Loading... Additional Content is being loaded

Windows Analysis Report
https://email.sg.on24event.com/ls/click?upn=u001.7kf5QUY4LGF7Fzt7LGE4bbPPsSPtBC4KXSPVJqWhtiH9UI-2BhWw3LCGKTJo7Z9EMzCv6v-2Bdd5VVoXP3XlG45HPyDr8-2BgrDKJ-2B-2BtI8gAptqvw2zht-2FkcDcCA4C0VZG6iAKBDpPywKzX83ooMnYk-2F4Aj-2FUH3KGQoI-2FKaG9FvEIGjeU-3D-NFf_BaQI6ftTEX0p02VOvTLx1tJhIFg7TTp5-2BDlW2paPLalLO8mycXH1

Overview

General Information

Sample URL:	https://email.sg.on24event.com/ls/click?upn=u001.7kf5QUY4LGF7Fzt7LGE4bbPPsSPtBC4KXSPVJqWhtiH9UI-2BhWw3LCGKTJo7Z9EMzCv6v-2Bdd5VVoXP3XlG45HPyDr8-2BgrDKJ-2B-2BtI8gAptqvw2zht-2FkcDcCA4C0VZG6iAKBDpPywKzX83
Analysis ID:	1541194

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Detected hidden input values containing email addresses (often used in phishing pages)

HTML title does not match URL

Stores files to the Windows start menu directory

Classification

Signatures

Detected hidden input values containing email addresses (often used in phishing pages)

Source: https://event.on24.com/wcc/r/4690151/34BF02897675491F741EFA18926C1356?mode=login&email=spalmer@dewberry.com

HTTP Parser: spalmer@dewberry.com

HTML title does not match URL

Source: https://event.on24.com/wcc/r/4690151/34BF02897675491F741EFA18926C1356?mode=login&email=spalmer@dewberry.com

HTTP Parser: Title: Automated Logic - Implementing ASHRAE Guideline 36 in Existing Buildings does not match URL

Source: https://event.on24.com/wcc/r/4690151/34BF02897675491F741EFA18926C1356?mode=login&email=spalmer@dewberry.com

HTTP Parser: No favicon

Source: https://event.on24.com/wcc/r/4690151/34BF02897675491F741EFA18926C1356?mode=login&email=spalmer@dewberry.com

HTTP Parser: No <meta name="author".. found

Source: https://event.on24.com/wcc/r/4690151/34BF02897675491F741EFA18926C1356?mode=login&email=spalmer@dewberry.com

HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.16:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.16:49744 version: TLS 1.2

Source: chrome.exe

Memory has grown: Private usage: 22MB later: 44MB

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200

Source: global traffic	DNS traffic detected: DNS query: email.sg.on24event.com
Source: global traffic	DNS traffic detected: DNS query: event.on24.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.16:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.16:49744 version: TLS 1.2

