Windows Analysis Report
https://google.com/amp/s/login.sharesyncportal.tech/dmYzPMej

Overview

General Information

Sample URL:	https://google.com/amp/s/login.sharesyncportal.tech/dmYzPMej
Analysis ID:	1529262
Infos:

Detection

HTMLPhisher

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Yara detected HtmlPhish54

Phishing site detected (based on favicon image match)

Phishing site detected (based on image similarity)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected non-DNS traffic on DNS port

Drops PE files

Drops PE files to the windows directory (C:\Windows)

HTML body contains low number of good links

HTML page contains hidden javascript code

HTML page contains string obfuscation

HTML title does not match URL

Stores files to the Windows start menu directory

Classification

Signatures

Phishing

AI detected phishing page

Source: https://login.sharesyncportal.tech/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638640066194875337.MjRmYTlhMTQtNDM1MC00Njg4LWFkMjYtNDU5NDlhYzgzM2RmMDgzMzk2NTYtNTIyMC00M2JiLWE1ZGMtMjU1YmUwNDlhMDFj&ui_locales=en-US&mkt=en-US&client-request-id=a223cbd8-78c5-4dbd-b7ee-a98cd50a0cd6&state=2TiaG4RdWAjLH44zuoPdxtIG6LOv0SRIiAd8bLCmbo1h3-3JQ-5fo3p21lo7yBfjdgs4PfY8BO24hAG75ZED1RgGMkQEwRl0zC0UeXdRplpdXpF5BVJUIqouco9wfFC0L56kv_0MfDAeqRGE3BhZGmhQ1PLfW9qUoHciMenuj18CXdTwlzzkgl7pjEQI8N8VMUbWobTcO75iqOe5gpjiXRGC32Tr6wob2ygs7CxmZjEY9B8cHtSNR0i23nB-nNs0mCYQyLGtkEIPrp6ZIST-pA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true

LLM: Score: 8 Reasons: The brand 'Microsoft' is a well-known technology company with a primary domain of 'microsoft.com'., The URL 'login.sharesyncportal.tech' does not match the legitimate domain associated with Microsoft., The domain 'sharesyncportal.tech' is not commonly associated with Microsoft and could be a third-party service., The use of a generic domain extension '.tech' and the presence of 'login' in the subdomain can be indicative of phishing., There is no direct association between 'sharesyncportal.tech' and Microsoft, raising suspicion. DOM: 0.6.pages.csv

Yara detected HtmlPhish54

Source: Yara match	File source: 0.9.id.script.csv, type: HTML
Source: Yara match	File source: 0.25.i.script.csv, type: HTML
Source: Yara match	File source: 0.6.pages.csv, type: HTML

Phishing site detected (based on favicon image match)

Source: https://login.sharesyncportal.tech/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638640066194875337.MjRmYTlhMTQtNDM1MC00Njg4LWFkMjYtNDU5NDlhYzgzM2RmMDgzMzk2NTYtNTIyMC00M2JiLWE1ZGMtMjU1YmUwNDlhMDFj&ui_locales=en-US&mkt=en-US&client-request-id=a223cbd8-78c5-4dbd-b7ee-a98cd50a0cd6&state=2TiaG4RdWAjLH44zuoPdxtIG6LOv0SRIiAd8bLCmbo1h3-3JQ-5fo3p21lo7yBfjdgs4PfY8BO24hAG75ZED1RgGMkQEwRl0zC0UeXdRplpdXpF5BVJUIqouco9wfFC0L56kv_0MfDAeqRGE3BhZGmhQ1PLfW9qUoHciMenuj18CXdTwlzzkgl7pjEQI8N8VMUbWobTcO75iqOe5gpjiXRGC32Tr6wob2ygs7CxmZjEY9B8cHtSNR0i23nB-nNs0mCYQyLGtkEIPrp6ZIST-pA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	Matcher: Template: microsoft matched with high similarity
Source: https://sharesyncportal.tech	Matcher: Template: microsoft matched with high similarity

Phishing site detected (based on image similarity)

Matcher: Found strong image similarity, brand: MICROSOFT

HTML body contains low number of good links

Source: https://login.sharesyncportal.tech/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638640066194875337.MjRmYTlhMTQtNDM1MC00Njg4LWFkMjYtNDU5NDlhYzgzM2RmMDgzMzk2NTYtNTIyMC00M2JiLWE1ZGMtMjU1YmUwNDlhMDFj&ui_locales=en-US&mkt=en-US&client-request-id=a223cbd8-78c5-4dbd-b7ee-a98cd50a0cd6&state=2TiaG4RdWAjLH44zuoPdxtIG6LOv0SRIiAd8bLCmbo1h3-3JQ-5fo3p21lo7yBfjdgs4PfY8BO24hAG75ZED1RgGMkQEwRl0zC0UeXdRplpdXpF5BVJUIqouco9wfFC0L56kv_0MfDAeqRGE3BhZGmhQ1PLfW9qUoHciMenuj18CXdTwlzzkgl7pjEQI8N8VMUbWobTcO75iqOe5gpjiXRGC32Tr6wob2ygs7CxmZjEY9B8cHtSNR0i23nB-nNs0mCYQyLGtkEIPrp6ZIST-pA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0	HTTP Parser: Number of links: 0
Source: https://login.sharesyncportal.tech/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638640066194875337.MjRmYTlhMTQtNDM1MC00Njg4LWFkMjYtNDU5NDlhYzgzM2RmMDgzMzk2NTYtNTIyMC00M2JiLWE1ZGMtMjU1YmUwNDlhMDFj&ui_locales=en-US&mkt=en-US&client-request-id=a223cbd8-78c5-4dbd-b7ee-a98cd50a0cd6&state=2TiaG4RdWAjLH44zuoPdxtIG6LOv0SRIiAd8bLCmbo1h3-3JQ-5fo3p21lo7yBfjdgs4PfY8BO24hAG75ZED1RgGMkQEwRl0zC0UeXdRplpdXpF5BVJUIqouco9wfFC0L56kv_0MfDAeqRGE3BhZGmhQ1PLfW9qUoHciMenuj18CXdTwlzzkgl7pjEQI8N8VMUbWobTcO75iqOe5gpjiXRGC32Tr6wob2ygs7CxmZjEY9B8cHtSNR0i23nB-nNs0mCYQyLGtkEIPrp6ZIST-pA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: Number of links: 0

HTML page contains hidden javascript code

Source: https://login.sharesyncportal.tech/dmYzPMej

HTTP Parser: Base64 decoded: 1728409809.000000

HTML page contains string obfuscation

Source: https://login.sharesyncportal.tech/dmYzPMej

HTTP Parser: Found new string: script . var ip;. function EnterSite() {. window.location.href = 'htt' + 'ps:' + '//l' + 'ogi' + 'n.' + 'sha' + 're' + 'syn' + 'c' + 'por' + 't' + 'a' + 'l.t' + 'ech' + '/d' + 'm' + 'Yz' + 'PM' + 'ej?' + 'm' + '=X' + 'pA5' + 'U0I'. }. ..

HTML title does not match URL

Source: https://login.sharesyncportal.tech/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638640066194875337.MjRmYTlhMTQtNDM1MC00Njg4LWFkMjYtNDU5NDlhYzgzM2RmMDgzMzk2NTYtNTIyMC00M2JiLWE1ZGMtMjU1YmUwNDlhMDFj&ui_locales=en-US&mkt=en-US&client-request-id=a223cbd8-78c5-4dbd-b7ee-a98cd50a0cd6&state=2TiaG4RdWAjLH44zuoPdxtIG6LOv0SRIiAd8bLCmbo1h3-3JQ-5fo3p21lo7yBfjdgs4PfY8BO24hAG75ZED1RgGMkQEwRl0zC0UeXdRplpdXpF5BVJUIqouco9wfFC0L56kv_0MfDAeqRGE3BhZGmhQ1PLfW9qUoHciMenuj18CXdTwlzzkgl7pjEQI8N8VMUbWobTcO75iqOe5gpjiXRGC32Tr6wob2ygs7CxmZjEY9B8cHtSNR0i23nB-nNs0mCYQyLGtkEIPrp6ZIST-pA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0	HTTP Parser: Title: Redirecting does not match URL
Source: https://login.sharesyncportal.tech/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638640066194875337.MjRmYTlhMTQtNDM1MC00Njg4LWFkMjYtNDU5NDlhYzgzM2RmMDgzMzk2NTYtNTIyMC00M2JiLWE1ZGMtMjU1YmUwNDlhMDFj&ui_locales=en-US&mkt=en-US&client-request-id=a223cbd8-78c5-4dbd-b7ee-a98cd50a0cd6&state=2TiaG4RdWAjLH44zuoPdxtIG6LOv0SRIiAd8bLCmbo1h3-3JQ-5fo3p21lo7yBfjdgs4PfY8BO24hAG75ZED1RgGMkQEwRl0zC0UeXdRplpdXpF5BVJUIqouco9wfFC0L56kv_0MfDAeqRGE3BhZGmhQ1PLfW9qUoHciMenuj18CXdTwlzzkgl7pjEQI8N8VMUbWobTcO75iqOe5gpjiXRGC32Tr6wob2ygs7CxmZjEY9B8cHtSNR0i23nB-nNs0mCYQyLGtkEIPrp6ZIST-pA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: Title: Sign in to your account does not match URL

HTTP Parser: <input type="password" .../> found

Source: https://login.sharesyncportal.tech/dmYzPMej	HTTP Parser: No favicon
Source: https://login.sharesyncportal.tech/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638640066194875337.MjRmYTlhMTQtNDM1MC00Njg4LWFkMjYtNDU5NDlhYzgzM2RmMDgzMzk2NTYtNTIyMC00M2JiLWE1ZGMtMjU1YmUwNDlhMDFj&ui_locales=en-US&mkt=en-US&client-request-id=a223cbd8-78c5-4dbd-b7ee-a98cd50a0cd6&state=2TiaG4RdWAjLH44zuoPdxtIG6LOv0SRIiAd8bLCmbo1h3-3JQ-5fo3p21lo7yBfjdgs4PfY8BO24hAG75ZED1RgGMkQEwRl0zC0UeXdRplpdXpF5BVJUIqouco9wfFC0L56kv_0MfDAeqRGE3BhZGmhQ1PLfW9qUoHciMenuj18CXdTwlzzkgl7pjEQI8N8VMUbWobTcO75iqOe5gpjiXRGC32Tr6wob2ygs7CxmZjEY9B8cHtSNR0i23nB-nNs0mCYQyLGtkEIPrp6ZIST-pA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0	HTTP Parser: No favicon

Source: https://login.sharesyncportal.tech/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638640066194875337.MjRmYTlhMTQtNDM1MC00Njg4LWFkMjYtNDU5NDlhYzgzM2RmMDgzMzk2NTYtNTIyMC00M2JiLWE1ZGMtMjU1YmUwNDlhMDFj&ui_locales=en-US&mkt=en-US&client-request-id=a223cbd8-78c5-4dbd-b7ee-a98cd50a0cd6&state=2TiaG4RdWAjLH44zuoPdxtIG6LOv0SRIiAd8bLCmbo1h3-3JQ-5fo3p21lo7yBfjdgs4PfY8BO24hAG75ZED1RgGMkQEwRl0zC0UeXdRplpdXpF5BVJUIqouco9wfFC0L56kv_0MfDAeqRGE3BhZGmhQ1PLfW9qUoHciMenuj18CXdTwlzzkgl7pjEQI8N8VMUbWobTcO75iqOe5gpjiXRGC32Tr6wob2ygs7CxmZjEY9B8cHtSNR0i23nB-nNs0mCYQyLGtkEIPrp6ZIST-pA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0	HTTP Parser: No <meta name="author".. found
Source: https://login.sharesyncportal.tech/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638640066194875337.MjRmYTlhMTQtNDM1MC00Njg4LWFkMjYtNDU5NDlhYzgzM2RmMDgzMzk2NTYtNTIyMC00M2JiLWE1ZGMtMjU1YmUwNDlhMDFj&ui_locales=en-US&mkt=en-US&client-request-id=a223cbd8-78c5-4dbd-b7ee-a98cd50a0cd6&state=2TiaG4RdWAjLH44zuoPdxtIG6LOv0SRIiAd8bLCmbo1h3-3JQ-5fo3p21lo7yBfjdgs4PfY8BO24hAG75ZED1RgGMkQEwRl0zC0UeXdRplpdXpF5BVJUIqouco9wfFC0L56kv_0MfDAeqRGE3BhZGmhQ1PLfW9qUoHciMenuj18CXdTwlzzkgl7pjEQI8N8VMUbWobTcO75iqOe5gpjiXRGC32Tr6wob2ygs7CxmZjEY9B8cHtSNR0i23nB-nNs0mCYQyLGtkEIPrp6ZIST-pA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.sharesyncportal.tech/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638640066194875337.MjRmYTlhMTQtNDM1MC00Njg4LWFkMjYtNDU5NDlhYzgzM2RmMDgzMzk2NTYtNTIyMC00M2JiLWE1ZGMtMjU1YmUwNDlhMDFj&ui_locales=en-US&mkt=en-US&client-request-id=a223cbd8-78c5-4dbd-b7ee-a98cd50a0cd6&state=2TiaG4RdWAjLH44zuoPdxtIG6LOv0SRIiAd8bLCmbo1h3-3JQ-5fo3p21lo7yBfjdgs4PfY8BO24hAG75ZED1RgGMkQEwRl0zC0UeXdRplpdXpF5BVJUIqouco9wfFC0L56kv_0MfDAeqRGE3BhZGmhQ1PLfW9qUoHciMenuj18CXdTwlzzkgl7pjEQI8N8VMUbWobTcO75iqOe5gpjiXRGC32Tr6wob2ygs7CxmZjEY9B8cHtSNR0i23nB-nNs0mCYQyLGtkEIPrp6ZIST-pA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.sharesyncportal.tech/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638640066194875337.MjRmYTlhMTQtNDM1MC00Njg4LWFkMjYtNDU5NDlhYzgzM2RmMDgzMzk2NTYtNTIyMC00M2JiLWE1ZGMtMjU1YmUwNDlhMDFj&ui_locales=en-US&mkt=en-US&client-request-id=a223cbd8-78c5-4dbd-b7ee-a98cd50a0cd6&state=2TiaG4RdWAjLH44zuoPdxtIG6LOv0SRIiAd8bLCmbo1h3-3JQ-5fo3p21lo7yBfjdgs4PfY8BO24hAG75ZED1RgGMkQEwRl0zC0UeXdRplpdXpF5BVJUIqouco9wfFC0L56kv_0MfDAeqRGE3BhZGmhQ1PLfW9qUoHciMenuj18CXdTwlzzkgl7pjEQI8N8VMUbWobTcO75iqOe5gpjiXRGC32Tr6wob2ygs7CxmZjEY9B8cHtSNR0i23nB-nNs0mCYQyLGtkEIPrp6ZIST-pA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="author".. found

Source: https://login.sharesyncportal.tech/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638640066194875337.MjRmYTlhMTQtNDM1MC00Njg4LWFkMjYtNDU5NDlhYzgzM2RmMDgzMzk2NTYtNTIyMC00M2JiLWE1ZGMtMjU1YmUwNDlhMDFj&ui_locales=en-US&mkt=en-US&client-request-id=a223cbd8-78c5-4dbd-b7ee-a98cd50a0cd6&state=2TiaG4RdWAjLH44zuoPdxtIG6LOv0SRIiAd8bLCmbo1h3-3JQ-5fo3p21lo7yBfjdgs4PfY8BO24hAG75ZED1RgGMkQEwRl0zC0UeXdRplpdXpF5BVJUIqouco9wfFC0L56kv_0MfDAeqRGE3BhZGmhQ1PLfW9qUoHciMenuj18CXdTwlzzkgl7pjEQI8N8VMUbWobTcO75iqOe5gpjiXRGC32Tr6wob2ygs7CxmZjEY9B8cHtSNR0i23nB-nNs0mCYQyLGtkEIPrp6ZIST-pA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0	HTTP Parser: No <meta name="copyright".. found
Source: https://login.sharesyncportal.tech/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638640066194875337.MjRmYTlhMTQtNDM1MC00Njg4LWFkMjYtNDU5NDlhYzgzM2RmMDgzMzk2NTYtNTIyMC00M2JiLWE1ZGMtMjU1YmUwNDlhMDFj&ui_locales=en-US&mkt=en-US&client-request-id=a223cbd8-78c5-4dbd-b7ee-a98cd50a0cd6&state=2TiaG4RdWAjLH44zuoPdxtIG6LOv0SRIiAd8bLCmbo1h3-3JQ-5fo3p21lo7yBfjdgs4PfY8BO24hAG75ZED1RgGMkQEwRl0zC0UeXdRplpdXpF5BVJUIqouco9wfFC0L56kv_0MfDAeqRGE3BhZGmhQ1PLfW9qUoHciMenuj18CXdTwlzzkgl7pjEQI8N8VMUbWobTcO75iqOe5gpjiXRGC32Tr6wob2ygs7CxmZjEY9B8cHtSNR0i23nB-nNs0mCYQyLGtkEIPrp6ZIST-pA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.sharesyncportal.tech/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638640066194875337.MjRmYTlhMTQtNDM1MC00Njg4LWFkMjYtNDU5NDlhYzgzM2RmMDgzMzk2NTYtNTIyMC00M2JiLWE1ZGMtMjU1YmUwNDlhMDFj&ui_locales=en-US&mkt=en-US&client-request-id=a223cbd8-78c5-4dbd-b7ee-a98cd50a0cd6&state=2TiaG4RdWAjLH44zuoPdxtIG6LOv0SRIiAd8bLCmbo1h3-3JQ-5fo3p21lo7yBfjdgs4PfY8BO24hAG75ZED1RgGMkQEwRl0zC0UeXdRplpdXpF5BVJUIqouco9wfFC0L56kv_0MfDAeqRGE3BhZGmhQ1PLfW9qUoHciMenuj18CXdTwlzzkgl7pjEQI8N8VMUbWobTcO75iqOe5gpjiXRGC32Tr6wob2ygs7CxmZjEY9B8cHtSNR0i23nB-nNs0mCYQyLGtkEIPrp6ZIST-pA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.sharesyncportal.tech/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638640066194875337.MjRmYTlhMTQtNDM1MC00Njg4LWFkMjYtNDU5NDlhYzgzM2RmMDgzMzk2NTYtNTIyMC00M2JiLWE1ZGMtMjU1YmUwNDlhMDFj&ui_locales=en-US&mkt=en-US&client-request-id=a223cbd8-78c5-4dbd-b7ee-a98cd50a0cd6&state=2TiaG4RdWAjLH44zuoPdxtIG6LOv0SRIiAd8bLCmbo1h3-3JQ-5fo3p21lo7yBfjdgs4PfY8BO24hAG75ZED1RgGMkQEwRl0zC0UeXdRplpdXpF5BVJUIqouco9wfFC0L56kv_0MfDAeqRGE3BhZGmhQ1PLfW9qUoHciMenuj18CXdTwlzzkgl7pjEQI8N8VMUbWobTcO75iqOe5gpjiXRGC32Tr6wob2ygs7CxmZjEY9B8cHtSNR0i23nB-nNs0mCYQyLGtkEIPrp6ZIST-pA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_719969287\LICENSE.txt

Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.17:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.17:63145 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.209.135:443 -> 192.168.2.17:63157 version: TLS 1.2

Detected non-DNS traffic on DNS port

Source: global traffic	TCP traffic: 192.168.2.17:63143 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.17:63143 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.17:63143 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.17:63143 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.17:63143 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.17:63143 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.17:51340 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:63143 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.17:51340 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:63143 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.17:51340 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:63143 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.17:51340 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:63143 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.17:51340 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:63143 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.17:51340 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:63143 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.17:51340 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:63143 -> 162.159.36.2:53

Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203

Source: global traffic	DNS traffic detected: DNS query: google.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: login.sharesyncportal.tech
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: www.sharesyncportal.tech
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: ywnjb.sharesyncportal.tech
Source: global traffic	DNS traffic detected: DNS query: identity.nel.measure.office.net

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63145 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49691
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63151
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63147 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 51351 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63145
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63148
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63147
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63149
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63157
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 63149 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51343
Source: unknown	Network traffic detected: HTTP traffic on port 49691 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51351
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51343 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 63157 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63148 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 63151 -> 443

Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.17:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.17:63145 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.209.135:443 -> 192.168.2.17:63157 version: TLS 1.2

Creates files inside the system directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_1700762260
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_1700762260\sets.json
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_1700762260\manifest.json
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_1700762260\LICENSE
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_1700762260\_metadata\
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_1700762260\_metadata\verified_contents.json
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_1700762260\manifest.fingerprint
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_1047533516
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_1047533516\Google.Widevine.CDM.dll
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_1047533516\manifest.json
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_1047533516\_metadata\
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_1047533516\_metadata\verified_contents.json
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_1047533516\manifest.fingerprint
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_719969287
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_719969287\LICENSE.txt
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_719969287\Filtering Rules
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_719969287\manifest.json
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_719969287\_metadata\
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_719969287\_metadata\verified_contents.json
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_719969287\manifest.fingerprint
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_260536069
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_260536069\cr_en-us_500000_index.bin
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_260536069\manifest.json
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_260536069\_metadata\
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_260536069\_metadata\verified_contents.json
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_260536069\manifest.fingerprint

Deletes files inside the Windows folder

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\chrome_BITS_6756_1226025701

Source: classification engine

Classification label: mal64.phis.win@29/50@26/243

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=2000,i,14252091542976459431,7911676512981613110,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://google.com/amp/s/login.sharesyncportal.tech/dmYzPMej"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=2000,i,14252091542976459431,7911676512981613110,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Drops PE files

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_1047533516\Google.Widevine.CDM.dll

Jump to dropped file

Drops PE files to the windows directory (C:\Windows)

