Windows Analysis Report
https://jira.flywire.tech/plugins/servlet/desk/portal/34

Overview

General Information

Sample URL:	https://jira.flywire.tech/plugins/servlet/desk/portal/34
Analysis ID:	1532113

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

HTML body contains low number of good links

HTML page contains hidden javascript code

Stores files to the Windows start menu directory

Classification

Signatures

HTML body contains low number of good links

Source: https://flywire.okta.com/oauth2/v1/authorize?client_id=0oam8v0n7en8Yj7ON0x7&redirect_uri=https%3A%2F%2Fflywire.cloudflareaccess.com%2Fcdn-cgi%2Faccess%2Fcallback&response_type=code&scope=openid%20groups%20profile%20email&state=19b80ec91e7d08e7bf25bee8b40416b0206bd1199e66bd0afb080829a4ae4c0b.JTdCJTIyaWF0JTIyJTNBMTcyODcyOTQwNSUyQyUyMmF1dGhEb21haW4lMjIlM0ElMjJmbHl3aXJlLmNsb3VkZmxhcmVhY2Nlc3MuY29tJTIyJTJDJTIyaG9zdG5hbWUlMjIlM0ElMjJqaXJhLmZseXdpcmUudGVjaCUyMiUyQyUyMnJlZGlyZWN0VVJMJTIyJTNBJTIyJTJGcGx1Z2lucyUyRnNlcnZsZXQlMkZkZXNrJTJGcG9ydGFsJTJGMzQlMjIlMkMlMjJhdWQlMjIlM0ElMjI3MTZjMTYyOGRiMDU2ODNjYTNiYzRlNDY3OTdkMzQ0YmQ3M2Q4ZTE1MjZjODE5OWQ2NGRlZjAwNjBjMWE0YTI0JTIyJTJDJTIyaXNTYW1lU2l0ZU5vbmVDb21wYXRpYmxlJTIyJTNBdHJ1ZSUyQyUyMmlzSURQVGVzdCUyMiUzQWZhbHNlJTJDJTIyaXNSZWZyZXNoJTIyJTNBZmFsc2UlMkMlMjJub25jZSUyMiUzQSUyMm5BcWY1eGVLZzE3eWJLR09wJTIyJTJDJTIyaWRwSWQlMjIlM0ElMjI0NTI5YzBiNS04ZGYwLTQ1ZjktYjUyZi1jMjVjMWM2ZWQ4ZGElMjIlMkMlMjJzZXJ2aWNlX3Rva2VuX2lkJTIyJTNBJTIyJTIyJTJDJTIyc2VydmljZV90b2tlbl9zdGF0dXMlMjIlM0FmYWxzZSUyQyUyMmF1...

HTTP Parser: Number of links: 1

HTML page contains hidden javascript code

HTTP Parser: Base64 decoded: %7B%22iat%22%3A1728729405%2C%22authDomain%22%3A%22flywire.cloudflareaccess.com%22%2C%22hostname%22%3A%22jira.flywire.tech%22%2C%22redirectURL%22%3A%22%2Fplugins%2Fservlet%2Fdesk%2Fportal%2F34%22%2C%22aud%22%3A%22716c1628db05683ca3bc4e46797d344bd73d8e1526c...

Source: https://flywire.okta.com/oauth2/v1/authorize?client_id=0oam8v0n7en8Yj7ON0x7&redirect_uri=https%3A%2F%2Fflywire.cloudflareaccess.com%2Fcdn-cgi%2Faccess%2Fcallback&response_type=code&scope=openid%20groups%20profile%20email&state=19b80ec91e7d08e7bf25bee8b40416b0206bd1199e66bd0afb080829a4ae4c0b.JTdCJTIyaWF0JTIyJTNBMTcyODcyOTQwNSUyQyUyMmF1dGhEb21haW4lMjIlM0ElMjJmbHl3aXJlLmNsb3VkZmxhcmVhY2Nlc3MuY29tJTIyJTJDJTIyaG9zdG5hbWUlMjIlM0ElMjJqaXJhLmZseXdpcmUudGVjaCUyMiUyQyUyMnJlZGlyZWN0VVJMJTIyJTNBJTIyJTJGcGx1Z2lucyUyRnNlcnZsZXQlMkZkZXNrJTJGcG9ydGFsJTJGMzQlMjIlMkMlMjJhdWQlMjIlM0ElMjI3MTZjMTYyOGRiMDU2ODNjYTNiYzRlNDY3OTdkMzQ0YmQ3M2Q4ZTE1MjZjODE5OWQ2NGRlZjAwNjBjMWE0YTI0JTIyJTJDJTIyaXNTYW1lU2l0ZU5vbmVDb21wYXRpYmxlJTIyJTNBdHJ1ZSUyQyUyMmlzSURQVGVzdCUyMiUzQWZhbHNlJTJDJTIyaXNSZWZyZXNoJTIyJTNBZmFsc2UlMkMlMjJub25jZSUyMiUzQSUyMm5BcWY1eGVLZzE3eWJLR09wJTIyJTJDJTIyaWRwSWQlMjIlM0ElMjI0NTI5YzBiNS04ZGYwLTQ1ZjktYjUyZi1jMjVjMWM2ZWQ4ZGElMjIlMkMlMjJzZXJ2aWNlX3Rva2VuX2lkJTIyJTNBJTIyJTIyJTJDJTIyc2VydmljZV90b2tlbl9zdGF0dXMlMjIlM0FmYWxzZSUyQyUyMmF1...	HTTP Parser: Iframe src: https://login.okta.com/discovery/iframe.html
Source: https://flywire.okta.com/oauth2/v1/authorize?client_id=0oam8v0n7en8Yj7ON0x7&redirect_uri=https%3A%2F%2Fflywire.cloudflareaccess.com%2Fcdn-cgi%2Faccess%2Fcallback&response_type=code&scope=openid%20groups%20profile%20email&state=19b80ec91e7d08e7bf25bee8b40416b0206bd1199e66bd0afb080829a4ae4c0b.JTdCJTIyaWF0JTIyJTNBMTcyODcyOTQwNSUyQyUyMmF1dGhEb21haW4lMjIlM0ElMjJmbHl3aXJlLmNsb3VkZmxhcmVhY2Nlc3MuY29tJTIyJTJDJTIyaG9zdG5hbWUlMjIlM0ElMjJqaXJhLmZseXdpcmUudGVjaCUyMiUyQyUyMnJlZGlyZWN0VVJMJTIyJTNBJTIyJTJGcGx1Z2lucyUyRnNlcnZsZXQlMkZkZXNrJTJGcG9ydGFsJTJGMzQlMjIlMkMlMjJhdWQlMjIlM0ElMjI3MTZjMTYyOGRiMDU2ODNjYTNiYzRlNDY3OTdkMzQ0YmQ3M2Q4ZTE1MjZjODE5OWQ2NGRlZjAwNjBjMWE0YTI0JTIyJTJDJTIyaXNTYW1lU2l0ZU5vbmVDb21wYXRpYmxlJTIyJTNBdHJ1ZSUyQyUyMmlzSURQVGVzdCUyMiUzQWZhbHNlJTJDJTIyaXNSZWZyZXNoJTIyJTNBZmFsc2UlMkMlMjJub25jZSUyMiUzQSUyMm5BcWY1eGVLZzE3eWJLR09wJTIyJTJDJTIyaWRwSWQlMjIlM0ElMjI0NTI5YzBiNS04ZGYwLTQ1ZjktYjUyZi1jMjVjMWM2ZWQ4ZGElMjIlMkMlMjJzZXJ2aWNlX3Rva2VuX2lkJTIyJTNBJTIyJTIyJTJDJTIyc2VydmljZV90b2tlbl9zdGF0dXMlMjIlM0FmYWxzZSUyQyUyMmF1...	HTTP Parser: Iframe src: https://login.okta.com/discovery/iframe.html
Source: https://flywire.okta.com/oauth2/v1/authorize?client_id=0oam8v0n7en8Yj7ON0x7&redirect_uri=https%3A%2F%2Fflywire.cloudflareaccess.com%2Fcdn-cgi%2Faccess%2Fcallback&response_type=code&scope=openid%20groups%20profile%20email&state=19b80ec91e7d08e7bf25bee8b40416b0206bd1199e66bd0afb080829a4ae4c0b.JTdCJTIyaWF0JTIyJTNBMTcyODcyOTQwNSUyQyUyMmF1dGhEb21haW4lMjIlM0ElMjJmbHl3aXJlLmNsb3VkZmxhcmVhY2Nlc3MuY29tJTIyJTJDJTIyaG9zdG5hbWUlMjIlM0ElMjJqaXJhLmZseXdpcmUudGVjaCUyMiUyQyUyMnJlZGlyZWN0VVJMJTIyJTNBJTIyJTJGcGx1Z2lucyUyRnNlcnZsZXQlMkZkZXNrJTJGcG9ydGFsJTJGMzQlMjIlMkMlMjJhdWQlMjIlM0ElMjI3MTZjMTYyOGRiMDU2ODNjYTNiYzRlNDY3OTdkMzQ0YmQ3M2Q4ZTE1MjZjODE5OWQ2NGRlZjAwNjBjMWE0YTI0JTIyJTJDJTIyaXNTYW1lU2l0ZU5vbmVDb21wYXRpYmxlJTIyJTNBdHJ1ZSUyQyUyMmlzSURQVGVzdCUyMiUzQWZhbHNlJTJDJTIyaXNSZWZyZXNoJTIyJTNBZmFsc2UlMkMlMjJub25jZSUyMiUzQSUyMm5BcWY1eGVLZzE3eWJLR09wJTIyJTJDJTIyaWRwSWQlMjIlM0ElMjI0NTI5YzBiNS04ZGYwLTQ1ZjktYjUyZi1jMjVjMWM2ZWQ4ZGElMjIlMkMlMjJzZXJ2aWNlX3Rva2VuX2lkJTIyJTNBJTIyJTIyJTJDJTIyc2VydmljZV90b2tlbl9zdGF0dXMlMjIlM0FmYWxzZSUyQyUyMmF1...	HTTP Parser: Iframe src: https://login.okta.com/discovery/iframe.html

HTTP Parser: No favicon

Source: https://flywire.okta.com/oauth2/v1/authorize?client_id=0oam8v0n7en8Yj7ON0x7&redirect_uri=https%3A%2F%2Fflywire.cloudflareaccess.com%2Fcdn-cgi%2Faccess%2Fcallback&response_type=code&scope=openid%20groups%20profile%20email&state=19b80ec91e7d08e7bf25bee8b40416b0206bd1199e66bd0afb080829a4ae4c0b.JTdCJTIyaWF0JTIyJTNBMTcyODcyOTQwNSUyQyUyMmF1dGhEb21haW4lMjIlM0ElMjJmbHl3aXJlLmNsb3VkZmxhcmVhY2Nlc3MuY29tJTIyJTJDJTIyaG9zdG5hbWUlMjIlM0ElMjJqaXJhLmZseXdpcmUudGVjaCUyMiUyQyUyMnJlZGlyZWN0VVJMJTIyJTNBJTIyJTJGcGx1Z2lucyUyRnNlcnZsZXQlMkZkZXNrJTJGcG9ydGFsJTJGMzQlMjIlMkMlMjJhdWQlMjIlM0ElMjI3MTZjMTYyOGRiMDU2ODNjYTNiYzRlNDY3OTdkMzQ0YmQ3M2Q4ZTE1MjZjODE5OWQ2NGRlZjAwNjBjMWE0YTI0JTIyJTJDJTIyaXNTYW1lU2l0ZU5vbmVDb21wYXRpYmxlJTIyJTNBdHJ1ZSUyQyUyMmlzSURQVGVzdCUyMiUzQWZhbHNlJTJDJTIyaXNSZWZyZXNoJTIyJTNBZmFsc2UlMkMlMjJub25jZSUyMiUzQSUyMm5BcWY1eGVLZzE3eWJLR09wJTIyJTJDJTIyaWRwSWQlMjIlM0ElMjI0NTI5YzBiNS04ZGYwLTQ1ZjktYjUyZi1jMjVjMWM2ZWQ4ZGElMjIlMkMlMjJzZXJ2aWNlX3Rva2VuX2lkJTIyJTNBJTIyJTIyJTJDJTIyc2VydmljZV90b2tlbl9zdGF0dXMlMjIlM0FmYWxzZSUyQyUyMmF1	HTTP Parser: No <meta name="author".. found
Source: https://flywire.okta.com/oauth2/v1/authorize?client_id=0oam8v0n7en8Yj7ON0x7&redirect_uri=https%3A%2F%2Fflywire.cloudflareaccess.com%2Fcdn-cgi%2Faccess%2Fcallback&response_type=code&scope=openid%20groups%20profile%20email&state=19b80ec91e7d08e7bf25bee8b40416b0206bd1199e66bd0afb080829a4ae4c0b.JTdCJTIyaWF0JTIyJTNBMTcyODcyOTQwNSUyQyUyMmF1dGhEb21haW4lMjIlM0ElMjJmbHl3aXJlLmNsb3VkZmxhcmVhY2Nlc3MuY29tJTIyJTJDJTIyaG9zdG5hbWUlMjIlM0ElMjJqaXJhLmZseXdpcmUudGVjaCUyMiUyQyUyMnJlZGlyZWN0VVJMJTIyJTNBJTIyJTJGcGx1Z2lucyUyRnNlcnZsZXQlMkZkZXNrJTJGcG9ydGFsJTJGMzQlMjIlMkMlMjJhdWQlMjIlM0ElMjI3MTZjMTYyOGRiMDU2ODNjYTNiYzRlNDY3OTdkMzQ0YmQ3M2Q4ZTE1MjZjODE5OWQ2NGRlZjAwNjBjMWE0YTI0JTIyJTJDJTIyaXNTYW1lU2l0ZU5vbmVDb21wYXRpYmxlJTIyJTNBdHJ1ZSUyQyUyMmlzSURQVGVzdCUyMiUzQWZhbHNlJTJDJTIyaXNSZWZyZXNoJTIyJTNBZmFsc2UlMkMlMjJub25jZSUyMiUzQSUyMm5BcWY1eGVLZzE3eWJLR09wJTIyJTJDJTIyaWRwSWQlMjIlM0ElMjI0NTI5YzBiNS04ZGYwLTQ1ZjktYjUyZi1jMjVjMWM2ZWQ4ZGElMjIlMkMlMjJzZXJ2aWNlX3Rva2VuX2lkJTIyJTNBJTIyJTIyJTJDJTIyc2VydmljZV90b2tlbl9zdGF0dXMlMjIlM0FmYWxzZSUyQyUyMmF1	HTTP Parser: No <meta name="author".. found
Source: https://flywire.okta.com/oauth2/v1/authorize?client_id=0oam8v0n7en8Yj7ON0x7&redirect_uri=https%3A%2F%2Fflywire.cloudflareaccess.com%2Fcdn-cgi%2Faccess%2Fcallback&response_type=code&scope=openid%20groups%20profile%20email&state=19b80ec91e7d08e7bf25bee8b40416b0206bd1199e66bd0afb080829a4ae4c0b.JTdCJTIyaWF0JTIyJTNBMTcyODcyOTQwNSUyQyUyMmF1dGhEb21haW4lMjIlM0ElMjJmbHl3aXJlLmNsb3VkZmxhcmVhY2Nlc3MuY29tJTIyJTJDJTIyaG9zdG5hbWUlMjIlM0ElMjJqaXJhLmZseXdpcmUudGVjaCUyMiUyQyUyMnJlZGlyZWN0VVJMJTIyJTNBJTIyJTJGcGx1Z2lucyUyRnNlcnZsZXQlMkZkZXNrJTJGcG9ydGFsJTJGMzQlMjIlMkMlMjJhdWQlMjIlM0ElMjI3MTZjMTYyOGRiMDU2ODNjYTNiYzRlNDY3OTdkMzQ0YmQ3M2Q4ZTE1MjZjODE5OWQ2NGRlZjAwNjBjMWE0YTI0JTIyJTJDJTIyaXNTYW1lU2l0ZU5vbmVDb21wYXRpYmxlJTIyJTNBdHJ1ZSUyQyUyMmlzSURQVGVzdCUyMiUzQWZhbHNlJTJDJTIyaXNSZWZyZXNoJTIyJTNBZmFsc2UlMkMlMjJub25jZSUyMiUzQSUyMm5BcWY1eGVLZzE3eWJLR09wJTIyJTJDJTIyaWRwSWQlMjIlM0ElMjI0NTI5YzBiNS04ZGYwLTQ1ZjktYjUyZi1jMjVjMWM2ZWQ4ZGElMjIlMkMlMjJzZXJ2aWNlX3Rva2VuX2lkJTIyJTNBJTIyJTIyJTJDJTIyc2VydmljZV90b2tlbl9zdGF0dXMlMjIlM0FmYWxzZSUyQyUyMmF1	HTTP Parser: No <meta name="author".. found
Source: https://flywire.okta.com/oauth2/v1/authorize?client_id=0oam8v0n7en8Yj7ON0x7&redirect_uri=https%3A%2F%2Fflywire.cloudflareaccess.com%2Fcdn-cgi%2Faccess%2Fcallback&response_type=code&scope=openid%20groups%20profile%20email&state=19b80ec91e7d08e7bf25bee8b40416b0206bd1199e66bd0afb080829a4ae4c0b.JTdCJTIyaWF0JTIyJTNBMTcyODcyOTQwNSUyQyUyMmF1dGhEb21haW4lMjIlM0ElMjJmbHl3aXJlLmNsb3VkZmxhcmVhY2Nlc3MuY29tJTIyJTJDJTIyaG9zdG5hbWUlMjIlM0ElMjJqaXJhLmZseXdpcmUudGVjaCUyMiUyQyUyMnJlZGlyZWN0VVJMJTIyJTNBJTIyJTJGcGx1Z2lucyUyRnNlcnZsZXQlMkZkZXNrJTJGcG9ydGFsJTJGMzQlMjIlMkMlMjJhdWQlMjIlM0ElMjI3MTZjMTYyOGRiMDU2ODNjYTNiYzRlNDY3OTdkMzQ0YmQ3M2Q4ZTE1MjZjODE5OWQ2NGRlZjAwNjBjMWE0YTI0JTIyJTJDJTIyaXNTYW1lU2l0ZU5vbmVDb21wYXRpYmxlJTIyJTNBdHJ1ZSUyQyUyMmlzSURQVGVzdCUyMiUzQWZhbHNlJTJDJTIyaXNSZWZyZXNoJTIyJTNBZmFsc2UlMkMlMjJub25jZSUyMiUzQSUyMm5BcWY1eGVLZzE3eWJLR09wJTIyJTJDJTIyaWRwSWQlMjIlM0ElMjI0NTI5YzBiNS04ZGYwLTQ1ZjktYjUyZi1jMjVjMWM2ZWQ4ZGElMjIlMkMlMjJzZXJ2aWNlX3Rva2VuX2lkJTIyJTNBJTIyJTIyJTJDJTIyc2VydmljZV90b2tlbl9zdGF0dXMlMjIlM0FmYWxzZSUyQyUyMmF1	HTTP Parser: No <meta name="author".. found
Source: https://flywire.okta.com/oauth2/v1/authorize?client_id=0oam8v0n7en8Yj7ON0x7&redirect_uri=https%3A%2F%2Fflywire.cloudflareaccess.com%2Fcdn-cgi%2Faccess%2Fcallback&response_type=code&scope=openid%20groups%20profile%20email&state=19b80ec91e7d08e7bf25bee8b40416b0206bd1199e66bd0afb080829a4ae4c0b.JTdCJTIyaWF0JTIyJTNBMTcyODcyOTQwNSUyQyUyMmF1dGhEb21haW4lMjIlM0ElMjJmbHl3aXJlLmNsb3VkZmxhcmVhY2Nlc3MuY29tJTIyJTJDJTIyaG9zdG5hbWUlMjIlM0ElMjJqaXJhLmZseXdpcmUudGVjaCUyMiUyQyUyMnJlZGlyZWN0VVJMJTIyJTNBJTIyJTJGcGx1Z2lucyUyRnNlcnZsZXQlMkZkZXNrJTJGcG9ydGFsJTJGMzQlMjIlMkMlMjJhdWQlMjIlM0ElMjI3MTZjMTYyOGRiMDU2ODNjYTNiYzRlNDY3OTdkMzQ0YmQ3M2Q4ZTE1MjZjODE5OWQ2NGRlZjAwNjBjMWE0YTI0JTIyJTJDJTIyaXNTYW1lU2l0ZU5vbmVDb21wYXRpYmxlJTIyJTNBdHJ1ZSUyQyUyMmlzSURQVGVzdCUyMiUzQWZhbHNlJTJDJTIyaXNSZWZyZXNoJTIyJTNBZmFsc2UlMkMlMjJub25jZSUyMiUzQSUyMm5BcWY1eGVLZzE3eWJLR09wJTIyJTJDJTIyaWRwSWQlMjIlM0ElMjI0NTI5YzBiNS04ZGYwLTQ1ZjktYjUyZi1jMjVjMWM2ZWQ4ZGElMjIlMkMlMjJzZXJ2aWNlX3Rva2VuX2lkJTIyJTNBJTIyJTIyJTJDJTIyc2VydmljZV90b2tlbl9zdGF0dXMlMjIlM0FmYWxzZSUyQyUyMmF1	HTTP Parser: No <meta name="author".. found

Source: https://flywire.okta.com/oauth2/v1/authorize?client_id=0oam8v0n7en8Yj7ON0x7&redirect_uri=https%3A%2F%2Fflywire.cloudflareaccess.com%2Fcdn-cgi%2Faccess%2Fcallback&response_type=code&scope=openid%20groups%20profile%20email&state=19b80ec91e7d08e7bf25bee8b40416b0206bd1199e66bd0afb080829a4ae4c0b.JTdCJTIyaWF0JTIyJTNBMTcyODcyOTQwNSUyQyUyMmF1dGhEb21haW4lMjIlM0ElMjJmbHl3aXJlLmNsb3VkZmxhcmVhY2Nlc3MuY29tJTIyJTJDJTIyaG9zdG5hbWUlMjIlM0ElMjJqaXJhLmZseXdpcmUudGVjaCUyMiUyQyUyMnJlZGlyZWN0VVJMJTIyJTNBJTIyJTJGcGx1Z2lucyUyRnNlcnZsZXQlMkZkZXNrJTJGcG9ydGFsJTJGMzQlMjIlMkMlMjJhdWQlMjIlM0ElMjI3MTZjMTYyOGRiMDU2ODNjYTNiYzRlNDY3OTdkMzQ0YmQ3M2Q4ZTE1MjZjODE5OWQ2NGRlZjAwNjBjMWE0YTI0JTIyJTJDJTIyaXNTYW1lU2l0ZU5vbmVDb21wYXRpYmxlJTIyJTNBdHJ1ZSUyQyUyMmlzSURQVGVzdCUyMiUzQWZhbHNlJTJDJTIyaXNSZWZyZXNoJTIyJTNBZmFsc2UlMkMlMjJub25jZSUyMiUzQSUyMm5BcWY1eGVLZzE3eWJLR09wJTIyJTJDJTIyaWRwSWQlMjIlM0ElMjI0NTI5YzBiNS04ZGYwLTQ1ZjktYjUyZi1jMjVjMWM2ZWQ4ZGElMjIlMkMlMjJzZXJ2aWNlX3Rva2VuX2lkJTIyJTNBJTIyJTIyJTJDJTIyc2VydmljZV90b2tlbl9zdGF0dXMlMjIlM0FmYWxzZSUyQyUyMmF1...	HTTP Parser: No <meta name="copyright".. found
Source: https://flywire.okta.com/oauth2/v1/authorize?client_id=0oam8v0n7en8Yj7ON0x7&redirect_uri=https%3A%2F%2Fflywire.cloudflareaccess.com%2Fcdn-cgi%2Faccess%2Fcallback&response_type=code&scope=openid%20groups%20profile%20email&state=19b80ec91e7d08e7bf25bee8b40416b0206bd1199e66bd0afb080829a4ae4c0b.JTdCJTIyaWF0JTIyJTNBMTcyODcyOTQwNSUyQyUyMmF1dGhEb21haW4lMjIlM0ElMjJmbHl3aXJlLmNsb3VkZmxhcmVhY2Nlc3MuY29tJTIyJTJDJTIyaG9zdG5hbWUlMjIlM0ElMjJqaXJhLmZseXdpcmUudGVjaCUyMiUyQyUyMnJlZGlyZWN0VVJMJTIyJTNBJTIyJTJGcGx1Z2lucyUyRnNlcnZsZXQlMkZkZXNrJTJGcG9ydGFsJTJGMzQlMjIlMkMlMjJhdWQlMjIlM0ElMjI3MTZjMTYyOGRiMDU2ODNjYTNiYzRlNDY3OTdkMzQ0YmQ3M2Q4ZTE1MjZjODE5OWQ2NGRlZjAwNjBjMWE0YTI0JTIyJTJDJTIyaXNTYW1lU2l0ZU5vbmVDb21wYXRpYmxlJTIyJTNBdHJ1ZSUyQyUyMmlzSURQVGVzdCUyMiUzQWZhbHNlJTJDJTIyaXNSZWZyZXNoJTIyJTNBZmFsc2UlMkMlMjJub25jZSUyMiUzQSUyMm5BcWY1eGVLZzE3eWJLR09wJTIyJTJDJTIyaWRwSWQlMjIlM0ElMjI0NTI5YzBiNS04ZGYwLTQ1ZjktYjUyZi1jMjVjMWM2ZWQ4ZGElMjIlMkMlMjJzZXJ2aWNlX3Rva2VuX2lkJTIyJTNBJTIyJTIyJTJDJTIyc2VydmljZV90b2tlbl9zdGF0dXMlMjIlM0FmYWxzZSUyQyUyMmF1...	HTTP Parser: No <meta name="copyright".. found
Source: https://flywire.okta.com/oauth2/v1/authorize?client_id=0oam8v0n7en8Yj7ON0x7&redirect_uri=https%3A%2F%2Fflywire.cloudflareaccess.com%2Fcdn-cgi%2Faccess%2Fcallback&response_type=code&scope=openid%20groups%20profile%20email&state=19b80ec91e7d08e7bf25bee8b40416b0206bd1199e66bd0afb080829a4ae4c0b.JTdCJTIyaWF0JTIyJTNBMTcyODcyOTQwNSUyQyUyMmF1dGhEb21haW4lMjIlM0ElMjJmbHl3aXJlLmNsb3VkZmxhcmVhY2Nlc3MuY29tJTIyJTJDJTIyaG9zdG5hbWUlMjIlM0ElMjJqaXJhLmZseXdpcmUudGVjaCUyMiUyQyUyMnJlZGlyZWN0VVJMJTIyJTNBJTIyJTJGcGx1Z2lucyUyRnNlcnZsZXQlMkZkZXNrJTJGcG9ydGFsJTJGMzQlMjIlMkMlMjJhdWQlMjIlM0ElMjI3MTZjMTYyOGRiMDU2ODNjYTNiYzRlNDY3OTdkMzQ0YmQ3M2Q4ZTE1MjZjODE5OWQ2NGRlZjAwNjBjMWE0YTI0JTIyJTJDJTIyaXNTYW1lU2l0ZU5vbmVDb21wYXRpYmxlJTIyJTNBdHJ1ZSUyQyUyMmlzSURQVGVzdCUyMiUzQWZhbHNlJTJDJTIyaXNSZWZyZXNoJTIyJTNBZmFsc2UlMkMlMjJub25jZSUyMiUzQSUyMm5BcWY1eGVLZzE3eWJLR09wJTIyJTJDJTIyaWRwSWQlMjIlM0ElMjI0NTI5YzBiNS04ZGYwLTQ1ZjktYjUyZi1jMjVjMWM2ZWQ4ZGElMjIlMkMlMjJzZXJ2aWNlX3Rva2VuX2lkJTIyJTNBJTIyJTIyJTJDJTIyc2VydmljZV90b2tlbl9zdGF0dXMlMjIlM0FmYWxzZSUyQyUyMmF1...	HTTP Parser: No <meta name="copyright".. found
Source: https://flywire.okta.com/oauth2/v1/authorize?client_id=0oam8v0n7en8Yj7ON0x7&redirect_uri=https%3A%2F%2Fflywire.cloudflareaccess.com%2Fcdn-cgi%2Faccess%2Fcallback&response_type=code&scope=openid%20groups%20profile%20email&state=19b80ec91e7d08e7bf25bee8b40416b0206bd1199e66bd0afb080829a4ae4c0b.JTdCJTIyaWF0JTIyJTNBMTcyODcyOTQwNSUyQyUyMmF1dGhEb21haW4lMjIlM0ElMjJmbHl3aXJlLmNsb3VkZmxhcmVhY2Nlc3MuY29tJTIyJTJDJTIyaG9zdG5hbWUlMjIlM0ElMjJqaXJhLmZseXdpcmUudGVjaCUyMiUyQyUyMnJlZGlyZWN0VVJMJTIyJTNBJTIyJTJGcGx1Z2lucyUyRnNlcnZsZXQlMkZkZXNrJTJGcG9ydGFsJTJGMzQlMjIlMkMlMjJhdWQlMjIlM0ElMjI3MTZjMTYyOGRiMDU2ODNjYTNiYzRlNDY3OTdkMzQ0YmQ3M2Q4ZTE1MjZjODE5OWQ2NGRlZjAwNjBjMWE0YTI0JTIyJTJDJTIyaXNTYW1lU2l0ZU5vbmVDb21wYXRpYmxlJTIyJTNBdHJ1ZSUyQyUyMmlzSURQVGVzdCUyMiUzQWZhbHNlJTJDJTIyaXNSZWZyZXNoJTIyJTNBZmFsc2UlMkMlMjJub25jZSUyMiUzQSUyMm5BcWY1eGVLZzE3eWJLR09wJTIyJTJDJTIyaWRwSWQlMjIlM0ElMjI0NTI5YzBiNS04ZGYwLTQ1ZjktYjUyZi1jMjVjMWM2ZWQ4ZGElMjIlMkMlMjJzZXJ2aWNlX3Rva2VuX2lkJTIyJTNBJTIyJTIyJTJDJTIyc2VydmljZV90b2tlbl9zdGF0dXMlMjIlM0FmYWxzZSUyQyUyMmF1...	HTTP Parser: No <meta name="copyright".. found
Source: https://flywire.okta.com/oauth2/v1/authorize?client_id=0oam8v0n7en8Yj7ON0x7&redirect_uri=https%3A%2F%2Fflywire.cloudflareaccess.com%2Fcdn-cgi%2Faccess%2Fcallback&response_type=code&scope=openid%20groups%20profile%20email&state=19b80ec91e7d08e7bf25bee8b40416b0206bd1199e66bd0afb080829a4ae4c0b.JTdCJTIyaWF0JTIyJTNBMTcyODcyOTQwNSUyQyUyMmF1dGhEb21haW4lMjIlM0ElMjJmbHl3aXJlLmNsb3VkZmxhcmVhY2Nlc3MuY29tJTIyJTJDJTIyaG9zdG5hbWUlMjIlM0ElMjJqaXJhLmZseXdpcmUudGVjaCUyMiUyQyUyMnJlZGlyZWN0VVJMJTIyJTNBJTIyJTJGcGx1Z2lucyUyRnNlcnZsZXQlMkZkZXNrJTJGcG9ydGFsJTJGMzQlMjIlMkMlMjJhdWQlMjIlM0ElMjI3MTZjMTYyOGRiMDU2ODNjYTNiYzRlNDY3OTdkMzQ0YmQ3M2Q4ZTE1MjZjODE5OWQ2NGRlZjAwNjBjMWE0YTI0JTIyJTJDJTIyaXNTYW1lU2l0ZU5vbmVDb21wYXRpYmxlJTIyJTNBdHJ1ZSUyQyUyMmlzSURQVGVzdCUyMiUzQWZhbHNlJTJDJTIyaXNSZWZyZXNoJTIyJTNBZmFsc2UlMkMlMjJub25jZSUyMiUzQSUyMm5BcWY1eGVLZzE3eWJLR09wJTIyJTJDJTIyaWRwSWQlMjIlM0ElMjI0NTI5YzBiNS04ZGYwLTQ1ZjktYjUyZi1jMjVjMWM2ZWQ4ZGElMjIlMkMlMjJzZXJ2aWNlX3Rva2VuX2lkJTIyJTNBJTIyJTIyJTJDJTIyc2VydmljZV90b2tlbl9zdGF0dXMlMjIlM0FmYWxzZSUyQyUyMmF1...	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49766 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56

Source: global traffic	DNS traffic detected: DNS query: jira.flywire.tech
Source: global traffic	DNS traffic detected: DNS query: flywire.cloudflareaccess.com
Source: global traffic	DNS traffic detected: DNS query: flywire.okta.com
Source: global traffic	DNS traffic detected: DNS query: ok2static.oktacdn.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: login.okta.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49766 version: TLS 1.2

Source: classification engine

Classification label: clean1.win@19/29@18/194

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1948,i,1210385584711832822,2850508338919820376,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://jira.flywire.tech/plugins/servlet/desk/portal/34"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1948,i,1210385584711832822,2850508338919820376,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.46	unknown	United States	15169	GOOGLEUS	false
18.245.86.88	d14fm7q9i1ewz3.cloudfront.net	United States	16509	AMAZON-02US	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
18.245.86.45	unknown	United States	16509	AMAZON-02US	false
99.83.213.230	a9fda6e8074f1dfbe.awsglobalaccelerator.com	United States	16509	AMAZON-02US	false
104.18.42.244	jira.flywire.tech	United States	13335	CLOUDFLARENETUS	false
216.58.206.67	unknown	United States	15169	GOOGLEUS	false
104.19.195.29	flywire.cloudflareaccess.com	United States	13335	CLOUDFLARENETUS	false
75.2.87.65	unknown	United States	16509	AMAZON-02US	false
216.58.206.46	unknown	United States	15169	GOOGLEUS	false
13.227.219.44	unknown	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.181.228	www.google.com	United States	15169	GOOGLEUS	false
142.250.186.42	unknown	United States	15169	GOOGLEUS	false
108.138.7.107	d37qf8t9pe6csu.cloudfront.net	United States	16509	AMAZON-02US	false
142.250.186.99	unknown	United States	15169	GOOGLEUS	false
66.102.1.84	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.16
127.0.0.1

Contacted Domains

Name	IP	Active
d14fm7q9i1ewz3.cloudfront.net	18.245.86.88	true
www.google.com	142.250.181.228	true
jira.flywire.tech	104.18.42.244	true
a9fda6e8074f1dfbe.awsglobalaccelerator.com	99.83.213.230	true
flywire.cloudflareaccess.com	104.19.195.29	true
d37qf8t9pe6csu.cloudfront.net	108.138.7.107	true
flywire.okta.com	unknown	unknown
ok2static.oktacdn.com	unknown	unknown
login.okta.com	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://flywire.okta.com/oauth2/v1/authorize?client_id=0oam8v0n7en8Yj7ON0x7&redirect_uri=https%3A%2F%2Fflywire.cloudflareaccess.com%2Fcdn-cgi%2Faccess%2Fcallback&response_type=code&scope=openid%20groups%20profile%20email&state=19b80ec91e7d08e7bf25bee8b40416b0206bd1199e66bd0afb080829a4ae4c0b.JTdCJTIyaWF0JTIyJTNBMTcyODcyOTQwNSUyQyUyMmF1dGhEb21haW4lMjIlM0ElMjJmbHl3aXJlLmNsb3VkZmxhcmVhY2Nlc3MuY29tJTIyJTJDJTIyaG9zdG5hbWUlMjIlM0ElMjJqaXJhLmZseXdpcmUudGVjaCUyMiUyQyUyMnJlZGlyZWN0VVJMJTIyJTNBJTIyJTJGcGx1Z2lucyUyRnNlcnZsZXQlMkZkZXNrJTJGcG9ydGFsJTJGMzQlMjIlMkMlMjJhdWQlMjIlM0ElMjI3MTZjMTYyOGRiMDU2ODNjYTNiYzRlNDY3OTdkMzQ0YmQ3M2Q4ZTE1MjZjODE5OWQ2NGRlZjAwNjBjMWE0YTI0JTIyJTJDJTIyaXNTYW1lU2l0ZU5vbmVDb21wYXRpYmxlJTIyJTNBdHJ1ZSUyQyUyMmlzSURQVGVzdCUyMiUzQWZhbHNlJTJDJTIyaXNSZWZyZXNoJTIyJTNBZmFsc2UlMkMlMjJub25jZSUyMiUzQSUyMm5BcWY1eGVLZzE3eWJLR09wJTIyJTJDJTIyaWRwSWQlMjIlM0ElMjI0NTI5YzBiNS04ZGYwLTQ1ZjktYjUyZi1jMjVjMWM2ZWQ4ZGElMjIlMkMlMjJzZXJ2aWNlX3Rva2VuX2lkJTIyJTNBJTIyJTIyJTJDJTIyc2VydmljZV90b2tlbl9zdGF0dXMlMjIlM0FmYWxzZSUyQyUyMmF1dGhfc3RhdHVzJTIyJTNBJTIyTk9ORSUyMiUyQyUyMmlzX3dhcnAlMjIlM0FmYWxzZSUyQyUyMmlzX2dhdGV3YXklMjIlM0FmYWxzZSUyQyUyMm10bHNfYXV0aCUyMiUzQSU3QiUyMmNlcnRfaXNzdWVyX3NraSUyMiUzQSUyMiUyMiUyQyUyMmNlcnRfcHJlc2VudGVkJTIyJTNBZmFsc2UlMkMlMjJjZXJ0X3NlcmlhbCUyMiUzQSUyMiUyMiUyQyUyMmNlcnRfaXNzdWVyX2RuJTIyJTNBJTIyJTIyJTJDJTIyYXV0aF9zdGF0dXMlMjIlM0ElMjJOT05FJTIyJTdEJTJDJTIyYXBwU2Vzc2lvbkhhc2glMjIlM0ElMjIzMmYwN2UxZTY1ZmQ1ZTFkMDgxMjQyNDMyZWQ1MWJiOWMwYjE0OWJkN2Q2YTE5MWJlYTcyNDQ5ZWU3MzQwMjI1JTIyJTdE	false		unknown

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Oct 12 09:36:44 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	0ABE995281A99E25B11FABA35D44E804	1698A248A74F6CADA4B82BB9076F8A944D800C96	CC8EDC470B90FE2244CABC497D97B46F0D6D14930CD182CBE3E7502A2842A423
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Oct 12 09:36:44 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	5748E5759E6A4D6FF72472E1E20D4923	9EB4122DE04CF8C3078DEDCB333C765EC8D9E8D8	B0825E4D0BBB625E229B5049290AD9B52F7EF9C7255C7D0648EC2E7E2C40D148
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	4090B49E32BE8A1D9233ACFEC68D08E3	9D7FE5952896E28DA7B6DAAC3912260984C487DA	453875BFEC2496D6494A7EFD0265CA66F66E561A592A10DE2AE675AE0CAB17E4
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Oct 12 09:36:44 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	4ECDD6B81E023C7659CD1D4191E72672	64CA889B257847581D5FBF97B55B61B5E8A09CCC	DB7A27EF854B684BEA07C8E05EF67506BC2C800397969F8D99B3C77496BCCEDF
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Oct 12 09:36:44 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	FD0F1E3A5BD24CCF568DE3EDE94AE11C	53A30383973012B4132822817EAAC69984BFBDA9	B2C6E6F4B2647C32A2640F8B7317173601D114ED1003D2895D782AA698E3D7EA
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Oct 12 09:36:44 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	91E9E37E700BA6A9672A4DB74BED2BBE	BCEBD3105338E8BC252003191379DB6A483AB0B0	678CBC558715DA0AFFB129F205D26B8369137711ED487CD003A02094DF15B283
Chrome Cache Entry: 103	Web Open Font Format (Version 2), CFF, length 42632, version 2.0	F37DD71E272C2E2A491B7F3E0BC3BC3B	74824DA964C79C9ACFB73D1F9501F6D2EEEB4373	419A069F2859715998EC2BEDA0659052F7E22469385CC25011C7ECBB97266719
Chrome Cache Entry: 72	Web Open Font Format (Version 2), TrueType, length 105804, version 1.0	007AD31A53F4AB3F58EE74F2308482CE	DFA9F8F3D79BF8A0001FE72EEADAD0490CBA59CC	152261291C938AA5AAD6A56D52B47FFCB893D1C0387E76D7F270A7382FF786D5
Chrome Cache Entry: 73	ASCII text, with very long lines (65460)	58DE3BE0C9B511A0FDFD7EA4F69B56FC	91ECA02ABF11239EC4AF7A30B1DA6E2610F1B9A6	6A6C595FCF3A6C74BF3509F160BA34B78A8A3EB92ECAF290412C46679576D3ED
Chrome Cache Entry: 74	JSON data	9B5CAF508170B020E11DA9528023459C	7C3D1EE333D184A7646D9D3723D6DAE4C46F74B7	4EB21A668EDCFD315D050B3E5677297D5C5A776DE5CDA5AB8A54937E02C00BE7
Chrome Cache Entry: 75	HTML document, Unicode text, UTF-8 text, with very long lines (7540)	E3B76749F779669D8EB94520342F0E57	883349AE6E1E15F0882F0D8B22FFD6222ADC1369	D79F63ECB520B57E351498CA71C9FD98A0F25B106592EE35E4717D28360431C9
Chrome Cache Entry: 76	ASCII text, with very long lines (51741)	CC9B6AFB7DEC5AB168AD8D9335378D66	42552ED2802032AE710EBD409AD23207BE6C3929	E35E1D03FB9B7417FC605B85E7A9EF1BAA9822BC6E6191E9E28F95E80ECBAF13
Chrome Cache Entry: 80	Unicode text, UTF-8 text, with very long lines (49026), with LF, NEL line terminators	611785C1E632D8744CBC829D0B832AF3	21F2AB2996DA4CBA76AEE72571740A6165FC908C	2E5A8B1383B348C8EAB64B46D2890F57B958AC730ECA10E0A541546D1E0EC5F6
Chrome Cache Entry: 81	Web Open Font Format, CFF, length 20600, version 1.0	DB28723126138387CDF40680E6E0FA5D	4D706297987D613A4E3F4F23D08C62D16830845D	7ECCBB3B4B68F9F24A3B826F2EEA4A1BBB48196CB734AFC1B62C3D045CB680E1
Chrome Cache Entry: 82	GIF image data, version 89a, 38 x 38	DA5AFED58D4A7AB9E44A16EE5387707B	CE2BAC88D718F974ADD007D55EF0E9314D0F4B61	2D0840961E9D93F813811D90C3ED7537149172E1BB0FA92762AB0E0A72AF054F
Chrome Cache Entry: 83	MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel	449C9DD651DB589388B721EB2496F5B0	64F3B213A89A00F7B0940271576ECC72280236F7	F9E86FB363A05F75AB3B525439D46BF4911D4CD4AE94C656C0198206374002AA
Chrome Cache Entry: 84	PNG image data, 362 x 120, 8-bit/color RGBA, non-interlaced	69FE4B63FCB5691B5FD0CA1A3CE7FB1A	481AF09D2403556B82CB402B7FE81B3C85BFD95B	973B46EC32BEB678E1FDB117601586EC8F1E301B1ACD88BFB7FF814B3711B133
Chrome Cache Entry: 85	Web Open Font Format (Version 2), TrueType, length 98868, version 1.0	DC131113894217B5031000575D9DE002	F96348260751EA78B1D23E9557DB297290BDAF28	D612F1212B452AF07F1A5DEFB2B672E76A91F7139E7499FA48BB9B2B985C22D6
Chrome Cache Entry: 86	JSON data	1B4CB0804DA2F7CFF6802F99A7A8C40F	52E8DAB8C35A70DB96523AEE9D116F81092933E0	0D14D3BB968BBFC9E70BB420E281AC6B7B944B826BAB2872178706A0CE4A5690
Chrome Cache Entry: 87	ASCII text, with very long lines (65460)	FDBF33124BE836560D8594251E6FA560	C996E5D037DFC0317CFD5590E465314D08FA0F47	CA7A7FB99CA375503E8978455C37F2D2CD36F0438BE9AF2BF5682B890270241C
Chrome Cache Entry: 88	ASCII text, with very long lines (40099)	F42FD819BE9C8CE10EC67481A1EF6CFC	9B68A71F87F8D9C537F39E668840507D13D87435	F60800D5114EB72B305133A3CCB5A441B12DAFFB5F166DFBCC5CF028283D0B97
Chrome Cache Entry: 90	ASCII text, with no line terminators	67917D37C3BA446E4238BC4234D57A0D	2DE3B18B0E76E3ACF380A582613FBEA21FB280B3	C14E1187B04C0980E5CF3514598D0C74A73D5602BF78F963DAFB1F82DF34A73D
Chrome Cache Entry: 91	PNG image data, 420 x 144, 8-bit/color RGBA, non-interlaced	813AF8FC3F88F62D4FD2BB7ADA7C693C	90F5AD33EB828E67FC5AD4697F7E4995791B8A76	8FAA87F02CA5FEA16808EA790ABA67C5957194A1FB98A52E706AD578CB10779D
Chrome Cache Entry: 92	ASCII text	9C015B709AE7678A8083966012F6CFC9	187C8EE9F8A0ED1168C90686EED591E41736A055	3ED7F33549C25F8DE6559B0E495BA63576F126FAFF3BA16B64E04378050E04D6
Chrome Cache Entry: 93	PNG image data, 50 x 1155, 8-bit/color RGBA, non-interlaced	7846B2F8C6D0A7CA69FDD3D3C294E92D	E0BB021FFDF93C68FEF44DE2A3B08F378B6FB50A	40810B0318131F9BA52C83A17E633A0AC476ADE66EA8A914D6C4980571397665
Chrome Cache Entry: 94	HTML document, ASCII text, with very long lines (451), with no line terminators	B2B86038BC19F36D4E1A0024A848C529	1F711BE55C288CA97852B189A5613E53EB93EEFB	925EC88AEC5EDB50CDF38D58E2DDD6D7E23D3F73391C0407EF50879C123AE330
Chrome Cache Entry: 95	PNG image data, 140 x 140, 8-bit/color RGBA, non-interlaced	8146A7091EDA20534F86CEADFB34A1FA	C429E1305E5DFF0F7CB60B5E9DC3420A58B5E9B0	D434B33B7D0382D89CD488DD964F27E395EB03CF34B51D822D45912D96E75C64
Chrome Cache Entry: 98	ASCII text, with very long lines (7276)	C8C15F6857642C257BCD94823D968BB1	9BCC52E2F521518405982468701A635FAC1AEF72	A9966A22000716A17F6A350B2D200E6638F3CB672021E57976CEE906CACAB021
Chrome Cache Entry: 99	PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced	0BCDCA59E2F615E121CBAD5CF1435E5E	25DD4359C0FB3C3D9B9624C38DAEED444B9314B5	F0A0CB86C3A462478B9603CF8B18042BADE83EBACE885BC2FC7D99FDDDE98138

HTML body contains low number of good links

HTTP Parser: Number of links: 1

HTML page contains hidden javascript code

Source: https://flywire.okta.com/oauth2/v1/authorize?client_id=0oam8v0n7en8Yj7ON0x7&redirect_uri=https%3A%2F%2Fflywire.cloudflareaccess.com%2Fcdn-cgi%2Faccess%2Fcallback&response_type=code&scope=openid%20groups%20profile%20email&state=19b80ec91e7d08e7bf25bee8b40416b0206bd1199e66bd0afb080829a4ae4c0b.JTdCJTIyaWF0JTIyJTNBMTcyODcyOTQwNSUyQyUyMmF1dGhEb21haW4lMjIlM0ElMjJmbHl3aXJlLmNsb3VkZmxhcmVhY2Nlc3MuY29tJTIyJTJDJTIyaG9zdG5hbWUlMjIlM0ElMjJqaXJhLmZseXdpcmUudGVjaCUyMiUyQyUyMnJlZGlyZWN0VVJMJTIyJTNBJTIyJTJGcGx1Z2lucyUyRnNlcnZsZXQlMkZkZXNrJTJGcG9ydGFsJTJGMzQlMjIlMkMlMjJhdWQlMjIlM0ElMjI3MTZjMTYyOGRiMDU2ODNjYTNiYzRlNDY3OTdkMzQ0YmQ3M2Q4ZTE1MjZjODE5OWQ2NGRlZjAwNjBjMWE0YTI0JTIyJTJDJTIyaXNTYW1lU2l0ZU5vbmVDb21wYXRpYmxlJTIyJTNBdHJ1ZSUyQyUyMmlzSURQVGVzdCUyMiUzQWZhbHNlJTJDJTIyaXNSZWZyZXNoJTIyJTNBZmFsc2UlMkMlMjJub25jZSUyMiUzQSUyMm5BcWY1eGVLZzE3eWJLR09wJTIyJTJDJTIyaWRwSWQlMjIlM0ElMjI0NTI5YzBiNS04ZGYwLTQ1ZjktYjUyZi1jMjVjMWM2ZWQ4ZGElMjIlMkMlMjJzZXJ2aWNlX3Rva2VuX2lkJTIyJTNBJTIyJTIyJTJDJTIyc2VydmljZV90b2tlbl9zdGF0dXMlMjIlM0FmYWxzZSUyQyUyMmF1...	HTTP Parser: Iframe src: https://login.okta.com/discovery/iframe.html
Source: https://flywire.okta.com/oauth2/v1/authorize?client_id=0oam8v0n7en8Yj7ON0x7&redirect_uri=https%3A%2F%2Fflywire.cloudflareaccess.com%2Fcdn-cgi%2Faccess%2Fcallback&response_type=code&scope=openid%20groups%20profile%20email&state=19b80ec91e7d08e7bf25bee8b40416b0206bd1199e66bd0afb080829a4ae4c0b.JTdCJTIyaWF0JTIyJTNBMTcyODcyOTQwNSUyQyUyMmF1dGhEb21haW4lMjIlM0ElMjJmbHl3aXJlLmNsb3VkZmxhcmVhY2Nlc3MuY29tJTIyJTJDJTIyaG9zdG5hbWUlMjIlM0ElMjJqaXJhLmZseXdpcmUudGVjaCUyMiUyQyUyMnJlZGlyZWN0VVJMJTIyJTNBJTIyJTJGcGx1Z2lucyUyRnNlcnZsZXQlMkZkZXNrJTJGcG9ydGFsJTJGMzQlMjIlMkMlMjJhdWQlMjIlM0ElMjI3MTZjMTYyOGRiMDU2ODNjYTNiYzRlNDY3OTdkMzQ0YmQ3M2Q4ZTE1MjZjODE5OWQ2NGRlZjAwNjBjMWE0YTI0JTIyJTJDJTIyaXNTYW1lU2l0ZU5vbmVDb21wYXRpYmxlJTIyJTNBdHJ1ZSUyQyUyMmlzSURQVGVzdCUyMiUzQWZhbHNlJTJDJTIyaXNSZWZyZXNoJTIyJTNBZmFsc2UlMkMlMjJub25jZSUyMiUzQSUyMm5BcWY1eGVLZzE3eWJLR09wJTIyJTJDJTIyaWRwSWQlMjIlM0ElMjI0NTI5YzBiNS04ZGYwLTQ1ZjktYjUyZi1jMjVjMWM2ZWQ4ZGElMjIlMkMlMjJzZXJ2aWNlX3Rva2VuX2lkJTIyJTNBJTIyJTIyJTJDJTIyc2VydmljZV90b2tlbl9zdGF0dXMlMjIlM0FmYWxzZSUyQyUyMmF1...	HTTP Parser: Iframe src: https://login.okta.com/discovery/iframe.html
Source: https://flywire.okta.com/oauth2/v1/authorize?client_id=0oam8v0n7en8Yj7ON0x7&redirect_uri=https%3A%2F%2Fflywire.cloudflareaccess.com%2Fcdn-cgi%2Faccess%2Fcallback&response_type=code&scope=openid%20groups%20profile%20email&state=19b80ec91e7d08e7bf25bee8b40416b0206bd1199e66bd0afb080829a4ae4c0b.JTdCJTIyaWF0JTIyJTNBMTcyODcyOTQwNSUyQyUyMmF1dGhEb21haW4lMjIlM0ElMjJmbHl3aXJlLmNsb3VkZmxhcmVhY2Nlc3MuY29tJTIyJTJDJTIyaG9zdG5hbWUlMjIlM0ElMjJqaXJhLmZseXdpcmUudGVjaCUyMiUyQyUyMnJlZGlyZWN0VVJMJTIyJTNBJTIyJTJGcGx1Z2lucyUyRnNlcnZsZXQlMkZkZXNrJTJGcG9ydGFsJTJGMzQlMjIlMkMlMjJhdWQlMjIlM0ElMjI3MTZjMTYyOGRiMDU2ODNjYTNiYzRlNDY3OTdkMzQ0YmQ3M2Q4ZTE1MjZjODE5OWQ2NGRlZjAwNjBjMWE0YTI0JTIyJTJDJTIyaXNTYW1lU2l0ZU5vbmVDb21wYXRpYmxlJTIyJTNBdHJ1ZSUyQyUyMmlzSURQVGVzdCUyMiUzQWZhbHNlJTJDJTIyaXNSZWZyZXNoJTIyJTNBZmFsc2UlMkMlMjJub25jZSUyMiUzQSUyMm5BcWY1eGVLZzE3eWJLR09wJTIyJTJDJTIyaWRwSWQlMjIlM0ElMjI0NTI5YzBiNS04ZGYwLTQ1ZjktYjUyZi1jMjVjMWM2ZWQ4ZGElMjIlMkMlMjJzZXJ2aWNlX3Rva2VuX2lkJTIyJTNBJTIyJTIyJTJDJTIyc2VydmljZV90b2tlbl9zdGF0dXMlMjIlM0FmYWxzZSUyQyUyMmF1...	HTTP Parser: Iframe src: https://login.okta.com/discovery/iframe.html

HTTP Parser: No favicon

Source: https://flywire.okta.com/oauth2/v1/authorize?client_id=0oam8v0n7en8Yj7ON0x7&redirect_uri=https%3A%2F%2Fflywire.cloudflareaccess.com%2Fcdn-cgi%2Faccess%2Fcallback&response_type=code&scope=openid%20groups%20profile%20email&state=19b80ec91e7d08e7bf25bee8b40416b0206bd1199e66bd0afb080829a4ae4c0b.JTdCJTIyaWF0JTIyJTNBMTcyODcyOTQwNSUyQyUyMmF1dGhEb21haW4lMjIlM0ElMjJmbHl3aXJlLmNsb3VkZmxhcmVhY2Nlc3MuY29tJTIyJTJDJTIyaG9zdG5hbWUlMjIlM0ElMjJqaXJhLmZseXdpcmUudGVjaCUyMiUyQyUyMnJlZGlyZWN0VVJMJTIyJTNBJTIyJTJGcGx1Z2lucyUyRnNlcnZsZXQlMkZkZXNrJTJGcG9ydGFsJTJGMzQlMjIlMkMlMjJhdWQlMjIlM0ElMjI3MTZjMTYyOGRiMDU2ODNjYTNiYzRlNDY3OTdkMzQ0YmQ3M2Q4ZTE1MjZjODE5OWQ2NGRlZjAwNjBjMWE0YTI0JTIyJTJDJTIyaXNTYW1lU2l0ZU5vbmVDb21wYXRpYmxlJTIyJTNBdHJ1ZSUyQyUyMmlzSURQVGVzdCUyMiUzQWZhbHNlJTJDJTIyaXNSZWZyZXNoJTIyJTNBZmFsc2UlMkMlMjJub25jZSUyMiUzQSUyMm5BcWY1eGVLZzE3eWJLR09wJTIyJTJDJTIyaWRwSWQlMjIlM0ElMjI0NTI5YzBiNS04ZGYwLTQ1ZjktYjUyZi1jMjVjMWM2ZWQ4ZGElMjIlMkMlMjJzZXJ2aWNlX3Rva2VuX2lkJTIyJTNBJTIyJTIyJTJDJTIyc2VydmljZV90b2tlbl9zdGF0dXMlMjIlM0FmYWxzZSUyQyUyMmF1	HTTP Parser: No <meta name="author".. found
Source: https://flywire.okta.com/oauth2/v1/authorize?client_id=0oam8v0n7en8Yj7ON0x7&redirect_uri=https%3A%2F%2Fflywire.cloudflareaccess.com%2Fcdn-cgi%2Faccess%2Fcallback&response_type=code&scope=openid%20groups%20profile%20email&state=19b80ec91e7d08e7bf25bee8b40416b0206bd1199e66bd0afb080829a4ae4c0b.JTdCJTIyaWF0JTIyJTNBMTcyODcyOTQwNSUyQyUyMmF1dGhEb21haW4lMjIlM0ElMjJmbHl3aXJlLmNsb3VkZmxhcmVhY2Nlc3MuY29tJTIyJTJDJTIyaG9zdG5hbWUlMjIlM0ElMjJqaXJhLmZseXdpcmUudGVjaCUyMiUyQyUyMnJlZGlyZWN0VVJMJTIyJTNBJTIyJTJGcGx1Z2lucyUyRnNlcnZsZXQlMkZkZXNrJTJGcG9ydGFsJTJGMzQlMjIlMkMlMjJhdWQlMjIlM0ElMjI3MTZjMTYyOGRiMDU2ODNjYTNiYzRlNDY3OTdkMzQ0YmQ3M2Q4ZTE1MjZjODE5OWQ2NGRlZjAwNjBjMWE0YTI0JTIyJTJDJTIyaXNTYW1lU2l0ZU5vbmVDb21wYXRpYmxlJTIyJTNBdHJ1ZSUyQyUyMmlzSURQVGVzdCUyMiUzQWZhbHNlJTJDJTIyaXNSZWZyZXNoJTIyJTNBZmFsc2UlMkMlMjJub25jZSUyMiUzQSUyMm5BcWY1eGVLZzE3eWJLR09wJTIyJTJDJTIyaWRwSWQlMjIlM0ElMjI0NTI5YzBiNS04ZGYwLTQ1ZjktYjUyZi1jMjVjMWM2ZWQ4ZGElMjIlMkMlMjJzZXJ2aWNlX3Rva2VuX2lkJTIyJTNBJTIyJTIyJTJDJTIyc2VydmljZV90b2tlbl9zdGF0dXMlMjIlM0FmYWxzZSUyQyUyMmF1	HTTP Parser: No <meta name="author".. found
Source: https://flywire.okta.com/oauth2/v1/authorize?client_id=0oam8v0n7en8Yj7ON0x7&redirect_uri=https%3A%2F%2Fflywire.cloudflareaccess.com%2Fcdn-cgi%2Faccess%2Fcallback&response_type=code&scope=openid%20groups%20profile%20email&state=19b80ec91e7d08e7bf25bee8b40416b0206bd1199e66bd0afb080829a4ae4c0b.JTdCJTIyaWF0JTIyJTNBMTcyODcyOTQwNSUyQyUyMmF1dGhEb21haW4lMjIlM0ElMjJmbHl3aXJlLmNsb3VkZmxhcmVhY2Nlc3MuY29tJTIyJTJDJTIyaG9zdG5hbWUlMjIlM0ElMjJqaXJhLmZseXdpcmUudGVjaCUyMiUyQyUyMnJlZGlyZWN0VVJMJTIyJTNBJTIyJTJGcGx1Z2lucyUyRnNlcnZsZXQlMkZkZXNrJTJGcG9ydGFsJTJGMzQlMjIlMkMlMjJhdWQlMjIlM0ElMjI3MTZjMTYyOGRiMDU2ODNjYTNiYzRlNDY3OTdkMzQ0YmQ3M2Q4ZTE1MjZjODE5OWQ2NGRlZjAwNjBjMWE0YTI0JTIyJTJDJTIyaXNTYW1lU2l0ZU5vbmVDb21wYXRpYmxlJTIyJTNBdHJ1ZSUyQyUyMmlzSURQVGVzdCUyMiUzQWZhbHNlJTJDJTIyaXNSZWZyZXNoJTIyJTNBZmFsc2UlMkMlMjJub25jZSUyMiUzQSUyMm5BcWY1eGVLZzE3eWJLR09wJTIyJTJDJTIyaWRwSWQlMjIlM0ElMjI0NTI5YzBiNS04ZGYwLTQ1ZjktYjUyZi1jMjVjMWM2ZWQ4ZGElMjIlMkMlMjJzZXJ2aWNlX3Rva2VuX2lkJTIyJTNBJTIyJTIyJTJDJTIyc2VydmljZV90b2tlbl9zdGF0dXMlMjIlM0FmYWxzZSUyQyUyMmF1	HTTP Parser: No <meta name="author".. found
Source: https://flywire.okta.com/oauth2/v1/authorize?client_id=0oam8v0n7en8Yj7ON0x7&redirect_uri=https%3A%2F%2Fflywire.cloudflareaccess.com%2Fcdn-cgi%2Faccess%2Fcallback&response_type=code&scope=openid%20groups%20profile%20email&state=19b80ec91e7d08e7bf25bee8b40416b0206bd1199e66bd0afb080829a4ae4c0b.JTdCJTIyaWF0JTIyJTNBMTcyODcyOTQwNSUyQyUyMmF1dGhEb21haW4lMjIlM0ElMjJmbHl3aXJlLmNsb3VkZmxhcmVhY2Nlc3MuY29tJTIyJTJDJTIyaG9zdG5hbWUlMjIlM0ElMjJqaXJhLmZseXdpcmUudGVjaCUyMiUyQyUyMnJlZGlyZWN0VVJMJTIyJTNBJTIyJTJGcGx1Z2lucyUyRnNlcnZsZXQlMkZkZXNrJTJGcG9ydGFsJTJGMzQlMjIlMkMlMjJhdWQlMjIlM0ElMjI3MTZjMTYyOGRiMDU2ODNjYTNiYzRlNDY3OTdkMzQ0YmQ3M2Q4ZTE1MjZjODE5OWQ2NGRlZjAwNjBjMWE0YTI0JTIyJTJDJTIyaXNTYW1lU2l0ZU5vbmVDb21wYXRpYmxlJTIyJTNBdHJ1ZSUyQyUyMmlzSURQVGVzdCUyMiUzQWZhbHNlJTJDJTIyaXNSZWZyZXNoJTIyJTNBZmFsc2UlMkMlMjJub25jZSUyMiUzQSUyMm5BcWY1eGVLZzE3eWJLR09wJTIyJTJDJTIyaWRwSWQlMjIlM0ElMjI0NTI5YzBiNS04ZGYwLTQ1ZjktYjUyZi1jMjVjMWM2ZWQ4ZGElMjIlMkMlMjJzZXJ2aWNlX3Rva2VuX2lkJTIyJTNBJTIyJTIyJTJDJTIyc2VydmljZV90b2tlbl9zdGF0dXMlMjIlM0FmYWxzZSUyQyUyMmF1	HTTP Parser: No <meta name="author".. found
Source: https://flywire.okta.com/oauth2/v1/authorize?client_id=0oam8v0n7en8Yj7ON0x7&redirect_uri=https%3A%2F%2Fflywire.cloudflareaccess.com%2Fcdn-cgi%2Faccess%2Fcallback&response_type=code&scope=openid%20groups%20profile%20email&state=19b80ec91e7d08e7bf25bee8b40416b0206bd1199e66bd0afb080829a4ae4c0b.JTdCJTIyaWF0JTIyJTNBMTcyODcyOTQwNSUyQyUyMmF1dGhEb21haW4lMjIlM0ElMjJmbHl3aXJlLmNsb3VkZmxhcmVhY2Nlc3MuY29tJTIyJTJDJTIyaG9zdG5hbWUlMjIlM0ElMjJqaXJhLmZseXdpcmUudGVjaCUyMiUyQyUyMnJlZGlyZWN0VVJMJTIyJTNBJTIyJTJGcGx1Z2lucyUyRnNlcnZsZXQlMkZkZXNrJTJGcG9ydGFsJTJGMzQlMjIlMkMlMjJhdWQlMjIlM0ElMjI3MTZjMTYyOGRiMDU2ODNjYTNiYzRlNDY3OTdkMzQ0YmQ3M2Q4ZTE1MjZjODE5OWQ2NGRlZjAwNjBjMWE0YTI0JTIyJTJDJTIyaXNTYW1lU2l0ZU5vbmVDb21wYXRpYmxlJTIyJTNBdHJ1ZSUyQyUyMmlzSURQVGVzdCUyMiUzQWZhbHNlJTJDJTIyaXNSZWZyZXNoJTIyJTNBZmFsc2UlMkMlMjJub25jZSUyMiUzQSUyMm5BcWY1eGVLZzE3eWJLR09wJTIyJTJDJTIyaWRwSWQlMjIlM0ElMjI0NTI5YzBiNS04ZGYwLTQ1ZjktYjUyZi1jMjVjMWM2ZWQ4ZGElMjIlMkMlMjJzZXJ2aWNlX3Rva2VuX2lkJTIyJTNBJTIyJTIyJTJDJTIyc2VydmljZV90b2tlbl9zdGF0dXMlMjIlM0FmYWxzZSUyQyUyMmF1	HTTP Parser: No <meta name="author".. found

Source: https://flywire.okta.com/oauth2/v1/authorize?client_id=0oam8v0n7en8Yj7ON0x7&redirect_uri=https%3A%2F%2Fflywire.cloudflareaccess.com%2Fcdn-cgi%2Faccess%2Fcallback&response_type=code&scope=openid%20groups%20profile%20email&state=19b80ec91e7d08e7bf25bee8b40416b0206bd1199e66bd0afb080829a4ae4c0b.JTdCJTIyaWF0JTIyJTNBMTcyODcyOTQwNSUyQyUyMmF1dGhEb21haW4lMjIlM0ElMjJmbHl3aXJlLmNsb3VkZmxhcmVhY2Nlc3MuY29tJTIyJTJDJTIyaG9zdG5hbWUlMjIlM0ElMjJqaXJhLmZseXdpcmUudGVjaCUyMiUyQyUyMnJlZGlyZWN0VVJMJTIyJTNBJTIyJTJGcGx1Z2lucyUyRnNlcnZsZXQlMkZkZXNrJTJGcG9ydGFsJTJGMzQlMjIlMkMlMjJhdWQlMjIlM0ElMjI3MTZjMTYyOGRiMDU2ODNjYTNiYzRlNDY3OTdkMzQ0YmQ3M2Q4ZTE1MjZjODE5OWQ2NGRlZjAwNjBjMWE0YTI0JTIyJTJDJTIyaXNTYW1lU2l0ZU5vbmVDb21wYXRpYmxlJTIyJTNBdHJ1ZSUyQyUyMmlzSURQVGVzdCUyMiUzQWZhbHNlJTJDJTIyaXNSZWZyZXNoJTIyJTNBZmFsc2UlMkMlMjJub25jZSUyMiUzQSUyMm5BcWY1eGVLZzE3eWJLR09wJTIyJTJDJTIyaWRwSWQlMjIlM0ElMjI0NTI5YzBiNS04ZGYwLTQ1ZjktYjUyZi1jMjVjMWM2ZWQ4ZGElMjIlMkMlMjJzZXJ2aWNlX3Rva2VuX2lkJTIyJTNBJTIyJTIyJTJDJTIyc2VydmljZV90b2tlbl9zdGF0dXMlMjIlM0FmYWxzZSUyQyUyMmF1...	HTTP Parser: No <meta name="copyright".. found
Source: https://flywire.okta.com/oauth2/v1/authorize?client_id=0oam8v0n7en8Yj7ON0x7&redirect_uri=https%3A%2F%2Fflywire.cloudflareaccess.com%2Fcdn-cgi%2Faccess%2Fcallback&response_type=code&scope=openid%20groups%20profile%20email&state=19b80ec91e7d08e7bf25bee8b40416b0206bd1199e66bd0afb080829a4ae4c0b.JTdCJTIyaWF0JTIyJTNBMTcyODcyOTQwNSUyQyUyMmF1dGhEb21haW4lMjIlM0ElMjJmbHl3aXJlLmNsb3VkZmxhcmVhY2Nlc3MuY29tJTIyJTJDJTIyaG9zdG5hbWUlMjIlM0ElMjJqaXJhLmZseXdpcmUudGVjaCUyMiUyQyUyMnJlZGlyZWN0VVJMJTIyJTNBJTIyJTJGcGx1Z2lucyUyRnNlcnZsZXQlMkZkZXNrJTJGcG9ydGFsJTJGMzQlMjIlMkMlMjJhdWQlMjIlM0ElMjI3MTZjMTYyOGRiMDU2ODNjYTNiYzRlNDY3OTdkMzQ0YmQ3M2Q4ZTE1MjZjODE5OWQ2NGRlZjAwNjBjMWE0YTI0JTIyJTJDJTIyaXNTYW1lU2l0ZU5vbmVDb21wYXRpYmxlJTIyJTNBdHJ1ZSUyQyUyMmlzSURQVGVzdCUyMiUzQWZhbHNlJTJDJTIyaXNSZWZyZXNoJTIyJTNBZmFsc2UlMkMlMjJub25jZSUyMiUzQSUyMm5BcWY1eGVLZzE3eWJLR09wJTIyJTJDJTIyaWRwSWQlMjIlM0ElMjI0NTI5YzBiNS04ZGYwLTQ1ZjktYjUyZi1jMjVjMWM2ZWQ4ZGElMjIlMkMlMjJzZXJ2aWNlX3Rva2VuX2lkJTIyJTNBJTIyJTIyJTJDJTIyc2VydmljZV90b2tlbl9zdGF0dXMlMjIlM0FmYWxzZSUyQyUyMmF1...	HTTP Parser: No <meta name="copyright".. found
Source: https://flywire.okta.com/oauth2/v1/authorize?client_id=0oam8v0n7en8Yj7ON0x7&redirect_uri=https%3A%2F%2Fflywire.cloudflareaccess.com%2Fcdn-cgi%2Faccess%2Fcallback&response_type=code&scope=openid%20groups%20profile%20email&state=19b80ec91e7d08e7bf25bee8b40416b0206bd1199e66bd0afb080829a4ae4c0b.JTdCJTIyaWF0JTIyJTNBMTcyODcyOTQwNSUyQyUyMmF1dGhEb21haW4lMjIlM0ElMjJmbHl3aXJlLmNsb3VkZmxhcmVhY2Nlc3MuY29tJTIyJTJDJTIyaG9zdG5hbWUlMjIlM0ElMjJqaXJhLmZseXdpcmUudGVjaCUyMiUyQyUyMnJlZGlyZWN0VVJMJTIyJTNBJTIyJTJGcGx1Z2lucyUyRnNlcnZsZXQlMkZkZXNrJTJGcG9ydGFsJTJGMzQlMjIlMkMlMjJhdWQlMjIlM0ElMjI3MTZjMTYyOGRiMDU2ODNjYTNiYzRlNDY3OTdkMzQ0YmQ3M2Q4ZTE1MjZjODE5OWQ2NGRlZjAwNjBjMWE0YTI0JTIyJTJDJTIyaXNTYW1lU2l0ZU5vbmVDb21wYXRpYmxlJTIyJTNBdHJ1ZSUyQyUyMmlzSURQVGVzdCUyMiUzQWZhbHNlJTJDJTIyaXNSZWZyZXNoJTIyJTNBZmFsc2UlMkMlMjJub25jZSUyMiUzQSUyMm5BcWY1eGVLZzE3eWJLR09wJTIyJTJDJTIyaWRwSWQlMjIlM0ElMjI0NTI5YzBiNS04ZGYwLTQ1ZjktYjUyZi1jMjVjMWM2ZWQ4ZGElMjIlMkMlMjJzZXJ2aWNlX3Rva2VuX2lkJTIyJTNBJTIyJTIyJTJDJTIyc2VydmljZV90b2tlbl9zdGF0dXMlMjIlM0FmYWxzZSUyQyUyMmF1...	HTTP Parser: No <meta name="copyright".. found
Source: https://flywire.okta.com/oauth2/v1/authorize?client_id=0oam8v0n7en8Yj7ON0x7&redirect_uri=https%3A%2F%2Fflywire.cloudflareaccess.com%2Fcdn-cgi%2Faccess%2Fcallback&response_type=code&scope=openid%20groups%20profile%20email&state=19b80ec91e7d08e7bf25bee8b40416b0206bd1199e66bd0afb080829a4ae4c0b.JTdCJTIyaWF0JTIyJTNBMTcyODcyOTQwNSUyQyUyMmF1dGhEb21haW4lMjIlM0ElMjJmbHl3aXJlLmNsb3VkZmxhcmVhY2Nlc3MuY29tJTIyJTJDJTIyaG9zdG5hbWUlMjIlM0ElMjJqaXJhLmZseXdpcmUudGVjaCUyMiUyQyUyMnJlZGlyZWN0VVJMJTIyJTNBJTIyJTJGcGx1Z2lucyUyRnNlcnZsZXQlMkZkZXNrJTJGcG9ydGFsJTJGMzQlMjIlMkMlMjJhdWQlMjIlM0ElMjI3MTZjMTYyOGRiMDU2ODNjYTNiYzRlNDY3OTdkMzQ0YmQ3M2Q4ZTE1MjZjODE5OWQ2NGRlZjAwNjBjMWE0YTI0JTIyJTJDJTIyaXNTYW1lU2l0ZU5vbmVDb21wYXRpYmxlJTIyJTNBdHJ1ZSUyQyUyMmlzSURQVGVzdCUyMiUzQWZhbHNlJTJDJTIyaXNSZWZyZXNoJTIyJTNBZmFsc2UlMkMlMjJub25jZSUyMiUzQSUyMm5BcWY1eGVLZzE3eWJLR09wJTIyJTJDJTIyaWRwSWQlMjIlM0ElMjI0NTI5YzBiNS04ZGYwLTQ1ZjktYjUyZi1jMjVjMWM2ZWQ4ZGElMjIlMkMlMjJzZXJ2aWNlX3Rva2VuX2lkJTIyJTNBJTIyJTIyJTJDJTIyc2VydmljZV90b2tlbl9zdGF0dXMlMjIlM0FmYWxzZSUyQyUyMmF1...	HTTP Parser: No <meta name="copyright".. found
Source: https://flywire.okta.com/oauth2/v1/authorize?client_id=0oam8v0n7en8Yj7ON0x7&redirect_uri=https%3A%2F%2Fflywire.cloudflareaccess.com%2Fcdn-cgi%2Faccess%2Fcallback&response_type=code&scope=openid%20groups%20profile%20email&state=19b80ec91e7d08e7bf25bee8b40416b0206bd1199e66bd0afb080829a4ae4c0b.JTdCJTIyaWF0JTIyJTNBMTcyODcyOTQwNSUyQyUyMmF1dGhEb21haW4lMjIlM0ElMjJmbHl3aXJlLmNsb3VkZmxhcmVhY2Nlc3MuY29tJTIyJTJDJTIyaG9zdG5hbWUlMjIlM0ElMjJqaXJhLmZseXdpcmUudGVjaCUyMiUyQyUyMnJlZGlyZWN0VVJMJTIyJTNBJTIyJTJGcGx1Z2lucyUyRnNlcnZsZXQlMkZkZXNrJTJGcG9ydGFsJTJGMzQlMjIlMkMlMjJhdWQlMjIlM0ElMjI3MTZjMTYyOGRiMDU2ODNjYTNiYzRlNDY3OTdkMzQ0YmQ3M2Q4ZTE1MjZjODE5OWQ2NGRlZjAwNjBjMWE0YTI0JTIyJTJDJTIyaXNTYW1lU2l0ZU5vbmVDb21wYXRpYmxlJTIyJTNBdHJ1ZSUyQyUyMmlzSURQVGVzdCUyMiUzQWZhbHNlJTJDJTIyaXNSZWZyZXNoJTIyJTNBZmFsc2UlMkMlMjJub25jZSUyMiUzQSUyMm5BcWY1eGVLZzE3eWJLR09wJTIyJTJDJTIyaWRwSWQlMjIlM0ElMjI0NTI5YzBiNS04ZGYwLTQ1ZjktYjUyZi1jMjVjMWM2ZWQ4ZGElMjIlMkMlMjJzZXJ2aWNlX3Rva2VuX2lkJTIyJTNBJTIyJTIyJTJDJTIyc2VydmljZV90b2tlbl9zdGF0dXMlMjIlM0FmYWxzZSUyQyUyMmF1...	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49766 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56

Source: global traffic	DNS traffic detected: DNS query: jira.flywire.tech
Source: global traffic	DNS traffic detected: DNS query: flywire.cloudflareaccess.com
Source: global traffic	DNS traffic detected: DNS query: flywire.okta.com
Source: global traffic	DNS traffic detected: DNS query: ok2static.oktacdn.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: login.okta.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49766 version: TLS 1.2

Source: classification engine

Classification label: clean1.win@19/29@18/194

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1948,i,1210385584711832822,2850508338919820376,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://jira.flywire.tech/plugins/servlet/desk/portal/34"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1948,i,1210385584711832822,2850508338919820376,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

ID:	1532113
Product:	CloudBasic
Start time:	12:36:12
Start date:	12.10.2024
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Windows Analysis Report
https://jira.flywire.tech/plugins/servlet/desk/portal/34

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report https://jira.flywire.tech/plugins/servlet/desk/portal/34

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
https://jira.flywire.tech/plugins/servlet/desk/portal/34