Windows Analysis Report
http://tracking.storm-fs.uk/tracking/click?d=fJoORub_QE91kgSs4ri51uanDW786Cne3ljS8HNSsaDCbuKEPRMVhgEEEz5QJ9jAvpu4dSeCw5akvG2Wqa7kogKtfqJL449vUtcOWfHkhFRljcNmb6muhaiahSR9fNUzeitpPF91BgR4M7uAKD1rUpR9zLwOZOplF5R-SIPh3yRZ0

Overview

General Information

Sample URL:	http://tracking.storm-fs.uk/tracking/click?d=fJoORub_QE91kgSs4ri51uanDW786Cne3ljS8HNSsaDCbuKEPRMVhgEEEz5QJ9jAvpu4dSeCw5akvG2Wqa7kogKtfqJL449vUtcOWfHkhFRljcNmb6muhaiahSR9fNUzeitpPF91BgR4M7uAKD1rUpR9zLw
Analysis ID:	1533073

Detection

Score:	22
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Phishing site detected (based on image similarity)

Form action URLs do not match main URL

HTML body contains low number of good links

HTML title does not match URL

Stores files to the Windows start menu directory

Suspicious form URL found

Classification

Signatures

Phishing

Phishing site detected (based on image similarity)

Source: https://www.trades-protection.co.uk/update/?id=frty

Matcher: Found strong image similarity, brand: 1PASSWORD

Form action URLs do not match main URL

Source: https://www.trades-protection.co.uk/update/?id=frty	HTTP Parser: Form action: https://financialadvisoruk.formstack.com/forms/index.php co formstack
Source: https://www.trades-protection.co.uk/update/?id=frty	HTTP Parser: Form action: https://financialadvisoruk.formstack.com/forms/index.php co formstack
Source: https://www.trades-protection.co.uk/update/?id=frty	HTTP Parser: Form action: https://financialadvisoruk.formstack.com/forms/index.php co formstack

HTML body contains low number of good links

Source: https://www.trades-protection.co.uk/update/?id=frty

HTTP Parser: Number of links: 0

HTML title does not match URL

Source: https://www.trades-protection.co.uk/update/?id=frty

HTTP Parser: Title: Tradesprotect - Compare Life Insurance Quotes does not match URL

Suspicious form URL found

Source: https://www.trades-protection.co.uk/update/?id=frty	HTTP Parser: Form action: https://financialadvisoruk.formstack.com/forms/index.php
Source: https://www.trades-protection.co.uk/update/?id=frty	HTTP Parser: Form action: https://financialadvisoruk.formstack.com/forms/index.php
Source: https://www.trades-protection.co.uk/update/?id=frty	HTTP Parser: Form action: https://financialadvisoruk.formstack.com/forms/index.php

Source: https://www.trades-protection.co.uk/update/?id=frty	HTTP Parser: No <meta name="author".. found
Source: https://www.trades-protection.co.uk/update/?id=frty	HTTP Parser: No <meta name="author".. found
Source: https://www.trades-protection.co.uk/update/?id=frty	HTTP Parser: No <meta name="author".. found

Source: https://www.trades-protection.co.uk/update/?id=frty	HTTP Parser: No <meta name="copyright".. found
Source: https://www.trades-protection.co.uk/update/?id=frty	HTTP Parser: No <meta name="copyright".. found
Source: https://www.trades-protection.co.uk/update/?id=frty	HTTP Parser: No <meta name="copyright".. found

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49784 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /tracking/click?d=fJoORub_QE91kgSs4ri51uanDW786Cne3ljS8HNSsaDCbuKEPRMVhgEEEz5QJ9jAvpu4dSeCw5akvG2Wqa7kogKtfqJL449vUtcOWfHkhFRljcNmb6muhaiahSR9fNUzeitpPF91BgR4M7uAKD1rUpR9zLwOZOplF5R-SIPh3yRZ0 HTTP/1.1Host: tracking.storm-fs.ukConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: tracking.storm-fs.uk
Source: global traffic	DNS traffic detected: DNS query: www.trades-protection.co.uk
Source: global traffic	DNS traffic detected: DNS query: cdn.jsdelivr.net
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: financialadvisoruk.formstack.com
Source: global traffic	DNS traffic detected: DNS query: connect.facebook.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: static.formstack.com
Source: global traffic	DNS traffic detected: DNS query: www.facebook.com
Source: global traffic	DNS traffic detected: DNS query: s3.amazonaws.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49784 version: TLS 1.2

Source: classification engine

Classification label: sus22.phis.win@18/35@38/263

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\Chrome\Application\Dictionaries

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1848,i,5208008381695995130,15769178658626671200,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://tracking.storm-fs.uk/tracking/click?d=fJoORub_QE91kgSs4ri51uanDW786Cne3ljS8HNSsaDCbuKEPRMVhgEEEz5QJ9jAvpu4dSeCw5akvG2Wqa7kogKtfqJL449vUtcOWfHkhFRljcNmb6muhaiahSR9fNUzeitpPF91BgR4M7uAKD1rUpR9zLwOZOplF5R-SIPh3yRZ0"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1848,i,5208008381695995130,15769178658626671200,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.46	unknown	United States	15169	GOOGLEUS	false
18.66.122.60	unknown	United States	3	MIT-GATEWAYSUS	false
104.18.187.31	unknown	United States	13335	CLOUDFLARENETUS	false
173.194.76.84	unknown	United States	15169	GOOGLEUS	false
164.132.95.123	api.elasticemail.com	France	16276	OVHFR	false
151.101.130.137	code.jquery.com	United States	54113	FASTLYUS	false
157.240.0.6	unknown	United States	32934	FACEBOOKUS	false
142.250.186.131	unknown	United States	15169	GOOGLEUS	false
77.72.4.16	www.trades-protection.co.uk	United Kingdom	12488	KRYSTALGR	false
142.250.184.196	www.google.com	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
157.240.0.35	star-mini.c10r.facebook.com	United States	32934	FACEBOOKUS	false
3.5.9.70	s3.amazonaws.com	United States	14618	AMAZON-AESUS	false
142.250.185.138	unknown	United States	15169	GOOGLEUS	false
142.250.185.170	unknown	United States	15169	GOOGLEUS	false
142.250.181.227	unknown	United States	15169	GOOGLEUS	false
18.239.50.103	unknown	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
52.216.57.216	unknown	United States	16509	AMAZON-02US	false
142.250.185.174	unknown	United States	15169	GOOGLEUS	false
157.240.253.1	scontent.xx.fbcdn.net	United States	32934	FACEBOOKUS	false
172.217.16.195	unknown	United States	15169	GOOGLEUS	false
18.66.122.65	formstack.com	United States	3	MIT-GATEWAYSUS	false
18.66.122.21	unknown	United States	3	MIT-GATEWAYSUS	false

Private

IP
192.168.2.16

Contacted Domains

Name	IP	Active
star-mini.c10r.facebook.com	157.240.0.35	true
api.elasticemail.com	164.132.95.123	true
scontent.xx.fbcdn.net	157.240.253.1	true
formstack.com	18.66.122.65	true
s3.amazonaws.com	3.5.9.70	true
code.jquery.com	151.101.130.137	true
www.google.com	142.250.184.196	true
www.trades-protection.co.uk	77.72.4.16	true
financialadvisoruk.formstack.com	unknown	unknown
www.facebook.com	unknown	unknown
static.formstack.com	unknown	unknown
cdn.jsdelivr.net	unknown	unknown
tracking.storm-fs.uk	unknown	unknown
connect.facebook.net	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://tracking.storm-fs.uk/tracking/click?d=fJoORub_QE91kgSs4ri51uanDW786Cne3ljS8HNSsaDCbuKEPRMVhgEEEz5QJ9jAvpu4dSeCw5akvG2Wqa7kogKtfqJL449vUtcOWfHkhFRljcNmb6muhaiahSR9fNUzeitpPF91BgR4M7uAKD1rUpR9zLwOZOplF5R-SIPh3yRZ0	false		unknown
https://www.trades-protection.co.uk/update/?id=frty	true		unknown

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 14 09:12:11 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	A28C4FD161DC33CB06328AF1BCE4E8F7	479CFC585B28D1390FF4ABE55FCAF25E37EA85A1	52ECD30FDC2599EA3E50ECCC42011EDD318D9AA1922F57795BF7D0100A81C5CF
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 14 09:12:11 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	0088308DD2827BBE4E10659F99DB613C	DB4EE3163ADC9CC3AF57C1315EA3CA465B118CBF	EAA881E4793CB46BDCCBFDB574D31F7A4F3E527255E4D2F2CCAFA916A02C638C
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	59ADCE77814C4D31094790DE2E457BD0	FEA228FFA2F19120F801AF94A370991D856E95E1	C9CA2D6CE1D47B5E46C75113DACF1225D858D803FBBC8C14537BB684E6D42A73
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 14 09:12:11 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	FD3F9CF19835CA046BB93C1CCA72EA8B	98756EB34E2C23396436C6BE569E9DE644021E31	FB39C8D321E02D566A2C1BA94DC54B9E26A045C353F36110DD1F3155A55C483A
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 14 09:12:11 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	46339A5ED06B9ABB11AAFC7A87CEFDE9	A9F557F9F87AD684C6B85663FA4C8BB87E0DDE83	287ED21D1EAF4BA5CBA2F6A01667A7B603D9FB40AA48520453A766FC4DDAC507
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 14 09:12:11 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	99E675F9850C90093F4287B6D17AA9AA	20B1AD034B68C193EB48CB3679BCC622150C7F36	290C0658D7EA7F1EC964FF884D3ACFF975EDB9D01964B44D919D0F3AA239F0E0
Chrome Cache Entry: 100	ASCII text	42852B78556A8DB68552429877C8B5A3	235B50B256EF8DE2A6081EC70FC167E4BCE42E76	F3DE8D945387B342C3E3F9A4A70B4BF8945FE75963824784CBF4690F6C64756E
Chrome Cache Entry: 101	ASCII text	94ED7B5F2F8F1C1A6562558C18096E4E	887EECF3760E3FE8A3FC8D433AE661553106FF6E	43CB6D488A4167B9BA0F1A9187006EB85B4D3138456CDF840DF3DEB1E9EDAB63
Chrome Cache Entry: 102	PNG image data, 101 x 101, 8-bit/color RGBA, non-interlaced	7216773119CFFB7F17908AABAF9D2DE5	0653E03367AD7A466B82FEAD3C9133BECB8297D8	FD8403CA13E0D750E0C9AB5988548A1B73D8D09416CE7B8189D325331E7ABA0E
Chrome Cache Entry: 104	PNG image data, 167 x 39, 8-bit/color RGBA, non-interlaced	26CC918464F26E21F897180E09791D5A	64171361C15F68F0E91C202C6EBA3EB7BF49B24E	42B0004A186A43D2333F157C214BB05D2DE98B5B9B34D4E27FC4D0E0F721208E
Chrome Cache Entry: 105	PNG image data, 101 x 101, 8-bit/color RGBA, non-interlaced	394CB4E5DECE2F07E823810E9346ED1E	A87487764F383F0F12D9786419F45409BA2362CC	3812125052ED8C230C52BC9289F85B68461C9880D4F582C8C99D03A19ECEC5EA
Chrome Cache Entry: 107	SVG Scalable Vector Graphics image	A24F0F2C8EC885ADCD367F74FE545ED7	0DC0F201A1ADFB34E6DC99EB16D22EE663BAFA53	EE8F4C691861A5813D66CE30BA4D197132E26E9EAC85021F12F06AFF684C03CD
Chrome Cache Entry: 108	PNG image data, 101 x 101, 8-bit/color RGBA, non-interlaced	02B16394679A0D82C1D666B6D8BFDC54	50898D220D8E5CACC1B98F06AAC41FBB649A2E64	EF59601BFED866BA4C9DF091F013F98F6EB895E67B27E7332AB28176F1246650
Chrome Cache Entry: 109	PNG image data, 100 x 101, 8-bit/color RGBA, non-interlaced	CBEC014F1D9C8427B873060DC85013D5	39BA7DBCDED4BAFFF05C7D36800E74112ED27731	ABF3CF1C0A71999BC2A4538134948B93B44590B3397E637DF6C2B4182CD9FA68
Chrome Cache Entry: 111	ASCII text, with very long lines (5552)	C75B3DC843D23DEB3CEF605B250C1E42	B5F7AF65A177BC79DFABA3533017D449539F76D1	C8CC91DCE6746FFC7D3C5FD23AC72EDB312BCB07AAD3BF1F4FF40D2C9EEC100C
Chrome Cache Entry: 112	ASCII text, with very long lines (65536), with no line terminators	CEE0307F75F634F3298C95C97230525A	2F0110777542409A67FD6A77BBA6B5FC1D7D016D	899CDAF5B0A731C8912C3B8C8998CC971E92150DF181C20F10A6DC44E345304A
Chrome Cache Entry: 113	ASCII text, with very long lines (65474)	2E77EE66C7316B52CFEFFA930A908292	005B2F1CF8CB5DB76CA879D51E4D82E218D5E03C	3B63CAE18DE974793E50A54630E7005D037D7858385F1788ADC2811395013F31
Chrome Cache Entry: 116	Web Open Font Format (Version 2), TrueType, length 39124, version 1.0	86B73AB5F530BE7984B704414F2A711D	8E297794ED7B6F5EA476D14B5270DF12E8F3E42A	1A48B70F97555C13F84B8F088A417F9179D99B5101250819350ACAF6E91BB92F
Chrome Cache Entry: 117	HTML document, ASCII text, with very long lines (48350)	CD0E358DD41850E10E866767989B376D	D4733BD1E9611B335584FB864EE1C863E834455E	EFF3F1345B25F5D06A6A00C09470E88E2FD4ED4DEFCF492F0767AB99800E0064
Chrome Cache Entry: 119	ASCII text, with very long lines (9217)	40283CFC473AFBE1D4ABBA7E6C809885	8A32CB88D9F537B02582DF17A5BB11C2087937F6	48BA1993011DB4834882D81B2153753437607292F704A6543D4466C0F6D1372A
Chrome Cache Entry: 123	HTML document, ASCII text, with very long lines (362)	AE5DFF93A9FAB003FB6AD41BDA1C0839	A938B02C17AF1C4366F476966F0E106E09159C36	6CB9C1CB711C056A95F70D078CE752E87587EECD5920D3398C21F3FA65F55669
Chrome Cache Entry: 74	PNG image data, 101 x 101, 8-bit/color RGBA, non-interlaced	D621F1AC8DDD5EDDECE4438E053B8062	715538419B1E27B12A1DECFABB643FB9F97AF9E6	99EAEEE889D1CDEAC040D915EE582521A04DB4196C7F6A9EBED5811B0FC80148
Chrome Cache Entry: 75	PNG image data, 143 x 73, 8-bit/color RGBA, non-interlaced	3CA64261550C5689659F46747F8E3A1B	427155BFA0CED4E28A2FB090EC50AD72658EEC9E	BA4B97A9AF7F4C5B6F33C77EB82CE0D28B11F45C49AC8B3F96957C67916105C6
Chrome Cache Entry: 79	ASCII text	588C46A7C63BCD4C98B95D8D97BB95D6	4FBF0E425D2FD266D88072884983B003349575DB	C71C144709E243473601E175ACAD7CD2D31BC7883D9DD7278CE6C5B74A06F9BF
Chrome Cache Entry: 80	PNG image data, 92 x 72, 8-bit/color RGBA, non-interlaced	62D080AF5F43C5ACCC5115A29495FA5F	036617F1E2EF751772361407974E9D36FC2B72F0	51B211953669FA09C6745520ED014F7645F0E4DFC98C7761B7C7DAAA2A6E9F23
Chrome Cache Entry: 81	Unicode text, UTF-8 text, with very long lines (65306)	ABE91756D18B7CD60871A2F47C1E8192	7C1C9E0573E5CEA8BAD3733BE2FC63AA8C68EA8D	7633B7C0C97D19E682FEEE8AFA2738523FCB2A14544A550572CAEECD2EEFE66B
Chrome Cache Entry: 82	PNG image data, 99 x 72, 8-bit/color RGBA, non-interlaced	C2BAA3D9A7E30E69712E30C82887F659	A9B1AD3C66ED6BB629280061C418B9C3585E3614	987F4CFE11BB783DAC19661F593CABD459237E629364EAC5BA7BE01910433341
Chrome Cache Entry: 84	ASCII text, with very long lines (65447)	8FB8FEE4FCC3CC86FF6C724154C49C42	B82D238D4E31FDF618BAE8AC11A6C812C03DD0D4	FF1523FB7389539C84C65ABA19260648793BB4F5E29329D2EE8804BC37A3FE6E
Chrome Cache Entry: 87	PNG image data, 101 x 101, 8-bit/color RGBA, non-interlaced	E5ACA3C4D173C887222AB6AC400BC248	23D92A34C66A34EE8B58B02C6867D61CBDF1B8CB	3C8EC0496647B587C146C5D14E701B8BC9BF130DFA13FDA29C0BC8053FD46893
Chrome Cache Entry: 90	PNG image data, 101 x 101, 8-bit/color RGBA, non-interlaced	9081946F1AE9E17427D1CD3382B77A2E	AD8EB80DA48147670F32FB16B72E23937FDEEB6E	5F9023FD0123ABB6FC6C57AFF9E9DAF181428E9E5C410880F71D0C5BAD879F15
Chrome Cache Entry: 91	PNG image data, 183 x 66, 8-bit/color RGBA, non-interlaced	35A05CF873C8E9A2E1CB8A959C278DB1	1A46ADC9647406F4C2FEF7B2332A61C5CE86AD09	BEDDFFFFCC19EA26B06910F24AD0300D3419584407E5767A0235590160345248
Chrome Cache Entry: 93	PNG image data, 101 x 101, 8-bit/color RGBA, non-interlaced	1572C5E5B2F6B4A0033A3D2165A3FA58	162840D21EBD91CF5CD3EF32FD846F31AD3A61DE	FEDB59AF30A7506CAA8E9C498485F04B66833B7F8DEC3554F7D11A351324D93D
Chrome Cache Entry: 94	ASCII text, with no line terminators	3C9C728DE5B2E3D46E5FEF7A97B5EF95	C799D210A5103F147DB1382F02EA9C1611012A8C	BCFA0F26F9B208536BEA857178ADBCA0D2113BC6A0B027BA2EE3D6615B9C4700
Chrome Cache Entry: 95	PNG image data, 101 x 101, 8-bit/color RGBA, non-interlaced	6A61DAEE48A324016C0AFAA13FF4C8C2	C579B4F148C9CE039BDF1E8E5E90432D9700604F	28048F29326ABC2566177C781B2DF04C0B425B300B480E185C6A92F6103B485B
Chrome Cache Entry: 96	HTML document, ASCII text, with very long lines (48350)	278C6A5DC06EC0643632E9AD37BEC46C	C79ADA5C5F0B462F7753A159F24C437424BC0F28	D76921B5FB6BF4E14CB23A76F232D47999CEC71BD875F0D732F0E290016CC104

Phishing

Phishing site detected (based on image similarity)

Source: https://www.trades-protection.co.uk/update/?id=frty

Matcher: Found strong image similarity, brand: 1PASSWORD

Form action URLs do not match main URL

Source: https://www.trades-protection.co.uk/update/?id=frty	HTTP Parser: Form action: https://financialadvisoruk.formstack.com/forms/index.php co formstack
Source: https://www.trades-protection.co.uk/update/?id=frty	HTTP Parser: Form action: https://financialadvisoruk.formstack.com/forms/index.php co formstack
Source: https://www.trades-protection.co.uk/update/?id=frty	HTTP Parser: Form action: https://financialadvisoruk.formstack.com/forms/index.php co formstack

HTML body contains low number of good links

Source: https://www.trades-protection.co.uk/update/?id=frty

HTTP Parser: Number of links: 0

HTML title does not match URL

Source: https://www.trades-protection.co.uk/update/?id=frty

HTTP Parser: Title: Tradesprotect - Compare Life Insurance Quotes does not match URL

Suspicious form URL found

Source: https://www.trades-protection.co.uk/update/?id=frty	HTTP Parser: Form action: https://financialadvisoruk.formstack.com/forms/index.php
Source: https://www.trades-protection.co.uk/update/?id=frty	HTTP Parser: Form action: https://financialadvisoruk.formstack.com/forms/index.php
Source: https://www.trades-protection.co.uk/update/?id=frty	HTTP Parser: Form action: https://financialadvisoruk.formstack.com/forms/index.php

Source: https://www.trades-protection.co.uk/update/?id=frty	HTTP Parser: No <meta name="author".. found
Source: https://www.trades-protection.co.uk/update/?id=frty	HTTP Parser: No <meta name="author".. found
Source: https://www.trades-protection.co.uk/update/?id=frty	HTTP Parser: No <meta name="author".. found

Source: https://www.trades-protection.co.uk/update/?id=frty	HTTP Parser: No <meta name="copyright".. found
Source: https://www.trades-protection.co.uk/update/?id=frty	HTTP Parser: No <meta name="copyright".. found
Source: https://www.trades-protection.co.uk/update/?id=frty	HTTP Parser: No <meta name="copyright".. found

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49784 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

Source: global traffic	DNS traffic detected: DNS query: tracking.storm-fs.uk
Source: global traffic	DNS traffic detected: DNS query: www.trades-protection.co.uk
Source: global traffic	DNS traffic detected: DNS query: cdn.jsdelivr.net
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: financialadvisoruk.formstack.com
Source: global traffic	DNS traffic detected: DNS query: connect.facebook.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: static.formstack.com
Source: global traffic	DNS traffic detected: DNS query: www.facebook.com
Source: global traffic	DNS traffic detected: DNS query: s3.amazonaws.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49784 version: TLS 1.2

Source: classification engine

Classification label: sus22.phis.win@18/35@38/263

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\Chrome\Application\Dictionaries

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1848,i,5208008381695995130,15769178658626671200,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://tracking.storm-fs.uk/tracking/click?d=fJoORub_QE91kgSs4ri51uanDW786Cne3ljS8HNSsaDCbuKEPRMVhgEEEz5QJ9jAvpu4dSeCw5akvG2Wqa7kogKtfqJL449vUtcOWfHkhFRljcNmb6muhaiahSR9fNUzeitpPF91BgR4M7uAKD1rUpR9zLwOZOplF5R-SIPh3yRZ0"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1848,i,5208008381695995130,15769178658626671200,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

ID:	1533073
Product:	CloudBasic
Start time:	12:11:37
Start date:	14.10.2024
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Windows Analysis Report
http://tracking.storm-fs.uk/tracking/click?d=fJoORub_QE91kgSs4ri51uanDW786Cne3ljS8HNSsaDCbuKEPRMVhgEEEz5QJ9jAvpu4dSeCw5akvG2Wqa7kogKtfqJL449vUtcOWfHkhFRljcNmb6muhaiahSR9fNUzeitpPF91BgR4M7uAKD1rUpR9zLwOZOplF5R-SIPh3yRZ0

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report http://tracking.storm-fs.uk/tracking/click?d=fJoORub_QE91kgSs4ri51uanDW786Cne3ljS8HNSsaDCbuKEPRMVhgEEEz5QJ9jAvpu4dSeCw5akvG2Wqa7kogKtfqJL449vUtcOWfHkhFRljcNmb6muhaiahSR9fNUzeitpPF91BgR4M7uAKD1rUpR9zLwOZOplF5R-SIPh3yRZ0

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
http://tracking.storm-fs.uk/tracking/click?d=fJoORub_QE91kgSs4ri51uanDW786Cne3ljS8HNSsaDCbuKEPRMVhgEEEz5QJ9jAvpu4dSeCw5akvG2Wqa7kogKtfqJL449vUtcOWfHkhFRljcNmb6muhaiahSR9fNUzeitpPF91BgR4M7uAKD1rUpR9zLwOZOplF5R-SIPh3yRZ0