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_1047533516\Google.Widevine.CDM.dll

Jump to dropped file

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_719969287\LICENSE.txt

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.185.99	unknown	United States	15169	GOOGLEUS	false
172.217.16.202	unknown	United States	15169	GOOGLEUS	false
34.104.35.123	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
13.107.246.67	s-part-0039.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.217.18.14	google.com	United States	15169	GOOGLEUS	false
172.67.73.159	ywnjb.sharesyncportal.tech	United States	13335	CLOUDFLARENETUS	true
104.18.94.41	unknown	United States	13335	CLOUDFLARENETUS	false
104.26.10.211	www.sharesyncportal.tech	United States	13335	CLOUDFLARENETUS	false
104.18.95.41	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
142.250.185.106	unknown	United States	15169	GOOGLEUS	false
216.58.206.68	www.google.com	United States	15169	GOOGLEUS	false
142.250.181.238	unknown	United States	15169	GOOGLEUS	false
64.233.167.84	unknown	United States	15169	GOOGLEUS	false
2.19.126.143	unknown	European Union	16625	AKAMAI-ASUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.185.163	unknown	United States	15169	GOOGLEUS	false
142.250.185.142	unknown	United States	15169	GOOGLEUS	false
13.107.253.64	s-part-0036.t-0009.fb-t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
152.199.21.175	sni1gl.wpc.omegacdn.net	United States	15133	EDGECASTUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
142.250.184.202	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.17
192.168.2.5

Contacted Domains

Name	IP	Active
ywnjb.sharesyncportal.tech	172.67.73.159	true
google.com	172.217.18.14	true
login.sharesyncportal.tech	172.67.73.159	true
a.nel.cloudflare.com	35.190.80.1	true
s-part-0036.t-0009.fb-t-msedge.net	13.107.253.64	true
www.sharesyncportal.tech	104.26.10.211	true
challenges.cloudflare.com	104.18.95.41	true
sni1gl.wpc.omegacdn.net	152.199.21.175	true
www.google.com	216.58.206.68	true
s-part-0039.t-0009.t-msedge.net	13.107.246.67	true
identity.nel.measure.office.net	unknown	unknown
aadcdn.msftauth.net	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://login.sharesyncportal.tech/dmYzPMej	false		unknown

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 8 16:50:07 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	66A30A12F11AB7E1845C3CDC2B185B38	4806ED35A4B422A8E840C66D1E5778FDE0C5DA22	3C8389413C627656595BFEA05C9A70430959B67B4849E97F9C250CFA6FF8CC14
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 8 16:50:06 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	B025FBBC39F2E0E33CE85735765B5FE3	AB72318274E4248799D56AAC39E91C425C058637	EE03A6A18387B8F989BCB100A3CAA63425EB14B82A2684243B695B26AA1805D7
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:54:41 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	3C8AC093191708CCE5C13C91ABF0BB01	2EE87AAFAED9EBFE04978BFB086FEA0BBAC2A671	B1909B0A8F64FE3739CEA40A6EF78861D26DF2B33337876A0F2B6FD0897AE009
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 8 16:50:06 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	A76FC1888BFE015502F29F01070C2D4D	F340E55E341B07E5964F8A768BD1A2798D768096	C4CB03E812A678ED137570C348DEFB6901F4A0A7BEBBA2EC28E8ADFF2F89C6BF
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 8 16:50:07 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	8367BA96CC79696DE24F93E806C14734	32D5BE62F7D3053C8E1E831F28715FA8A858CB44	351D2CDE922167B31C67741E0AF9FA0149ACFE529A17012445E8E0AA2A5A39C8
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 8 16:50:06 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	C8622A99127DE76920777B4E08990308	2C77B2F919E9CBB373E112BEAB1F255122D26FE5	5BA026592CC9009A95689F71C77E42F5D68532D8ED59B2CDA0E513EB63A69ECA
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_1047533516\Google.Widevine.CDM.dll	PE32+ executable (DLL) (console) x86-64, for MS Windows	477C17B6448695110B4D227664AA3C48	949FF1136E0971A0176F6ADEA8ADCC0DD6030F22	CB190E7D1B002A3050705580DD51EBA895A19EB09620BDD48D63085D5D88031E
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_1047533516\_metadata\verified_contents.json	JSON data	3E839BA4DA1FFCE29A543C5756A19BDF	D8D84AC06C3BA27CCEF221C6F188042B741D2B91	43DAA4139D3ED90F4B4635BD4D32346EB8E8528D0D5332052FCDA8F7860DB729
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_1047533516\manifest.fingerprint	ASCII text, with no line terminators	D30A5BBC00F7334EEDE0795D147B2E80	78F3A6995856854CAD0C524884F74E182F9C3C57	A08C1BC41DE319392676C7389048D8B1C7424C4B74D2F6466BCF5732B8D86642
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_1047533516\manifest.json	JSON data	BBC03E9C7C5944E62EFC9C660B7BD2B6	83F161E3F49B64553709994B048D9F597CDE3DC6	6CCE5AD8D496BC5179FA84AF8AFC568EEBA980D8A75058C6380B64FB42298C28
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_1700762260\LICENSE	ASCII text	EE002CB9E51BB8DFA89640A406A1090A	49EE3AD535947D8821FFDEB67FFC9BC37D1EBBB2	3DBD2C90050B652D63656481C3E5871C52261575292DB77D4EA63419F187A55B
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_1700762260\_metadata\verified_contents.json	JSON data	68E6B5733E04AB7BF19699A84D8ABBC2	1C11F06CA1AD3ED8116D356AB9164FD1D52B5CF0	F095F969D6711F53F97747371C83D5D634EAEF21C54CB1A6A1CC5B816D633709
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_1700762260\manifest.fingerprint	ASCII text, with no line terminators	CFB54589424206D0AE6437B5673F498D	D1EF6314F0F68EFDD0BA8F6CA9E59BFF863B1609	285AC183C35350B4B77332172413902F83726CA8F53D63859B5DA082FD425A1C
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_1700762260\manifest.json	JSON data	C3419069A1C30140B77045ABA38F12CF	11920F0C1E55CADC7D2893D1EEBB268B3459762A	DB9A702209807BA039871E542E8356219F342A8D9C9CA34BCD9A86727F4A3A0F
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_1700762260\sets.json	JSON data	EEA4913A6625BEB838B3E4E79999B627	1B4966850F1B117041407413B70BFA925FD83703	20EF4DE871ECE3C5F14867C4AE8465999C7A2CC1633525E752320E61F78A373C
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_260536069\_metadata\verified_contents.json	JSON data	F5B9C966EB93F7872A3912DF54FB111F	7B1A197F4D759316284BFEC79F30013B7C781D94	38332E166736E41CE2E5E668C3DE1EEC8467B87D5136C8413E6261C0F8B35ABE
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_260536069\cr_en-us_500000_index.bin	data	96DB58957B26AB466F04A49E564B88E9	8F3A2CEE899435119189804820DA85E488876279	EC7173FCA63E6AE7185279F7B0977460D3824E1C124DDADEA0C1BF327C93FA76
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_260536069\manifest.fingerprint	ASCII text, with no line terminators	D2F3C5774D48283F037291454607C3CD	F4BA368313FCDC02C75DE02F2FD3CB5F7A0980F6	3B8A11F3A749394203849D0FAED36A6FD0695B85B4774FC5476A651D55684825
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_260536069\manifest.json	JSON data	79C93E2D4FF43CED56BC85DD135A1F7F	BAC80396DD067CDE3E8B35C2569224D9774FE6B5	973A1C3D8EAD6F6C560FCD17CBC38122FD18EF0095523409CF8C58296B57D54C
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_719969287\Filtering Rules	data	B23DD5B6ECCB460003EA37BA0F5E3730	FD444553CB7699F84CE7E5664232771673DCF67D	7F7F432C27D97DEE184DCD3EA20F731674C008BE849C0136F9C5358E359F3EA9
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_719969287\LICENSE.txt	ASCII text, with CRLF line terminators	D33AAA5246E1CE0A94FA15BA0C407AE2	11D197ACB61361657D638154A9416DC3249EC9FB	1D4FF95CE9C6E21FE4A4FF3B41E7A0DF88638DD449D909A7B46974D3DFAB7311
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_719969287\_metadata\verified_contents.json	JSON data	2FF08C4B4128F634CBBFEA0C1C44AA2E	45D11E57DDF29E843AC8545C7D06CDDB5DF3E962	33B6F2ECD5FB7F9FAF538F29808716EFA337A653809943A8E4B5E450B734DA09
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_719969287\manifest.fingerprint	ASCII text, with no line terminators	6DBEDE254AF8A23D6CB2ABAEA8D2E38F	A827D46FA5D53CB7B134F143CC15A30BA015ED21	376ED55CD5AB45C0F7BAA1AF0AC2637C33DEA6D1D4683B729AE7CE764F70DAA1
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_719969287\manifest.json	JSON data	3448D97DA638C7EF0FBCA9B6949FFC8F	36D8434F26F0316FAB4627F7856FCA7291FE8ADF	1700A11FD1E58367B450A41B2AE5FD26ECB5CDB459869C796C7DDE18F1D30F73
Chrome Cache Entry: 209	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592	4761405717E938D7E7400BB15715DB1E	76FED7C229D353A27DB3257F5927C1EAF0AB8DE9	F7ED91A1DAB5BB2802A7A3B3890DF4777588CCBE04903260FBA83E6E64C90DDF
Chrome Cache Entry: 211	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 449703	AF2A7A4929E13F15A045C8C8D80A4543	6A1EC81A5085D0846C77DD616AE686FF732C32D6	EB47C5509CEF44C582EF8ABB8C58766EA6118AD40B0FFC22A7652ED1DC6FEE8B
Chrome Cache Entry: 212	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 57443	C217AE35B8592DC9F1E680487DAD094F	2E642562C2BFD8968629317FF212684C7EB59193	D41992E79D7BCFCC1F32597208DD99033D99C04882EAFCC8508F2FA0EE728C6B
Chrome Cache Entry: 213	ASCII text, with very long lines (32058)	C9F5AEECA3AD37BF2AA006139B935F0A	1055018C28AB41087EF9CCEFE411606893DABEA2	87083882CC6015984EB0411A99D3981817F5DC5C90BA24F0940420C5548D82DE
Chrome Cache Entry: 214	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651	9F368BC4580FED907775F31C6B26D6CF	E393A40B3E337F43057EEE3DE189F197AB056451	7ECBBA946C099539C3D9C03F4B6804958900E5B90D48336EEA7E5A2ED050FA36
Chrome Cache Entry: 216	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 15755	6DEB44A9FE273266EFABC3214B998BA0	C8BE755694C25E416C81F5057670E3B14B2FE08F	4A1AA3B8B23FB3C150A62BB681DAE96E6CAB20BFAFB89D74FED2E0BC85826BAF
Chrome Cache Entry: 217	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors	12E3DAC858061D088023B2BD48E2FA96	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
Chrome Cache Entry: 219	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 141866	6DE768A4DF1E0D0061CDB52EF06346C4	3829A667B97668008023DDA98F4C0772174C8EF6	58732EEE2ED9091F4F5776DC8A8A14116CBE5A2BA1CCDA0256896BAB08A52128
Chrome Cache Entry: 225	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113769	D3B6AE9986DF244AB03412CC700335D0	BAAA1F9899178938F3881F09B18265E47DA806E3	CA50059111D30C2E212C90805792EB543548AEF0D4941E886A778E3DCE0B9066
Chrome Cache Entry: 226	ASCII text, with very long lines (65450), with CRLF line terminators	75CF78D0E38C65A538AD253CA9E48DBE	BF0452E4A42A9AF3B69D5D8C3A3A0433F14921B6	DF2AA8537C1992C94846A0FFFFAA9031D430D9D0210B9E396EC059AFF62627E0
Chrome Cache Entry: 228	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113401	48981D3CF57E7C58CA7E3E851EF9354E	73593DE7633B10F9FFD0EF0E46280FA40FF433FF	8A5E756923CC5C3F013862427B7622F58A52501C5A6017FFF2FDB2AFD94A10C2
Chrome Cache Entry: 229	ASCII text, with very long lines (8087), with no line terminators	AC18AB52C184F1CB404B5953EEA2BCB3	2EB1AE877A122D89A7427687FD85BAC6CCB957C1	E3BADEEEB1479FB6A7CA86C5638A1B1401DA15BF74F69A4991A9B8812590C39C
Chrome Cache Entry: 231	ASCII text, with very long lines (2054)	439A53994F1A9C860C7787ED5100CA0C	15BA120F64BBF6A59A457841B10DF0D6D1B4574C	441BFA485FB0EB8AD2BE7001209868B57C41769CAE9512A774419F5882C093E6
Chrome Cache Entry: 232	PNG image data, 98 x 81, 8-bit/color RGB, non-interlaced	1B7A76968A04918FFB20348A0BBC5CD8	15897CF978EC7AEEFCFF53624139AB7FA6BC9C1B	CFF689EB4FD5C01E00E421CA68F9A124C3CD9A7D7D938515B479A9157A9AA822
Chrome Cache Entry: 233	ASCII text, with very long lines (46090)	3894D02F360D8CD81B6A6A22657D6FC4	76DED99C3BEEC2B3B51C487FBCD471725DFFEFCB	5298D0E8E19294C4137A13AA02949CA05F777BFB9B142F5CB5A343B09B69AA38
Chrome Cache Entry: 235	ASCII text, with very long lines (8147), with no line terminators	02287858DE91D967D2E6086BBB783CAA	47272D8E957E767DAA61992D1E062706B7517358	98C2E0364BE11C5CD462090506ACD06788517759E6E3BB9B5FEBDA51D0C948AC
Chrome Cache Entry: 236	GIF image data, version 89a, 352 x 3	B540A8E518037192E32C4FE58BF2DBAB	3047C1DB97B86F6981E0AD2F96AF40CDF43511AF	8737D721808655F37B333F08A90185699E7E8B9BDAAA15CDB63C8448B426F95D
Chrome Cache Entry: 237	PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced	9246CCA8FC3C00F50035F28E9F6B7F7D	3AA538440F70873B574F40CD793060F53EC17A5D	C07D7D29E3C20FA6CA4C5D20663688D52BAD13E129AD82CE06B80EB187D9DC84
Chrome Cache Entry: 238	HTML document, ASCII text, with very long lines (3452), with CRLF line terminators	E7AE8C9928E96968EDA8C5D9C46E9FC2	FF931E5DA30F18EB82AA5172E9599C1719ED46D2	03A37060854762D3A8A04663C4DE9785B2226F5E98AC80D8C979B53640CD910F
Chrome Cache Entry: 239	ASCII text, with no line terminators	9F9FA94F28FE0DE82BC8FD039A7BDB24	6FE91F82974BD5B101782941064BCB2AFDEB17D8	9A37FDC0DBA8B23EB7D3AA9473D59A45B3547CF060D68B4D52253EE0DA1AF92E
Chrome Cache Entry: 240	GIF image data, version 89a, 352 x 3	166DE53471265253AB3A456DEFE6DA23	17C6DF4D7CCF1FA2C9EFD716FBAE0FC2C71C8D6D	A46201581A7C7C667FD42787CD1E9ADF2F6BF809EFB7596E61A03E8DBA9ADA13
Chrome Cache Entry: 242	ASCII text, with very long lines (512)	39A0EB35CD7799A181D34F4AE1DDB496	E933CA8534BCB6AD79D240316CE23C8B870050D0	C8CEF105FCAF7CBF3F8682C861045505C24D41CF6686C20C1C03E14031A3DB69
Chrome Cache Entry: 243	HTML document, ASCII text, with very long lines (4585)	B32188995590BD0C44D003B76E3FAD58	A323050059D2FB383190C9B13B1707BDCDCB6322	523C3B02AA02E7D200D980D59F2112656918C299B159D9D8C403A9BDAB52FD9A
Chrome Cache Entry: 244	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 406986	2D3FBED6DDD719FCC1BFB500B612FCEC	CD91B795DDE806AC8A38E51CCB6E8BAD8E57DA1B	B2566B646F02DF4CE30B05D8223B78130A719D4EC9E4794A0106C371ADE33CC7
Chrome Cache Entry: 247	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1864	0E176276362B94279A4492511BFCBD98	389FE6B51F62254BB98939896B8C89EBEFFE2A02	9A2C174AE45CAC057822844211156A5ED293E65C5F69E1D211A7206472C5C80C
Chrome Cache Entry: 251	ASCII text, with very long lines (47459)	5D332FD1AE9FEB79A10425DFC3F84FE4	C7D7F9D2BF5EE08E242765803CDD3A223FE1CBFC	2EA786910282DF7AE154A0011375CD1254ADBD8EF0E75EB62177ADA67DAF9611

Phishing

AI detected phishing page

Yara detected HtmlPhish54

Source: Yara match	File source: 0.9.id.script.csv, type: HTML
Source: Yara match	File source: 0.25.i.script.csv, type: HTML
Source: Yara match	File source: 0.6.pages.csv, type: HTML

Phishing site detected (based on favicon image match)

Source: https://login.sharesyncportal.tech/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638640066194875337.MjRmYTlhMTQtNDM1MC00Njg4LWFkMjYtNDU5NDlhYzgzM2RmMDgzMzk2NTYtNTIyMC00M2JiLWE1ZGMtMjU1YmUwNDlhMDFj&ui_locales=en-US&mkt=en-US&client-request-id=a223cbd8-78c5-4dbd-b7ee-a98cd50a0cd6&state=2TiaG4RdWAjLH44zuoPdxtIG6LOv0SRIiAd8bLCmbo1h3-3JQ-5fo3p21lo7yBfjdgs4PfY8BO24hAG75ZED1RgGMkQEwRl0zC0UeXdRplpdXpF5BVJUIqouco9wfFC0L56kv_0MfDAeqRGE3BhZGmhQ1PLfW9qUoHciMenuj18CXdTwlzzkgl7pjEQI8N8VMUbWobTcO75iqOe5gpjiXRGC32Tr6wob2ygs7CxmZjEY9B8cHtSNR0i23nB-nNs0mCYQyLGtkEIPrp6ZIST-pA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	Matcher: Template: microsoft matched with high similarity
Source: https://sharesyncportal.tech	Matcher: Template: microsoft matched with high similarity

Phishing site detected (based on image similarity)

Matcher: Found strong image similarity, brand: MICROSOFT

HTML body contains low number of good links

Source: https://login.sharesyncportal.tech/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638640066194875337.MjRmYTlhMTQtNDM1MC00Njg4LWFkMjYtNDU5NDlhYzgzM2RmMDgzMzk2NTYtNTIyMC00M2JiLWE1ZGMtMjU1YmUwNDlhMDFj&ui_locales=en-US&mkt=en-US&client-request-id=a223cbd8-78c5-4dbd-b7ee-a98cd50a0cd6&state=2TiaG4RdWAjLH44zuoPdxtIG6LOv0SRIiAd8bLCmbo1h3-3JQ-5fo3p21lo7yBfjdgs4PfY8BO24hAG75ZED1RgGMkQEwRl0zC0UeXdRplpdXpF5BVJUIqouco9wfFC0L56kv_0MfDAeqRGE3BhZGmhQ1PLfW9qUoHciMenuj18CXdTwlzzkgl7pjEQI8N8VMUbWobTcO75iqOe5gpjiXRGC32Tr6wob2ygs7CxmZjEY9B8cHtSNR0i23nB-nNs0mCYQyLGtkEIPrp6ZIST-pA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0	HTTP Parser: Number of links: 0
Source: https://login.sharesyncportal.tech/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638640066194875337.MjRmYTlhMTQtNDM1MC00Njg4LWFkMjYtNDU5NDlhYzgzM2RmMDgzMzk2NTYtNTIyMC00M2JiLWE1ZGMtMjU1YmUwNDlhMDFj&ui_locales=en-US&mkt=en-US&client-request-id=a223cbd8-78c5-4dbd-b7ee-a98cd50a0cd6&state=2TiaG4RdWAjLH44zuoPdxtIG6LOv0SRIiAd8bLCmbo1h3-3JQ-5fo3p21lo7yBfjdgs4PfY8BO24hAG75ZED1RgGMkQEwRl0zC0UeXdRplpdXpF5BVJUIqouco9wfFC0L56kv_0MfDAeqRGE3BhZGmhQ1PLfW9qUoHciMenuj18CXdTwlzzkgl7pjEQI8N8VMUbWobTcO75iqOe5gpjiXRGC32Tr6wob2ygs7CxmZjEY9B8cHtSNR0i23nB-nNs0mCYQyLGtkEIPrp6ZIST-pA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: Number of links: 0

HTML page contains hidden javascript code

Source: https://login.sharesyncportal.tech/dmYzPMej

HTTP Parser: Base64 decoded: 1728409809.000000

HTML page contains string obfuscation

Source: https://login.sharesyncportal.tech/dmYzPMej

HTML title does not match URL

Source: https://login.sharesyncportal.tech/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638640066194875337.MjRmYTlhMTQtNDM1MC00Njg4LWFkMjYtNDU5NDlhYzgzM2RmMDgzMzk2NTYtNTIyMC00M2JiLWE1ZGMtMjU1YmUwNDlhMDFj&ui_locales=en-US&mkt=en-US&client-request-id=a223cbd8-78c5-4dbd-b7ee-a98cd50a0cd6&state=2TiaG4RdWAjLH44zuoPdxtIG6LOv0SRIiAd8bLCmbo1h3-3JQ-5fo3p21lo7yBfjdgs4PfY8BO24hAG75ZED1RgGMkQEwRl0zC0UeXdRplpdXpF5BVJUIqouco9wfFC0L56kv_0MfDAeqRGE3BhZGmhQ1PLfW9qUoHciMenuj18CXdTwlzzkgl7pjEQI8N8VMUbWobTcO75iqOe5gpjiXRGC32Tr6wob2ygs7CxmZjEY9B8cHtSNR0i23nB-nNs0mCYQyLGtkEIPrp6ZIST-pA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0	HTTP Parser: Title: Redirecting does not match URL
Source: https://login.sharesyncportal.tech/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638640066194875337.MjRmYTlhMTQtNDM1MC00Njg4LWFkMjYtNDU5NDlhYzgzM2RmMDgzMzk2NTYtNTIyMC00M2JiLWE1ZGMtMjU1YmUwNDlhMDFj&ui_locales=en-US&mkt=en-US&client-request-id=a223cbd8-78c5-4dbd-b7ee-a98cd50a0cd6&state=2TiaG4RdWAjLH44zuoPdxtIG6LOv0SRIiAd8bLCmbo1h3-3JQ-5fo3p21lo7yBfjdgs4PfY8BO24hAG75ZED1RgGMkQEwRl0zC0UeXdRplpdXpF5BVJUIqouco9wfFC0L56kv_0MfDAeqRGE3BhZGmhQ1PLfW9qUoHciMenuj18CXdTwlzzkgl7pjEQI8N8VMUbWobTcO75iqOe5gpjiXRGC32Tr6wob2ygs7CxmZjEY9B8cHtSNR0i23nB-nNs0mCYQyLGtkEIPrp6ZIST-pA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: Title: Sign in to your account does not match URL

HTTP Parser: <input type="password" .../> found

Source: https://login.sharesyncportal.tech/dmYzPMej	HTTP Parser: No favicon
Source: https://login.sharesyncportal.tech/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638640066194875337.MjRmYTlhMTQtNDM1MC00Njg4LWFkMjYtNDU5NDlhYzgzM2RmMDgzMzk2NTYtNTIyMC00M2JiLWE1ZGMtMjU1YmUwNDlhMDFj&ui_locales=en-US&mkt=en-US&client-request-id=a223cbd8-78c5-4dbd-b7ee-a98cd50a0cd6&state=2TiaG4RdWAjLH44zuoPdxtIG6LOv0SRIiAd8bLCmbo1h3-3JQ-5fo3p21lo7yBfjdgs4PfY8BO24hAG75ZED1RgGMkQEwRl0zC0UeXdRplpdXpF5BVJUIqouco9wfFC0L56kv_0MfDAeqRGE3BhZGmhQ1PLfW9qUoHciMenuj18CXdTwlzzkgl7pjEQI8N8VMUbWobTcO75iqOe5gpjiXRGC32Tr6wob2ygs7CxmZjEY9B8cHtSNR0i23nB-nNs0mCYQyLGtkEIPrp6ZIST-pA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0	HTTP Parser: No favicon

Source: https://login.sharesyncportal.tech/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638640066194875337.MjRmYTlhMTQtNDM1MC00Njg4LWFkMjYtNDU5NDlhYzgzM2RmMDgzMzk2NTYtNTIyMC00M2JiLWE1ZGMtMjU1YmUwNDlhMDFj&ui_locales=en-US&mkt=en-US&client-request-id=a223cbd8-78c5-4dbd-b7ee-a98cd50a0cd6&state=2TiaG4RdWAjLH44zuoPdxtIG6LOv0SRIiAd8bLCmbo1h3-3JQ-5fo3p21lo7yBfjdgs4PfY8BO24hAG75ZED1RgGMkQEwRl0zC0UeXdRplpdXpF5BVJUIqouco9wfFC0L56kv_0MfDAeqRGE3BhZGmhQ1PLfW9qUoHciMenuj18CXdTwlzzkgl7pjEQI8N8VMUbWobTcO75iqOe5gpjiXRGC32Tr6wob2ygs7CxmZjEY9B8cHtSNR0i23nB-nNs0mCYQyLGtkEIPrp6ZIST-pA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0	HTTP Parser: No <meta name="author".. found
Source: https://login.sharesyncportal.tech/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638640066194875337.MjRmYTlhMTQtNDM1MC00Njg4LWFkMjYtNDU5NDlhYzgzM2RmMDgzMzk2NTYtNTIyMC00M2JiLWE1ZGMtMjU1YmUwNDlhMDFj&ui_locales=en-US&mkt=en-US&client-request-id=a223cbd8-78c5-4dbd-b7ee-a98cd50a0cd6&state=2TiaG4RdWAjLH44zuoPdxtIG6LOv0SRIiAd8bLCmbo1h3-3JQ-5fo3p21lo7yBfjdgs4PfY8BO24hAG75ZED1RgGMkQEwRl0zC0UeXdRplpdXpF5BVJUIqouco9wfFC0L56kv_0MfDAeqRGE3BhZGmhQ1PLfW9qUoHciMenuj18CXdTwlzzkgl7pjEQI8N8VMUbWobTcO75iqOe5gpjiXRGC32Tr6wob2ygs7CxmZjEY9B8cHtSNR0i23nB-nNs0mCYQyLGtkEIPrp6ZIST-pA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.sharesyncportal.tech/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638640066194875337.MjRmYTlhMTQtNDM1MC00Njg4LWFkMjYtNDU5NDlhYzgzM2RmMDgzMzk2NTYtNTIyMC00M2JiLWE1ZGMtMjU1YmUwNDlhMDFj&ui_locales=en-US&mkt=en-US&client-request-id=a223cbd8-78c5-4dbd-b7ee-a98cd50a0cd6&state=2TiaG4RdWAjLH44zuoPdxtIG6LOv0SRIiAd8bLCmbo1h3-3JQ-5fo3p21lo7yBfjdgs4PfY8BO24hAG75ZED1RgGMkQEwRl0zC0UeXdRplpdXpF5BVJUIqouco9wfFC0L56kv_0MfDAeqRGE3BhZGmhQ1PLfW9qUoHciMenuj18CXdTwlzzkgl7pjEQI8N8VMUbWobTcO75iqOe5gpjiXRGC32Tr6wob2ygs7CxmZjEY9B8cHtSNR0i23nB-nNs0mCYQyLGtkEIPrp6ZIST-pA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.sharesyncportal.tech/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638640066194875337.MjRmYTlhMTQtNDM1MC00Njg4LWFkMjYtNDU5NDlhYzgzM2RmMDgzMzk2NTYtNTIyMC00M2JiLWE1ZGMtMjU1YmUwNDlhMDFj&ui_locales=en-US&mkt=en-US&client-request-id=a223cbd8-78c5-4dbd-b7ee-a98cd50a0cd6&state=2TiaG4RdWAjLH44zuoPdxtIG6LOv0SRIiAd8bLCmbo1h3-3JQ-5fo3p21lo7yBfjdgs4PfY8BO24hAG75ZED1RgGMkQEwRl0zC0UeXdRplpdXpF5BVJUIqouco9wfFC0L56kv_0MfDAeqRGE3BhZGmhQ1PLfW9qUoHciMenuj18CXdTwlzzkgl7pjEQI8N8VMUbWobTcO75iqOe5gpjiXRGC32Tr6wob2ygs7CxmZjEY9B8cHtSNR0i23nB-nNs0mCYQyLGtkEIPrp6ZIST-pA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="author".. found

Source: https://login.sharesyncportal.tech/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638640066194875337.MjRmYTlhMTQtNDM1MC00Njg4LWFkMjYtNDU5NDlhYzgzM2RmMDgzMzk2NTYtNTIyMC00M2JiLWE1ZGMtMjU1YmUwNDlhMDFj&ui_locales=en-US&mkt=en-US&client-request-id=a223cbd8-78c5-4dbd-b7ee-a98cd50a0cd6&state=2TiaG4RdWAjLH44zuoPdxtIG6LOv0SRIiAd8bLCmbo1h3-3JQ-5fo3p21lo7yBfjdgs4PfY8BO24hAG75ZED1RgGMkQEwRl0zC0UeXdRplpdXpF5BVJUIqouco9wfFC0L56kv_0MfDAeqRGE3BhZGmhQ1PLfW9qUoHciMenuj18CXdTwlzzkgl7pjEQI8N8VMUbWobTcO75iqOe5gpjiXRGC32Tr6wob2ygs7CxmZjEY9B8cHtSNR0i23nB-nNs0mCYQyLGtkEIPrp6ZIST-pA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0	HTTP Parser: No <meta name="copyright".. found
Source: https://login.sharesyncportal.tech/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638640066194875337.MjRmYTlhMTQtNDM1MC00Njg4LWFkMjYtNDU5NDlhYzgzM2RmMDgzMzk2NTYtNTIyMC00M2JiLWE1ZGMtMjU1YmUwNDlhMDFj&ui_locales=en-US&mkt=en-US&client-request-id=a223cbd8-78c5-4dbd-b7ee-a98cd50a0cd6&state=2TiaG4RdWAjLH44zuoPdxtIG6LOv0SRIiAd8bLCmbo1h3-3JQ-5fo3p21lo7yBfjdgs4PfY8BO24hAG75ZED1RgGMkQEwRl0zC0UeXdRplpdXpF5BVJUIqouco9wfFC0L56kv_0MfDAeqRGE3BhZGmhQ1PLfW9qUoHciMenuj18CXdTwlzzkgl7pjEQI8N8VMUbWobTcO75iqOe5gpjiXRGC32Tr6wob2ygs7CxmZjEY9B8cHtSNR0i23nB-nNs0mCYQyLGtkEIPrp6ZIST-pA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.sharesyncportal.tech/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638640066194875337.MjRmYTlhMTQtNDM1MC00Njg4LWFkMjYtNDU5NDlhYzgzM2RmMDgzMzk2NTYtNTIyMC00M2JiLWE1ZGMtMjU1YmUwNDlhMDFj&ui_locales=en-US&mkt=en-US&client-request-id=a223cbd8-78c5-4dbd-b7ee-a98cd50a0cd6&state=2TiaG4RdWAjLH44zuoPdxtIG6LOv0SRIiAd8bLCmbo1h3-3JQ-5fo3p21lo7yBfjdgs4PfY8BO24hAG75ZED1RgGMkQEwRl0zC0UeXdRplpdXpF5BVJUIqouco9wfFC0L56kv_0MfDAeqRGE3BhZGmhQ1PLfW9qUoHciMenuj18CXdTwlzzkgl7pjEQI8N8VMUbWobTcO75iqOe5gpjiXRGC32Tr6wob2ygs7CxmZjEY9B8cHtSNR0i23nB-nNs0mCYQyLGtkEIPrp6ZIST-pA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.sharesyncportal.tech/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638640066194875337.MjRmYTlhMTQtNDM1MC00Njg4LWFkMjYtNDU5NDlhYzgzM2RmMDgzMzk2NTYtNTIyMC00M2JiLWE1ZGMtMjU1YmUwNDlhMDFj&ui_locales=en-US&mkt=en-US&client-request-id=a223cbd8-78c5-4dbd-b7ee-a98cd50a0cd6&state=2TiaG4RdWAjLH44zuoPdxtIG6LOv0SRIiAd8bLCmbo1h3-3JQ-5fo3p21lo7yBfjdgs4PfY8BO24hAG75ZED1RgGMkQEwRl0zC0UeXdRplpdXpF5BVJUIqouco9wfFC0L56kv_0MfDAeqRGE3BhZGmhQ1PLfW9qUoHciMenuj18CXdTwlzzkgl7pjEQI8N8VMUbWobTcO75iqOe5gpjiXRGC32Tr6wob2ygs7CxmZjEY9B8cHtSNR0i23nB-nNs0mCYQyLGtkEIPrp6ZIST-pA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_719969287\LICENSE.txt

Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.17:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.17:63145 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.209.135:443 -> 192.168.2.17:63157 version: TLS 1.2

Detected non-DNS traffic on DNS port

Source: global traffic	TCP traffic: 192.168.2.17:63143 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.17:63143 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.17:63143 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.17:63143 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.17:63143 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.17:63143 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.17:51340 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:63143 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.17:51340 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:63143 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.17:51340 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:63143 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.17:51340 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:63143 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.17:51340 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:63143 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.17:51340 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:63143 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.17:51340 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:63143 -> 162.159.36.2:53

Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203

Source: global traffic	DNS traffic detected: DNS query: google.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: login.sharesyncportal.tech
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: www.sharesyncportal.tech
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: ywnjb.sharesyncportal.tech
Source: global traffic	DNS traffic detected: DNS query: identity.nel.measure.office.net

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63145 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49691
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63151
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63147 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 51351 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63145
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63148
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63147
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63149
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63157
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 63149 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51343
Source: unknown	Network traffic detected: HTTP traffic on port 49691 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51351
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51343 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 63157 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63148 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 63151 -> 443

Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.17:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.17:63145 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.209.135:443 -> 192.168.2.17:63157 version: TLS 1.2

Creates files inside the system directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_1700762260
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_1700762260\sets.json
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_1700762260\manifest.json
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_1700762260\LICENSE
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_1700762260\_metadata\
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_1700762260\_metadata\verified_contents.json
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_1700762260\manifest.fingerprint
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_1047533516
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_1047533516\Google.Widevine.CDM.dll
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_1047533516\manifest.json
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_1047533516\_metadata\
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_1047533516\_metadata\verified_contents.json
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_1047533516\manifest.fingerprint
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_719969287
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_719969287\LICENSE.txt
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_719969287\Filtering Rules
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_719969287\manifest.json
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_719969287\_metadata\
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_719969287\_metadata\verified_contents.json
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_719969287\manifest.fingerprint
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_260536069
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_260536069\cr_en-us_500000_index.bin
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_260536069\manifest.json
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_260536069\_metadata\
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_260536069\_metadata\verified_contents.json
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_260536069\manifest.fingerprint

Deletes files inside the Windows folder

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\chrome_BITS_6756_1226025701

Source: classification engine

Classification label: mal64.phis.win@29/50@26/243

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=2000,i,14252091542976459431,7911676512981613110,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://google.com/amp/s/login.sharesyncportal.tech/dmYzPMej"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=2000,i,14252091542976459431,7911676512981613110,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Drops PE files

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_1047533516\Google.Widevine.CDM.dll

Jump to dropped file

Drops PE files to the windows directory (C:\Windows)

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_1047533516\Google.Widevine.CDM.dll

Jump to dropped file

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6756_719969287\LICENSE.txt

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

ID:	1529262
Product:	CloudBasic
Start time:	19:49:27
Start date:	08.10.2024
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Windows Analysis Report
https://google.com/amp/s/login.sharesyncportal.tech/dmYzPMej

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Persistence and Installation Behavior

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report https://google.com/amp/s/login.sharesyncportal.tech/dmYzPMej

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Persistence and Installation Behavior

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
https://google.com/amp/s/login.sharesyncportal.tech/dmYzPMej