Source: classification engine

Classification label: clean1.win@18/24@8/133

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1960,i,4190544763224165528,5673137479003705613,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://email.sg.on24event.com/ls/click?upn=u001.7kf5QUY4LGF7Fzt7LGE4bbPPsSPtBC4KXSPVJqWhtiH9UI-2BhWw3LCGKTJo7Z9EMzCv6v-2Bdd5VVoXP3XlG45HPyDr8-2BgrDKJ-2B-2BtI8gAptqvw2zht-2FkcDcCA4C0VZG6iAKBDpPywKzX83ooMnYk-2F4Aj-2FUH3KGQoI-2FKaG9FvEIGjeU-3D-NFf_BaQI6ftTEX0p02VOvTLx1tJhIFg7TTp5-2BDlW2paPLalLO8mycXH10uZduAIpOdraZb-2BlnHUbiqOm-2FlulrSt52rTLb6j8iC-2Fwx28ncyLA0XL2-2BrnPscPaULbUS94mgno-2FxwNrLGkkxALXAmDF4ZVlC0BjfN9x2nmJ2rno-2BjzJzvGt3nbU2YyyELyu6a09xFw4fC6dZ-2FElnv0Wg6f-2BlCdo1q6xwYMUN1dJTBnjgFfxInHZGa6XlNE0iVPQAn-2Fha2UXF-2BXQhHnns5j6hYjP99U2K7MQ-2FRTTIXppCyBGcGjDla0llvO57zrDPYkclLyA-2Bv6WplJq0YNw9z9Huhz-2BUXoRlg-3D-3D"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1960,i,4190544763224165528,5673137479003705613,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
142.250.184.195	unknown	United States		15169	GOOGLEUS	false
142.250.185.68	www.google.com	United States		15169	GOOGLEUS	false
172.217.16.202	unknown	United States		15169	GOOGLEUS	false
1.1.1.1	unknown	Australia		13335	CLOUDFLARENETUS	false
2.16.164.96	unknown	European Union		20940	AKAMAI-ASN1EU	false
142.250.185.110	unknown	United States		15169	GOOGLEUS	false
142.250.185.238	unknown	United States		15169	GOOGLEUS	false
2.16.164.57	unknown	European Union		20940	AKAMAI-ASN1EU	false
142.251.168.84	unknown	United States		15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved		unknown	unknown	false
199.83.44.71	r-event.on24.com	United States		18742	ON24-SACUS	false
199.83.44.68	r-email.sg.on24event.com	United States		18742	ON24-SACUS	false

Private

IP
192.168.2.16

Contacted Domains

Name	IP	Active
www.google.com	142.250.185.68	true
r-email.sg.on24event.com	199.83.44.68	true
r-event.on24.com	199.83.44.71	true
event.on24.com	unknown	unknown
email.sg.on24event.com	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://event.on24.com/wcc/r/4690151/34BF02897675491F741EFA18926C1356?mode=login&email=spalmer@dewberry.com	false		unknown

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 12:08:09 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	7B32A1F80B8583AC36FD759B527BC828	CE63C6A7992B57F4AEF085FD7070677900EC7494	07B3920FDF5B54022766D65CB5B6DA6EA1543CBA2B073D969710F616B5BA621E
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 12:08:09 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	C6C57651362990C450C4D25EDBC6920D	7959EA0113B8481B0C0EDEE6DB111CE7FC9D4168	E82DB0E51E28F1C0DE523E163DC0F6B6997A8E15541CB811D6447CA309E84C4D
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	3958D7E983C93BC62ACC8910CB26A50C	930AD140ECB396078E200A20D3CC9BD249948059	50125F5D37E226D0D3A775EB8716DC6AE3C82998F5EE732F97666E96348A4CAE
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 12:08:09 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	D8851A556100B7DAC6B34568EF9F34AC	15822AC559487F0B3D0C70818AD4963F8EDE1726	2284DA004BB32D1CD96DC76182B631855B458305C130739673AAB2001DD45628
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 12:08:09 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	33369F7D386DFA96CEADFA2BEF3D90C0	4774BEE0076CB109B1B58CE6B5827FAFEA4E00EA	9FA4D495FB1798AE435920A8E6A23C3F08D389AB9A3D764FD81CD92F23DF4ABC
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 12:08:09 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	262A464D7C6FB04AC4B14C74B2BE69E5	F9B2669BD781330A870E1D88531E26C88CE5BBC5	B8F20FE39492E70A435674A80CF6A1C4204380155DC307B919BBE8E8BB4FCFBF
Chrome Cache Entry: 100	ASCII text, with very long lines (2363)	2304E9C7BCB3CDF51B65AA8A2C9F8919	0CB026033AC28E683724F87925D299E3ECFC60C2	009EA457FF3FF823D24E01032A8725E573018B35DDFBB7F28C67F6F58998E502
Chrome Cache Entry: 73	JSON data	C1FACF98E5DAB0C6D74B72E54F9909B0	42E0C7DAE5890E84CC63DBB7F595A5D39CC916BA	36FFAD06DA9DC97DCB38D156F2B502810E949FBB418FA2858F587B0731BA1528
Chrome Cache Entry: 74	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel	4EAAF322533442A7BEC61B0D8619999F	1BA08B6357930A6C98FE358029D51D7380F5C246	9480A6181B9AA45EC64B615336B9EF5A970EE640E29D8A6C361B59F474E4E31C
Chrome Cache Entry: 75	JPEG image data, JFIF standard 1.01, resolution (DPI), density 220x220, segment length 16, baseline, precision 8, 374x363, components 3	9E182C8D4585D235101D68519FA67779	5BE80DD729CDE5ED66816C668597A5E3CB66EDAF	B985625D9E1664C07D2D7597C36702E7C98A264139ACA0262DDCF985FEE728FF
Chrome Cache Entry: 77	HTML document, ASCII text	2532BA7E35515F0826E46A5768B44B9E	BE4A92F2353995ECD20497717B91457A0411AB2F	46DC010C5567329F424914413D8F491BDEA86E894F8305F109117D28219F9DE2
Chrome Cache Entry: 78	PNG image data, 740 x 92, 8-bit/color RGBA, non-interlaced	A950D90523BFA96DA20DEB5EB00548CC	1340B7568CE6EEEF47FFEBAD20A5F093C3941DD8	E7B9D33A3BF139FEC8EC5440E6F0EF712B11E0C5F0AD5ED2AEE155ED12C951B5
Chrome Cache Entry: 79	Unicode text, UTF-8 text	A2E1E696F9109C439C21C7525B5B86A5	1EB49E7AE5848C9C6D240EB94448824D7B5610B0	811B943E9281304989EBAA1B1227EA4A6384E933A30035B6B5E208096BE43FE2
Chrome Cache Entry: 80	JSON data	DA2BB3491371DF94B481BAB664A5DDB1	E395C1D3811603D14B594D1ADDC4FFED15E6DB7F	8190B946CA19D1BB9BEE33A252859ECC617E376C3F333DE0B8958D2F0661DC1B
Chrome Cache Entry: 82	JSON data	A9A257D94347F7F7F2F29ECF6B995F21	9B255BF537BCAA58B761124463F8D15D2A7F66C4	9385ECC3A2B5F04CCF0F8D87319E599E8CEA2B6F5741EFA711FB46935C848A58
Chrome Cache Entry: 84	Web Open Font Format (Version 2), TrueType, length 77160, version 4.459	AF7AE505A9EED503F8B8E6982036873E	D6F48CBA7D076FB6F2FD6BA993A75B9DC1ECBF0C	2ADEFCBC041E7D18FCF2D417879DC5A09997AA64D675B7A3C4B6CE33DA13F3FE
Chrome Cache Entry: 85	ASCII text, with no line terminators	903747EA4323C522742842A52CE710C9	9F806EA4288867A31A4AD53AC171AA4029DF182B	4BD8B60F91849C936AE45615145A7B7BE2CF803322A30BABBAE7267A142CA5BB
Chrome Cache Entry: 87	JSON data	30645BC6BF6547ED3F87A2708ACD2002	43784332A539F4ECD0FFF967951BF66B3FA3CD18	2FAA7CBFC93535E71F3CF54D6C51349BDD7B1F356C422223B99CBA0760757567
Chrome Cache Entry: 88	JSON data	CDC1DD374F940116BA63A86691394DBC	69D17B6099FC7C4362F793E3754D248852793FB0	A901D54EDD59210C4FDAF72EA6FADF828C1FC0385A671487E7A7A98CE6BF10F1
Chrome Cache Entry: 89	HTML document, ASCII text, with very long lines (546)	0F042782BB77E05BAC5C67683712C17F	9B0DE34D75DC5448AC773D3DFFFE40DF496F72D7	33C1EBC20F0BAAEE7475FD82A3F1CE7307EBFCF166010A9C4C9140A48D427C88
Chrome Cache Entry: 91	ASCII text, with no line terminators	0EAD5290EE11F36AF6A907C4EC3CBCBD	B69C0BE568E823942C78FAA0BFCCAE6E4AFF8EA2	2584F4618A9A3901536BF4CDCB3B16C28E18D959AB406867605150F511880DD1
Chrome Cache Entry: 92	Web Open Font Format, TrueType, length 235472, version 0.0	A1F67B3626AA6C1DDE47A21214A2BACD	FB5BFEF666DB079A581438CAFA4990A72CF60EF1	4DE12927BA915B8E2C311F0F99DE411118D7C8143513CE3F78068F6F44B0C4B2
Chrome Cache Entry: 93	PNG image data, 86 x 38, 8-bit/color RGBA, non-interlaced	6CBF43F3AE1D079B7D7C90F1F73E9C97	6F51609F2F11FDE6C663AFFD85924DC01D4CC85C	EE3F6AEC6430D78E4189049F3C4523D5448EF71759860BAA62A8202ED89F679C
Chrome Cache Entry: 99	ASCII text, with very long lines (65451)	6D3B47EE2826BCA50572424CF77343E1	9F4930F72E80A98196743997333D9E669620C773	48E5B8657138ECBB3D10EDFBC68E1636131B2160CC29E2554007078272D49155

Detected hidden input values containing email addresses (often used in phishing pages)

Source: https://event.on24.com/wcc/r/4690151/34BF02897675491F741EFA18926C1356?mode=login&email=spalmer@dewberry.com

HTTP Parser: spalmer@dewberry.com

HTML title does not match URL

Source: https://event.on24.com/wcc/r/4690151/34BF02897675491F741EFA18926C1356?mode=login&email=spalmer@dewberry.com

HTTP Parser: Title: Automated Logic - Implementing ASHRAE Guideline 36 in Existing Buildings does not match URL

Source: https://event.on24.com/wcc/r/4690151/34BF02897675491F741EFA18926C1356?mode=login&email=spalmer@dewberry.com

HTTP Parser: No favicon

Source: https://event.on24.com/wcc/r/4690151/34BF02897675491F741EFA18926C1356?mode=login&email=spalmer@dewberry.com

HTTP Parser: No <meta name="author".. found

Source: https://event.on24.com/wcc/r/4690151/34BF02897675491F741EFA18926C1356?mode=login&email=spalmer@dewberry.com

HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.16:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.16:49744 version: TLS 1.2

Source: chrome.exe

Memory has grown: Private usage: 22MB later: 44MB

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200

Source: global traffic	DNS traffic detected: DNS query: email.sg.on24event.com
Source: global traffic	DNS traffic detected: DNS query: event.on24.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.16:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.16:49744 version: TLS 1.2

Source: classification engine

Classification label: clean1.win@18/24@8/133

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1960,i,4190544763224165528,5673137479003705613,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://email.sg.on24event.com/ls/click?upn=u001.7kf5QUY4LGF7Fzt7LGE4bbPPsSPtBC4KXSPVJqWhtiH9UI-2BhWw3LCGKTJo7Z9EMzCv6v-2Bdd5VVoXP3XlG45HPyDr8-2BgrDKJ-2B-2BtI8gAptqvw2zht-2FkcDcCA4C0VZG6iAKBDpPywKzX83ooMnYk-2F4Aj-2FUH3KGQoI-2FKaG9FvEIGjeU-3D-NFf_BaQI6ftTEX0p02VOvTLx1tJhIFg7TTp5-2BDlW2paPLalLO8mycXH10uZduAIpOdraZb-2BlnHUbiqOm-2FlulrSt52rTLb6j8iC-2Fwx28ncyLA0XL2-2BrnPscPaULbUS94mgno-2FxwNrLGkkxALXAmDF4ZVlC0BjfN9x2nmJ2rno-2BjzJzvGt3nbU2YyyELyu6a09xFw4fC6dZ-2FElnv0Wg6f-2BlCdo1q6xwYMUN1dJTBnjgFfxInHZGa6XlNE0iVPQAn-2Fha2UXF-2BXQhHnns5j6hYjP99U2K7MQ-2FRTTIXppCyBGcGjDla0llvO57zrDPYkclLyA-2Bv6WplJq0YNw9z9Huhz-2BUXoRlg-3D-3D"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1960,i,4190544763224165528,5673137479003705613,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk