Windows Analysis Report
https://eu.knowbe4.com/auth/saml/91b6f5903c38

Overview

General Information

Sample URL:	https://eu.knowbe4.com/auth/saml/91b6f5903c38
Analysis ID:	1541363

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

HTML body contains low number of good links

HTML title does not match URL

Stores files to the Windows start menu directory

Classification

Signatures

HTML body contains low number of good links

Source: https://login.microsoftonline.com/c765d391-7aad-4c45-8362-df4ece7a3fd4/saml2/?SAMLRequest=fZJPT9wwEMW%2FSm4%2BOc4fJ9lYm5VSVpVWQIWg7aGXataZFAvHXjxOgW9PNqiCHtrr03u%2FN5qZLcFkT6qf4727xccZKSY9EYZovLvwjuYJwx2G30bjt9urjt3HeCIlBM7pg%2FNPR5Sp9pOABSDOLNHmx3qs2qzU5UZosPYI%2BoEl%2B4VsHJyx7xDrfxmXTkYHT36M3lnjcOXppq6Gss15AzBwqWXFN2Vd8GGUqLGBchzk2lcIlhz2Hfu5aTW0VQa8llmxJKqSH0epeZOVC0tik9dysRLNeHAUwcWOFVkheZ7xQn7Na1XkSpY%2FWPIdA61jFmnGkufJOlLnqo7NwSkPZEg5mJBU1Oquv75Si1HBn619jJz%2BnzkFH732lu22Z7dapwu7y2Wxn1BuxUdx%2B3apLwvksL%2Fx1uiXpLfWP10EhIgdi2FGlnz2YYL479o8zVfFDHxcrQonMLYfhoBETOzeWv9%2Bid0r	HTTP Parser: Number of links: 0
Source: https://login.microsoftonline.com/c765d391-7aad-4c45-8362-df4ece7a3fd4/saml2/?SAMLRequest=fZJPT9wwEMW%2FSm4%2BOc4fJ9lYm5VSVpVWQIWg7aGXataZFAvHXjxOgW9PNqiCHtrr03u%2FN5qZLcFkT6qf4727xccZKSY9EYZovLvwjuYJwx2G30bjt9urjt3HeCIlBM7pg%2FNPR5Sp9pOABSDOLNHmx3qs2qzU5UZosPYI%2BoEl%2B4VsHJyx7xDrfxmXTkYHT36M3lnjcOXppq6Gss15AzBwqWXFN2Vd8GGUqLGBchzk2lcIlhz2Hfu5aTW0VQa8llmxJKqSH0epeZOVC0tik9dysRLNeHAUwcWOFVkheZ7xQn7Na1XkSpY%2FWPIdA61jFmnGkufJOlLnqo7NwSkPZEg5mJBU1Oquv75Si1HBn619jJz%2BnzkFH732lu22Z7dapwu7y2Wxn1BuxUdx%2B3apLwvksL%2Fx1uiXpLfWP10EhIgdi2FGlnz2YYL479o8zVfFDHxcrQonMLYfhoBETOzeWv9%2Bid0r&sso_reload=true	HTTP Parser: Number of links: 0

HTML title does not match URL

Source: https://login.microsoftonline.com/c765d391-7aad-4c45-8362-df4ece7a3fd4/saml2/?SAMLRequest=fZJPT9wwEMW%2FSm4%2BOc4fJ9lYm5VSVpVWQIWg7aGXataZFAvHXjxOgW9PNqiCHtrr03u%2FN5qZLcFkT6qf4727xccZKSY9EYZovLvwjuYJwx2G30bjt9urjt3HeCIlBM7pg%2FNPR5Sp9pOABSDOLNHmx3qs2qzU5UZosPYI%2BoEl%2B4VsHJyx7xDrfxmXTkYHT36M3lnjcOXppq6Gss15AzBwqWXFN2Vd8GGUqLGBchzk2lcIlhz2Hfu5aTW0VQa8llmxJKqSH0epeZOVC0tik9dysRLNeHAUwcWOFVkheZ7xQn7Na1XkSpY%2FWPIdA61jFmnGkufJOlLnqo7NwSkPZEg5mJBU1Oquv75Si1HBn619jJz%2BnzkFH732lu22Z7dapwu7y2Wxn1BuxUdx%2B3apLwvksL%2Fx1uiXpLfWP10EhIgdi2FGlnz2YYL479o8zVfFDHxcrQonMLYfhoBETOzeWv9%2Bid0r	HTTP Parser: Title: Redirecting does not match URL
Source: https://login.microsoftonline.com/c765d391-7aad-4c45-8362-df4ece7a3fd4/saml2/?SAMLRequest=fZJPT9wwEMW%2FSm4%2BOc4fJ9lYm5VSVpVWQIWg7aGXataZFAvHXjxOgW9PNqiCHtrr03u%2FN5qZLcFkT6qf4727xccZKSY9EYZovLvwjuYJwx2G30bjt9urjt3HeCIlBM7pg%2FNPR5Sp9pOABSDOLNHmx3qs2qzU5UZosPYI%2BoEl%2B4VsHJyx7xDrfxmXTkYHT36M3lnjcOXppq6Gss15AzBwqWXFN2Vd8GGUqLGBchzk2lcIlhz2Hfu5aTW0VQa8llmxJKqSH0epeZOVC0tik9dysRLNeHAUwcWOFVkheZ7xQn7Na1XkSpY%2FWPIdA61jFmnGkufJOlLnqo7NwSkPZEg5mJBU1Oquv75Si1HBn619jJz%2BnzkFH732lu22Z7dapwu7y2Wxn1BuxUdx%2B3apLwvksL%2Fx1uiXpLfWP10EhIgdi2FGlnz2YYL479o8zVfFDHxcrQonMLYfhoBETOzeWv9%2Bid0r&sso_reload=true	HTTP Parser: Title: Sign in to your account does not match URL

Source: https://login.microsoftonline.com/c765d391-7aad-4c45-8362-df4ece7a3fd4/saml2/?SAMLRequest=fZJPT9wwEMW%2FSm4%2BOc4fJ9lYm5VSVpVWQIWg7aGXataZFAvHXjxOgW9PNqiCHtrr03u%2FN5qZLcFkT6qf4727xccZKSY9EYZovLvwjuYJwx2G30bjt9urjt3HeCIlBM7pg%2FNPR5Sp9pOABSDOLNHmx3qs2qzU5UZosPYI%2BoEl%2B4VsHJyx7xDrfxmXTkYHT36M3lnjcOXppq6Gss15AzBwqWXFN2Vd8GGUqLGBchzk2lcIlhz2Hfu5aTW0VQa8llmxJKqSH0epeZOVC0tik9dysRLNeHAUwcWOFVkheZ7xQn7Na1XkSpY%2FWPIdA61jFmnGkufJOlLnqo7NwSkPZEg5mJBU1Oquv75Si1HBn619jJz%2BnzkFH732lu22Z7dapwu7y2Wxn1BuxUdx%2B3apLwvksL%2Fx1uiXpLfWP10EhIgdi2FGlnz2YYL479o8zVfFDHxcrQonMLYfhoBETOzeWv9%2Bid0r&sso_reload=true

HTTP Parser: <input type="password" .../> found

HTTP Parser: No favicon

Source: https://login.microsoftonline.com/c765d391-7aad-4c45-8362-df4ece7a3fd4/saml2/?SAMLRequest=fZJPT9wwEMW%2FSm4%2BOc4fJ9lYm5VSVpVWQIWg7aGXataZFAvHXjxOgW9PNqiCHtrr03u%2FN5qZLcFkT6qf4727xccZKSY9EYZovLvwjuYJwx2G30bjt9urjt3HeCIlBM7pg%2FNPR5Sp9pOABSDOLNHmx3qs2qzU5UZosPYI%2BoEl%2B4VsHJyx7xDrfxmXTkYHT36M3lnjcOXppq6Gss15AzBwqWXFN2Vd8GGUqLGBchzk2lcIlhz2Hfu5aTW0VQa8llmxJKqSH0epeZOVC0tik9dysRLNeHAUwcWOFVkheZ7xQn7Na1XkSpY%2FWPIdA61jFmnGkufJOlLnqo7NwSkPZEg5mJBU1Oquv75Si1HBn619jJz%2BnzkFH732lu22Z7dapwu7y2Wxn1BuxUdx%2B3apLwvksL%2Fx1uiXpLfWP10EhIgdi2FGlnz2YYL479o8zVfFDHxcrQonMLYfhoBETOzeWv9%2Bid0r	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/c765d391-7aad-4c45-8362-df4ece7a3fd4/saml2/?SAMLRequest=fZJPT9wwEMW%2FSm4%2BOc4fJ9lYm5VSVpVWQIWg7aGXataZFAvHXjxOgW9PNqiCHtrr03u%2FN5qZLcFkT6qf4727xccZKSY9EYZovLvwjuYJwx2G30bjt9urjt3HeCIlBM7pg%2FNPR5Sp9pOABSDOLNHmx3qs2qzU5UZosPYI%2BoEl%2B4VsHJyx7xDrfxmXTkYHT36M3lnjcOXppq6Gss15AzBwqWXFN2Vd8GGUqLGBchzk2lcIlhz2Hfu5aTW0VQa8llmxJKqSH0epeZOVC0tik9dysRLNeHAUwcWOFVkheZ7xQn7Na1XkSpY%2FWPIdA61jFmnGkufJOlLnqo7NwSkPZEg5mJBU1Oquv75Si1HBn619jJz%2BnzkFH732lu22Z7dapwu7y2Wxn1BuxUdx%2B3apLwvksL%2Fx1uiXpLfWP10EhIgdi2FGlnz2YYL479o8zVfFDHxcrQonMLYfhoBETOzeWv9%2Bid0r&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/c765d391-7aad-4c45-8362-df4ece7a3fd4/saml2/?SAMLRequest=fZJPT9wwEMW%2FSm4%2BOc4fJ9lYm5VSVpVWQIWg7aGXataZFAvHXjxOgW9PNqiCHtrr03u%2FN5qZLcFkT6qf4727xccZKSY9EYZovLvwjuYJwx2G30bjt9urjt3HeCIlBM7pg%2FNPR5Sp9pOABSDOLNHmx3qs2qzU5UZosPYI%2BoEl%2B4VsHJyx7xDrfxmXTkYHT36M3lnjcOXppq6Gss15AzBwqWXFN2Vd8GGUqLGBchzk2lcIlhz2Hfu5aTW0VQa8llmxJKqSH0epeZOVC0tik9dysRLNeHAUwcWOFVkheZ7xQn7Na1XkSpY%2FWPIdA61jFmnGkufJOlLnqo7NwSkPZEg5mJBU1Oquv75Si1HBn619jJz%2BnzkFH732lu22Z7dapwu7y2Wxn1BuxUdx%2B3apLwvksL%2Fx1uiXpLfWP10EhIgdi2FGlnz2YYL479o8zVfFDHxcrQonMLYfhoBETOzeWv9%2Bid0r&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/c765d391-7aad-4c45-8362-df4ece7a3fd4/saml2/?SAMLRequest=fZJPT9wwEMW%2FSm4%2BOc4fJ9lYm5VSVpVWQIWg7aGXataZFAvHXjxOgW9PNqiCHtrr03u%2FN5qZLcFkT6qf4727xccZKSY9EYZovLvwjuYJwx2G30bjt9urjt3HeCIlBM7pg%2FNPR5Sp9pOABSDOLNHmx3qs2qzU5UZosPYI%2BoEl%2B4VsHJyx7xDrfxmXTkYHT36M3lnjcOXppq6Gss15AzBwqWXFN2Vd8GGUqLGBchzk2lcIlhz2Hfu5aTW0VQa8llmxJKqSH0epeZOVC0tik9dysRLNeHAUwcWOFVkheZ7xQn7Na1XkSpY%2FWPIdA61jFmnGkufJOlLnqo7NwSkPZEg5mJBU1Oquv75Si1HBn619jJz%2BnzkFH732lu22Z7dapwu7y2Wxn1BuxUdx%2B3apLwvksL%2Fx1uiXpLfWP10EhIgdi2FGlnz2YYL479o8zVfFDHxcrQonMLYfhoBETOzeWv9%2Bid0r&sso_reload=true	HTTP Parser: No <meta name="author".. found

Source: https://login.microsoftonline.com/c765d391-7aad-4c45-8362-df4ece7a3fd4/saml2/?SAMLRequest=fZJPT9wwEMW%2FSm4%2BOc4fJ9lYm5VSVpVWQIWg7aGXataZFAvHXjxOgW9PNqiCHtrr03u%2FN5qZLcFkT6qf4727xccZKSY9EYZovLvwjuYJwx2G30bjt9urjt3HeCIlBM7pg%2FNPR5Sp9pOABSDOLNHmx3qs2qzU5UZosPYI%2BoEl%2B4VsHJyx7xDrfxmXTkYHT36M3lnjcOXppq6Gss15AzBwqWXFN2Vd8GGUqLGBchzk2lcIlhz2Hfu5aTW0VQa8llmxJKqSH0epeZOVC0tik9dysRLNeHAUwcWOFVkheZ7xQn7Na1XkSpY%2FWPIdA61jFmnGkufJOlLnqo7NwSkPZEg5mJBU1Oquv75Si1HBn619jJz%2BnzkFH732lu22Z7dapwu7y2Wxn1BuxUdx%2B3apLwvksL%2Fx1uiXpLfWP10EhIgdi2FGlnz2YYL479o8zVfFDHxcrQonMLYfhoBETOzeWv9%2Bid0r	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/c765d391-7aad-4c45-8362-df4ece7a3fd4/saml2/?SAMLRequest=fZJPT9wwEMW%2FSm4%2BOc4fJ9lYm5VSVpVWQIWg7aGXataZFAvHXjxOgW9PNqiCHtrr03u%2FN5qZLcFkT6qf4727xccZKSY9EYZovLvwjuYJwx2G30bjt9urjt3HeCIlBM7pg%2FNPR5Sp9pOABSDOLNHmx3qs2qzU5UZosPYI%2BoEl%2B4VsHJyx7xDrfxmXTkYHT36M3lnjcOXppq6Gss15AzBwqWXFN2Vd8GGUqLGBchzk2lcIlhz2Hfu5aTW0VQa8llmxJKqSH0epeZOVC0tik9dysRLNeHAUwcWOFVkheZ7xQn7Na1XkSpY%2FWPIdA61jFmnGkufJOlLnqo7NwSkPZEg5mJBU1Oquv75Si1HBn619jJz%2BnzkFH732lu22Z7dapwu7y2Wxn1BuxUdx%2B3apLwvksL%2Fx1uiXpLfWP10EhIgdi2FGlnz2YYL479o8zVfFDHxcrQonMLYfhoBETOzeWv9%2Bid0r&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/c765d391-7aad-4c45-8362-df4ece7a3fd4/saml2/?SAMLRequest=fZJPT9wwEMW%2FSm4%2BOc4fJ9lYm5VSVpVWQIWg7aGXataZFAvHXjxOgW9PNqiCHtrr03u%2FN5qZLcFkT6qf4727xccZKSY9EYZovLvwjuYJwx2G30bjt9urjt3HeCIlBM7pg%2FNPR5Sp9pOABSDOLNHmx3qs2qzU5UZosPYI%2BoEl%2B4VsHJyx7xDrfxmXTkYHT36M3lnjcOXppq6Gss15AzBwqWXFN2Vd8GGUqLGBchzk2lcIlhz2Hfu5aTW0VQa8llmxJKqSH0epeZOVC0tik9dysRLNeHAUwcWOFVkheZ7xQn7Na1XkSpY%2FWPIdA61jFmnGkufJOlLnqo7NwSkPZEg5mJBU1Oquv75Si1HBn619jJz%2BnzkFH732lu22Z7dapwu7y2Wxn1BuxUdx%2B3apLwvksL%2Fx1uiXpLfWP10EhIgdi2FGlnz2YYL479o8zVfFDHxcrQonMLYfhoBETOzeWv9%2Bid0r&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/c765d391-7aad-4c45-8362-df4ece7a3fd4/saml2/?SAMLRequest=fZJPT9wwEMW%2FSm4%2BOc4fJ9lYm5VSVpVWQIWg7aGXataZFAvHXjxOgW9PNqiCHtrr03u%2FN5qZLcFkT6qf4727xccZKSY9EYZovLvwjuYJwx2G30bjt9urjt3HeCIlBM7pg%2FNPR5Sp9pOABSDOLNHmx3qs2qzU5UZosPYI%2BoEl%2B4VsHJyx7xDrfxmXTkYHT36M3lnjcOXppq6Gss15AzBwqWXFN2Vd8GGUqLGBchzk2lcIlhz2Hfu5aTW0VQa8llmxJKqSH0epeZOVC0tik9dysRLNeHAUwcWOFVkheZ7xQn7Na1XkSpY%2FWPIdA61jFmnGkufJOlLnqo7NwSkPZEg5mJBU1Oquv75Si1HBn619jJz%2BnzkFH732lu22Z7dapwu7y2Wxn1BuxUdx%2B3apLwvksL%2Fx1uiXpLfWP10EhIgdi2FGlnz2YYL479o8zVfFDHxcrQonMLYfhoBETOzeWv9%2Bid0r&sso_reload=true	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49750 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212

Source: global traffic	DNS traffic detected: DNS query: eu.knowbe4.com
Source: global traffic	DNS traffic detected: DNS query: login.microsoftonline.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: identity.nel.measure.office.net
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauthimages.net
Source: global traffic	DNS traffic detected: DNS query: autologon.microsoftazuread-sso.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49750 version: TLS 1.2

Source: classification engine

Classification label: clean1.win@18/21@24/206

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1736,i,1474601239279698102,4990120423817348364,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://eu.knowbe4.com/auth/saml/91b6f5903c38"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1736,i,1474601239279698102,4990120423817348364,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.110.84	unknown	United States	15169	GOOGLEUS	false
142.250.186.67	unknown	United States	15169	GOOGLEUS	false
13.107.246.45	s-part-0017.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.253.45	s-part-0017.t-0009.fb-t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.190.159.71	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.246.60	s-part-0032.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.185.106	unknown	United States	15169	GOOGLEUS	false
2.19.126.146	unknown	European Union	16625	AKAMAI-ASUS	false
216.58.206.46	unknown	United States	15169	GOOGLEUS	false
20.190.159.23	autologon.microsoftazuread-sso.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
2.19.126.143	unknown	European Union	16625	AKAMAI-ASUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
152.199.21.175	sni1gl.wpc.omegacdn.net	United States	15133	EDGECASTUS	false
142.250.186.131	unknown	United States	15169	GOOGLEUS	false
142.250.186.132	www.google.com	United States	15169	GOOGLEUS	false
142.250.186.110	unknown	United States	15169	GOOGLEUS	false
20.190.160.20	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
40.126.31.69	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
52.222.236.7	eu.knowbe4.com	United States	16509	AMAZON-02US	false

Private

IP
192.168.2.16

Contacted Domains

Name	IP	Active
eu.knowbe4.com	52.222.236.7	true
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true
sni1gl.wpc.omegacdn.net	152.199.21.175	true
s-part-0017.t-0009.fb-t-msedge.net	13.107.253.45	true
www.google.com	142.250.186.132	true
s-part-0032.t-0009.t-msedge.net	13.107.246.60	true
autologon.microsoftazuread-sso.com	20.190.159.23	true
identity.nel.measure.office.net	unknown	unknown
aadcdn.msftauth.net	unknown	unknown
login.microsoftonline.com	unknown	unknown
aadcdn.msftauthimages.net	unknown	unknown

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 15:21:43 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	1F0EF6D6D6511268ACF03F44D365311E	4A44A9A94822BA5282109FDC175CEBF7CE13813F	B0C9DAE0110AD039B234CF87882B6C46AA4A1E528777E35C471021A1D1968B49
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 15:21:42 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	AC5531858A8030635A7465A3BC586AED	B5371BCA051FB8581ED14AB3DF1497A1A4489B19	D7F64F338098C13C15D0AF7C0B6ABE4FE019D98935C1E12743E4A7D79C776B60
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	3BFB86F7E90617F317564B4BD473EF20	ACFE0EF199AF9DB528A2A5E19D5A9E61C32C829D	A777E98833568992613FE779F5620F27732859B656E362870FDD8B2AC6A47D26
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 15:21:42 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	BCE0C3A1C473C9EB2FE9965B4573A010	7235A283078140D4C4C948828CB0F34763C97649	C6BEE527E534188EAE0E0FA026D61AD33DF5840D7973F8ACE45FC8387DB7F3FC
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 15:21:43 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	713D3AD54C57F0165E57FED66F684C1B	70BD6DACC3BF19FF78C3BB7B7768AD81BCEAF818	D651C69EEC923DF4C3F5B028842BF1B5C0A6134C48045A0CEDBA392BF330E8F1
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 15:21:42 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	29C4B0A90BE10FEC5CE2832ADF928863	ECA0C1C70A351C7FCAA6D07FE23616F64081570C	0F810F8E4D6B9D12569078FDF818674F5B53465163546A2B3AE1F5AF10FCA987
Chrome Cache Entry: 102	ASCII text, with very long lines (64616)	40B17FF1AA4D4490F7382A25F23C2DC7	401F26BDF93A14779CA131C29E385C97F1FF9830	9019F3CFFB86BF28F83D0E85EEBF21FD0A37C4BF159EDFCB6F18D0DF12CB5E02
Chrome Cache Entry: 103	ASCII text, with very long lines (14782)	630831903F4BA9060856520624E34CFC	36DC15B9CCC3FC8EF627354BF55EF44EBD10E203	BC6804D058D5BD5B24FC04E479FC8973BEF5D3EFEAFAA9C19C60A009BF0FAC0B
Chrome Cache Entry: 77	PNG image data, 280 x 60, 8-bit colormap, non-interlaced	ED9639384619BCC6A110F1E101CC2599	44471CBB873C6BCCBD6D4B1E369ACA92AA0C207A	890CD1393BD68BD180A97E74E10B6423185637CACDADCDD34587C6DD1049C59A
Chrome Cache Entry: 78	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 141866	6DE768A4DF1E0D0061CDB52EF06346C4	3829A667B97668008023DDA98F4C0772174C8EF6	58732EEE2ED9091F4F5776DC8A8A14116CBE5A2BA1CCDA0256896BAB08A52128
Chrome Cache Entry: 79	HTML document, ASCII text, with very long lines (3450), with CRLF line terminators	CB06E9A552B197D5C0EA600B431A3407	04E167433F2F1038C78F387F8A166BB6542C2008	1F4EDBD2416E15BD82E61BA1A8E5558D44C4E914536B1B07712181BF57934021
Chrome Cache Entry: 80	GIF image data, version 89a, 352 x 3	166DE53471265253AB3A456DEFE6DA23	17C6DF4D7CCF1FA2C9EFD716FBAE0FC2C71C8D6D	A46201581A7C7C667FD42787CD1E9ADF2F6BF809EFB7596E61A03E8DBA9ADA13
Chrome Cache Entry: 81	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=9, xresolution=122, yresolution=130, resolutionunit=2, software=paint.net 4.0.21], baseline, precision 8, 1920x1080, components 3	B75E9E58497B4615896DA946AF3DBAB8	28C4BBAB57AF3BD0E4ABD7CA7A8B97D8E407483F	78B440779F07B8A64DA00BCBE5A00B6573F220562FFD0368173D645FBD94B1DA
Chrome Cache Entry: 82	ASCII text, with very long lines (61177)	9C837C2B6C9C441656C3C64BE6FC6401	D44AA83093C4109DDD8FFAEA60755F05D1BFE7D3	68C2994E21A564345EB3B4091DD2334C9CBDDB0AECDA45EE963C6DE2E1629B93
Chrome Cache Entry: 83	GIF image data, version 89a, 352 x 3	B540A8E518037192E32C4FE58BF2DBAB	3047C1DB97B86F6981E0AD2F96AF40CDF43511AF	8737D721808655F37B333F08A90185699E7E8B9BDAAA15CDB63C8448B426F95D
Chrome Cache Entry: 84	SVG Scalable Vector Graphics image	4E48046CE74F4B89D45037C90576BFAC	4A41B3B51ED787F7B33294202DA72220C7CD2C32	8E6DB1634F1812D42516778FC890010AA57F3E39914FB4803DF2C38ABBF56D93
Chrome Cache Entry: 87	ASCII text, with very long lines (64612)	C6C029BA88D52E5312FEC69603A00340	079011F6F0662C11AE907C773EFE8E0C9338EAD0	DDD0BB1C19B3D2D045BFCDE85D2020BBA57854C887A6691B66DBA3DA1BB3AFBE
Chrome Cache Entry: 93	ASCII text, with no line terminators	06B313E93DD76909460FBFC0CD98CB6B	C4F9B2BBD840A4328F85F54873C434336A193888	B4532478707B495D0BB1C21C314AEF959DD1A5E0F66E52DAD5FC332C8B697CBA
Chrome Cache Entry: 94	ASCII text, with very long lines (45797)	E40761677762EAB0692F86B259C7D744	34A9B50CEC6E1163CEEFCD4D394DB6524C89A854	DA4A8DF0C326292B5BEE9C732B3C962FD67AAF2F99D850F1BF65068D573C5619
Chrome Cache Entry: 96	Unicode text, UTF-8 text, with very long lines (32009)	D580777BB3A28B94F6F1D18EE17AEDA3	E78833A2DB1AA97DA3F4A1994E6AF1F0D74D7CC7	81188E8A76162C79DB4A5C10AC933C9E874C5B9EAE10E47956AD9DF704E01B28
Chrome Cache Entry: 99	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors	12E3DAC858061D088023B2BD48E2FA96	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21

HTML body contains low number of good links

Source: https://login.microsoftonline.com/c765d391-7aad-4c45-8362-df4ece7a3fd4/saml2/?SAMLRequest=fZJPT9wwEMW%2FSm4%2BOc4fJ9lYm5VSVpVWQIWg7aGXataZFAvHXjxOgW9PNqiCHtrr03u%2FN5qZLcFkT6qf4727xccZKSY9EYZovLvwjuYJwx2G30bjt9urjt3HeCIlBM7pg%2FNPR5Sp9pOABSDOLNHmx3qs2qzU5UZosPYI%2BoEl%2B4VsHJyx7xDrfxmXTkYHT36M3lnjcOXppq6Gss15AzBwqWXFN2Vd8GGUqLGBchzk2lcIlhz2Hfu5aTW0VQa8llmxJKqSH0epeZOVC0tik9dysRLNeHAUwcWOFVkheZ7xQn7Na1XkSpY%2FWPIdA61jFmnGkufJOlLnqo7NwSkPZEg5mJBU1Oquv75Si1HBn619jJz%2BnzkFH732lu22Z7dapwu7y2Wxn1BuxUdx%2B3apLwvksL%2Fx1uiXpLfWP10EhIgdi2FGlnz2YYL479o8zVfFDHxcrQonMLYfhoBETOzeWv9%2Bid0r	HTTP Parser: Number of links: 0
Source: https://login.microsoftonline.com/c765d391-7aad-4c45-8362-df4ece7a3fd4/saml2/?SAMLRequest=fZJPT9wwEMW%2FSm4%2BOc4fJ9lYm5VSVpVWQIWg7aGXataZFAvHXjxOgW9PNqiCHtrr03u%2FN5qZLcFkT6qf4727xccZKSY9EYZovLvwjuYJwx2G30bjt9urjt3HeCIlBM7pg%2FNPR5Sp9pOABSDOLNHmx3qs2qzU5UZosPYI%2BoEl%2B4VsHJyx7xDrfxmXTkYHT36M3lnjcOXppq6Gss15AzBwqWXFN2Vd8GGUqLGBchzk2lcIlhz2Hfu5aTW0VQa8llmxJKqSH0epeZOVC0tik9dysRLNeHAUwcWOFVkheZ7xQn7Na1XkSpY%2FWPIdA61jFmnGkufJOlLnqo7NwSkPZEg5mJBU1Oquv75Si1HBn619jJz%2BnzkFH732lu22Z7dapwu7y2Wxn1BuxUdx%2B3apLwvksL%2Fx1uiXpLfWP10EhIgdi2FGlnz2YYL479o8zVfFDHxcrQonMLYfhoBETOzeWv9%2Bid0r&sso_reload=true	HTTP Parser: Number of links: 0

HTML title does not match URL

Source: https://login.microsoftonline.com/c765d391-7aad-4c45-8362-df4ece7a3fd4/saml2/?SAMLRequest=fZJPT9wwEMW%2FSm4%2BOc4fJ9lYm5VSVpVWQIWg7aGXataZFAvHXjxOgW9PNqiCHtrr03u%2FN5qZLcFkT6qf4727xccZKSY9EYZovLvwjuYJwx2G30bjt9urjt3HeCIlBM7pg%2FNPR5Sp9pOABSDOLNHmx3qs2qzU5UZosPYI%2BoEl%2B4VsHJyx7xDrfxmXTkYHT36M3lnjcOXppq6Gss15AzBwqWXFN2Vd8GGUqLGBchzk2lcIlhz2Hfu5aTW0VQa8llmxJKqSH0epeZOVC0tik9dysRLNeHAUwcWOFVkheZ7xQn7Na1XkSpY%2FWPIdA61jFmnGkufJOlLnqo7NwSkPZEg5mJBU1Oquv75Si1HBn619jJz%2BnzkFH732lu22Z7dapwu7y2Wxn1BuxUdx%2B3apLwvksL%2Fx1uiXpLfWP10EhIgdi2FGlnz2YYL479o8zVfFDHxcrQonMLYfhoBETOzeWv9%2Bid0r	HTTP Parser: Title: Redirecting does not match URL
Source: https://login.microsoftonline.com/c765d391-7aad-4c45-8362-df4ece7a3fd4/saml2/?SAMLRequest=fZJPT9wwEMW%2FSm4%2BOc4fJ9lYm5VSVpVWQIWg7aGXataZFAvHXjxOgW9PNqiCHtrr03u%2FN5qZLcFkT6qf4727xccZKSY9EYZovLvwjuYJwx2G30bjt9urjt3HeCIlBM7pg%2FNPR5Sp9pOABSDOLNHmx3qs2qzU5UZosPYI%2BoEl%2B4VsHJyx7xDrfxmXTkYHT36M3lnjcOXppq6Gss15AzBwqWXFN2Vd8GGUqLGBchzk2lcIlhz2Hfu5aTW0VQa8llmxJKqSH0epeZOVC0tik9dysRLNeHAUwcWOFVkheZ7xQn7Na1XkSpY%2FWPIdA61jFmnGkufJOlLnqo7NwSkPZEg5mJBU1Oquv75Si1HBn619jJz%2BnzkFH732lu22Z7dapwu7y2Wxn1BuxUdx%2B3apLwvksL%2Fx1uiXpLfWP10EhIgdi2FGlnz2YYL479o8zVfFDHxcrQonMLYfhoBETOzeWv9%2Bid0r&sso_reload=true	HTTP Parser: Title: Sign in to your account does not match URL

HTTP Parser: <input type="password" .../> found

HTTP Parser: No favicon

Source: https://login.microsoftonline.com/c765d391-7aad-4c45-8362-df4ece7a3fd4/saml2/?SAMLRequest=fZJPT9wwEMW%2FSm4%2BOc4fJ9lYm5VSVpVWQIWg7aGXataZFAvHXjxOgW9PNqiCHtrr03u%2FN5qZLcFkT6qf4727xccZKSY9EYZovLvwjuYJwx2G30bjt9urjt3HeCIlBM7pg%2FNPR5Sp9pOABSDOLNHmx3qs2qzU5UZosPYI%2BoEl%2B4VsHJyx7xDrfxmXTkYHT36M3lnjcOXppq6Gss15AzBwqWXFN2Vd8GGUqLGBchzk2lcIlhz2Hfu5aTW0VQa8llmxJKqSH0epeZOVC0tik9dysRLNeHAUwcWOFVkheZ7xQn7Na1XkSpY%2FWPIdA61jFmnGkufJOlLnqo7NwSkPZEg5mJBU1Oquv75Si1HBn619jJz%2BnzkFH732lu22Z7dapwu7y2Wxn1BuxUdx%2B3apLwvksL%2Fx1uiXpLfWP10EhIgdi2FGlnz2YYL479o8zVfFDHxcrQonMLYfhoBETOzeWv9%2Bid0r	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/c765d391-7aad-4c45-8362-df4ece7a3fd4/saml2/?SAMLRequest=fZJPT9wwEMW%2FSm4%2BOc4fJ9lYm5VSVpVWQIWg7aGXataZFAvHXjxOgW9PNqiCHtrr03u%2FN5qZLcFkT6qf4727xccZKSY9EYZovLvwjuYJwx2G30bjt9urjt3HeCIlBM7pg%2FNPR5Sp9pOABSDOLNHmx3qs2qzU5UZosPYI%2BoEl%2B4VsHJyx7xDrfxmXTkYHT36M3lnjcOXppq6Gss15AzBwqWXFN2Vd8GGUqLGBchzk2lcIlhz2Hfu5aTW0VQa8llmxJKqSH0epeZOVC0tik9dysRLNeHAUwcWOFVkheZ7xQn7Na1XkSpY%2FWPIdA61jFmnGkufJOlLnqo7NwSkPZEg5mJBU1Oquv75Si1HBn619jJz%2BnzkFH732lu22Z7dapwu7y2Wxn1BuxUdx%2B3apLwvksL%2Fx1uiXpLfWP10EhIgdi2FGlnz2YYL479o8zVfFDHxcrQonMLYfhoBETOzeWv9%2Bid0r&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/c765d391-7aad-4c45-8362-df4ece7a3fd4/saml2/?SAMLRequest=fZJPT9wwEMW%2FSm4%2BOc4fJ9lYm5VSVpVWQIWg7aGXataZFAvHXjxOgW9PNqiCHtrr03u%2FN5qZLcFkT6qf4727xccZKSY9EYZovLvwjuYJwx2G30bjt9urjt3HeCIlBM7pg%2FNPR5Sp9pOABSDOLNHmx3qs2qzU5UZosPYI%2BoEl%2B4VsHJyx7xDrfxmXTkYHT36M3lnjcOXppq6Gss15AzBwqWXFN2Vd8GGUqLGBchzk2lcIlhz2Hfu5aTW0VQa8llmxJKqSH0epeZOVC0tik9dysRLNeHAUwcWOFVkheZ7xQn7Na1XkSpY%2FWPIdA61jFmnGkufJOlLnqo7NwSkPZEg5mJBU1Oquv75Si1HBn619jJz%2BnzkFH732lu22Z7dapwu7y2Wxn1BuxUdx%2B3apLwvksL%2Fx1uiXpLfWP10EhIgdi2FGlnz2YYL479o8zVfFDHxcrQonMLYfhoBETOzeWv9%2Bid0r&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/c765d391-7aad-4c45-8362-df4ece7a3fd4/saml2/?SAMLRequest=fZJPT9wwEMW%2FSm4%2BOc4fJ9lYm5VSVpVWQIWg7aGXataZFAvHXjxOgW9PNqiCHtrr03u%2FN5qZLcFkT6qf4727xccZKSY9EYZovLvwjuYJwx2G30bjt9urjt3HeCIlBM7pg%2FNPR5Sp9pOABSDOLNHmx3qs2qzU5UZosPYI%2BoEl%2B4VsHJyx7xDrfxmXTkYHT36M3lnjcOXppq6Gss15AzBwqWXFN2Vd8GGUqLGBchzk2lcIlhz2Hfu5aTW0VQa8llmxJKqSH0epeZOVC0tik9dysRLNeHAUwcWOFVkheZ7xQn7Na1XkSpY%2FWPIdA61jFmnGkufJOlLnqo7NwSkPZEg5mJBU1Oquv75Si1HBn619jJz%2BnzkFH732lu22Z7dapwu7y2Wxn1BuxUdx%2B3apLwvksL%2Fx1uiXpLfWP10EhIgdi2FGlnz2YYL479o8zVfFDHxcrQonMLYfhoBETOzeWv9%2Bid0r&sso_reload=true	HTTP Parser: No <meta name="author".. found

Source: https://login.microsoftonline.com/c765d391-7aad-4c45-8362-df4ece7a3fd4/saml2/?SAMLRequest=fZJPT9wwEMW%2FSm4%2BOc4fJ9lYm5VSVpVWQIWg7aGXataZFAvHXjxOgW9PNqiCHtrr03u%2FN5qZLcFkT6qf4727xccZKSY9EYZovLvwjuYJwx2G30bjt9urjt3HeCIlBM7pg%2FNPR5Sp9pOABSDOLNHmx3qs2qzU5UZosPYI%2BoEl%2B4VsHJyx7xDrfxmXTkYHT36M3lnjcOXppq6Gss15AzBwqWXFN2Vd8GGUqLGBchzk2lcIlhz2Hfu5aTW0VQa8llmxJKqSH0epeZOVC0tik9dysRLNeHAUwcWOFVkheZ7xQn7Na1XkSpY%2FWPIdA61jFmnGkufJOlLnqo7NwSkPZEg5mJBU1Oquv75Si1HBn619jJz%2BnzkFH732lu22Z7dapwu7y2Wxn1BuxUdx%2B3apLwvksL%2Fx1uiXpLfWP10EhIgdi2FGlnz2YYL479o8zVfFDHxcrQonMLYfhoBETOzeWv9%2Bid0r	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/c765d391-7aad-4c45-8362-df4ece7a3fd4/saml2/?SAMLRequest=fZJPT9wwEMW%2FSm4%2BOc4fJ9lYm5VSVpVWQIWg7aGXataZFAvHXjxOgW9PNqiCHtrr03u%2FN5qZLcFkT6qf4727xccZKSY9EYZovLvwjuYJwx2G30bjt9urjt3HeCIlBM7pg%2FNPR5Sp9pOABSDOLNHmx3qs2qzU5UZosPYI%2BoEl%2B4VsHJyx7xDrfxmXTkYHT36M3lnjcOXppq6Gss15AzBwqWXFN2Vd8GGUqLGBchzk2lcIlhz2Hfu5aTW0VQa8llmxJKqSH0epeZOVC0tik9dysRLNeHAUwcWOFVkheZ7xQn7Na1XkSpY%2FWPIdA61jFmnGkufJOlLnqo7NwSkPZEg5mJBU1Oquv75Si1HBn619jJz%2BnzkFH732lu22Z7dapwu7y2Wxn1BuxUdx%2B3apLwvksL%2Fx1uiXpLfWP10EhIgdi2FGlnz2YYL479o8zVfFDHxcrQonMLYfhoBETOzeWv9%2Bid0r&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/c765d391-7aad-4c45-8362-df4ece7a3fd4/saml2/?SAMLRequest=fZJPT9wwEMW%2FSm4%2BOc4fJ9lYm5VSVpVWQIWg7aGXataZFAvHXjxOgW9PNqiCHtrr03u%2FN5qZLcFkT6qf4727xccZKSY9EYZovLvwjuYJwx2G30bjt9urjt3HeCIlBM7pg%2FNPR5Sp9pOABSDOLNHmx3qs2qzU5UZosPYI%2BoEl%2B4VsHJyx7xDrfxmXTkYHT36M3lnjcOXppq6Gss15AzBwqWXFN2Vd8GGUqLGBchzk2lcIlhz2Hfu5aTW0VQa8llmxJKqSH0epeZOVC0tik9dysRLNeHAUwcWOFVkheZ7xQn7Na1XkSpY%2FWPIdA61jFmnGkufJOlLnqo7NwSkPZEg5mJBU1Oquv75Si1HBn619jJz%2BnzkFH732lu22Z7dapwu7y2Wxn1BuxUdx%2B3apLwvksL%2Fx1uiXpLfWP10EhIgdi2FGlnz2YYL479o8zVfFDHxcrQonMLYfhoBETOzeWv9%2Bid0r&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/c765d391-7aad-4c45-8362-df4ece7a3fd4/saml2/?SAMLRequest=fZJPT9wwEMW%2FSm4%2BOc4fJ9lYm5VSVpVWQIWg7aGXataZFAvHXjxOgW9PNqiCHtrr03u%2FN5qZLcFkT6qf4727xccZKSY9EYZovLvwjuYJwx2G30bjt9urjt3HeCIlBM7pg%2FNPR5Sp9pOABSDOLNHmx3qs2qzU5UZosPYI%2BoEl%2B4VsHJyx7xDrfxmXTkYHT36M3lnjcOXppq6Gss15AzBwqWXFN2Vd8GGUqLGBchzk2lcIlhz2Hfu5aTW0VQa8llmxJKqSH0epeZOVC0tik9dysRLNeHAUwcWOFVkheZ7xQn7Na1XkSpY%2FWPIdA61jFmnGkufJOlLnqo7NwSkPZEg5mJBU1Oquv75Si1HBn619jJz%2BnzkFH732lu22Z7dapwu7y2Wxn1BuxUdx%2B3apLwvksL%2Fx1uiXpLfWP10EhIgdi2FGlnz2YYL479o8zVfFDHxcrQonMLYfhoBETOzeWv9%2Bid0r&sso_reload=true	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49750 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212

Source: global traffic	DNS traffic detected: DNS query: eu.knowbe4.com
Source: global traffic	DNS traffic detected: DNS query: login.microsoftonline.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: identity.nel.measure.office.net
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauthimages.net
Source: global traffic	DNS traffic detected: DNS query: autologon.microsoftazuread-sso.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49750 version: TLS 1.2

Source: classification engine

Classification label: clean1.win@18/21@24/206

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1736,i,1474601239279698102,4990120423817348364,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://eu.knowbe4.com/auth/saml/91b6f5903c38"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1736,i,1474601239279698102,4990120423817348364,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

ID:	1541363
Product:	CloudBasic
Start time:	18:21:11
Start date:	24.10.2024
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Windows Analysis Report
https://eu.knowbe4.com/auth/saml/91b6f5903c38

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Windows Analysis Report https://eu.knowbe4.com/auth/saml/91b6f5903c38

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Windows Analysis Report
https://eu.knowbe4.com/auth/saml/91b6f5903c38