Windows Analysis Report
https://eu.knowbe4.com/auth/saml/91b6f5903c38

Overview

General Information

Sample URL:	https://eu.knowbe4.com/auth/saml/91b6f5903c38
Analysis ID:	1541365
Infos:

Detection

Score:	4
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Creates files inside the system directory

Deletes files inside the Windows folder

Detected non-DNS traffic on DNS port

Drops PE files

Drops PE files to the windows directory (C:\Windows)

HTML body contains low number of good links

HTML title does not match URL

Stores files to the Windows start menu directory

Classification

Signatures

HTML body contains low number of good links

Source: https://login.microsoftonline.com/c765d391-7aad-4c45-8362-df4ece7a3fd4/saml2/?SAMLRequest=fZJPb9QwEMW%2FSm4%2BOc4fJ9m1NiuFrpBWlAq1lAMXNGtPqFXHXjxOC9%2BebCpEe4Dr6L3fG72ZHcHkzmqY04O%2FxR8zUsoGIozJBn8VPM0TxjuMT1bj%2Fe11zx5SOpMSAuf80YfnE8pch0nAAhAXltiWp3ZstkWt643Q4NwJ9CPLDgvZerhg%2F0Jc%2BG59PlkdA4UxBe%2Bsx5Wnu7Yx9bbkHYDhUsuGb%2Bq24maUqLGDejRyzasEy46Hnn1DbUaDcsOx6Bou26LkUHQjb0FD3dSFbrZ6kRLNePSUwKeeVUUleVnwSn4uW1VJJZuvLPuCkdY1q7xg2c%2FJeVKXqJ7N0asAZEl5mJBU0upu%2BHitFqGCP629tpz%2F7znHkIIOju13F7Vat4v7D0ux71DuxOvh7uVSNwvkePgUnNW%2FssG58HwVERL2LMUZWfY%2BxAnSv2PLvFwn1vBxlSqcwLrBmIhETOxfUt%2B%2BxP43	HTTP Parser: Number of links: 0
Source: https://login.microsoftonline.com/c765d391-7aad-4c45-8362-df4ece7a3fd4/saml2/?SAMLRequest=fZJPb9QwEMW%2FSm4%2BOc4fJ9m1NiuFrpBWlAq1lAMXNGtPqFXHXjxOC9%2BebCpEe4Dr6L3fG72ZHcHkzmqY04O%2FxR8zUsoGIozJBn8VPM0TxjuMT1bj%2Fe11zx5SOpMSAuf80YfnE8pch0nAAhAXltiWp3ZstkWt643Q4NwJ9CPLDgvZerhg%2F0Jc%2BG59PlkdA4UxBe%2Bsx5Wnu7Yx9bbkHYDhUsuGb%2Bq24maUqLGDejRyzasEy46Hnn1DbUaDcsOx6Bou26LkUHQjb0FD3dSFbrZ6kRLNePSUwKeeVUUleVnwSn4uW1VJJZuvLPuCkdY1q7xg2c%2FJeVKXqJ7N0asAZEl5mJBU0upu%2BHitFqGCP629tpz%2F7znHkIIOju13F7Vat4v7D0ux71DuxOvh7uVSNwvkePgUnNW%2FssG58HwVERL2LMUZWfY%2BxAnSv2PLvFwn1vBxlSqcwLrBmIhETOxfUt%2B%2BxP43&sso_reload=true	HTTP Parser: Number of links: 0

