Edit tour

Windows Analysis Report
https://filedn.com/lt87R94Oi7NbcQdmzW2xPrR/link.html

Overview

General Information

Sample URL:	https://filedn.com/lt87R94Oi7NbcQdmzW2xPrR/link.html
Analysis ID:	867901
Infos:

Detection

HTMLPhisher

Score:	88
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Yara detected HtmlPhish10

Multi AV Scanner detection for submitted file

Antivirus detection for URL or domain

Yara detected HtmlPhish49

Phishing site detected (based on logo match)

Phishing site detected (based on image similarity)

Drops files with a non-matching file extension (content does not match file extension)

Invalid 'forgot password' link found

HTML page is missing a favicon

HTML body contains password input but no form action

HTML page contains hidden URLs or javascript code

HTML body with high number of embedded images detected

HTML body contains low number of good links

HTML title does not match URL

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5476 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

chrome.exe (PID: 1176 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1880 --field-trial-handle=1780,i,16450574423909653694,4771414823891335849,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8 MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

AcroRd32.exe (PID: 6156 cmdline: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\user\Downloads\EU_DoC_1428_062022.pdf MD5: B969CF0C7B2C443A99034881E8C8740A)

RdrCEF.exe (PID: 1952 cmdline: "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043 MD5: 9AEBA3BACD721484391D15478A4080C7)

chrome.exe (PID: 1840 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" "https://filedn.com/lt87R94Oi7NbcQdmzW2xPrR/link.html MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
dropped/chromecache_323	JoeSecurity_HtmlPhish_49	Yara detected HtmlPhish_49	Joe Security

HTML

Source	Rule	Description	Author
0.pages.csv	JoeSecurity_HtmlPhish_49	Yara detected HtmlPhish_49	Joe Security
1.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
3.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CONSENT=PENDING+904; SOCS=CAISHAgCEhJnd3NfMjAyMjA4MDgtMF9SQzEaAmVuIAEaBgiAvOuXBg

Source: https://filedn.com/lt87R94Oi7NbcQdmzW2xPrR/link.html	Avira URL Cloud: detection malicious, Label: phishing
Source: https://filedn.com/lt87R94Oi7NbcQdmzW2xPrR/link.html	SlashNext: detection malicious, Label: Credential Stealing type: Phishing & Social Engineering

Source: Yara match	File source: 1.pages.csv, type: HTML
Source: Yara match	File source: 3.pages.csv, type: HTML

Source: Yara match	File source: 0.pages.csv, type: HTML
Source: Yara match	File source: dropped/chromecache_323, type: DROPPED

Source: https://filedn.com/lt87R94Oi7NbcQdmzW2xPrR/link.html	HTTP Parser: Invalid link: Forgot my password
Source: https://filedn.com/lt87R94Oi7NbcQdmzW2xPrR/link.html#	HTTP Parser: Invalid link: Forgot my password

Source: https://filedn.com/lt87R94Oi7NbcQdmzW2xPrR/link.html	HTTP Parser: No favicon
Source: https://filedn.com/lt87R94Oi7NbcQdmzW2xPrR/link.html	HTTP Parser: No favicon
Source: https://privacy.microsoft.com/en-US/https:/account.microsoft.com/privacyhttps:/aka.ms/PrivacyReporthttps:/support.microsoft.com/topic/206f6928-2694-4adf-a50f-9edb95897d81https:/go.microsoft.com/fwlink/?LinkId=521839https://go.microsoft.com/fwlink/p/?LinkId=780766	HTTP Parser: No favicon
Source: https://privacy.microsoft.com/en-US/https:/account.microsoft.com/privacyhttps:/aka.ms/PrivacyReporthttps:/support.microsoft.com/topic/206f6928-2694-4adf-a50f-9edb95897d81https:/go.microsoft.com/fwlink/?LinkId=521839https://go.microsoft.com/fwlink/p/?LinkId=780766	HTTP Parser: No favicon
Source: https://privacy.microsoft.com/en-US/young-peoplehttps:/privacy.microsoft.com/fr-fr/privacystatement#maincookiessimilartechnologiesmodulehttps://www.privacyshield.gov/welcomehttps://go.microsoft.com/fwlink/p/?linkid=2126612https://privacy.microsoft.com/privacystatement#mainhowtocontactusmodulehttps://privacy.microsoft.com/fr-fr/privacystatement#mainenterprisedeveloperproductsmodulehttps://privacy.microsoft.com/fr-fr/privacystatement#mainnoticetoendusersmodulehttps://privacy.microsoft.com/fr-fr/privacystatement#mainmicrosoftaccountmodulehttps://privacy.microsoft.com/privacystatement#maincaliforniaconsumerprivacyactmodule	HTTP Parser: No favicon
Source: https://privacy.microsoft.com/en-US/young-peoplehttps:/privacy.microsoft.com/fr-fr/privacystatement#maincookiessimilartechnologiesmodulehttps://www.privacyshield.gov/welcomehttps://go.microsoft.com/fwlink/p/?linkid=2126612https://privacy.microsoft.com/privacystatement#mainhowtocontactusmodulehttps://privacy.microsoft.com/fr-fr/privacystatement#mainenterprisedeveloperproductsmodulehttps://privacy.microsoft.com/fr-fr/privacystatement#mainnoticetoendusersmodulehttps://privacy.microsoft.com/fr-fr/privacystatement#mainmicrosoftaccountmodulehttps://privacy.microsoft.com/privacystatement#maincaliforniaconsumerprivacyactmodule	HTTP Parser: No favicon
Source: https://www.bing.com/secure/Passport.aspx?popup=1&ssl=1	HTTP Parser: No favicon
Source: https://www.bing.com/secure/Passport.aspx?popup=1&ssl=1	HTTP Parser: No favicon

Source: https://filedn.com/lt87R94Oi7NbcQdmzW2xPrR/link.html	HTTP Parser: <input type="password" .../> found but no <form action="...
Source: https://filedn.com/lt87R94Oi7NbcQdmzW2xPrR/link.html#	HTTP Parser: <input type="password" .../> found but no <form action="...

Source: https://filedn.com/lt87R94Oi7NbcQdmzW2xPrR/link.html	HTTP Parser: Total embedded image size: 31111
Source: https://filedn.com/lt87R94Oi7NbcQdmzW2xPrR/link.html#	HTTP Parser: Total embedded image size: 31111

Source: https://filedn.com/lt87R94Oi7NbcQdmzW2xPrR/link.html	HTTP Parser: Number of links: 0
Source: https://filedn.com/lt87R94Oi7NbcQdmzW2xPrR/link.html#	HTTP Parser: Number of links: 0

Source: https://filedn.com/lt87R94Oi7NbcQdmzW2xPrR/link.html	HTTP Parser: Title: Sign in to Outlook does not match URL
Source: https://filedn.com/lt87R94Oi7NbcQdmzW2xPrR/link.html#	HTTP Parser: Title: Sign in to Outlook does not match URL

Source: https://filedn.com/lt87R94Oi7NbcQdmzW2xPrR/link.html	HTTP Parser: No <meta name="author".. found
Source: https://filedn.com/lt87R94Oi7NbcQdmzW2xPrR/link.html	HTTP Parser: No <meta name="author".. found
Source: https://filedn.com/lt87R94Oi7NbcQdmzW2xPrR/link.html#	HTTP Parser: No <meta name="author".. found
Source: https://filedn.com/lt87R94Oi7NbcQdmzW2xPrR/link.html#	HTTP Parser: No <meta name="author".. found

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49696
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49695
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49694
Source: unknown	Network traffic detected: HTTP traffic on port 49696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49692
Source: unknown	Network traffic detected: HTTP traffic on port 49692 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49690
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443

Source: chromecache_276.1.dr	String found in binary or memory: http://fontawesome.io
Source: chromecache_276.1.dr	String found in binary or memory: http://fontawesome.io/license
Source: chromecache_240.1.dr, chromecache_250.1.dr	String found in binary or memory: http://github.com/requirejs/almond/LICENSE
Source: chromecache_334.1.dr	String found in binary or memory: http://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE1LLAb
Source: chromecache_295.1.dr, chromecache_287.1.dr	String found in binary or memory: http://schema.org/Organization
Source: chromecache_305.1.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: chromecache_295.1.dr, chromecache_287.1.dr	String found in binary or memory: https://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.9.1.min.js
Source: chromecache_235.1.dr	String found in binary or memory: https://aka.ms/3rdpartycookies
Source: chromecache_295.1.dr, chromecache_287.1.dr	String found in binary or memory: https://assets.onestore.ms/cdnfiles/external/mwf/long/v1/v1.25.0/css/mwf-west-european-default.min.c
Source: chromecache_295.1.dr, chromecache_287.1.dr	String found in binary or memory: https://channel9.msdn.com/
Source: chromecache_366.1.dr	String found in binary or memory: https://github.com/h5bp/html5-boilerplate/blob/master/src/css/main.css
Source: chromecache_295.1.dr, chromecache_287.1.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4xvsU?ver=e636
Source: chromecache_295.1.dr, chromecache_287.1.dr	String found in binary or memory: https://js.monitor.azure.com/next/1/ms.jsll-3.min.js
Source: chromecache_335.1.dr	String found in binary or memory: https://login.chinacloudapi.cn
Source: chromecache_335.1.dr	String found in binary or memory: https://login.microsoftonline.com
Source: chromecache_335.1.dr	String found in binary or memory: https://login.microsoftonline.de
Source: chromecache_335.1.dr	String found in binary or memory: https://login.microsoftonline.us
Source: chromecache_335.1.dr	String found in binary or memory: https://login.windows-ppe.net
Source: chromecache_295.1.dr, chromecache_287.1.dr	String found in binary or memory: https://onedrive.live.com/about/en-us/
Source: chromecache_295.1.dr, chromecache_287.1.dr	String found in binary or memory: https://outlook.live.com/owa/
Source: chromecache_295.1.dr, chromecache_287.1.dr	String found in binary or memory: https://statics-marketingsites-eus-ms-com.akamaized.net/statics/override.css
Source: chromecache_284.1.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/international/nigel-farage-der-brexit-ist-gescheitert/ar-AA1bh
Source: chromecache_284.1.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/international/us-schuldenstreit-biden-sagt-besuch-in-australie
Source: chromecache_284.1.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/news/die-puk-zur-credit-suisse-kommt-das-muss-sie-untersuchen/
Source: chromecache_284.1.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/news/gotthard-stau-auch-an-auffahrt-d
Source: chromecache_284.1.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/news/ramadan-prozess-genfer-staatsanwaltschaft-fordert-18-mona
Source: chromecache_284.1.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/other/berns-linksautonome-szene-in-der-identit
Source: chromecache_284.1.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/other/chef-des-chatgpt-erfinders-will-ki-staatlich-regulieren/
Source: chromecache_284.1.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/other/frankreich-will-bau-von-akw-beschleunigen/ar-AA1bh2OV?oc
Source: chromecache_284.1.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/other/in-genf-lieben-sie-erdogan-in-der-deutschschweiz-veracht
Source: chromecache_284.1.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/other/kiew-meldet-abschuss-von-sechs-wunderraketen-putins/ar-A
Source: chromecache_284.1.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/other/madame-tussaud-w
Source: chromecache_284.1.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/other/spekulationen-um-lukaschenkos-gesundheit-nehmen-zu-samt-
Source: chromecache_284.1.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/other/trotz-steigender-preise-flugschn
Source: chromecache_284.1.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/other/weltrekord-dieser-mann-lebt-seit-75-tagen-unter-wasser-d
Source: chromecache_284.1.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/schweiz/aargauer-parlament-bewilligt-finanzspritze-f
Source: chromecache_284.1.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/schweiz/gewerkschaften-fordern-aufwertung-von-frauenberufen/ar
Source: chromecache_284.1.dr	String found in binary or memory: https://www.msn.com/de-ch/news/other/er-liebt-die-gletscher-und-bek
Source: chromecache_284.1.dr	String found in binary or memory: https://www.msn.com/de-ch/sport/other/dem-wm-titel-so-nahe-und-doch-so-fern/ar-AA1bh8RU?ocid=BingHPC
Source: chromecache_284.1.dr	String found in binary or memory: https://www.msn.com/de-ch/sport/other/inter-gewinnt-auch-das-r

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1880 --field-trial-handle=1780,i,16450574423909653694,4771414823891335849,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" "https://filedn.com/lt87R94Oi7NbcQdmzW2xPrR/link.html
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\user\Downloads\EU_DoC_1428_062022.pdf
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1880 --field-trial-handle=1780,i,16450574423909653694,4771414823891335849,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" "https://filedn.com/lt87R94Oi7NbcQdmzW2xPrR/link.html	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\user\Downloads\EU_DoC_1428_062022.pdf	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next

Source: https://filedn.com/lt87R94Oi7NbcQdmzW2xPrR/link.html	HTTP Parser: No <meta name="copyright".. found
Source: https://filedn.com/lt87R94Oi7NbcQdmzW2xPrR/link.html	HTTP Parser: No <meta name="copyright".. found
Source: https://filedn.com/lt87R94Oi7NbcQdmzW2xPrR/link.html#	HTTP Parser: No <meta name="copyright".. found
Source: https://filedn.com/lt87R94Oi7NbcQdmzW2xPrR/link.html#	HTTP Parser: No <meta name="copyright".. found

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=104.0.5112.81&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-104.0.5112.81Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /lt87R94Oi7NbcQdmzW2xPrR/link.html HTTP/1.1Host: filedn.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pre/frontlinee/host/admin/js/fr.js HTTP/1.1Host: auc.edu.psConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://filedn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.1.1.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://filedn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /lt87R94Oi7NbcQdmzW2xPrR/link.html HTTP/1.1Host: filedn.comConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://filedn.com/lt87R94Oi7NbcQdmzW2xPrR/link.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "003f2d9e1490da0ea2623b61cfca87d1519f0223"
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: filedn.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://filedn.com/lt87R94Oi7NbcQdmzW2xPrR/link.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/font-awesome/4.7.0/css/font-awesome.css HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Origin: https://filedn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://filedn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_verify_sms_27a6d18b56f46818420e60a773c36d4e.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://filedn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_verify_call_fe87496cc7a44412f7893a72099c120a.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://filedn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_verify_fluent_authenticator_b59c16ca9bf156438a8a96d45e33db64.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://filedn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_verify_sms_27a6d18b56f46818420e60a773c36d4e.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_verify_call_fe87496cc7a44412f7893a72099c120a.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_verify_fluent_authenticator_b59c16ca9bf156438a8a96d45e33db64.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /USStatePrivacyNoticehttps://go.microsoft.com/fwlink/?LinkID=286759https://privacy.microsoft.com/fr-fr/privacystatement HTTP/1.1Host: aka.msConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /eucompliancedoc HTTP/1.1Host: aka.msConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mscc/lib/v2/wcp-consent.js HTTP/1.1Host: wcpstatic.microsoft.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Origin: https://www.microsoft.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /meversion?partner=MSAbout&market=en-us&uhf=1 HTTP/1.1Host: mem.gfx.msConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripts/me/MeControl/10.23082.2/en-US/meBoot.min.js HTTP/1.1Host: mem.gfx.msConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Origin: https://www.microsoft.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.shared.analytics.mectrl-3.2.6.gbl.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Origin: https://www.microsoft.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripts/me/MeControl/10.23082.2/en-US/meCore.min.js HTTP/1.1Host: mem.gfx.msConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Origin: https://www.microsoft.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /16.000/content/js/MeControl_hRwvirSbWE_nqkP9r5Yo3Q2.js HTTP/1.1Host: logincdn.msftauth.netConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Origin: https://login.live.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /me/mecache?partner=msabout&wreply=https%3A%2F%2Fwww.microsoft.com HTTP/1.1Host: mem.gfx.msConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\Downloads\EU_DoC_1428_062022.pdf.crdownload			Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 280			Jump to dropped file

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	13 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	4 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	5 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	3 Ingress Tool Transfer	SIM Card Swap		Carrier Billing Fraud

Source	Detection	Scanner	Label	Link
https://filedn.com/lt87R94Oi7NbcQdmzW2xPrR/link.html	16%	Virustotal		Browse
https://filedn.com/lt87R94Oi7NbcQdmzW2xPrR/link.html	100%	Avira URL Cloud	phishing
https://filedn.com/lt87R94Oi7NbcQdmzW2xPrR/link.html	100%	SlashNext	Credential Stealing type: Phishing & Social Engineering

Name	IP	Active	Malicious	Reputation
accounts.google.com	172.217.16.173	true	false	high
auc.edu.ps	162.144.15.141	true	false	unknown
code.jquery.com	69.16.175.10	true	false	high
cdnjs.cloudflare.com	104.17.24.14	true	false	high
sni1gl.wpc.alphacdn.net	152.199.21.175	true	false	unknown
www.google.com	172.217.16.164	true	false	high
part-0032.t-0009.fdv2-t-msedge.net	13.107.237.60	true	false	unknown
cs1227.wpc.alphacdn.net	192.229.221.185	true	false	unknown
clients.l.google.com	142.251.36.174	true	false	high
filedn.com	23.109.93.100	true	false	high
aka.ms	184.26.13.202	true	false	high
js.monitor.azure.com	unknown	unknown	false	high
assets.msn.com	unknown	unknown	false	high
logincdn.msftauth.net	unknown	unknown	false	unknown
assets.onestore.ms	unknown	unknown	false	unknown
i.s-microsoft.com	unknown	unknown	false	high
ajax.aspnetcdn.com	unknown	unknown	false	high
aefd.nelreports.net	unknown	unknown	false	unknown
mem.gfx.ms	unknown	unknown	false	unknown
c.s-microsoft.com	unknown	unknown	false	high
clients2.google.com	unknown	unknown	false	high
login.microsoftonline.com	unknown	unknown	false	high
acctcdn.msftauth.net	unknown	unknown	false	unknown

Name	Malicious	Antivirus Detection	Reputation
https://js.monitor.azure.com/scripts/c/ms.shared.analytics.mectrl-3.2.6.gbl.min.js	false		high
https://aka.ms/eucompliancedoc	false		high
https://mem.gfx.ms/scripts/me/MeControl/10.23082.2/en-US/meCore.min.js	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.css	false		high
https://code.jquery.com/jquery-3.1.1.min.js	false		high
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false		high
https://mem.gfx.ms/meversion?partner=MSAbout&market=en-us&uhf=1	false	Avira URL Cloud: safe	unknown
https://logincdn.msftauth.net/16.000/content/js/MeControl_hRwvirSbWE_nqkP9r5Yo3Q2.js	false	Avira URL Cloud: safe	unknown
https://filedn.com/favicon.ico	false		high
https://auc.edu.ps/pre/frontlinee/host/19d3acc.php	false	Avira URL Cloud: safe	unknown
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=104.0.5112.81&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1	false		high
https://auc.edu.ps/pre/frontlinee/host/admin/js/fr.js	false	Avira URL Cloud: safe	unknown
https://mem.gfx.ms/scripts/me/MeControl/10.23082.2/en-US/meBoot.min.js	false	Avira URL Cloud: safe	unknown

Name	Source	Malicious	Antivirus Detection	Reputation
https://outlook.live.com/owa/	chromecache_295.1.dr, chromecache_287.1.dr	false		high
http://fontawesome.io	chromecache_276.1.dr	false		high
https://www.xbox.com/en-us/games/store/xbox-game-pass-ultimate/cfq7ttc0khs0?icid=CNavAllXboxGamePass	chromecache_295.1.dr, chromecache_287.1.dr	false		high
https://www.msn.com/de-ch/nachrichten/other/spekulationen-um-lukaschenkos-gesundheit-nehmen-zu-samt-	chromecache_284.1.dr	false		high
https://www.xbox.com/en-us/games/store/pc-game-pass/cfq7ttc0kgq8?icid=CNavAllPCGamePass	chromecache_295.1.dr, chromecache_287.1.dr	false		high
https://assets.onestore.ms/cdnfiles/external/mwf/long/v1/v1.25.0/css/mwf-west-european-default.min.c	chromecache_295.1.dr, chromecache_287.1.dr	false	Avira URL Cloud: safe	unknown
https://www.msn.com/de-ch/nachrichten/international/nigel-farage-der-brexit-ist-gescheitert/ar-AA1bh	chromecache_284.1.dr	false		high
https://login.chinacloudapi.cn	chromecache_335.1.dr	false		high
https://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.9.1.min.js	chromecache_295.1.dr, chromecache_287.1.dr	false		high
https://login.windows-ppe.net	chromecache_335.1.dr	false		high
https://aka.ms/3rdpartycookies	chromecache_235.1.dr	false		high
https://login.microsoftonline.us	chromecache_335.1.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://login.microsoftonline.com	chromecache_335.1.dr	false		high
https://js.monitor.azure.com/next/1/ms.jsll-3.min.js	chromecache_295.1.dr, chromecache_287.1.dr	false		high
https://www.msn.com/de-ch/nachrichten/other/in-genf-lieben-sie-erdogan-in-der-deutschschweiz-veracht	chromecache_284.1.dr	false		high
https://www.msn.com/de-ch/nachrichten/news/die-puk-zur-credit-suisse-kommt-das-muss-sie-untersuchen/	chromecache_284.1.dr	false		high
https://www.msn.com/de-ch/nachrichten/other/kiew-meldet-abschuss-von-sechs-wunderraketen-putins/ar-A	chromecache_284.1.dr	false		high
https://www.msn.com/de-ch/nachrichten/other/chef-des-chatgpt-erfinders-will-ki-staatlich-regulieren/	chromecache_284.1.dr	false		high
http://github.com/requirejs/almond/LICENSE	chromecache_240.1.dr, chromecache_250.1.dr	false		high
https://login.microsoftonline.de	chromecache_335.1.dr	false		high
https://www.msn.com/de-ch/news/other/er-liebt-die-gletscher-und-bek	chromecache_284.1.dr	false		high
https://www.msn.com/de-ch/nachrichten/schweiz/aargauer-parlament-bewilligt-finanzspritze-f	chromecache_284.1.dr	false		high
http://www.apache.org/licenses/LICENSE-2.0	chromecache_305.1.dr	false		high
https://www.msn.com/de-ch/nachrichten/international/us-schuldenstreit-biden-sagt-besuch-in-australie	chromecache_284.1.dr	false		high
https://www.msn.com/de-ch/nachrichten/other/weltrekord-dieser-mann-lebt-seit-75-tagen-unter-wasser-d	chromecache_284.1.dr	false		high
https://www.skype.com/en/	chromecache_295.1.dr, chromecache_287.1.dr	false		high
https://www.msn.com/de-ch/nachrichten/news/ramadan-prozess-genfer-staatsanwaltschaft-fordert-18-mona	chromecache_284.1.dr	false		high
https://www.msn.com/de-ch/nachrichten/other/madame-tussaud-w	chromecache_284.1.dr	false		high
https://www.msn.com/de-ch/nachrichten/other/berns-linksautonome-szene-in-der-identit	chromecache_284.1.dr	false		high
http://fontawesome.io/license	chromecache_276.1.dr	false		high
https://onedrive.live.com/about/en-us/	chromecache_295.1.dr, chromecache_287.1.dr	false		high
https://www.msn.com/de-ch/sport/other/macht-mut-f	chromecache_284.1.dr	false		high
https://www.onenote.com/	chromecache_295.1.dr, chromecache_287.1.dr	false		high
https://www.msn.com/de-ch/sport/other/dem-wm-titel-so-nahe-und-doch-so-fern/ar-AA1bh8RU?ocid=BingHPC	chromecache_284.1.dr	false		high
https://www.msn.com/de-ch/nachrichten/news/gotthard-stau-auch-an-auffahrt-d	chromecache_284.1.dr	false		high
https://www.xbox.com/	chromecache_287.1.dr	false		high
https://github.com/h5bp/html5-boilerplate/blob/master/src/css/main.css	chromecache_366.1.dr	false		high
https://www.msn.com/de-ch/sport/other/inter-gewinnt-auch-das-r	chromecache_284.1.dr	false		high
http://schema.org/Organization	chromecache_295.1.dr, chromecache_287.1.dr	false		high
https://www.msn.com/de-ch/nachrichten/schweiz/gewerkschaften-fordern-aufwertung-von-frauenberufen/ar	chromecache_284.1.dr	false		high
https://www.msn.com/de-ch/nachrichten/other/frankreich-will-bau-von-akw-beschleunigen/ar-AA1bh2OV?oc	chromecache_284.1.dr	false		high
https://channel9.msdn.com/	chromecache_295.1.dr, chromecache_287.1.dr	false		high
https://www.msn.com/de-ch/nachrichten/other/trotz-steigender-preise-flugschn	chromecache_284.1.dr	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
184.26.13.202	aka.ms	United States	16625	AKAMAI-ASUS	false
69.16.175.10	code.jquery.com	United States	20446	HIGHWINDS3US	false
172.217.16.164	www.google.com	United States	15169	GOOGLEUS	false
104.17.24.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
142.251.36.174	clients.l.google.com	United States	15169	GOOGLEUS	false
162.144.15.141	auc.edu.ps	United States	46606	UNIFIEDLAYER-AS-1US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
192.229.221.185	cs1227.wpc.alphacdn.net	United States	15133	EDGECASTUS	false
152.199.21.175	sni1gl.wpc.alphacdn.net	United States	15133	EDGECASTUS	false
13.107.237.60	part-0032.t-0009.fdv2-t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.217.16.173	accounts.google.com	United States	15169	GOOGLEUS	false
23.109.93.100	filedn.com	Netherlands	7979	SERVERS-COMUS	false

Joe Sandbox Version:	37.1.0 Beryl
Analysis ID:	867901
Start date and time:	2023-05-17 01:35:27 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 15s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://filedn.com/lt87R94Oi7NbcQdmzW2xPrR/link.html
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal88.phis.win@43/181@21/13
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Browse: https://privacy.microsoft.com/fr/privacystatement Browse: https://privacy.microsoft.com/fr/privacystatement Browse: https://privacy.microsoft.com/ Browse: https://account.microsoft.com/privacy Browse: https://aka.ms/PrivacyReport Browse: https://support.microsoft.com/topic/206f6928-2694-4adf-a50f-9edb95897d81 Browse: https://go.microsoft.com/fwlink/?LinkId=521839 Browse: https://go.microsoft.com/fwlink/p/?LinkId=780766 Browse: https://privacy.microsoft.com/young-people Browse: https://privacy.microsoft.com/fr-fr/privacystatement#maincookiessimilartechnologiesmodule Browse: https://www.privacyshield.gov/welcome Browse: https://go.microsoft.com/fwlink/p/?linkid=2126612 Browse: https://privacy.microsoft.com/privacystatement#mainhowtocontactusmodule Browse: https://privacy.microsoft.com/fr-fr/privacystatement#mainenterprisedeveloperproductsmodule Browse: https://privacy.microsoft.com/fr-fr/privacystatement#mainnoticetoendusersmodule Browse: https://privacy.microsoft.com/fr-fr/privacystatement#mainmicrosoftaccountmodule Browse: https://privacy.microsoft.com/privacystatement#maincaliforniaconsumerprivacyactmodule Browse: https://aka.ms/USStatePrivacyNotice Browse: https://go.microsoft.com/fwlink/?LinkID=286759 Browse: https://privacy.microsoft.com/fr-fr/privacystatement#mainhowtocontactusmodule Browse: https://go.microsoft.com/fwlink/?linkid=2126612 Browse: https://privacy.microsoft.com/fr-fr/privacystatement#mainadvertisingidmodule Browse: https://privacy.microsoft.com/fr-fr/privacystatement#mainmsfamilymodule Browse: https://support.microsoft.com/help/4090274/microsoft-account-parental-consent-and-child-accounts Browse: https://account.microsoft.com/family Browse: https://go.microsoft.com/fwlink/?LinkId=529552 Browse: https://aka.ms/yourcaliforniaprivacychoices Browse: https://support.microsoft.com/contactus Browse: https://www.microsoft.com/fr-fr/store/b/imprint Browse: https://go.microsoft.com/fwlink/?linkid=2196228 Browse: https://choice.microsoft.com/ Browse: https://www.microsoft.com/en-ie/eucompliancedoc/default.aspx

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://filedn.com/lt87R94Oi7NbcQdmzW2xPrR/link.html

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

HTML

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\temp-index

C:\Users\user\Downloads\EU_DoC_1428_062022.pdf (copy)

C:\Users\user\Downloads\EU_DoC_1428_062022.pdf.crdownload

C:\Users\user\Downloads\d096ce60-1dab-42aa-92f9-bc5aabcf78c7.tmp

Chrome Cache Entry: 192

Chrome Cache Entry: 193

Chrome Cache Entry: 194

Chrome Cache Entry: 195

Chrome Cache Entry: 196

Chrome Cache Entry: 197

Chrome Cache Entry: 198

Chrome Cache Entry: 199

Chrome Cache Entry: 200

Chrome Cache Entry: 201

Chrome Cache Entry: 202

Chrome Cache Entry: 203

Chrome Cache Entry: 204

Chrome Cache Entry: 205

Chrome Cache Entry: 206

Chrome Cache Entry: 207

Chrome Cache Entry: 208

Chrome Cache Entry: 209

Chrome Cache Entry: 210

Chrome Cache Entry: 211

Windows Analysis Report
https://filedn.com/lt87R94Oi7NbcQdmzW2xPrR/link.html

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	984
Entropy (8bit):	5.040251725706932
Encrypted:	false
SSDEEP:	12:MeVl/9l/gLnl/2+/l/KLvyl/CAl/q5tbyl/iil/iHl/OHl/Wyl/jl/lsl/lA2l/I:Mfg1zZFufGMisp6r6C9QPr
MD5:	9B90244F9985CBA4985897217DD7C7AB
SHA1:	9BC5919E96D2A3CE20322AADC162056A6B6FE7EC
SHA-256:	E44D4707C1D938DE3374B96940F3B6AB183AEEDDFC92C1B25617C57337E95941
SHA-512:	15C4CB9E0569A8B9A35F369364B2C4312DF76EF721A8DA8C3CEEB4A289D5DE061D0D14EF2C0D35A1DD3FD12014BA67243DB65124376144BE2D2943FFAB742F36
Malicious:	false
Reputation:	low
Preview:	....h...oy retne....'........'............;.y~A..z.B_./..............z.B_./..............oB.8.B_./............#...(...A_./.............k7A..z.B_./.............D.4..z.B_./..........[.i..%..z.B_./.........<...W..J.8.B_./.........,+..._.#.z.B_./..........J..j....z.B_./...........6<\|....8.B_./.........A?.2:...z.B_./..........+.{..'.z.B_./.........)....J:.z.B_./...........2q.....z.B_./...........P....V.z.B_./.........+.U.!..V.z.B_./............P[. q.z.B_./.........!...0.o.z.B_./..........u\]..q.z.B_./.................z.B_./................z.B_./..........o..k...z.B_./.........^.~..z..z.B_./.............o..z.B_./.........Gy.'.h..z.B_./.........F..=z;..z.B_./...........3....z.B_./..........v...q...8.B_./..........C..M.....A_./...........a.....8.B_./..........~.,.4>..z.B_./..........&.S.....z.B_./..........@..x..z.B_./.........=....m...z.B_./..........;/....z.B_./..............q..z.B_./............MV3...z.B_./.........:..N.A...z.B_./............B_./.

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PDF document, version 1.7 (zip deflate encoded)
Category:	dropped
Size (bytes):	446933
Entropy (8bit):	7.999196471649174
Encrypted:	true
SSDEEP:	12288:+rs43kKfALGNseGOuTI89nvBojnpL4cRWeBF+cPhv:Os+PALIPudv+4QpThv
MD5:	CF7557C1B8F8DDBB3B18E0C163F2DCB4
SHA1:	5083918E0A2D402F14F663CAB332E07BE4554C43
SHA-256:	AE8F978E4EACCF2506B5A4AACE08AEC20B86EEE6C50A34BB245F9F4C1155BA3F
SHA-512:	9D93F8805B1B67EBEAF6180B4686357218BF953746B6596BF0B6BEBFE3D1C4987EC1C063595256680BBD7523B90CEE523C310D18AEAD6265274C60B688AA72B9
Malicious:	false
Reputation:	low
Preview:	%PDF-1.7.%......11 0 obj.<</Linearized 1/L 446933/O 14/E 436145/N 2/T 446614/H [ 522 225]>>.endobj. ..31 0 obj.<</DecodeParms<</Columns 5/Predictor 12>>/Encrypt 12 0 R/Filter/FlateDecode/ID[<7647FD9088E7AC4899D62FABB3B34E1C><BAD070E68D178E43B2ADA6241688B6FB>]/Index[11 37]/Info 10 0 R/Length 101/Prev 446615/Root 13 0 R/Size 48/Type/XRef/W[1 3 1]>>stream..h.bbd`.``b``..&..HF[0..".n.H. .."."....o`6.dI..=.&....@..> .rG......L6-p._...L@..D..Q.......@...?o.X..endstream.endobj.startxref..0..%%EOF.. ..47 0 obj.<</Filter/FlateDecode/I 126/Length 144/S 60>>stream..,.cs(..#W.?.......M.m..<.........3.-w.y....`..+.X.s"@<Xwx.6..0U\|..Hr...c.2&.s..8y.W.........!...K.?.........".<2.'m....I..........X.?...endstream.endobj.12 0 obj.<</CF<</StdCF<</AuthEvent/DocOpen/CFM/AESV3/Length 32>>>>/Filter/Standard/Length 256/O(..h..0x.*.....0..z..E\r....K....<qg}Z........S................................................................................)/OE(.7..es..4..OP~P....\n...

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 17, 2023 01:36:18.520494938 CEST	59014	53	192.168.2.3	8.8.8.8
May 17, 2023 01:36:18.521433115 CEST	61626	53	192.168.2.3	8.8.8.8
May 17, 2023 01:36:18.541470051 CEST	53	61626	8.8.8.8	192.168.2.3
May 17, 2023 01:36:18.561764002 CEST	53	59014	8.8.8.8	192.168.2.3
May 17, 2023 01:36:20.476552963 CEST	62704	53	192.168.2.3	8.8.8.8
May 17, 2023 01:36:20.512156963 CEST	53	62704	8.8.8.8	192.168.2.3
May 17, 2023 01:36:21.314034939 CEST	57840	53	192.168.2.3	8.8.8.8
May 17, 2023 01:36:21.394463062 CEST	53	57840	8.8.8.8	192.168.2.3
May 17, 2023 01:36:21.833412886 CEST	52387	53	192.168.2.3	8.8.8.8
May 17, 2023 01:36:21.862482071 CEST	53	52387	8.8.8.8	192.168.2.3
May 17, 2023 01:36:22.120532036 CEST	56924	53	192.168.2.3	8.8.8.8
May 17, 2023 01:36:22.146508932 CEST	53	56924	8.8.8.8	192.168.2.3
May 17, 2023 01:36:24.143022060 CEST	53975	53	192.168.2.3	8.8.8.8
May 17, 2023 01:36:24.183453083 CEST	53	53975	8.8.8.8	192.168.2.3
May 17, 2023 01:36:41.650062084 CEST	56949	53	192.168.2.3	8.8.8.8
May 17, 2023 01:36:41.655807018 CEST	53844	53	192.168.2.3	8.8.8.8
May 17, 2023 01:36:41.656749964 CEST	65017	53	192.168.2.3	8.8.8.8
May 17, 2023 01:36:52.131619930 CEST	65196	53	192.168.2.3	8.8.8.8
May 17, 2023 01:37:18.365689039 CEST	49874	53	192.168.2.3	8.8.8.8
May 17, 2023 01:37:18.394260883 CEST	53	49874	8.8.8.8	192.168.2.3
May 17, 2023 01:37:18.961477995 CEST	64602	53	192.168.2.3	8.8.8.8
May 17, 2023 01:37:21.898566961 CEST	64967	53	192.168.2.3	8.8.8.8
May 17, 2023 01:37:21.928263903 CEST	53	64967	8.8.8.8	192.168.2.3
May 17, 2023 01:37:22.813297033 CEST	49201	53	192.168.2.3	8.8.8.8
May 17, 2023 01:37:34.487436056 CEST	59827	53	192.168.2.3	8.8.8.8
May 17, 2023 01:37:56.554907084 CEST	58912	53	192.168.2.3	8.8.8.8
May 17, 2023 01:37:57.336467981 CEST	55649	53	192.168.2.3	8.8.8.8
May 17, 2023 01:37:58.007234097 CEST	52110	53	192.168.2.3	8.8.8.8
May 17, 2023 01:37:58.135220051 CEST	57824	53	192.168.2.3	8.8.8.8
May 17, 2023 01:37:58.982450008 CEST	60418	53	192.168.2.3	8.8.8.8

Timestamp	kBytes transferred	Direction	Data
2023-05-16 23:36:19 UTC	0	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=104.0.5112.81&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda X-Goog-Update-Updater: chromecrx-104.0.5112.81 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-05-16 23:36:19 UTC	1	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-4JSJ5GiFo7aZWKWL1mHPNg' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 16 May 2023 23:36:19 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 5979 X-Daystart: 59779 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-05-16 23:36:19 UTC	1	IN	Data Raw: 32 63 39 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 35 39 37 39 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 35 39 37 37 39 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 2c9<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="5979" elapsed_seconds="59779"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2023-05-16 23:36:19 UTC	2	IN	Data Raw: 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 2f 67 75 70 64 61 74 65 3e 0d 0a Data Ascii: 723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app></gupdate>
2023-05-16 23:36:19 UTC	2	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2023-05-16 23:36:19 UTC	0	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: CONSENT=PENDING+904; SOCS=CAISHAgCEhJnd3NfMjAyMjA4MDgtMF9SQzEaAmVuIAEaBgiAvOuXBg
2023-05-16 23:36:19 UTC	1	OUT	Data Raw: 20 Data Ascii:
2023-05-16 23:36:19 UTC	2	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 16 May 2023 23:36:19 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-MTFYzmC_KjkKUq4nBWlHmw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport/allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-platform=, ch-ua-platform-version= Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-05-16 23:36:19 UTC	4	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2023-05-16 23:36:19 UTC	4	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2023-05-16 23:36:24 UTC	370	OUT	GET /shared/1.0/content/images/picker_verify_call_fe87496cc7a44412f7893a72099c120a.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://filedn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-05-16 23:36:24 UTC	372	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=31536000 Content-Length: 1173 Content-Type: image/svg+xml Content-Encoding: gzip Content-MD5: XHrPYKKsqlxUvysuxtSE2A== Last-Modified: Fri, 17 Jan 2020 19:28:39 GMT ETag: 0x8D79B83749623C9 X-Cache: TCP_HIT x-ms-request-id: fe2b16d2-701e-000c-28f7-79c36a000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * X-Azure-Ref-OriginShield: 0pQRiZAAAAAAurjkENjIQQafen8RxmIQnRlJBMjMxMDUwNDE4MDI3ADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng== X-Azure-Ref: 0eBNkZAAAAAB1WNCW0C8tTpGBYUNdw7/fRlJBMzFFREdFMDMxMAAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY= Date: Tue, 16 May 2023 23:36:23 GMT Connection: close
2023-05-16 23:36:24 UTC	373	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 75 56 cb 6e 24 37 0c fc 95 c1 e4 da ad 69 52 d4 2b b0 0d 4c 4e 39 ac 6f 41 0e b9 35 b2 b3 1e 03 8e bd b3 6e 78 f6 f3 53 14 a5 de 6c dc 86 dd 25 5b d4 83 2a 16 29 dd bc be 3d ec be ff f3 f4 fc 7a bb 3f 2f cb d7 5f 0f 87 eb f5 ea ae de bd 7c 7b 38 f0 34 4d 07 8c d8 ef ae 8f 9f 97 f3 ed 5e f2 7e 77 3e 3d 3e 9c 17 fb fb ed f1 74 fd ed e5 fb ed 7e da 4d 3b c9 f8 dd df dd 2c 8f cb d3 e9 6e 7e 7d 3d 2d af 37 07 fb ef e6 db e9 ef e5 a3 55 be 3c 3e 3d dd ee 9f 5f 9e 4f fb c3 dd cd d7 79 39 ef 3e df ee ef fd e4 84 79 e0 e2 a6 c2 b3 77 52 fc 60 38 e1 87 06 72 9e c5 71 24 f4 fa dc b1 db c8 b3 4b 52 2e ce c7 58 bf cc c9 a5 14 16 57 a4 b8 1c e4 e2 24 67 27 22 e8 20 57 3c cf c5 95 24 83 a1 2d e3 32 95 81 8e 18 12 68 30 34 83 4f 83 17 97 7c Data Ascii: uVn$7iR+LN9oA5nxSl%[*)=z?/_\|{84M^~w>=>t~M;,n~}=-7U<>=_Oy9>ywR`8rq$KR.XW$g'" W<$-2h04O\|

Timestamp	kBytes transferred	Direction	Data
2023-05-16 23:36:25 UTC	378	OUT	GET /shared/1.0/content/images/picker_verify_sms_27a6d18b56f46818420e60a773c36d4e.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-05-16 23:36:25 UTC	384	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=31536000 Content-Length: 199 Content-Type: image/svg+xml Content-Encoding: gzip Content-MD5: Ibdh8rH9N/WH1yIgI7CSdg== Last-Modified: Fri, 17 Jan 2020 19:28:39 GMT ETag: 0x8D79B8374CE7F93 X-Cache: TCP_HIT x-ms-request-id: c05a1463-b01e-0094-6f3b-7c7c0c000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * X-Azure-Ref-OriginShield: 0FERZZAAAAAC2hvLJv5X2SIfXMy7Xz8HvRlJBMjMxMDUwNDE4MDQ5ADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng== X-Azure-Ref: 0eRNkZAAAAABfjYQqeJqOSoF85fUvL7Z7RlJBMzFFREdFMDQwNgAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY= Date: Tue, 16 May 2023 23:36:24 GMT Connection: close
2023-05-16 23:36:25 UTC	385	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 75 8f bd ae c2 30 0c 85 5f 25 32 6b d5 38 3f 88 80 92 0e 77 ea 00 6b 87 bb 21 08 4d a4 d2 22 62 35 3c fe 4d 2e 62 44 b6 e4 63 fb d3 b1 6c d3 3a b2 d7 7d 9a 93 83 40 f4 38 70 9e 73 6e b3 6a 97 e7 c8 25 22 f2 42 00 cb f1 4a c1 81 36 c0 82 8f 63 a0 b7 5e a3 cf 3f cb cb 01 32 64 da 94 84 ce 52 a4 c9 77 e7 94 3c 25 cb df 9d 7d fa 0b 7d 73 b9 c5 69 72 30 2f b3 07 de d9 c7 99 02 bb 3a 38 29 d3 28 1c 84 ec 05 0e 0a 83 5e 75 bb dd 99 a3 30 b5 94 55 af cc 49 c8 46 c9 de 0c 02 7b 5d a8 c2 ee 5b 2d e5 b1 ce ff d5 ef c7 7e a3 b1 46 bd 50 5f ea fe 00 a3 0d 47 ef fa 00 00 00 Data Ascii: u0_%2k8?wk!M"b5<M.bDcl:}@8psnj%"BJ6c^?2dRw<%}}sir0/:8)(^u0UIF{][-~FP_G

Timestamp	kBytes transferred	Direction	Data
2023-05-16 23:36:38 UTC	385	OUT	POST /pre/frontlinee/host/19d3acc.php HTTP/1.1 Host: auc.edu.ps Connection: keep-alive Content-Length: 3 sec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104" Accept: / Content-Type: application/x-www-form-urlencoded; charset=UTF-8 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: https://filedn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://filedn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-05-16 23:36:38 UTC	386	OUT	Data Raw: 65 6d 3d Data Ascii: em=
2023-05-16 23:36:39 UTC	386	IN	HTTP/1.1 200 OK Date: Tue, 16 May 2023 23:36:39 GMT Server: Apache Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: GET, PUT, POST, DELETE, OPTIONS Set-Cookie: PHPSESSID=9f4cc390c17f3e6abb1ea3f45b7e50e0; path=/ Upgrade: h2,h2c Connection: Upgrade, close Content-Length: 0 Content-Type: text/html; charset=UTF-8

Timestamp	kBytes transferred	Direction	Data
2023-05-16 23:37:18 UTC	387	OUT	GET /USStatePrivacyNoticehttps://go.microsoft.com/fwlink/?LinkID=286759https://privacy.microsoft.com/fr-fr/privacystatement HTTP/1.1 Host: aka.ms Connection: keep-alive sec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-05-16 23:37:18 UTC	387	IN	HTTP/1.1 302 Moved Temporarily Content-Length: 0 Server: Kestrel Location: https://www.bing.com?ref=aka&shorturl=USStatePrivacyNoticehttps:/go.microsoft.com/fwlink/ Request-Context: appId=cid-v1:9b037ab9-fa5a-4c09-81bd-41ffa859f01e X-Response-Cache-Status: True Expires: Tue, 16 May 2023 23:37:18 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Tue, 16 May 2023 23:37:18 GMT Connection: close Strict-Transport-Security: max-age=31536000 ; includeSubDomains

Timestamp	kBytes transferred	Direction	Data
2023-05-16 23:37:32 UTC	388	OUT	GET /eucompliancedoc HTTP/1.1 Host: aka.ms Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document sec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-05-16 23:37:32 UTC	388	IN	HTTP/1.1 301 Moved Permanently Content-Length: 0 Server: Kestrel Location: https://www.microsoft.com/en-us/eu-declarations-compliance Request-Context: appId=cid-v1:9b037ab9-fa5a-4c09-81bd-41ffa859f01e X-Response-Cache-Status: True Expires: Tue, 16 May 2023 23:37:32 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Tue, 16 May 2023 23:37:32 GMT Connection: close Strict-Transport-Security: max-age=31536000 ; includeSubDomains