGZTZUNwWmFkTnlqMFJCODNDZUE9PQ==Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Eav6yS1hyZwo3x2&MD=4vYWh4rf HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /hubfs/241394/html_file/files/img/KB4-logo.png HTTP/1.1Host: cdn2.hubspot.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/sei-flag-90af55d793544fe1893f26677661a4252761afbe811fab0eced85c67bc82f984.png HTTP/1.1Host: secure.encryptedconnection.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://secure.encryptedconnection.net/assets/sei-styles-1837e0b6e1baaf1af90438028a176241b70a365a8a09ff4bf668cf3bf9e3c759.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/application-237cb5c4f318687625f8ccf2f42de3fc20238bfe267384653491a6bba8c8f6f5.js HTTP/1.1Host: secure.encryptedconnection.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: secure.encryptedconnection.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://secure.encryptedconnection.net/pages/5dcf267a4ff2/XUXIrOHR6RjhQNXRDVW5iWmFYNTZaZlB0Z1ZnZHBzcVhlTW1qdU04ZXpTUXRDVmJVWGZzaSsxd05aQUF3emJmeFZyVkhKN3RPM2cwU3NDMWkrMFhSbTcwSEh5N09lN256QnJjRG9sWklQRy9KZm14M1JhMER1NzVYVjFlZUxmeTZnQVc4Z0t1T2pTTnJ5dHN3NVNSTFljQzlxOFJRb2NraUtMVVZ4ckN0eVF1WTFCS3VqVnNZazlaSlUrK3ZjUE1PcVM1eFhrQT0tLUs1UUpQQ3gzcDZ1VzRKVVEtLW44eGZTZUNwWmFkTnlqMFJCODNDZUE9PQ==Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/sei-flag-90af55d793544fe1893f26677661a4252761afbe811fab0eced85c67bc82f984.png HTTP/1.1Host: secure.encryptedconnection.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: secure.encryptedconnection.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Eav6yS1hyZwo3x2&MD=4vYWh4rf HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net

Source: global traffic	DNS traffic detected: DNS query: covid19.auth-verify.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: secure.encryptedconnection.net
Source: global traffic	DNS traffic detected: DNS query: cdn2.hubspot.net
Source: global traffic	DNS traffic detected: DNS query: preview.eu.knowbe4.com

Source: chromecache_67.2.dr	String found in binary or memory: http://preview.eu.knowbe4.com/XYU5xVWFIRkxUYzNvSCtxS1JlRHNMdndXU1ZQWmJtYjBBSGd4andEaWdlQXVSMnJaMUV2R
Source: chromecache_70.2.dr, chromecache_63.2.dr	String found in binary or memory: http://www.day.com/dam/1.0
Source: chromecache_70.2.dr, chromecache_63.2.dr	String found in binary or memory: http://www.day.com/jcr/cq/1.0
Source: chromecache_67.2.dr	String found in binary or memory: https://cdn2.hubspot.net/hubfs/241394/html_file/files/img/KB4-logo.png
Source: chromecache_74.2.dr	String found in binary or memory: https://secure.encryptedconnection.net/pages/5dcf267a4ff2/XUXIrOHR6RjhQNXRDVW5iWmFYNTZaZlB0Z1ZnZHBzc

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746

Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.8:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.8:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.8:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.8:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.8:49738 version: TLS 1.2

Source: classification engine

Classification label: mal56.phis.win@17/26@14/7

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=1904,i,1799070922863384488,5680841517388367676,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://covid19.auth-verify.com/XUXIrOHR6RjhQNXRDVW5iWmFYNTZaZlB0Z1ZnZHBzcVhlTW1qdU04ZXpTUXRDVmJVWGZzaSsxd05aQUF3emJmeFZyVkhKN3RPM2cwU3NDMWkrMFhSbTcwSEh5N09lN256QnJjRG9sWklQRy9KZm14M1JhMER1NzVYVjFlZUxmeTZnQVc4Z0t1T2pTTnJ5dHN3NVNSTFljQzlxOFJRb2NraUtMVVZ4ckN0eVF1WTFCS3VqVnNZazlaSlUrK3ZjUE1PcVM1eFhrQT0tLUs1UUpQQ3gzcDZ1VzRKVVEtLW44eGZTZUNwWmFkTnlqMFJCODNDZUE9PQ==?cid=289532680"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=1904,i,1799070922863384488,5680841517388367676,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

ID:	1559459
Product:	CloudBasic
Start time:	15:08:15
Start date:	20.11.2024
Cookbook:	browseurl.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs