Windows Analysis Report
https://aa.ns.agingbydesignministry.org/?company=john_smith@company.com/1/01020192845e78dd-2d6e57c1-2477-4368-9808-e405234d7366-000000/JciFxQG6yOVw83-lKIliC63cjw4=395

Overview

General Information

Sample URL:	https://aa.ns.agingbydesignministry.org/?company=john_smith@company.com/1/01020192845e78dd-2d6e57c1-2477-4368-9808-e405234d7366-000000/JciFxQG6yOVw83-lKIliC63cjw4=395
Analysis ID:	1532874

Detection

HTMLPhisher

Score:	72
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

AI detected phishing page (G)

Yara detected HtmlPhish54

Phishing site detected (based on favicon image match)

Phishing site detected (based on image similarity)

Detected hidden input values containing email addresses (often used in phishing pages)

HTML body contains low number of good links

HTML page contains hidden javascript code

HTML title does not match URL

Stores files to the Windows start menu directory

URL contains potential PII (phishing indication)

Classification

Signatures

Phishing

AI detected phishing page

Source: https://15da7cc3-3e1e66dd.babjeetrading.com/adfs/ls/?login_hint=john_smith%40company.com&client-request-id=8f1de839-f25d-4e98-be19-bfd71706122d&wa=wsignin1.0&wtrealm=urn:federation:MicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3D2%26estsrequest%3DrQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAQsX8j2x36a4bdPcv91cTYh3VWMyoSN0L_AyPiCkXESk1hWfkZefHFuZkmGA1C8IDGvEiR_i0nQvyjdMyW82C01JbUosSQzP-8Rs1BSZk6OA9w4kMILLAKvWHgMmK04OLgEGCQYFBh-sDAuYgW669Gj248jjga7rGOc6XNBnpHhFKt-iFuIU2hqUpVRmreHWZqTm7NjlZdxhXeeUZ5zlJGjq597vlNOgGlmSXGor62JleEENqEJbEyn2Bg-sDF2sDPMYmc4wMl4gJfhB19H56qWC_92vfN4xa-T5Wrk5VppGGgc6GLuku9tURaSmhmUUZbvnWKckWvo4uaY71rlmmZalOdsYLtBgOGBAAMA0&username=bill%40microsoft.com&pullStatus=0	LLM: Score: 9 Reasons: The brand 'Microsoft' is a well-known global technology company., The URL '15da7cc3-3e1e66dd.babjeetrading.com' does not match the legitimate domain 'microsoft.com'., The domain 'babjeetrading.com' is not associated with Microsoft., The presence of a password input field on a non-legitimate domain is suspicious., The subdomain '15da7cc3-3e1e66dd' is unusual and does not align with Microsoft's typical subdomain structure. DOM: 4.18.pages.csv
Source: https://15da7cc3-3e1e66dd.babjeetrading.com/adfs/ls/?login_hint=john_smith%40company.com&client-request-id=8f1de839-f25d-4e98-be19-bfd71706122d&wa=wsignin1.0&wtrealm=urn:federation:MicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3D2%26estsrequest%3DrQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAQsX8j2x36a4bdPcv91cTYh3VWMyoSN0L_AyPiCkXESk1hWfkZefHFuZkmGA1C8IDGvEiR_i0nQvyjdMyW82C01JbUosSQzP-8Rs1BSZk6OA9w4kMILLAKvWHgMmK04OLgEGCQYFBh-sDAuYgW669Gj248jjga7rGOc6XNBnpHhFKt-iFuIU2hqUpVRmreHWZqTm7NjlZdxhXeeUZ5zlJGjq597vlNOgGlmSXGor62JleEENqEJbEyn2Bg-sDF2sDPMYmc4wMl4gJfhB19H56qWC_92vfN4xa-T5Wrk5VppGGgc6GLuku9tURaSmhmUUZbvnWKckWvo4uaY71rlmmZalOdsYLtBgOGBAAMA0&username=bill%40microsoft.com&pullStatus=0	LLM: Score: 9 Reasons: The brand 'Microsoft' is a well-known global technology company., The legitimate domain for Microsoft is 'microsoft.com'., The provided URL '15da7cc3-3e1e66dd.babjeetrading.com' does not match the legitimate domain., The URL contains a random alphanumeric subdomain and a different primary domain 'babjeetrading.com', which is not associated with Microsoft., The presence of a well-known brand name in the input fields suggests an attempt to impersonate Microsoft., The URL structure and domain name are suspicious and indicative of a phishing attempt. DOM: 4.19.pages.csv

AI detected phishing page (G)

Source: https://0nline.babjeetrading.com/?bond=john_smith@company.com	LLM: Score: 10 Reasons: The URL "0nline.babjeetrading.com" is highly suspicious. The use of "0" (zero) instead of "o" (the letter 'o') is a common tactic in phishing attacks to mimic legitimate URLs. The brand name "reCAPTCHA" is associated with Google and its domain "google.com". The presented URL does not match the legitimate domain, suggesting a potential phishing attempt. The presence of only one input field, "I'm not a robot," while characteristic of reCAPTCHA, doesn't confirm legitimacy in this context given the suspicious URL. The domain "babjeetrading.com" is not related to Google or reCAPTCHA, further raising suspicion. DOM: 1.4.pages.csv
Source: https://0nline.babjeetrading.com/?bond=john_smith@company.com&sso_reload=true	LLM: Score: 10 Reasons: The URL "0nline.babjeetrading.com" is highly suspicious. The presence of a numeral '0' at the beginning of a subdomain is unusual and often used in phishing attempts to mimic the letter 'o'., The domain "babjeetrading.com" has no clear association with Microsoft. This strong mismatch between the provided brand name (Microsoft) and the base domain raises a significant red flag., The input field containing an email address suggests a potential attempt to collect user credentials, a common phishing tactic. DOM: 2.14.pages.csv
Source: https://15da7cc3-3e1e66dd.babjeetrading.com/adfs/ls/?login_hint=john_smith%40company.com&client-request-id=8f1de839-f25d-4e98-be19-bfd71706122d&wa=wsignin1.0&wtrealm=urn:federation:MicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3D2%26estsrequest%3DrQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAQsX8j2x36a4bdPcv91cTYh3VWMyoSN0L_AyPiCkXESk1hWfkZefHFuZkmGA1C8IDGvEiR_i0nQvyjdMyW82C01JbUosSQzP-8Rs1BSZk6OA9w4kMILLAKvWHgMmK04OLgEGCQYFBh-sDAuYgW669Gj248jjga7rGOc6XNBnpHhFKt-iFuIU2hqUpVRmreHWZqTm7NjlZdxhXeeUZ5zlJGjq597vlNOgGlmSXGor62JleEENqEJbEyn2Bg-sDF2sDPMYmc4wMl4gJfhB19H56qWC_92vfN4xa-T5Wrk5VppGGgc6GLuku9tURaSmhmUUZbvnWKckWvo4uaY71rlmmZalOdsYLtBgOGBAAMA0&username=bill%40microsoft.com&pullStatus=0	LLM: Score: 10 Reasons: The URL contains a random prefix '15da7cc3-3e1e66dd' which is very unusual for legitimate Microsoft sites., The domain 'babjeetrading.com' does not belong to Microsoft. It is highly suspicious that a well-known brand like Microsoft would use a third-party domain, especially one with an unrelated name like 'babjeetrading'., The presence of a password field on a site mimicking a well-known brand raises red flags. Phishers often use such fields to steal login credentials. DOM: 4.18.pages.csv
Source: https://15da7cc3-3e1e66dd.babjeetrading.com/adfs/ls/?login_hint=john_smith%40company.com&client-request-id=8f1de839-f25d-4e98-be19-bfd71706122d&wa=wsignin1.0&wtrealm=urn:federation:MicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3D2%26estsrequest%3DrQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAQsX8j2x36a4bdPcv91cTYh3VWMyoSN0L_AyPiCkXESk1hWfkZefHFuZkmGA1C8IDGvEiR_i0nQvyjdMyW82C01JbUosSQzP-8Rs1BSZk6OA9w4kMILLAKvWHgMmK04OLgEGCQYFBh-sDAuYgW669Gj248jjga7rGOc6XNBnpHhFKt-iFuIU2hqUpVRmreHWZqTm7NjlZdxhXeeUZ5zlJGjq597vlNOgGlmSXGor62JleEENqEJbEyn2Bg-sDF2sDPMYmc4wMl4gJfhB19H56qWC_92vfN4xa-T5Wrk5VppGGgc6GLuku9tURaSmhmUUZbvnWKckWvo4uaY71rlmmZalOdsYLtBgOGBAAMA0&username=bill%40microsoft.com&pullStatus=0	LLM: Score: 10 Reasons: The URL contains a random prefix '15da7cc3-3e1e66dd' which is very unusual for legitimate Microsoft sites., The domain 'babjeetrading.com' does not belong to Microsoft. It is highly suspicious that a well-known brand like Microsoft would use a third-party domain, especially one with an unrelated name like 'babjeetrading'., The presence of a password field on a site mimicking a well-known brand raises red flags. Phishers often use such fields to steal login credentials. DOM: 4.19.pages.csv

Yara detected HtmlPhish54

Source: Yara match	File source: 2.11.pages.csv, type: HTML
Source: Yara match	File source: 2.12.pages.csv, type: HTML

Phishing site detected (based on favicon image match)

Source: https://0nline.babjeetrading.com/?bond=john_smith@company.com&sso_reload=true

Matcher: Template: microsoft matched with high similarity

Phishing site detected (based on image similarity)

Source: https://0nline.babjeetrading.com/?bond=john_smith@company.com&sso_reload=true

Matcher: Found strong image similarity, brand: MICROSOFT

Detected hidden input values containing email addresses (often used in phishing pages)

Source: https://15da7cc3-3e1e66dd.babjeetrading.com/adfs/ls/?login_hint=john_smith%40company.com&client-request-id=8f1de839-f25d-4e98-be19-bfd71706122d&wa=wsignin1.0&wtrealm=urn:federation:MicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3D2%26estsrequest%3DrQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAQsX8j2x36a4bdPcv91cTYh3VWMyoSN0L_AyPiCkXESk1hWfkZefHFuZkmGA1C8IDGvEiR_i0nQvyjdMyW82C01JbUosSQzP-8Rs1BSZk6OA9w4kMILLAKvWHgMmK04OLgEGCQYFBh-sDAuYgW669Gj248jjga7rGOc6XNBnpHhFKt-iFuIU2hqUpVRmreHWZqTm7NjlZdxhXeeUZ5zlJGjq597vlNOgGlmSXGor62JleEENqEJbEyn2Bg-sDF2sDPMYmc4wMl4gJfhB19H56qWC_92vfN4xa-T5Wrk5VppGGgc6GLuku9tURaSmhmUUZbvnWKckWvo4uaY71rlmmZalOdsYLtBgOGBAAMA0&username=bill%40microsoft.com&pullStatus=0

HTTP Parser: bill@microsoft.com

HTML body contains low number of good links

Source: https://0nline.babjeetrading.com/?bond=john_smith@company.com&sso_reload=true	HTTP Parser: Number of links: 0
Source: https://15da7cc3-3e1e66dd.babjeetrading.com/adfs/ls/?login_hint=john_smith%40company.com&client-request-id=8f1de839-f25d-4e98-be19-bfd71706122d&wa=wsignin1.0&wtrealm=urn:federation:MicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3D2%26estsrequest%3DrQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAQsX8j2x36a4bdPcv91cTYh3VWMyoSN0L_AyPiCkXESk1hWfkZefHFuZkmGA1C8IDGvEiR_i0nQvyjdMyW82C01JbUosSQzP-8Rs1BSZk6OA9w4kMILLAKvWHgMmK04OLgEGCQYFBh-sDAuYgW669Gj248jjga7rGOc6XNBnpHhFKt-iFuIU2hqUpVRmreHWZqTm7NjlZdxhXeeUZ5zlJGjq597vlNOgGlmSXGor62JleEENqEJbEyn2Bg-sDF2sDPMYmc4wMl4gJfhB19H56qWC_92vfN4xa-T5Wrk5VppGGgc6GLuku9tURaSmhmUUZbvnWKckWvo4uaY71rlmmZalOdsYLtBgOGBAAMA0&username=bill%40microsoft.com&pullStatus=0	HTTP Parser: Number of links: 0

HTML page contains hidden javascript code

Source: https://0nline.babjeetrading.com/?bond=john_smith@company.com

HTTP Parser: Base64 decoded: a[href="http://www.salidzini.lv/"][style="display: block; width: 120px; height: 40px; overflow: hidden; position: relative;"]

HTML title does not match URL

Source: https://0nline.babjeetrading.com/?bond=john_smith@company.com&sso_reload=true	HTTP Parser: Title: Sign in to your account does not match URL
Source: https://15da7cc3-3e1e66dd.babjeetrading.com/adfs/ls/?login_hint=john_smith%40company.com&client-request-id=8f1de839-f25d-4e98-be19-bfd71706122d&wa=wsignin1.0&wtrealm=urn:federation:MicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3D2%26estsrequest%3DrQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAQsX8j2x36a4bdPcv91cTYh3VWMyoSN0L_AyPiCkXESk1hWfkZefHFuZkmGA1C8IDGvEiR_i0nQvyjdMyW82C01JbUosSQzP-8Rs1BSZk6OA9w4kMILLAKvWHgMmK04OLgEGCQYFBh-sDAuYgW669Gj248jjga7rGOc6XNBnpHhFKt-iFuIU2hqUpVRmreHWZqTm7NjlZdxhXeeUZ5zlJGjq597vlNOgGlmSXGor62JleEENqEJbEyn2Bg-sDF2sDPMYmc4wMl4gJfhB19H56qWC_92vfN4xa-T5Wrk5VppGGgc6GLuku9tURaSmhmUUZbvnWKckWvo4uaY71rlmmZalOdsYLtBgOGBAAMA0&username=bill%40microsoft.com&pullStatus=0	HTTP Parser: Title: Sign In does not match URL

URL contains potential PII (phishing indication)

Source: https://aa.ns.agingbydesignministry.org/?company=john_smith@company.com/1/01020192845e78dd-2d6e57c1-2477-4368-9808-e405234d7366-000000/JciFxQG6yOVw83-lKIliC63cjw4=395	Sample URL: PII: john_smith@company.com
Source: https://aa.ns.agingbydesignministry.org/?company=john_smith@company.com/1/01020192845e78dd-2d6e57c1-2477-4368-9808-e405234d7366-000000/JciFxQG6yOVw83-lKIliC63cjw4=395	Sample URL: PII: john_smith@company.com
Source: https://aa.ns.agingbydesignministry.org/?company=john_smith@company.com/1/01020192845e78dd-2d6e57c1-2477-4368-9808-e405234d7366-000000/JciFxQG6yOVw83-lKIliC63cjw4=395	Sample URL: PII: john_smith@company.com
Source: https://aa.ns.agingbydesignministry.org/?company=john_smith@company.com/1/01020192845e78dd-2d6e57c1-2477-4368-9808-e405234d7366-000000/JciFxQG6yOVw83-lKIliC63cjw4=395	Sample URL: PII: john_smith@company.com
Source: https://aa.ns.agingbydesignministry.org/?company=john_smith@company.com/1/01020192845e78dd-2d6e57c1-2477-4368-9808-e405234d7366-000000/JciFxQG6yOVw83-lKIliC63cjw4=395	Sample URL: PII: john_smith@company.com
Source: https://aa.ns.agingbydesignministry.org/?company=john_smith@company.com/1/01020192845e78dd-2d6e57c1-2477-4368-9808-e405234d7366-000000/JciFxQG6yOVw83-lKIliC63cjw4=395	Sample URL: PII: john_smith@company.com
Source: https://aa.ns.agingbydesignministry.org/?company=john_smith@company.com/1/01020192845e78dd-2d6e57c1-2477-4368-9808-e405234d7366-000000/JciFxQG6yOVw83-lKIliC63cjw4=395	Sample URL: PII: john_smith@company.com
Source: https://aa.ns.agingbydesignministry.org/?company=john_smith@company.com/1/01020192845e78dd-2d6e57c1-2477-4368-9808-e405234d7366-000000/JciFxQG6yOVw83-lKIliC63cjw4=395	Sample URL: PII: john_smith@company.com
Source: https://aa.ns.agingbydesignministry.org/?company=john_smith@company.com/1/01020192845e78dd-2d6e57c1-2477-4368-9808-e405234d7366-000000/JciFxQG6yOVw83-lKIliC63cjw4=395	Sample URL: PII: john_smith@company.com
Source: https://aa.ns.agingbydesignministry.org/?company=john_smith@company.com/1/01020192845e78dd-2d6e57c1-2477-4368-9808-e405234d7366-000000/JciFxQG6yOVw83-lKIliC63cjw4=395	Sample URL: PII: john_smith@company.com
Source: https://aa.ns.agingbydesignministry.org/?company=john_smith@company.com/1/01020192845e78dd-2d6e57c1-2477-4368-9808-e405234d7366-000000/JciFxQG6yOVw83-lKIliC63cjw4=395	Sample URL: PII: john_smith@company.com
Source: https://aa.ns.agingbydesignministry.org/?company=john_smith@company.com/1/01020192845e78dd-2d6e57c1-2477-4368-9808-e405234d7366-000000/JciFxQG6yOVw83-lKIliC63cjw4=395	Sample URL: PII: john_smith@company.com

Source: https://0nline.babjeetrading.com/?bond=john_smith@company.com&sso_reload=true	HTTP Parser: Iframe src: https://dd8f6fc2-3e1e66dd.babjeetrading.com/Prefetch/Prefetch.aspx
Source: https://0nline.babjeetrading.com/?bond=john_smith@company.com&sso_reload=true	HTTP Parser: Iframe src: https://dd8f6fc2-3e1e66dd.babjeetrading.com/Prefetch/Prefetch.aspx
Source: https://0nline.babjeetrading.com/?bond=john_smith@company.com&sso_reload=true	HTTP Parser: Iframe src: https://dd8f6fc2-3e1e66dd.babjeetrading.com/Prefetch/Prefetch.aspx
Source: https://0nline.babjeetrading.com/?bond=john_smith@company.com&sso_reload=true	HTTP Parser: Iframe src: https://dd8f6fc2-3e1e66dd.babjeetrading.com/Prefetch/Prefetch.aspx
Source: https://0nline.babjeetrading.com/?bond=john_smith@company.com&sso_reload=true	HTTP Parser: Iframe src: https://8c1cd37c-3e1e66dd.babjeetrading.com/?session_id=8f1de839-f25d-4e98-be19-bfd71706122d&instanceid=9e21cb52-25cc-4c73-b853-e8d4ae325369&assessment=asmtaadeu&requestid=e3dbe2e2-c558-4453-ae01-994cd01f0100

Source: https://0nline.babjeetrading.com/?bond=john_smith@company.com&sso_reload=true	HTTP Parser: <input type="password" .../> found
Source: https://15da7cc3-3e1e66dd.babjeetrading.com/adfs/ls/?login_hint=john_smith%40company.com&client-request-id=8f1de839-f25d-4e98-be19-bfd71706122d&wa=wsignin1.0&wtrealm=urn:federation:MicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3D2%26estsrequest%3DrQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAQsX8j2x36a4bdPcv91cTYh3VWMyoSN0L_AyPiCkXESk1hWfkZefHFuZkmGA1C8IDGvEiR_i0nQvyjdMyW82C01JbUosSQzP-8Rs1BSZk6OA9w4kMILLAKvWHgMmK04OLgEGCQYFBh-sDAuYgW669Gj248jjga7rGOc6XNBnpHhFKt-iFuIU2hqUpVRmreHWZqTm7NjlZdxhXeeUZ5zlJGjq597vlNOgGlmSXGor62JleEENqEJbEyn2Bg-sDF2sDPMYmc4wMl4gJfhB19H56qWC_92vfN4xa-T5Wrk5VppGGgc6GLuku9tURaSmhmUUZbvnWKckWvo4uaY71rlmmZalOdsYLtBgOGBAAMA0&username=bill%40microsoft.com&pullStatus=0	HTTP Parser: <input type="password" .../> found

Source: https://aa.ns.agingbydesignministry.org/?company=john_smith@company.com/1/01020192845e78dd-2d6e57c1-2477-4368-9808-e405234d7366-000000/JciFxQG6yOVw83-lKIliC63cjw4=395	HTTP Parser: No favicon
Source: https://aa.ns.agingbydesignministry.org/?company=john_smith@company.com/1/01020192845e78dd-2d6e57c1-2477-4368-9808-e405234d7366-000000/JciFxQG6yOVw83-lKIliC63cjw4=395	HTTP Parser: No favicon
Source: https://0nline.babjeetrading.com/?bond=john_smith@company.com	HTTP Parser: No favicon
Source: https://0nline.babjeetrading.com/?bond=john_smith@company.com	HTTP Parser: No favicon
Source: https://0nline.babjeetrading.com/?bond=john_smith@company.com	HTTP Parser: No favicon
Source: https://0nline.babjeetrading.com/?bond=john_smith@company.com	HTTP Parser: No favicon
Source: https://0nline.babjeetrading.com/?bond=john_smith@company.com	HTTP Parser: No favicon
Source: https://0nline.babjeetrading.com/?bond=john_smith@company.com&sso_reload=true	HTTP Parser: No favicon
Source: https://0nline.babjeetrading.com/?bond=john_smith@company.com&sso_reload=true	HTTP Parser: No favicon
Source: https://0nline.babjeetrading.com/?bond=john_smith@company.com&sso_reload=true	HTTP Parser: No favicon
Source: https://0nline.babjeetrading.com/?bond=john_smith@company.com&sso_reload=true	HTTP Parser: No favicon
Source: https://0nline.babjeetrading.com/?bond=john_smith@company.com&sso_reload=true	HTTP Parser: No favicon
Source: https://0nline.babjeetrading.com/?bond=john_smith@company.com&sso_reload=true	HTTP Parser: No favicon
Source: https://0nline.babjeetrading.com/?bond=john_smith@company.com&sso_reload=true	HTTP Parser: No favicon
Source: https://15da7cc3-3e1e66dd.babjeetrading.com/adfs/ls/?login_hint=john_smith%40company.com&client-request-id=8f1de839-f25d-4e98-be19-bfd71706122d&wa=wsignin1.0&wtrealm=urn:federation:MicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3D2%26estsrequest%3DrQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAQsX8j2x36a4bdPcv91cTYh3VWMyoSN0L_AyPiCkXESk1hWfkZefHFuZkmGA1C8IDGvEiR_i0nQvyjdMyW82C01JbUosSQzP-8Rs1BSZk6OA9w4kMILLAKvWHgMmK04OLgEGCQYFBh-sDAuYgW669Gj248jjga7rGOc6XNBnpHhFKt-iFuIU2hqUpVRmreHWZqTm7NjlZdxhXeeUZ5zlJGjq597vlNOgGlmSXGor62JleEENqEJbEyn2Bg-sDF2sDPMYmc4wMl4gJfhB19H56qWC_92vfN4xa-T5Wrk5VppGGgc6GLuku9tURaSmhmUUZbvnWKckWvo4uaY71rlmmZalOdsYLtBgOGBAAMA0&username=bill%40microsoft.com&pullStatus=0	HTTP Parser: No favicon
Source: https://15da7cc3-3e1e66dd.babjeetrading.com/adfs/ls/?login_hint=john_smith%40company.com&client-request-id=8f1de839-f25d-4e98-be19-bfd71706122d&wa=wsignin1.0&wtrealm=urn:federation:MicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3D2%26estsrequest%3DrQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAQsX8j2x36a4bdPcv91cTYh3VWMyoSN0L_AyPiCkXESk1hWfkZefHFuZkmGA1C8IDGvEiR_i0nQvyjdMyW82C01JbUosSQzP-8Rs1BSZk6OA9w4kMILLAKvWHgMmK04OLgEGCQYFBh-sDAuYgW669Gj248jjga7rGOc6XNBnpHhFKt-iFuIU2hqUpVRmreHWZqTm7NjlZdxhXeeUZ5zlJGjq597vlNOgGlmSXGor62JleEENqEJbEyn2Bg-sDF2sDPMYmc4wMl4gJfhB19H56qWC_92vfN4xa-T5Wrk5VppGGgc6GLuku9tURaSmhmUUZbvnWKckWvo4uaY71rlmmZalOdsYLtBgOGBAAMA0&username=bill%40microsoft.com&pullStatus=0	HTTP Parser: No favicon
Source: https://15da7cc3-3e1e66dd.babjeetrading.com/adfs/ls/?login_hint=john_smith%40company.com&client-request-id=8f1de839-f25d-4e98-be19-bfd71706122d&wa=wsignin1.0&wtrealm=urn:federation:MicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3D2%26estsrequest%3DrQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAQsX8j2x36a4bdPcv91cTYh3VWMyoSN0L_AyPiCkXESk1hWfkZefHFuZkmGA1C8IDGvEiR_i0nQvyjdMyW82C01JbUosSQzP-8Rs1BSZk6OA9w4kMILLAKvWHgMmK04OLgEGCQYFBh-sDAuYgW669Gj248jjga7rGOc6XNBnpHhFKt-iFuIU2hqUpVRmreHWZqTm7NjlZdxhXeeUZ5zlJGjq597vlNOgGlmSXGor62JleEENqEJbEyn2Bg-sDF2sDPMYmc4wMl4gJfhB19H56qWC_92vfN4xa-T5Wrk5VppGGgc6GLuku9tURaSmhmUUZbvnWKckWvo4uaY71rlmmZalOdsYLtBgOGBAAMA0&username=bill%40microsoft.com&pullStatus=0	HTTP Parser: No favicon

Source: https://0nline.babjeetrading.com/?bond=john_smith@company.com&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://0nline.babjeetrading.com/?bond=john_smith@company.com&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://0nline.babjeetrading.com/?bond=john_smith@company.com&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://0nline.babjeetrading.com/?bond=john_smith@company.com&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://15da7cc3-3e1e66dd.babjeetrading.com/adfs/ls/?login_hint=john_smith%40company.com&client-request-id=8f1de839-f25d-4e98-be19-bfd71706122d&wa=wsignin1.0&wtrealm=urn:federation:MicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3D2%26estsrequest%3DrQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAQsX8j2x36a4bdPcv91cTYh3VWMyoSN0L_AyPiCkXESk1hWfkZefHFuZkmGA1C8IDGvEiR_i0nQvyjdMyW82C01JbUosSQzP-8Rs1BSZk6OA9w4kMILLAKvWHgMmK04OLgEGCQYFBh-sDAuYgW669Gj248jjga7rGOc6XNBnpHhFKt-iFuIU2hqUpVRmreHWZqTm7NjlZdxhXeeUZ5zlJGjq597vlNOgGlmSXGor62JleEENqEJbEyn2Bg-sDF2sDPMYmc4wMl4gJfhB19H56qWC_92vfN4xa-T5Wrk5VppGGgc6GLuku9tURaSmhmUUZbvnWKckWvo4uaY71rlmmZalOdsYLtBgOGBAAMA0&username=bill%40microsoft.com&pullStatus=0	HTTP Parser: No <meta name="author".. found
Source: https://15da7cc3-3e1e66dd.babjeetrading.com/adfs/ls/?login_hint=john_smith%40company.com&client-request-id=8f1de839-f25d-4e98-be19-bfd71706122d&wa=wsignin1.0&wtrealm=urn:federation:MicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3D2%26estsrequest%3DrQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAQsX8j2x36a4bdPcv91cTYh3VWMyoSN0L_AyPiCkXESk1hWfkZefHFuZkmGA1C8IDGvEiR_i0nQvyjdMyW82C01JbUosSQzP-8Rs1BSZk6OA9w4kMILLAKvWHgMmK04OLgEGCQYFBh-sDAuYgW669Gj248jjga7rGOc6XNBnpHhFKt-iFuIU2hqUpVRmreHWZqTm7NjlZdxhXeeUZ5zlJGjq597vlNOgGlmSXGor62JleEENqEJbEyn2Bg-sDF2sDPMYmc4wMl4gJfhB19H56qWC_92vfN4xa-T5Wrk5VppGGgc6GLuku9tURaSmhmUUZbvnWKckWvo4uaY71rlmmZalOdsYLtBgOGBAAMA0&username=bill%40microsoft.com&pullStatus=0	HTTP Parser: No <meta name="author".. found
Source: https://15da7cc3-3e1e66dd.babjeetrading.com/adfs/ls/?login_hint=john_smith%40company.com&client-request-id=8f1de839-f25d-4e98-be19-bfd71706122d&wa=wsignin1.0&wtrealm=urn:federation:MicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3D2%26estsrequest%3DrQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAQsX8j2x36a4bdPcv91cTYh3VWMyoSN0L_AyPiCkXESk1hWfkZefHFuZkmGA1C8IDGvEiR_i0nQvyjdMyW82C01JbUosSQzP-8Rs1BSZk6OA9w4kMILLAKvWHgMmK04OLgEGCQYFBh-sDAuYgW669Gj248jjga7rGOc6XNBnpHhFKt-iFuIU2hqUpVRmreHWZqTm7NjlZdxhXeeUZ5zlJGjq597vlNOgGlmSXGor62JleEENqEJbEyn2Bg-sDF2sDPMYmc4wMl4gJfhB19H56qWC_92vfN4xa-T5Wrk5VppGGgc6GLuku9tURaSmhmUUZbvnWKckWvo4uaY71rlmmZalOdsYLtBgOGBAAMA0&username=bill%40microsoft.com&pullStatus=0	HTTP Parser: No <meta name="author".. found

Source: https://0nline.babjeetrading.com/?bond=john_smith@company.com&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://0nline.babjeetrading.com/?bond=john_smith@company.com&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://0nline.babjeetrading.com/?bond=john_smith@company.com&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://0nline.babjeetrading.com/?bond=john_smith@company.com&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://15da7cc3-3e1e66dd.babjeetrading.com/adfs/ls/?login_hint=john_smith%40company.com&client-request-id=8f1de839-f25d-4e98-be19-bfd71706122d&wa=wsignin1.0&wtrealm=urn:federation:MicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3D2%26estsrequest%3DrQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAQsX8j2x36a4bdPcv91cTYh3VWMyoSN0L_AyPiCkXESk1hWfkZefHFuZkmGA1C8IDGvEiR_i0nQvyjdMyW82C01JbUosSQzP-8Rs1BSZk6OA9w4kMILLAKvWHgMmK04OLgEGCQYFBh-sDAuYgW669Gj248jjga7rGOc6XNBnpHhFKt-iFuIU2hqUpVRmreHWZqTm7NjlZdxhXeeUZ5zlJGjq597vlNOgGlmSXGor62JleEENqEJbEyn2Bg-sDF2sDPMYmc4wMl4gJfhB19H56qWC_92vfN4xa-T5Wrk5VppGGgc6GLuku9tURaSmhmUUZbvnWKckWvo4uaY71rlmmZalOdsYLtBgOGBAAMA0&username=bill%40microsoft.com&pullStatus=0	HTTP Parser: No <meta name="copyright".. found
Source: https://15da7cc3-3e1e66dd.babjeetrading.com/adfs/ls/?login_hint=john_smith%40company.com&client-request-id=8f1de839-f25d-4e98-be19-bfd71706122d&wa=wsignin1.0&wtrealm=urn:federation:MicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3D2%26estsrequest%3DrQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAQsX8j2x36a4bdPcv91cTYh3VWMyoSN0L_AyPiCkXESk1hWfkZefHFuZkmGA1C8IDGvEiR_i0nQvyjdMyW82C01JbUosSQzP-8Rs1BSZk6OA9w4kMILLAKvWHgMmK04OLgEGCQYFBh-sDAuYgW669Gj248jjga7rGOc6XNBnpHhFKt-iFuIU2hqUpVRmreHWZqTm7NjlZdxhXeeUZ5zlJGjq597vlNOgGlmSXGor62JleEENqEJbEyn2Bg-sDF2sDPMYmc4wMl4gJfhB19H56qWC_92vfN4xa-T5Wrk5VppGGgc6GLuku9tURaSmhmUUZbvnWKckWvo4uaY71rlmmZalOdsYLtBgOGBAAMA0&username=bill%40microsoft.com&pullStatus=0	HTTP Parser: No <meta name="copyright".. found
Source: https://15da7cc3-3e1e66dd.babjeetrading.com/adfs/ls/?login_hint=john_smith%40company.com&client-request-id=8f1de839-f25d-4e98-be19-bfd71706122d&wa=wsignin1.0&wtrealm=urn:federation:MicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3D2%26estsrequest%3DrQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAQsX8j2x36a4bdPcv91cTYh3VWMyoSN0L_AyPiCkXESk1hWfkZefHFuZkmGA1C8IDGvEiR_i0nQvyjdMyW82C01JbUosSQzP-8Rs1BSZk6OA9w4kMILLAKvWHgMmK04OLgEGCQYFBh-sDAuYgW669Gj248jjga7rGOc6XNBnpHhFKt-iFuIU2hqUpVRmreHWZqTm7NjlZdxhXeeUZ5zlJGjq597vlNOgGlmSXGor62JleEENqEJbEyn2Bg-sDF2sDPMYmc4wMl4gJfhB19H56qWC_92vfN4xa-T5Wrk5VppGGgc6GLuku9tURaSmhmUUZbvnWKckWvo4uaY71rlmmZalOdsYLtBgOGBAAMA0&username=bill%40microsoft.com&pullStatus=0	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49774 version: TLS 1.2

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 30MB

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: aa.ns.agingbydesignministry.org
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: 0nline.babjeetrading.com
Source: global traffic	DNS traffic detected: DNS query: 61e6f3ed-3e1e66dd.babjeetrading.com
Source: global traffic	DNS traffic detected: DNS query: 9d591190-3e1e66dd.babjeetrading.com
Source: global traffic	DNS traffic detected: DNS query: eabc60fc-3e1e66dd.babjeetrading.com
Source: global traffic	DNS traffic detected: DNS query: l1ve.babjeetrading.com
Source: global traffic	DNS traffic detected: DNS query: dd8f6fc2-3e1e66dd.babjeetrading.com
Source: global traffic	DNS traffic detected: DNS query: 8c1cd37c-3e1e66dd.babjeetrading.com
Source: global traffic	DNS traffic detected: DNS query: 15da7cc3-3e1e66dd.babjeetrading.com
Source: global traffic	DNS traffic detected: DNS query: 777ce323-3e1e66dd.babjeetrading.com
Source: global traffic	DNS traffic detected: DNS query: 11279407-3e1e66dd.babjeetrading.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49774 version: TLS 1.2

Source: classification engine

Classification label: mal72.phis.win@19/52@46/190

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2100 --field-trial-handle=2032,i,14475709619503712584,10795689494528793694,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://aa.ns.agingbydesignministry.org/?company=john_smith@company.com/1/01020192845e78dd-2d6e57c1-2477-4368-9808-e405234d7366-000000/JciFxQG6yOVw83-lKIliC63cjw4=395"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2100 --field-trial-handle=2032,i,14475709619503712584,10795689494528793694,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.35	unknown	United States	15169	GOOGLEUS	false
142.250.185.67	unknown	United States	15169	GOOGLEUS	false
172.236.233.44	0nline.babjeetrading.com	United States	20940	AKAMAI-ASN1EU	true
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
216.58.212.131	unknown	United States	15169	GOOGLEUS	false
216.58.206.78	unknown	United States	15169	GOOGLEUS	false
172.217.23.106	unknown	United States	15169	GOOGLEUS	false
142.250.185.227	unknown	United States	15169	GOOGLEUS	false
142.250.185.106	unknown	United States	15169	GOOGLEUS	false
216.58.206.36	unknown	United States	15169	GOOGLEUS	false
216.58.206.46	unknown	United States	15169	GOOGLEUS	false
142.251.168.84	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.217.23.99	unknown	United States	15169	GOOGLEUS	false
142.250.181.228	unknown	United States	15169	GOOGLEUS	false
142.250.186.100	unknown	United States	15169	GOOGLEUS	false
142.250.184.227	unknown	United States	15169	GOOGLEUS	false
172.217.16.196	www.google.com	United States	15169	GOOGLEUS	false
44.206.164.171	server-38541367.us-east-1.elb.amazonaws.com	United States	14618	AMAZON-AESUS	false
142.250.184.202	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.17
192.168.2.16

Contacted Domains

Name	IP	Active
0nline.babjeetrading.com	172.236.233.44	true
9d591190-3e1e66dd.babjeetrading.com	172.236.233.44	true
15da7cc3-3e1e66dd.babjeetrading.com	172.236.233.44	true
777ce323-3e1e66dd.babjeetrading.com	172.236.233.44	true
dd8f6fc2-3e1e66dd.babjeetrading.com	172.236.233.44	true
8c1cd37c-3e1e66dd.babjeetrading.com	172.236.233.44	true
61e6f3ed-3e1e66dd.babjeetrading.com	172.236.233.44	true
www.google.com	172.217.16.196	true
eabc60fc-3e1e66dd.babjeetrading.com	172.236.233.44	true
11279407-3e1e66dd.babjeetrading.com	172.236.233.44	true
l1ve.babjeetrading.com	172.236.233.44	true
server-38541367.us-east-1.elb.amazonaws.com	44.206.164.171	true
aa.ns.agingbydesignministry.org	unknown	unknown

Contacted URLs

Name	Malicious	Reputation
https://0nline.babjeetrading.com/?bond=john_smith@company.com	true	unknown
https://aa.ns.agingbydesignministry.org/?company=john_smith@company.com/1/01020192845e78dd-2d6e57c1-2477-4368-9808-e405234d7366-000000/JciFxQG6yOVw83-lKIliC63cjw4=395	false	unknown
https://0nline.babjeetrading.com/?bond=john_smith@company.com&sso_reload=true	true	unknown

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 14 01:06:51 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	DF0D770E4A7F213C1B9EE359EEB33D13	B1C0F946F4BF0CF5082CA2040258BCE21B7C93BF	3932333FC1E2D77097CD07807062DAFACDB3D7D812C8371E4545B0CA21F9C3EF
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 14 01:06:51 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	F6661DAC363B328F01BE7A8CDBAC0F62	2F7AC755EFD44912957605BCAC1C2CF309CDCB9F	C6FBFA5D4B83D170400B27FC064DBD1A2D0E2EDADB8D27FC0051DB2312425EBF
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	3A4BEDAB21F7D70739FA2E060082436E	D124D2EF30B8BF70DB82B0D05C311EDAE3086C78	786B4B6DC572E16A05565595EF5C28F79AC94909F7B9CF64D4FE9A1C36E95C90
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 14 01:06:51 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	B6C45F9EC6E20D9CA003CEFFDAD23692	7AAE5D3BBB0C20E1B886245BAD322AE5FA00E7CE	47F3A52D4AC6007C56BED8A3E92677F2C71DD1A8E05F863C569B94B79056DDEF
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 14 01:06:51 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	BBF7800697DDBFC5AEA0AEEA3D9575A1	9E6BF78CAD47EBBB82319CB61981408811F0FE7F	AA4DF7C27A51B2DB4C1EB603A2A358E91ED9D2D40C5C6949A2397E9478E704DF
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 14 01:06:51 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	23E707928DA0BAEEEAD54553AB2DF764	B428CF4EEF8666A879F9B2AA59E849FB1535D081	9B98D193952387041F47465C328EAC7F7CB3A55192B3660E0DA59DC9C74CEF90
Chrome Cache Entry: 100	ASCII text, with no line terminators	BCE74A066E68DD96B3B2540376EC6DBC	A28403B9557EE9ADA5CEF53311CDBA6B9444F9B3	3A1428F58A249E270186BCACA0B75F8B2BCC42324D711107791A9A343BD76BEA
Chrome Cache Entry: 101	gzip compressed data, original size modulo 2^32 3651	DF6A7721C242813411CC6950DF40F9B3	B2068C4A65C183AAD6FC22A44CC1FA449CD355B4	AA53B6DC744357B392FC57C34E516BAE465D4A6837775C137A176D599C8EA948
Chrome Cache Entry: 102	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 100x100, components 3	232C1250BF8223BE830E401A928D27EC	88FD406AFEECE528D59EFFD748243F5EA96CAD10	4E5B8A948095BB502DE41A7FD57ED73B37666959F468905FFB73DB8E90D2B982
Chrome Cache Entry: 104	gzip compressed data, from Unix, original size modulo 2^32 449673	B005A13CA9FBAC0EB850118D0015962D	74C245C53B5F1C168190EF3C9245AB4F1A4A81B3	AFB533CDDAFBEE179E252F50847213823BA2ADB6F16D6DAD6885842A288599C1
Chrome Cache Entry: 107	Web Open Font Format (Version 2), TrueType, length 15340, version 1.0	19B7A0ADFDD4F808B53AF7E2CE2AD4E5	81D5D4C7B5035AD10CCE63CF7100295E0C51FDDA	C912A9CE0C3122D4B2B29AD26BFE06B0390D1A5BDAA5D6128692C0BEFD1DFBBD
Chrome Cache Entry: 108	PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced	0F2A4639B8A4CB30C76E8333C00D30A6	57E273A270BB864970D747C74B3F0A7C8E515B13	44B988703019CD6BFA86C91840FECF2A42B611B364E3EEA2F4EB63BF62714E98
Chrome Cache Entry: 109	PNG image data, 216 x 46, 8-bit/color RGBA, non-interlaced	9F14C20150A003D7CE4DE57C298F0FBA	DAA53CF17CC45878A1B153F3C3BF47DC9669D78F	112FEC798B78AA02E102A724B5CB1990C0F909BC1D8B7B1FA256EAB41BBC0960
Chrome Cache Entry: 110	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 100x100, components 3	D2750FD9E7DCF70491761FBECFF4D7EA	C02F2A508088A4CF80644DF1DA966D015DDE7D6B	1CF071E355674F54E02319BD67B2D9EA35BC096AC78DFDCB07D25F29E801429A
Chrome Cache Entry: 112	PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced	07BF314AAB04047B9E9A959EE6F63DA3	17BEF6602672E2FD9956381E01356245144003E5	55EAF62CB05DA20088DC12B39D7D254D046CB1FD61DDF3AE641F1439EFD0A5EE
Chrome Cache Entry: 113	gzip compressed data, from Unix, original size modulo 2^32 3569	DDCFDE5FF2ACC44DC914668F7CDA3E63	FFD161F04B3E2BCD8897A9FEB0DD9FD7339D7326	19F97579F93BE7634E374BB809E22E6D54A34F935CE6125D64DF257695E54253
Chrome Cache Entry: 115	Web Open Font Format (Version 2), TrueType, length 14940, version 1.0	A46FB7AAE99225FDFD9D64B2B8B1063F	1EE50BF5985C1956DDE1C06D9B1CEC4645DDB92B	4B5816BBFC52587979139951355FE4048DA02CE60E40CEF8E4A1EFB6CD396281
Chrome Cache Entry: 116	HTML document, ASCII text, with CRLF line terminators	5343C1A8B203C162A3BF3870D9F50FD4	04B5B886C20D88B57EEA6D8FF882624A4AC1E51D	DC1D54DAB6EC8C00F70137927504E4F222C8395F10760B6BEECFCFA94E08249F
Chrome Cache Entry: 117	gzip compressed data, from Unix, original size modulo 2^32 2525	399880F5EF8B4042DC4D23DBA9F9BE78	38C496BD80196357E5EF82D680B31BCB703EBC1F	1CCB149181BD6B7CFE735AD50BB5DABD4B8AE5C7B7612B3BD77696A1139D82AC
Chrome Cache Entry: 121	ASCII text	EBB1FA2B87ABED3D7E7A57B6F4164586	434172051D34D35C7205BCA0A59A146D622855DD	E43426DB8ACDB169400777C28A199C2D9B32DDAA7AE3444A8BA0FAA45B6189C7
Chrome Cache Entry: 122	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 100x100, components 3	1BE8F824B0B646BDA495A284F16BF65D	AB85A85B1188AC8B28F5A8CF6919BED84FA8E5C0	25DE2F6CFAC7B7C51282CEE33358B2478D58FB9E6E0F7549EE7A38F13CE1A288
Chrome Cache Entry: 123	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 100x100, components 3	9F735C1579F60C605CA6543B6F9E98F2	A4C21EA19CB30C595A4C5B516BABF479979158E8	8BC1FCA18FCA4588CE6251C14A3380F17174983144502E6BC62AF94E04AE87EE
Chrome Cache Entry: 127	ASCII text, with very long lines (1434), with no line terminators	428199CEE2F0EEB6B22877D19E9A5948	8904CC6022394076F644563F5AADCB999A23B9E5	9BB78787D230094E7B59FD220AF0A87160630712D25307D3DBEF05FB554A261F
Chrome Cache Entry: 128	gzip compressed data, from Unix, original size modulo 2^32 113401	7E18E71D589531855CF589482EAB8174	05F69583C81A69910337CFC736EDC8CE67544DBF	7C0DF71DA7BB0F2C55BE83B8BA31FCA820E7F856CDA39A0BD009584B6FB36B3B
Chrome Cache Entry: 129	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced	EF9941290C50CD3866E2BA6B793F010D	4736508C795667DCEA21F8D864233031223B7832	1B9EFB22C938500971AAC2B2130A475FA23684DD69E43103894968DF83145B8A
Chrome Cache Entry: 132	gzip compressed data, from Unix, original size modulo 2^32 96722	1C037236AAB435D9BF0B193E5596C15C	96C3D03AEC7A838AE8F8A06D357ECCCDD137F2EC	EA6F0F265C1E77AEEF1F94B70BA69B9C21AEF2A3D4692B824C13B6DA0AAEC8DC
Chrome Cache Entry: 133	ASCII text, with very long lines (65536), with no line terminators	A0CE64213F4F6193A598DE1CDBAEA665	FEC9A873B214601198F7312BCB1BF99204014085	F0DFF86310E9D08A2D80DBE68BAE9367F8CD6CBD4B7D036F09B0702D035C7E8C
Chrome Cache Entry: 134	GIF image data, version 89a, 352 x 3	166DE53471265253AB3A456DEFE6DA23	17C6DF4D7CCF1FA2C9EFD716FBAE0FC2C71C8D6D	A46201581A7C7C667FD42787CD1E9ADF2F6BF809EFB7596E61A03E8DBA9ADA13
Chrome Cache Entry: 135	MS Windows icon resource - 6 icons, 16x16 with PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, 24x24 with PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced, 32 bits/pixel	7E0D59593F3377B72C29435C4B43954A	B4C5C39A6DFB460BBD2EACCEB09EC8079FB6A8E2	62D706019A0D80173113EF70FBBEE12F286E8E221534BE788448AADA4B14C8E8
Chrome Cache Entry: 140	HTML document, ASCII text	E158682C49201F8CE0FC84971481EDAC	D187459385DFDF84A1ADB154FF535009B8F72DD6	740F4BE9FE2C3DC71887DBC12D7E5315BE97E2E64153A467218B1655EE13D019
Chrome Cache Entry: 141	ASCII text, with very long lines (18026)	B6C546033517E98BCD9F15795CAA6358	3A2158811157E0D0C6A29A6AAA5472A186283B98	F49671129D0B86D684D6FD06C69A71603FA6338378F2E07640F8C769BABF78E6
Chrome Cache Entry: 142	gzip compressed data, from Unix, original size modulo 2^32 57443	210F3C4E623D333CB94746CEC563DE09	887911B0BCA564AFEC25787B44A98F16EBF7ACA3	4792643ECEBF0EEAA641474C9A1BA39D16D2F924C6B5A6FCB8FC443A5FE59F44
Chrome Cache Entry: 144	ASCII text, with no line terminators	AFB69DF47958EB78B4E941270772BD6A	D9FE9A625E906FF25C1F165E7872B1D9C731E78E	874809FB1235F80831B706B9E9B903D80BD5662D036B7712CC76F8C684118878
Chrome Cache Entry: 145	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 300x300, components 3	C4FE6DC6FA1E2C5659840C8A562D3C57	BA0A3564AB0A353022016E09A9AD0EAB91AAC8E0	BDE9FEA1AE5F1AEA5AA0ABAE18A73E1B5184958DF90717070C7ACE38AAA90C9D
Chrome Cache Entry: 147	gzip compressed data, original size modulo 2^32 1592	ECC8894D3791BEDDB4E0226F8DAB065A	6510EB51E76A49746C526E432455549B50DE5AF1	64C8C0A9EFBC27AD86EAEC90465B75C52AE8CD68F7E76FC9431DC6AE66072AC3
Chrome Cache Entry: 148	gzip compressed data, from Unix, original size modulo 2^32 141825	ABBE12FAFEEC76ADAD0A1F3ED506F7EE	61B40FC00B7ACA607C27597FC2DE74018F282381	0EEF9DE611A4239DCA8F9B2F3AEE147C41E39B35074B9883247C27884B77BBB3
Chrome Cache Entry: 151	gzip compressed data, from Unix, original size modulo 2^32 113811	C1A7A0C86D22263096B29489149930A6	1207CEA65DAB3DE885A5D5A2017261EEB1F5F567	621F3C6FED2855CC79919004FA1B8D77F329E15E691D602B16CA3CCC6FB1AB8B
Chrome Cache Entry: 152	Web Open Font Format (Version 2), TrueType, length 15344, version 1.0	5D4AEB4E5F5EF754E307D7FFAEF688BD	06DB651CDF354C64A7383EA9C77024EF4FB4CEF8	3E253B66056519AA065B00A453BAC37AC5ED8F3E6FE7B542E93A9DCDCC11D0BC
Chrome Cache Entry: 153	GIF image data, version 89a, 352 x 3	B540A8E518037192E32C4FE58BF2DBAB	3047C1DB97B86F6981E0AD2F96AF40CDF43511AF	8737D721808655F37B333F08A90185699E7E8B9BDAAA15CDB63C8448B426F95D
Chrome Cache Entry: 154	gzip compressed data, from Unix, original size modulo 2^32 2809	0F19DF8B6A227FA424ED16844758D37C	1D3472ED1341800753932D74F3983DF9B0451CD3	104F25A3C31133E184E3C0D90E6B91F73571442AD190735856C1FDD919383DD1
Chrome Cache Entry: 155	gzip compressed data, original size modulo 2^32 1864	2D2CBA7D7DC75F3BA9DC756738D41A6E	F87FD26066ED5E52A65DEE0ED2D581D3C3EA15AC	00E21864CF1BC70302EBB5B496C6C471A7DA8CBF600630B478A3E2376ED20EA2
Chrome Cache Entry: 157	Web Open Font Format (Version 2), TrueType, length 15552, version 1.0	285467176F7FE6BB6A9C6873B3DAD2CC	EA04E4FF5142DDD69307C183DEF721A160E0A64E	5A8C1E7681318CAA29E9F44E8A6E271F6A4067A2703E9916DFD4FE9099241DB7
Chrome Cache Entry: 159	ASCII text, with no line terminators	F3DFE1A46E91C1C5521B4ED0E336AE06	8112055ED07A442DD199C15A8B2C451A3E4B54E6	724FC56703E050F8625D033339E4C69746C05564BA34DF35003A34ED59432657
Chrome Cache Entry: 160	PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced	88E0F42C9FA4F94AA8BCD54D1685C180	5AD9D47A49B82718BAA3BE88550A0B3350270C42	89C62095126FCA89EA1511CF35B49B8306162946B0C26D6F60C5506C51D85992
Chrome Cache Entry: 162	HTML document, ASCII text, with very long lines (617)	99210E7C2195DE81C0EEDF98787A69B3	7B26C66058385B60109AA6129C2161A399A6034D	5F75BFBFBF0C7CAC2C87D6CA5DE0661AEDC188B0900B6CEF5EFBAEA134B53302
Chrome Cache Entry: 164	Unicode text, UTF-8 (with BOM) text, with very long lines (523), with CRLF line terminators	4E83011A56CDA084DDC2AE17863FB548	BAF326A140F1B28F818A3C61BF2B405623F717C1	662A3B02F40F2A4B3BB97889A3E6C681EFB452728D8E77E0F97203AE5C53057E
Chrome Cache Entry: 90	ASCII text, with no line terminators	4A32AF314729B3C66EFCEF19720B21B6	A4B2B55267A0C0A49AEC3DF82975F6960E4AE860	29A61A6C9F51F9850CC4327AA54478B3A7290E2B5E7592BAC2964B9DC72D3F00
Chrome Cache Entry: 92	gzip compressed data, from Unix, original size modulo 2^32 2990	13DA844EB1F64F9796190023E9AA69C4	6A200ACEFD00944BA5550187AC58007FCC60B8A0	8B5046A7B8E0C239968DD50E252289BCC46EE3B2A1720679AB69E5DAFB5140FF
Chrome Cache Entry: 93	ASCII text, with no line terminators	9F9FA94F28FE0DE82BC8FD039A7BDB24	6FE91F82974BD5B101782941064BCB2AFDEB17D8	9A37FDC0DBA8B23EB7D3AA9473D59A45B3547CF060D68B4D52253EE0DA1AF92E
Chrome Cache Entry: 94	gzip compressed data, from Unix, original size modulo 2^32 407106	26E022E3A97879A3CED811DCAF6E4F37	7C92CCE9D96CB812798F032D00140248B8F713C7	922E8437BBB71BAAA25B89C683E9385D128C0AF96391F51E4CE2A8D2D26E70A3
Chrome Cache Entry: 95	gzip compressed data, from Unix, original size modulo 2^32 23768	C7B0E69DE3ADDA3C2451F81C7069D487	5478E17E72E751BE1792D558FC92905AB14BEF6B	9BBB7C16B412407E481F64547D79525A54ED6CB954CE973527C274F9D109ACCD
Chrome Cache Entry: 99	JPEG image data, baseline, precision 8, 1920x1080, components 3	7916A894EBDE7D29C2CC29B267F1299F	78345CA08F9E2C3C2CC9B318950791B349211296	D8F5AB3E00202FD3B45BE1ACD95D677B137064001E171BC79B06826D98F1E1D3

Phishing

AI detected phishing page

Source: https://15da7cc3-3e1e66dd.babjeetrading.com/adfs/ls/?login_hint=john_smith%40company.com&client-request-id=8f1de839-f25d-4e98-be19-bfd71706122d&wa=wsignin1.0&wtrealm=urn:federation:MicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3D2%26estsrequest%3DrQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAQsX8j2x36a4bdPcv91cTYh3VWMyoSN0L_AyPiCkXESk1hWfkZefHFuZkmGA1C8IDGvEiR_i0nQvyjdMyW82C01JbUosSQzP-8Rs1BSZk6OA9w4kMILLAKvWHgMmK04OLgEGCQYFBh-sDAuYgW669Gj248jjga7rGOc6XNBnpHhFKt-iFuIU2hqUpVRmreHWZqTm7NjlZdxhXeeUZ5zlJGjq597vlNOgGlmSXGor62JleEENqEJbEyn2Bg-sDF2sDPMYmc4wMl4gJfhB19H56qWC_92vfN4xa-T5Wrk5VppGGgc6GLuku9tURaSmhmUUZbvnWKckWvo4uaY71rlmmZalOdsYLtBgOGBAAMA0&username=bill%40microsoft.com&pullStatus=0	LLM: Score: 9 Reasons: The brand 'Microsoft' is a well-known global technology company., The URL '15da7cc3-3e1e66dd.babjeetrading.com' does not match the legitimate domain 'microsoft.com'., The domain 'babjeetrading.com' is not associated with Microsoft., The presence of a password input field on a non-legitimate domain is suspicious., The subdomain '15da7cc3-3e1e66dd' is unusual and does not align with Microsoft's typical subdomain structure. DOM: 4.18.pages.csv
Source: https://15da7cc3-3e1e66dd.babjeetrading.com/adfs/ls/?login_hint=john_smith%40company.com&client-request-id=8f1de839-f25d-4e98-be19-bfd71706122d&wa=wsignin1.0&wtrealm=urn:federation:MicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3D2%26estsrequest%3DrQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAQsX8j2x36a4bdPcv91cTYh3VWMyoSN0L_AyPiCkXESk1hWfkZefHFuZkmGA1C8IDGvEiR_i0nQvyjdMyW82C01JbUosSQzP-8Rs1BSZk6OA9w4kMILLAKvWHgMmK04OLgEGCQYFBh-sDAuYgW669Gj248jjga7rGOc6XNBnpHhFKt-iFuIU2hqUpVRmreHWZqTm7NjlZdxhXeeUZ5zlJGjq597vlNOgGlmSXGor62JleEENqEJbEyn2Bg-sDF2sDPMYmc4wMl4gJfhB19H56qWC_92vfN4xa-T5Wrk5VppGGgc6GLuku9tURaSmhmUUZbvnWKckWvo4uaY71rlmmZalOdsYLtBgOGBAAMA0&username=bill%40microsoft.com&pullStatus=0	LLM: Score: 9 Reasons: The brand 'Microsoft' is a well-known global technology company., The legitimate domain for Microsoft is 'microsoft.com'., The provided URL '15da7cc3-3e1e66dd.babjeetrading.com' does not match the legitimate domain., The URL contains a random alphanumeric subdomain and a different primary domain 'babjeetrading.com', which is not associated with Microsoft., The presence of a well-known brand name in the input fields suggests an attempt to impersonate Microsoft., The URL structure and domain name are suspicious and indicative of a phishing attempt. DOM: 4.19.pages.csv

AI detected phishing page (G)

Source: https://0nline.babjeetrading.com/?bond=john_smith@company.com	LLM: Score: 10 Reasons: The URL "0nline.babjeetrading.com" is highly suspicious. The use of "0" (zero) instead of "o" (the letter 'o') is a common tactic in phishing attacks to mimic legitimate URLs. The brand name "reCAPTCHA" is associated with Google and its domain "google.com". The presented URL does not match the legitimate domain, suggesting a potential phishing attempt. The presence of only one input field, "I'm not a robot," while characteristic of reCAPTCHA, doesn't confirm legitimacy in this context given the suspicious URL. The domain "babjeetrading.com" is not related to Google or reCAPTCHA, further raising suspicion. DOM: 1.4.pages.csv
Source: https://0nline.babjeetrading.com/?bond=john_smith@company.com&sso_reload=true	LLM: Score: 10 Reasons: The URL "0nline.babjeetrading.com" is highly suspicious. The presence of a numeral '0' at the beginning of a subdomain is unusual and often used in phishing attempts to mimic the letter 'o'., The domain "babjeetrading.com" has no clear association with Microsoft. This strong mismatch between the provided brand name (Microsoft) and the base domain raises a significant red flag., The input field containing an email address suggests a potential attempt to collect user credentials, a common phishing tactic. DOM: 2.14.pages.csv
Source: https://15da7cc3-3e1e66dd.babjeetrading.com/adfs/ls/?login_hint=john_smith%40company.com&client-request-id=8f1de839-f25d-4e98-be19-bfd71706122d&wa=wsignin1.0&wtrealm=urn:federation:MicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3D2%26estsrequest%3DrQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAQsX8j2x36a4bdPcv91cTYh3VWMyoSN0L_AyPiCkXESk1hWfkZefHFuZkmGA1C8IDGvEiR_i0nQvyjdMyW82C01JbUosSQzP-8Rs1BSZk6OA9w4kMILLAKvWHgMmK04OLgEGCQYFBh-sDAuYgW669Gj248jjga7rGOc6XNBnpHhFKt-iFuIU2hqUpVRmreHWZqTm7NjlZdxhXeeUZ5zlJGjq597vlNOgGlmSXGor62JleEENqEJbEyn2Bg-sDF2sDPMYmc4wMl4gJfhB19H56qWC_92vfN4xa-T5Wrk5VppGGgc6GLuku9tURaSmhmUUZbvnWKckWvo4uaY71rlmmZalOdsYLtBgOGBAAMA0&username=bill%40microsoft.com&pullStatus=0	LLM: Score: 10 Reasons: The URL contains a random prefix '15da7cc3-3e1e66dd' which is very unusual for legitimate Microsoft sites., The domain 'babjeetrading.com' does not belong to Microsoft. It is highly suspicious that a well-known brand like Microsoft would use a third-party domain, especially one with an unrelated name like 'babjeetrading'., The presence of a password field on a site mimicking a well-known brand raises red flags. Phishers often use such fields to steal login credentials. DOM: 4.18.pages.csv
Source: https://15da7cc3-3e1e66dd.babjeetrading.com/adfs/ls/?login_hint=john_smith%40company.com&client-request-id=8f1de839-f25d-4e98-be19-bfd71706122d&wa=wsignin1.0&wtrealm=urn:federation:MicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3D2%26estsrequest%3DrQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAQsX8j2x36a4bdPcv91cTYh3VWMyoSN0L_AyPiCkXESk1hWfkZefHFuZkmGA1C8IDGvEiR_i0nQvyjdMyW82C01JbUosSQzP-8Rs1BSZk6OA9w4kMILLAKvWHgMmK04OLgEGCQYFBh-sDAuYgW669Gj248jjga7rGOc6XNBnpHhFKt-iFuIU2hqUpVRmreHWZqTm7NjlZdxhXeeUZ5zlJGjq597vlNOgGlmSXGor62JleEENqEJbEyn2Bg-sDF2sDPMYmc4wMl4gJfhB19H56qWC_92vfN4xa-T5Wrk5VppGGgc6GLuku9tURaSmhmUUZbvnWKckWvo4uaY71rlmmZalOdsYLtBgOGBAAMA0&username=bill%40microsoft.com&pullStatus=0	LLM: Score: 10 Reasons: The URL contains a random prefix '15da7cc3-3e1e66dd' which is very unusual for legitimate Microsoft sites., The domain 'babjeetrading.com' does not belong to Microsoft. It is highly suspicious that a well-known brand like Microsoft would use a third-party domain, especially one with an unrelated name like 'babjeetrading'., The presence of a password field on a site mimicking a well-known brand raises red flags. Phishers often use such fields to steal login credentials. DOM: 4.19.pages.csv

Yara detected HtmlPhish54

Source: Yara match	File source: 2.11.pages.csv, type: HTML
Source: Yara match	File source: 2.12.pages.csv, type: HTML

Phishing site detected (based on favicon image match)

Source: https://0nline.babjeetrading.com/?bond=john_smith@company.com&sso_reload=true

Matcher: Template: microsoft matched with high similarity

Phishing site detected (based on image similarity)

Source: https://0nline.babjeetrading.com/?bond=john_smith@company.com&sso_reload=true

Matcher: Found strong image similarity, brand: MICROSOFT

Detected hidden input values containing email addresses (often used in phishing pages)

HTTP Parser: bill@microsoft.com

HTML body contains low number of good links

Source: https://0nline.babjeetrading.com/?bond=john_smith@company.com&sso_reload=true	HTTP Parser: Number of links: 0
Source: https://15da7cc3-3e1e66dd.babjeetrading.com/adfs/ls/?login_hint=john_smith%40company.com&client-request-id=8f1de839-f25d-4e98-be19-bfd71706122d&wa=wsignin1.0&wtrealm=urn:federation:MicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3D2%26estsrequest%3DrQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAQsX8j2x36a4bdPcv91cTYh3VWMyoSN0L_AyPiCkXESk1hWfkZefHFuZkmGA1C8IDGvEiR_i0nQvyjdMyW82C01JbUosSQzP-8Rs1BSZk6OA9w4kMILLAKvWHgMmK04OLgEGCQYFBh-sDAuYgW669Gj248jjga7rGOc6XNBnpHhFKt-iFuIU2hqUpVRmreHWZqTm7NjlZdxhXeeUZ5zlJGjq597vlNOgGlmSXGor62JleEENqEJbEyn2Bg-sDF2sDPMYmc4wMl4gJfhB19H56qWC_92vfN4xa-T5Wrk5VppGGgc6GLuku9tURaSmhmUUZbvnWKckWvo4uaY71rlmmZalOdsYLtBgOGBAAMA0&username=bill%40microsoft.com&pullStatus=0	HTTP Parser: Number of links: 0

HTML page contains hidden javascript code

Source: https://0nline.babjeetrading.com/?bond=john_smith@company.com

HTTP Parser: Base64 decoded: a[href="http://www.salidzini.lv/"][style="display: block; width: 120px; height: 40px; overflow: hidden; position: relative;"]

HTML title does not match URL

Source: https://0nline.babjeetrading.com/?bond=john_smith@company.com&sso_reload=true	HTTP Parser: Title: Sign in to your account does not match URL
Source: https://15da7cc3-3e1e66dd.babjeetrading.com/adfs/ls/?login_hint=john_smith%40company.com&client-request-id=8f1de839-f25d-4e98-be19-bfd71706122d&wa=wsignin1.0&wtrealm=urn:federation:MicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3D2%26estsrequest%3DrQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAQsX8j2x36a4bdPcv91cTYh3VWMyoSN0L_AyPiCkXESk1hWfkZefHFuZkmGA1C8IDGvEiR_i0nQvyjdMyW82C01JbUosSQzP-8Rs1BSZk6OA9w4kMILLAKvWHgMmK04OLgEGCQYFBh-sDAuYgW669Gj248jjga7rGOc6XNBnpHhFKt-iFuIU2hqUpVRmreHWZqTm7NjlZdxhXeeUZ5zlJGjq597vlNOgGlmSXGor62JleEENqEJbEyn2Bg-sDF2sDPMYmc4wMl4gJfhB19H56qWC_92vfN4xa-T5Wrk5VppGGgc6GLuku9tURaSmhmUUZbvnWKckWvo4uaY71rlmmZalOdsYLtBgOGBAAMA0&username=bill%40microsoft.com&pullStatus=0	HTTP Parser: Title: Sign In does not match URL

URL contains potential PII (phishing indication)

Source: https://aa.ns.agingbydesignministry.org/?company=john_smith@company.com/1/01020192845e78dd-2d6e57c1-2477-4368-9808-e405234d7366-000000/JciFxQG6yOVw83-lKIliC63cjw4=395	Sample URL: PII: john_smith@company.com
Source: https://aa.ns.agingbydesignministry.org/?company=john_smith@company.com/1/01020192845e78dd-2d6e57c1-2477-4368-9808-e405234d7366-000000/JciFxQG6yOVw83-lKIliC63cjw4=395	Sample URL: PII: john_smith@company.com
Source: https://aa.ns.agingbydesignministry.org/?company=john_smith@company.com/1/01020192845e78dd-2d6e57c1-2477-4368-9808-e405234d7366-000000/JciFxQG6yOVw83-lKIliC63cjw4=395	Sample URL: PII: john_smith@company.com
Source: https://aa.ns.agingbydesignministry.org/?company=john_smith@company.com/1/01020192845e78dd-2d6e57c1-2477-4368-9808-e405234d7366-000000/JciFxQG6yOVw83-lKIliC63cjw4=395	Sample URL: PII: john_smith@company.com
Source: https://aa.ns.agingbydesignministry.org/?company=john_smith@company.com/1/01020192845e78dd-2d6e57c1-2477-4368-9808-e405234d7366-000000/JciFxQG6yOVw83-lKIliC63cjw4=395	Sample URL: PII: john_smith@company.com
Source: https://aa.ns.agingbydesignministry.org/?company=john_smith@company.com/1/01020192845e78dd-2d6e57c1-2477-4368-9808-e405234d7366-000000/JciFxQG6yOVw83-lKIliC63cjw4=395	Sample URL: PII: john_smith@company.com
Source: https://aa.ns.agingbydesignministry.org/?company=john_smith@company.com/1/01020192845e78dd-2d6e57c1-2477-4368-9808-e405234d7366-000000/JciFxQG6yOVw83-lKIliC63cjw4=395	Sample URL: PII: john_smith@company.com
Source: https://aa.ns.agingbydesignministry.org/?company=john_smith@company.com/1/01020192845e78dd-2d6e57c1-2477-4368-9808-e405234d7366-000000/JciFxQG6yOVw83-lKIliC63cjw4=395	Sample URL: PII: john_smith@company.com
Source: https://aa.ns.agingbydesignministry.org/?company=john_smith@company.com/1/01020192845e78dd-2d6e57c1-2477-4368-9808-e405234d7366-000000/JciFxQG6yOVw83-lKIliC63cjw4=395	Sample URL: PII: john_smith@company.com
Source: https://aa.ns.agingbydesignministry.org/?company=john_smith@company.com/1/01020192845e78dd-2d6e57c1-2477-4368-9808-e405234d7366-000000/JciFxQG6yOVw83-lKIliC63cjw4=395	Sample URL: PII: john_smith@company.com
Source: https://aa.ns.agingbydesignministry.org/?company=john_smith@company.com/1/01020192845e78dd-2d6e57c1-2477-4368-9808-e405234d7366-000000/JciFxQG6yOVw83-lKIliC63cjw4=395	Sample URL: PII: john_smith@company.com
Source: https://aa.ns.agingbydesignministry.org/?company=john_smith@company.com/1/01020192845e78dd-2d6e57c1-2477-4368-9808-e405234d7366-000000/JciFxQG6yOVw83-lKIliC63cjw4=395	Sample URL: PII: john_smith@company.com

Source: https://0nline.babjeetrading.com/?bond=john_smith@company.com&sso_reload=true	HTTP Parser: Iframe src: https://dd8f6fc2-3e1e66dd.babjeetrading.com/Prefetch/Prefetch.aspx
Source: https://0nline.babjeetrading.com/?bond=john_smith@company.com&sso_reload=true	HTTP Parser: Iframe src: https://dd8f6fc2-3e1e66dd.babjeetrading.com/Prefetch/Prefetch.aspx
Source: https://0nline.babjeetrading.com/?bond=john_smith@company.com&sso_reload=true	HTTP Parser: Iframe src: https://dd8f6fc2-3e1e66dd.babjeetrading.com/Prefetch/Prefetch.aspx
Source: https://0nline.babjeetrading.com/?bond=john_smith@company.com&sso_reload=true	HTTP Parser: Iframe src: https://dd8f6fc2-3e1e66dd.babjeetrading.com/Prefetch/Prefetch.aspx
Source: https://0nline.babjeetrading.com/?bond=john_smith@company.com&sso_reload=true	HTTP Parser: Iframe src: https://8c1cd37c-3e1e66dd.babjeetrading.com/?session_id=8f1de839-f25d-4e98-be19-bfd71706122d&instanceid=9e21cb52-25cc-4c73-b853-e8d4ae325369&assessment=asmtaadeu&requestid=e3dbe2e2-c558-4453-ae01-994cd01f0100

Source: https://0nline.babjeetrading.com/?bond=john_smith@company.com&sso_reload=true	HTTP Parser: <input type="password" .../> found
Source: https://15da7cc3-3e1e66dd.babjeetrading.com/adfs/ls/?login_hint=john_smith%40company.com&client-request-id=8f1de839-f25d-4e98-be19-bfd71706122d&wa=wsignin1.0&wtrealm=urn:federation:MicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3D2%26estsrequest%3DrQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAQsX8j2x36a4bdPcv91cTYh3VWMyoSN0L_AyPiCkXESk1hWfkZefHFuZkmGA1C8IDGvEiR_i0nQvyjdMyW82C01JbUosSQzP-8Rs1BSZk6OA9w4kMILLAKvWHgMmK04OLgEGCQYFBh-sDAuYgW669Gj248jjga7rGOc6XNBnpHhFKt-iFuIU2hqUpVRmreHWZqTm7NjlZdxhXeeUZ5zlJGjq597vlNOgGlmSXGor62JleEENqEJbEyn2Bg-sDF2sDPMYmc4wMl4gJfhB19H56qWC_92vfN4xa-T5Wrk5VppGGgc6GLuku9tURaSmhmUUZbvnWKckWvo4uaY71rlmmZalOdsYLtBgOGBAAMA0&username=bill%40microsoft.com&pullStatus=0	HTTP Parser: <input type="password" .../> found

Source: https://aa.ns.agingbydesignministry.org/?company=john_smith@company.com/1/01020192845e78dd-2d6e57c1-2477-4368-9808-e405234d7366-000000/JciFxQG6yOVw83-lKIliC63cjw4=395	HTTP Parser: No favicon
Source: https://aa.ns.agingbydesignministry.org/?company=john_smith@company.com/1/01020192845e78dd-2d6e57c1-2477-4368-9808-e405234d7366-000000/JciFxQG6yOVw83-lKIliC63cjw4=395	HTTP Parser: No favicon
Source: https://0nline.babjeetrading.com/?bond=john_smith@company.com	HTTP Parser: No favicon
Source: https://0nline.babjeetrading.com/?bond=john_smith@company.com	HTTP Parser: No favicon
Source: https://0nline.babjeetrading.com/?bond=john_smith@company.com	HTTP Parser: No favicon
Source: https://0nline.babjeetrading.com/?bond=john_smith@company.com	HTTP Parser: No favicon
Source: https://0nline.babjeetrading.com/?bond=john_smith@company.com	HTTP Parser: No favicon
Source: https://0nline.babjeetrading.com/?bond=john_smith@company.com&sso_reload=true	HTTP Parser: No favicon
Source: https://0nline.babjeetrading.com/?bond=john_smith@company.com&sso_reload=true	HTTP Parser: No favicon
Source: https://0nline.babjeetrading.com/?bond=john_smith@company.com&sso_reload=true	HTTP Parser: No favicon
Source: https://0nline.babjeetrading.com/?bond=john_smith@company.com&sso_reload=true	HTTP Parser: No favicon
Source: https://0nline.babjeetrading.com/?bond=john_smith@company.com&sso_reload=true	HTTP Parser: No favicon
Source: https://0nline.babjeetrading.com/?bond=john_smith@company.com&sso_reload=true	HTTP Parser: No favicon
Source: https://0nline.babjeetrading.com/?bond=john_smith@company.com&sso_reload=true	HTTP Parser: No favicon
Source: https://15da7cc3-3e1e66dd.babjeetrading.com/adfs/ls/?login_hint=john_smith%40company.com&client-request-id=8f1de839-f25d-4e98-be19-bfd71706122d&wa=wsignin1.0&wtrealm=urn:federation:MicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3D2%26estsrequest%3DrQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAQsX8j2x36a4bdPcv91cTYh3VWMyoSN0L_AyPiCkXESk1hWfkZefHFuZkmGA1C8IDGvEiR_i0nQvyjdMyW82C01JbUosSQzP-8Rs1BSZk6OA9w4kMILLAKvWHgMmK04OLgEGCQYFBh-sDAuYgW669Gj248jjga7rGOc6XNBnpHhFKt-iFuIU2hqUpVRmreHWZqTm7NjlZdxhXeeUZ5zlJGjq597vlNOgGlmSXGor62JleEENqEJbEyn2Bg-sDF2sDPMYmc4wMl4gJfhB19H56qWC_92vfN4xa-T5Wrk5VppGGgc6GLuku9tURaSmhmUUZbvnWKckWvo4uaY71rlmmZalOdsYLtBgOGBAAMA0&username=bill%40microsoft.com&pullStatus=0	HTTP Parser: No favicon
Source: https://15da7cc3-3e1e66dd.babjeetrading.com/adfs/ls/?login_hint=john_smith%40company.com&client-request-id=8f1de839-f25d-4e98-be19-bfd71706122d&wa=wsignin1.0&wtrealm=urn:federation:MicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3D2%26estsrequest%3DrQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAQsX8j2x36a4bdPcv91cTYh3VWMyoSN0L_AyPiCkXESk1hWfkZefHFuZkmGA1C8IDGvEiR_i0nQvyjdMyW82C01JbUosSQzP-8Rs1BSZk6OA9w4kMILLAKvWHgMmK04OLgEGCQYFBh-sDAuYgW669Gj248jjga7rGOc6XNBnpHhFKt-iFuIU2hqUpVRmreHWZqTm7NjlZdxhXeeUZ5zlJGjq597vlNOgGlmSXGor62JleEENqEJbEyn2Bg-sDF2sDPMYmc4wMl4gJfhB19H56qWC_92vfN4xa-T5Wrk5VppGGgc6GLuku9tURaSmhmUUZbvnWKckWvo4uaY71rlmmZalOdsYLtBgOGBAAMA0&username=bill%40microsoft.com&pullStatus=0	HTTP Parser: No favicon
Source: https://15da7cc3-3e1e66dd.babjeetrading.com/adfs/ls/?login_hint=john_smith%40company.com&client-request-id=8f1de839-f25d-4e98-be19-bfd71706122d&wa=wsignin1.0&wtrealm=urn:federation:MicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3D2%26estsrequest%3DrQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAQsX8j2x36a4bdPcv91cTYh3VWMyoSN0L_AyPiCkXESk1hWfkZefHFuZkmGA1C8IDGvEiR_i0nQvyjdMyW82C01JbUosSQzP-8Rs1BSZk6OA9w4kMILLAKvWHgMmK04OLgEGCQYFBh-sDAuYgW669Gj248jjga7rGOc6XNBnpHhFKt-iFuIU2hqUpVRmreHWZqTm7NjlZdxhXeeUZ5zlJGjq597vlNOgGlmSXGor62JleEENqEJbEyn2Bg-sDF2sDPMYmc4wMl4gJfhB19H56qWC_92vfN4xa-T5Wrk5VppGGgc6GLuku9tURaSmhmUUZbvnWKckWvo4uaY71rlmmZalOdsYLtBgOGBAAMA0&username=bill%40microsoft.com&pullStatus=0	HTTP Parser: No favicon

Source: https://0nline.babjeetrading.com/?bond=john_smith@company.com&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://0nline.babjeetrading.com/?bond=john_smith@company.com&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://0nline.babjeetrading.com/?bond=john_smith@company.com&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://0nline.babjeetrading.com/?bond=john_smith@company.com&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://15da7cc3-3e1e66dd.babjeetrading.com/adfs/ls/?login_hint=john_smith%40company.com&client-request-id=8f1de839-f25d-4e98-be19-bfd71706122d&wa=wsignin1.0&wtrealm=urn:federation:MicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3D2%26estsrequest%3DrQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAQsX8j2x36a4bdPcv91cTYh3VWMyoSN0L_AyPiCkXESk1hWfkZefHFuZkmGA1C8IDGvEiR_i0nQvyjdMyW82C01JbUosSQzP-8Rs1BSZk6OA9w4kMILLAKvWHgMmK04OLgEGCQYFBh-sDAuYgW669Gj248jjga7rGOc6XNBnpHhFKt-iFuIU2hqUpVRmreHWZqTm7NjlZdxhXeeUZ5zlJGjq597vlNOgGlmSXGor62JleEENqEJbEyn2Bg-sDF2sDPMYmc4wMl4gJfhB19H56qWC_92vfN4xa-T5Wrk5VppGGgc6GLuku9tURaSmhmUUZbvnWKckWvo4uaY71rlmmZalOdsYLtBgOGBAAMA0&username=bill%40microsoft.com&pullStatus=0	HTTP Parser: No <meta name="author".. found
Source: https://15da7cc3-3e1e66dd.babjeetrading.com/adfs/ls/?login_hint=john_smith%40company.com&client-request-id=8f1de839-f25d-4e98-be19-bfd71706122d&wa=wsignin1.0&wtrealm=urn:federation:MicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3D2%26estsrequest%3DrQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAQsX8j2x36a4bdPcv91cTYh3VWMyoSN0L_AyPiCkXESk1hWfkZefHFuZkmGA1C8IDGvEiR_i0nQvyjdMyW82C01JbUosSQzP-8Rs1BSZk6OA9w4kMILLAKvWHgMmK04OLgEGCQYFBh-sDAuYgW669Gj248jjga7rGOc6XNBnpHhFKt-iFuIU2hqUpVRmreHWZqTm7NjlZdxhXeeUZ5zlJGjq597vlNOgGlmSXGor62JleEENqEJbEyn2Bg-sDF2sDPMYmc4wMl4gJfhB19H56qWC_92vfN4xa-T5Wrk5VppGGgc6GLuku9tURaSmhmUUZbvnWKckWvo4uaY71rlmmZalOdsYLtBgOGBAAMA0&username=bill%40microsoft.com&pullStatus=0	HTTP Parser: No <meta name="author".. found
Source: https://15da7cc3-3e1e66dd.babjeetrading.com/adfs/ls/?login_hint=john_smith%40company.com&client-request-id=8f1de839-f25d-4e98-be19-bfd71706122d&wa=wsignin1.0&wtrealm=urn:federation:MicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3D2%26estsrequest%3DrQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAQsX8j2x36a4bdPcv91cTYh3VWMyoSN0L_AyPiCkXESk1hWfkZefHFuZkmGA1C8IDGvEiR_i0nQvyjdMyW82C01JbUosSQzP-8Rs1BSZk6OA9w4kMILLAKvWHgMmK04OLgEGCQYFBh-sDAuYgW669Gj248jjga7rGOc6XNBnpHhFKt-iFuIU2hqUpVRmreHWZqTm7NjlZdxhXeeUZ5zlJGjq597vlNOgGlmSXGor62JleEENqEJbEyn2Bg-sDF2sDPMYmc4wMl4gJfhB19H56qWC_92vfN4xa-T5Wrk5VppGGgc6GLuku9tURaSmhmUUZbvnWKckWvo4uaY71rlmmZalOdsYLtBgOGBAAMA0&username=bill%40microsoft.com&pullStatus=0	HTTP Parser: No <meta name="author".. found

Source: https://0nline.babjeetrading.com/?bond=john_smith@company.com&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://0nline.babjeetrading.com/?bond=john_smith@company.com&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://0nline.babjeetrading.com/?bond=john_smith@company.com&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://0nline.babjeetrading.com/?bond=john_smith@company.com&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://15da7cc3-3e1e66dd.babjeetrading.com/adfs/ls/?login_hint=john_smith%40company.com&client-request-id=8f1de839-f25d-4e98-be19-bfd71706122d&wa=wsignin1.0&wtrealm=urn:federation:MicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3D2%26estsrequest%3DrQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAQsX8j2x36a4bdPcv91cTYh3VWMyoSN0L_AyPiCkXESk1hWfkZefHFuZkmGA1C8IDGvEiR_i0nQvyjdMyW82C01JbUosSQzP-8Rs1BSZk6OA9w4kMILLAKvWHgMmK04OLgEGCQYFBh-sDAuYgW669Gj248jjga7rGOc6XNBnpHhFKt-iFuIU2hqUpVRmreHWZqTm7NjlZdxhXeeUZ5zlJGjq597vlNOgGlmSXGor62JleEENqEJbEyn2Bg-sDF2sDPMYmc4wMl4gJfhB19H56qWC_92vfN4xa-T5Wrk5VppGGgc6GLuku9tURaSmhmUUZbvnWKckWvo4uaY71rlmmZalOdsYLtBgOGBAAMA0&username=bill%40microsoft.com&pullStatus=0	HTTP Parser: No <meta name="copyright".. found
Source: https://15da7cc3-3e1e66dd.babjeetrading.com/adfs/ls/?login_hint=john_smith%40company.com&client-request-id=8f1de839-f25d-4e98-be19-bfd71706122d&wa=wsignin1.0&wtrealm=urn:federation:MicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3D2%26estsrequest%3DrQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAQsX8j2x36a4bdPcv91cTYh3VWMyoSN0L_AyPiCkXESk1hWfkZefHFuZkmGA1C8IDGvEiR_i0nQvyjdMyW82C01JbUosSQzP-8Rs1BSZk6OA9w4kMILLAKvWHgMmK04OLgEGCQYFBh-sDAuYgW669Gj248jjga7rGOc6XNBnpHhFKt-iFuIU2hqUpVRmreHWZqTm7NjlZdxhXeeUZ5zlJGjq597vlNOgGlmSXGor62JleEENqEJbEyn2Bg-sDF2sDPMYmc4wMl4gJfhB19H56qWC_92vfN4xa-T5Wrk5VppGGgc6GLuku9tURaSmhmUUZbvnWKckWvo4uaY71rlmmZalOdsYLtBgOGBAAMA0&username=bill%40microsoft.com&pullStatus=0	HTTP Parser: No <meta name="copyright".. found
Source: https://15da7cc3-3e1e66dd.babjeetrading.com/adfs/ls/?login_hint=john_smith%40company.com&client-request-id=8f1de839-f25d-4e98-be19-bfd71706122d&wa=wsignin1.0&wtrealm=urn:federation:MicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3D2%26estsrequest%3DrQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAQsX8j2x36a4bdPcv91cTYh3VWMyoSN0L_AyPiCkXESk1hWfkZefHFuZkmGA1C8IDGvEiR_i0nQvyjdMyW82C01JbUosSQzP-8Rs1BSZk6OA9w4kMILLAKvWHgMmK04OLgEGCQYFBh-sDAuYgW669Gj248jjga7rGOc6XNBnpHhFKt-iFuIU2hqUpVRmreHWZqTm7NjlZdxhXeeUZ5zlJGjq597vlNOgGlmSXGor62JleEENqEJbEyn2Bg-sDF2sDPMYmc4wMl4gJfhB19H56qWC_92vfN4xa-T5Wrk5VppGGgc6GLuku9tURaSmhmUUZbvnWKckWvo4uaY71rlmmZalOdsYLtBgOGBAAMA0&username=bill%40microsoft.com&pullStatus=0	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49774 version: TLS 1.2

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 30MB

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: aa.ns.agingbydesignministry.org
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: 0nline.babjeetrading.com
Source: global traffic	DNS traffic detected: DNS query: 61e6f3ed-3e1e66dd.babjeetrading.com
Source: global traffic	DNS traffic detected: DNS query: 9d591190-3e1e66dd.babjeetrading.com
Source: global traffic	DNS traffic detected: DNS query: eabc60fc-3e1e66dd.babjeetrading.com
Source: global traffic	DNS traffic detected: DNS query: l1ve.babjeetrading.com
Source: global traffic	DNS traffic detected: DNS query: dd8f6fc2-3e1e66dd.babjeetrading.com
Source: global traffic	DNS traffic detected: DNS query: 8c1cd37c-3e1e66dd.babjeetrading.com
Source: global traffic	DNS traffic detected: DNS query: 15da7cc3-3e1e66dd.babjeetrading.com
Source: global traffic	DNS traffic detected: DNS query: 777ce323-3e1e66dd.babjeetrading.com
Source: global traffic	DNS traffic detected: DNS query: 11279407-3e1e66dd.babjeetrading.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49774 version: TLS 1.2

Source: classification engine

Classification label: mal72.phis.win@19/52@46/190

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2100 --field-trial-handle=2032,i,14475709619503712584,10795689494528793694,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://aa.ns.agingbydesignministry.org/?company=john_smith@company.com/1/01020192845e78dd-2d6e57c1-2477-4368-9808-e405234d7366-000000/JciFxQG6yOVw83-lKIliC63cjw4=395"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2100 --field-trial-handle=2032,i,14475709619503712584,10795689494528793694,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

ID:	1532874
Product:	CloudBasic
Start time:	04:06:21
Start date:	14.10.2024
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Windows Analysis Report
https://aa.ns.agingbydesignministry.org/?company=john_smith@company.com/1/01020192845e78dd-2d6e57c1-2477-4368-9808-e405234d7366-000000/JciFxQG6yOVw83-lKIliC63cjw4=395

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report https://aa.ns.agingbydesignministry.org/?company=john_smith@company.com/1/01020192845e78dd-2d6e57c1-2477-4368-9808-e405234d7366-000000/JciFxQG6yOVw83-lKIliC63cjw4=395

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
https://aa.ns.agingbydesignministry.org/?company=john_smith@company.com/1/01020192845e78dd-2d6e57c1-2477-4368-9808-e405234d7366-000000/JciFxQG6yOVw83-lKIliC63cjw4=395