HTML title does not match URL

Source: https://login.microsoftonline.com/c765d391-7aad-4c45-8362-df4ece7a3fd4/saml2/?SAMLRequest=fZJPb9QwEMW%2FSm4%2BOc4fJ9m1NiuFrpBWlAq1lAMXNGtPqFXHXjxOC9%2BebCpEe4Dr6L3fG72ZHcHkzmqY04O%2FxR8zUsoGIozJBn8VPM0TxjuMT1bj%2Fe11zx5SOpMSAuf80YfnE8pch0nAAhAXltiWp3ZstkWt643Q4NwJ9CPLDgvZerhg%2F0Jc%2BG59PlkdA4UxBe%2Bsx5Wnu7Yx9bbkHYDhUsuGb%2Bq24maUqLGDejRyzasEy46Hnn1DbUaDcsOx6Bou26LkUHQjb0FD3dSFbrZ6kRLNePSUwKeeVUUleVnwSn4uW1VJJZuvLPuCkdY1q7xg2c%2FJeVKXqJ7N0asAZEl5mJBU0upu%2BHitFqGCP629tpz%2F7znHkIIOju13F7Vat4v7D0ux71DuxOvh7uVSNwvkePgUnNW%2FssG58HwVERL2LMUZWfY%2BxAnSv2PLvFwn1vBxlSqcwLrBmIhETOxfUt%2B%2BxP43	HTTP Parser: Title: Redirecting does not match URL
Source: https://login.microsoftonline.com/c765d391-7aad-4c45-8362-df4ece7a3fd4/saml2/?SAMLRequest=fZJPb9QwEMW%2FSm4%2BOc4fJ9m1NiuFrpBWlAq1lAMXNGtPqFXHXjxOC9%2BebCpEe4Dr6L3fG72ZHcHkzmqY04O%2FxR8zUsoGIozJBn8VPM0TxjuMT1bj%2Fe11zx5SOpMSAuf80YfnE8pch0nAAhAXltiWp3ZstkWt643Q4NwJ9CPLDgvZerhg%2F0Jc%2BG59PlkdA4UxBe%2Bsx5Wnu7Yx9bbkHYDhUsuGb%2Bq24maUqLGDejRyzasEy46Hnn1DbUaDcsOx6Bou26LkUHQjb0FD3dSFbrZ6kRLNePSUwKeeVUUleVnwSn4uW1VJJZuvLPuCkdY1q7xg2c%2FJeVKXqJ7N0asAZEl5mJBU0upu%2BHitFqGCP629tpz%2F7znHkIIOju13F7Vat4v7D0ux71DuxOvh7uVSNwvkePgUnNW%2FssG58HwVERL2LMUZWfY%2BxAnSv2PLvFwn1vBxlSqcwLrBmIhETOxfUt%2B%2BxP43&sso_reload=true	HTTP Parser: Title: Sign in to your account does not match URL

Source: https://login.microsoftonline.com/c765d391-7aad-4c45-8362-df4ece7a3fd4/saml2/?SAMLRequest=fZJPb9QwEMW%2FSm4%2BOc4fJ9m1NiuFrpBWlAq1lAMXNGtPqFXHXjxOC9%2BebCpEe4Dr6L3fG72ZHcHkzmqY04O%2FxR8zUsoGIozJBn8VPM0TxjuMT1bj%2Fe11zx5SOpMSAuf80YfnE8pch0nAAhAXltiWp3ZstkWt643Q4NwJ9CPLDgvZerhg%2F0Jc%2BG59PlkdA4UxBe%2Bsx5Wnu7Yx9bbkHYDhUsuGb%2Bq24maUqLGDejRyzasEy46Hnn1DbUaDcsOx6Bou26LkUHQjb0FD3dSFbrZ6kRLNePSUwKeeVUUleVnwSn4uW1VJJZuvLPuCkdY1q7xg2c%2FJeVKXqJ7N0asAZEl5mJBU0upu%2BHitFqGCP629tpz%2F7znHkIIOju13F7Vat4v7D0ux71DuxOvh7uVSNwvkePgUnNW%2FssG58HwVERL2LMUZWfY%2BxAnSv2PLvFwn1vBxlSqcwLrBmIhETOxfUt%2B%2BxP43&sso_reload=true

HTTP Parser: <input type="password" .../> found

HTTP Parser: No favicon

Source: https://login.microsoftonline.com/c765d391-7aad-4c45-8362-df4ece7a3fd4/saml2/?SAMLRequest=fZJPb9QwEMW%2FSm4%2BOc4fJ9m1NiuFrpBWlAq1lAMXNGtPqFXHXjxOC9%2BebCpEe4Dr6L3fG72ZHcHkzmqY04O%2FxR8zUsoGIozJBn8VPM0TxjuMT1bj%2Fe11zx5SOpMSAuf80YfnE8pch0nAAhAXltiWp3ZstkWt643Q4NwJ9CPLDgvZerhg%2F0Jc%2BG59PlkdA4UxBe%2Bsx5Wnu7Yx9bbkHYDhUsuGb%2Bq24maUqLGDejRyzasEy46Hnn1DbUaDcsOx6Bou26LkUHQjb0FD3dSFbrZ6kRLNePSUwKeeVUUleVnwSn4uW1VJJZuvLPuCkdY1q7xg2c%2FJeVKXqJ7N0asAZEl5mJBU0upu%2BHitFqGCP629tpz%2F7znHkIIOju13F7Vat4v7D0ux71DuxOvh7uVSNwvkePgUnNW%2FssG58HwVERL2LMUZWfY%2BxAnSv2PLvFwn1vBxlSqcwLrBmIhETOxfUt%2B%2BxP43	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/c765d391-7aad-4c45-8362-df4ece7a3fd4/saml2/?SAMLRequest=fZJPb9QwEMW%2FSm4%2BOc4fJ9m1NiuFrpBWlAq1lAMXNGtPqFXHXjxOC9%2BebCpEe4Dr6L3fG72ZHcHkzmqY04O%2FxR8zUsoGIozJBn8VPM0TxjuMT1bj%2Fe11zx5SOpMSAuf80YfnE8pch0nAAhAXltiWp3ZstkWt643Q4NwJ9CPLDgvZerhg%2F0Jc%2BG59PlkdA4UxBe%2Bsx5Wnu7Yx9bbkHYDhUsuGb%2Bq24maUqLGDejRyzasEy46Hnn1DbUaDcsOx6Bou26LkUHQjb0FD3dSFbrZ6kRLNePSUwKeeVUUleVnwSn4uW1VJJZuvLPuCkdY1q7xg2c%2FJeVKXqJ7N0asAZEl5mJBU0upu%2BHitFqGCP629tpz%2F7znHkIIOju13F7Vat4v7D0ux71DuxOvh7uVSNwvkePgUnNW%2FssG58HwVERL2LMUZWfY%2BxAnSv2PLvFwn1vBxlSqcwLrBmIhETOxfUt%2B%2BxP43&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/c765d391-7aad-4c45-8362-df4ece7a3fd4/saml2/?SAMLRequest=fZJPb9QwEMW%2FSm4%2BOc4fJ9m1NiuFrpBWlAq1lAMXNGtPqFXHXjxOC9%2BebCpEe4Dr6L3fG72ZHcHkzmqY04O%2FxR8zUsoGIozJBn8VPM0TxjuMT1bj%2Fe11zx5SOpMSAuf80YfnE8pch0nAAhAXltiWp3ZstkWt643Q4NwJ9CPLDgvZerhg%2F0Jc%2BG59PlkdA4UxBe%2Bsx5Wnu7Yx9bbkHYDhUsuGb%2Bq24maUqLGDejRyzasEy46Hnn1DbUaDcsOx6Bou26LkUHQjb0FD3dSFbrZ6kRLNePSUwKeeVUUleVnwSn4uW1VJJZuvLPuCkdY1q7xg2c%2FJeVKXqJ7N0asAZEl5mJBU0upu%2BHitFqGCP629tpz%2F7znHkIIOju13F7Vat4v7D0ux71DuxOvh7uVSNwvkePgUnNW%2FssG58HwVERL2LMUZWfY%2BxAnSv2PLvFwn1vBxlSqcwLrBmIhETOxfUt%2B%2BxP43&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/c765d391-7aad-4c45-8362-df4ece7a3fd4/saml2/?SAMLRequest=fZJPb9QwEMW%2FSm4%2BOc4fJ9m1NiuFrpBWlAq1lAMXNGtPqFXHXjxOC9%2BebCpEe4Dr6L3fG72ZHcHkzmqY04O%2FxR8zUsoGIozJBn8VPM0TxjuMT1bj%2Fe11zx5SOpMSAuf80YfnE8pch0nAAhAXltiWp3ZstkWt643Q4NwJ9CPLDgvZerhg%2F0Jc%2BG59PlkdA4UxBe%2Bsx5Wnu7Yx9bbkHYDhUsuGb%2Bq24maUqLGDejRyzasEy46Hnn1DbUaDcsOx6Bou26LkUHQjb0FD3dSFbrZ6kRLNePSUwKeeVUUleVnwSn4uW1VJJZuvLPuCkdY1q7xg2c%2FJeVKXqJ7N0asAZEl5mJBU0upu%2BHitFqGCP629tpz%2F7znHkIIOju13F7Vat4v7D0ux71DuxOvh7uVSNwvkePgUnNW%2FssG58HwVERL2LMUZWfY%2BxAnSv2PLvFwn1vBxlSqcwLrBmIhETOxfUt%2B%2BxP43&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/c765d391-7aad-4c45-8362-df4ece7a3fd4/saml2/?SAMLRequest=fZJPb9QwEMW%2FSm4%2BOc4fJ9m1NiuFrpBWlAq1lAMXNGtPqFXHXjxOC9%2BebCpEe4Dr6L3fG72ZHcHkzmqY04O%2FxR8zUsoGIozJBn8VPM0TxjuMT1bj%2Fe11zx5SOpMSAuf80YfnE8pch0nAAhAXltiWp3ZstkWt643Q4NwJ9CPLDgvZerhg%2F0Jc%2BG59PlkdA4UxBe%2Bsx5Wnu7Yx9bbkHYDhUsuGb%2Bq24maUqLGDejRyzasEy46Hnn1DbUaDcsOx6Bou26LkUHQjb0FD3dSFbrZ6kRLNePSUwKeeVUUleVnwSn4uW1VJJZuvLPuCkdY1q7xg2c%2FJeVKXqJ7N0asAZEl5mJBU0upu%2BHitFqGCP629tpz%2F7znHkIIOju13F7Vat4v7D0ux71DuxOvh7uVSNwvkePgUnNW%2FssG58HwVERL2LMUZWfY%2BxAnSv2PLvFwn1vBxlSqcwLrBmIhETOxfUt%2B%2BxP43&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/c765d391-7aad-4c45-8362-df4ece7a3fd4/saml2/?SAMLRequest=fZJPb9QwEMW%2FSm4%2BOc4fJ9m1NiuFrpBWlAq1lAMXNGtPqFXHXjxOC9%2BebCpEe4Dr6L3fG72ZHcHkzmqY04O%2FxR8zUsoGIozJBn8VPM0TxjuMT1bj%2Fe11zx5SOpMSAuf80YfnE8pch0nAAhAXltiWp3ZstkWt643Q4NwJ9CPLDgvZerhg%2F0Jc%2BG59PlkdA4UxBe%2Bsx5Wnu7Yx9bbkHYDhUsuGb%2Bq24maUqLGDejRyzasEy46Hnn1DbUaDcsOx6Bou26LkUHQjb0FD3dSFbrZ6kRLNePSUwKeeVUUleVnwSn4uW1VJJZuvLPuCkdY1q7xg2c%2FJeVKXqJ7N0asAZEl5mJBU0upu%2BHitFqGCP629tpz%2F7znHkIIOju13F7Vat4v7D0ux71DuxOvh7uVSNwvkePgUnNW%2FssG58HwVERL2LMUZWfY%2BxAnSv2PLvFwn1vBxlSqcwLrBmIhETOxfUt%2B%2BxP43&sso_reload=true	HTTP Parser: No <meta name="author".. found

Source: https://login.microsoftonline.com/c765d391-7aad-4c45-8362-df4ece7a3fd4/saml2/?SAMLRequest=fZJPb9QwEMW%2FSm4%2BOc4fJ9m1NiuFrpBWlAq1lAMXNGtPqFXHXjxOC9%2BebCpEe4Dr6L3fG72ZHcHkzmqY04O%2FxR8zUsoGIozJBn8VPM0TxjuMT1bj%2Fe11zx5SOpMSAuf80YfnE8pch0nAAhAXltiWp3ZstkWt643Q4NwJ9CPLDgvZerhg%2F0Jc%2BG59PlkdA4UxBe%2Bsx5Wnu7Yx9bbkHYDhUsuGb%2Bq24maUqLGDejRyzasEy46Hnn1DbUaDcsOx6Bou26LkUHQjb0FD3dSFbrZ6kRLNePSUwKeeVUUleVnwSn4uW1VJJZuvLPuCkdY1q7xg2c%2FJeVKXqJ7N0asAZEl5mJBU0upu%2BHitFqGCP629tpz%2F7znHkIIOju13F7Vat4v7D0ux71DuxOvh7uVSNwvkePgUnNW%2FssG58HwVERL2LMUZWfY%2BxAnSv2PLvFwn1vBxlSqcwLrBmIhETOxfUt%2B%2BxP43	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/c765d391-7aad-4c45-8362-df4ece7a3fd4/saml2/?SAMLRequest=fZJPb9QwEMW%2FSm4%2BOc4fJ9m1NiuFrpBWlAq1lAMXNGtPqFXHXjxOC9%2BebCpEe4Dr6L3fG72ZHcHkzmqY04O%2FxR8zUsoGIozJBn8VPM0TxjuMT1bj%2Fe11zx5SOpMSAuf80YfnE8pch0nAAhAXltiWp3ZstkWt643Q4NwJ9CPLDgvZerhg%2F0Jc%2BG59PlkdA4UxBe%2Bsx5Wnu7Yx9bbkHYDhUsuGb%2Bq24maUqLGDejRyzasEy46Hnn1DbUaDcsOx6Bou26LkUHQjb0FD3dSFbrZ6kRLNePSUwKeeVUUleVnwSn4uW1VJJZuvLPuCkdY1q7xg2c%2FJeVKXqJ7N0asAZEl5mJBU0upu%2BHitFqGCP629tpz%2F7znHkIIOju13F7Vat4v7D0ux71DuxOvh7uVSNwvkePgUnNW%2FssG58HwVERL2LMUZWfY%2BxAnSv2PLvFwn1vBxlSqcwLrBmIhETOxfUt%2B%2BxP43&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/c765d391-7aad-4c45-8362-df4ece7a3fd4/saml2/?SAMLRequest=fZJPb9QwEMW%2FSm4%2BOc4fJ9m1NiuFrpBWlAq1lAMXNGtPqFXHXjxOC9%2BebCpEe4Dr6L3fG72ZHcHkzmqY04O%2FxR8zUsoGIozJBn8VPM0TxjuMT1bj%2Fe11zx5SOpMSAuf80YfnE8pch0nAAhAXltiWp3ZstkWt643Q4NwJ9CPLDgvZerhg%2F0Jc%2BG59PlkdA4UxBe%2Bsx5Wnu7Yx9bbkHYDhUsuGb%2Bq24maUqLGDejRyzasEy46Hnn1DbUaDcsOx6Bou26LkUHQjb0FD3dSFbrZ6kRLNePSUwKeeVUUleVnwSn4uW1VJJZuvLPuCkdY1q7xg2c%2FJeVKXqJ7N0asAZEl5mJBU0upu%2BHitFqGCP629tpz%2F7znHkIIOju13F7Vat4v7D0ux71DuxOvh7uVSNwvkePgUnNW%2FssG58HwVERL2LMUZWfY%2BxAnSv2PLvFwn1vBxlSqcwLrBmIhETOxfUt%2B%2BxP43&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/c765d391-7aad-4c45-8362-df4ece7a3fd4/saml2/?SAMLRequest=fZJPb9QwEMW%2FSm4%2BOc4fJ9m1NiuFrpBWlAq1lAMXNGtPqFXHXjxOC9%2BebCpEe4Dr6L3fG72ZHcHkzmqY04O%2FxR8zUsoGIozJBn8VPM0TxjuMT1bj%2Fe11zx5SOpMSAuf80YfnE8pch0nAAhAXltiWp3ZstkWt643Q4NwJ9CPLDgvZerhg%2F0Jc%2BG59PlkdA4UxBe%2Bsx5Wnu7Yx9bbkHYDhUsuGb%2Bq24maUqLGDejRyzasEy46Hnn1DbUaDcsOx6Bou26LkUHQjb0FD3dSFbrZ6kRLNePSUwKeeVUUleVnwSn4uW1VJJZuvLPuCkdY1q7xg2c%2FJeVKXqJ7N0asAZEl5mJBU0upu%2BHitFqGCP629tpz%2F7znHkIIOju13F7Vat4v7D0ux71DuxOvh7uVSNwvkePgUnNW%2FssG58HwVERL2LMUZWfY%2BxAnSv2PLvFwn1vBxlSqcwLrBmIhETOxfUt%2B%2BxP43&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/c765d391-7aad-4c45-8362-df4ece7a3fd4/saml2/?SAMLRequest=fZJPb9QwEMW%2FSm4%2BOc4fJ9m1NiuFrpBWlAq1lAMXNGtPqFXHXjxOC9%2BebCpEe4Dr6L3fG72ZHcHkzmqY04O%2FxR8zUsoGIozJBn8VPM0TxjuMT1bj%2Fe11zx5SOpMSAuf80YfnE8pch0nAAhAXltiWp3ZstkWt643Q4NwJ9CPLDgvZerhg%2F0Jc%2BG59PlkdA4UxBe%2Bsx5Wnu7Yx9bbkHYDhUsuGb%2Bq24maUqLGDejRyzasEy46Hnn1DbUaDcsOx6Bou26LkUHQjb0FD3dSFbrZ6kRLNePSUwKeeVUUleVnwSn4uW1VJJZuvLPuCkdY1q7xg2c%2FJeVKXqJ7N0asAZEl5mJBU0upu%2BHitFqGCP629tpz%2F7znHkIIOju13F7Vat4v7D0ux71DuxOvh7uVSNwvkePgUnNW%2FssG58HwVERL2LMUZWfY%2BxAnSv2PLvFwn1vBxlSqcwLrBmIhETOxfUt%2B%2BxP43&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/c765d391-7aad-4c45-8362-df4ece7a3fd4/saml2/?SAMLRequest=fZJPb9QwEMW%2FSm4%2BOc4fJ9m1NiuFrpBWlAq1lAMXNGtPqFXHXjxOC9%2BebCpEe4Dr6L3fG72ZHcHkzmqY04O%2FxR8zUsoGIozJBn8VPM0TxjuMT1bj%2Fe11zx5SOpMSAuf80YfnE8pch0nAAhAXltiWp3ZstkWt643Q4NwJ9CPLDgvZerhg%2F0Jc%2BG59PlkdA4UxBe%2Bsx5Wnu7Yx9bbkHYDhUsuGb%2Bq24maUqLGDejRyzasEy46Hnn1DbUaDcsOx6Bou26LkUHQjb0FD3dSFbrZ6kRLNePSUwKeeVUUleVnwSn4uW1VJJZuvLPuCkdY1q7xg2c%2FJeVKXqJ7N0asAZEl5mJBU0upu%2BHitFqGCP629tpz%2F7znHkIIOju13F7Vat4v7D0ux71DuxOvh7uVSNwvkePgUnNW%2FssG58HwVERL2LMUZWfY%2BxAnSv2PLvFwn1vBxlSqcwLrBmIhETOxfUt%2B%2BxP43&sso_reload=true	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.17:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.17:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.209.158:443 -> 192.168.2.17:49765 version: TLS 1.2

Detected non-DNS traffic on DNS port

Source: global traffic	TCP traffic: 192.168.2.17:53041 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:53041 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:53041 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:53041 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:53041 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:53041 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:53041 -> 1.1.1.1:53

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27

Source: global traffic	DNS traffic detected: DNS query: eu.knowbe4.com
Source: global traffic	DNS traffic detected: DNS query: login.microsoftonline.com
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: identity.nel.measure.office.net
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauthimages.net
Source: global traffic	DNS traffic detected: DNS query: autologon.microsoftazuread-sso.com

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53059
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49691
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 53044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49691 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53044
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746

Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.17:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.17:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.209.158:443 -> 192.168.2.17:49765 version: TLS 1.2

Creates files inside the system directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1948_1774058300
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1948_1774058300\sets.json
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1948_1774058300\manifest.json
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1948_1774058300\LICENSE
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1948_1774058300\_metadata\
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1948_1774058300\_metadata\verified_contents.json
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1948_1774058300\manifest.fingerprint
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1948_1120480828
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1948_1120480828\ssl_error_assistant.pb
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1948_1120480828\manifest.json
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1948_1120480828\_metadata\
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1948_1120480828\_metadata\verified_contents.json
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1948_1120480828\manifest.fingerprint
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1948_1409054206
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1948_1409054206\Google.Widevine.CDM.dll
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1948_1409054206\manifest.json
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1948_1409054206\_metadata\
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1948_1409054206\_metadata\verified_contents.json
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1948_1409054206\manifest.fingerprint
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1948_1602622838
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1948_1602622838\crl-set
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1948_1602622838\manifest.json
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1948_1602622838\LICENSE
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1948_1602622838\_metadata\
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1948_1602622838\_metadata\verified_contents.json
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1948_1602622838\manifest.fingerprint

Deletes files inside the Windows folder

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\chrome_BITS_1948_1929281110

Source: classification engine

Classification label: clean4.win@27/44@22/214

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1932,i,17393653513939364326,5208148675971558025,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://eu.knowbe4.com/auth/saml/91b6f5903c38"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1932,i,17393653513939364326,5208148675971558025,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Drops PE files

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1948_1409054206\Google.Widevine.CDM.dll

Jump to dropped file

Drops PE files to the windows directory (C:\Windows)

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1948_1409054206\Google.Widevine.CDM.dll

Jump to dropped file

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
52.222.236.127	eu.knowbe4.com	United States	16509	AMAZON-02US	false
142.250.186.67	unknown	United States	15169	GOOGLEUS	false
34.104.35.123	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
108.177.15.84	unknown	United States	15169	GOOGLEUS	false
172.217.16.206	unknown	United States	15169	GOOGLEUS	false
13.107.253.67	s-part-0039.t-0009.fb-t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.185.110	unknown	United States	15169	GOOGLEUS	false
13.107.246.60	s-part-0032.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
40.126.31.71	autologon.microsoftazuread-sso.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.190.159.64	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
40.126.32.74	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
2.16.164.19	unknown	European Union	20940	AKAMAI-ASN1EU	false
152.199.21.175	sni1gl.wpc.omegacdn.net	United States	15133	EDGECASTUS	false
95.101.54.113	unknown	European Union	34164	AKAMAI-LONGB	false
142.250.186.100	www.google.com	United States	15169	GOOGLEUS	false
40.126.31.69	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.217.18.10	unknown	United States	15169	GOOGLEUS	false
172.217.16.195	unknown	United States	15169	GOOGLEUS	false
20.50.201.205	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.69.116.107	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Private

IP
192.168.2.17

Contacted Domains

Name	IP	Active
eu.knowbe4.com	52.222.236.127	true
s-part-0044.t-0009.fb-t-msedge.net	13.107.253.72	true
sni1gl.wpc.omegacdn.net	152.199.21.175	true
www.google.com	142.250.186.100	true
s-part-0039.t-0009.fb-t-msedge.net	13.107.253.67	true
s-part-0032.t-0009.t-msedge.net	13.107.246.60	true
autologon.microsoftazuread-sso.com	40.126.31.71	true
identity.nel.measure.office.net	unknown	unknown
aadcdn.msftauth.net	unknown	unknown
login.microsoftonline.com	unknown	unknown
aadcdn.msftauthimages.net	unknown	unknown

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 15:24:46 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	089ED8B1166F822BB19D4584B524D61F	EDC79082C5EDCB22B6361357EB9985904205AF9F	E76995C78F06CBC622B49820412A6E346076EB7ACFE96988EAEC8529450F7B83
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 15:24:46 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	B21451B05EB5D2308478EF47B8B97C48	414A1524E37126DCAC5FAC00F50F4BC25DE6D6F5	3E71B2E812DE9ED8D8F6E2674938B30FFC1D656CD88EC75A19F419F8541BF60A
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:54:41 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	DB486856593A849690098813BDFD4846	AE6DDB1E548D53EAD93A9F82F9E7CDB5CB4F4A66	16508DEC6C319246AC039E09E52FCAC5087CD7FB5766608C866E73E9FEA01E72
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 15:24:46 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	F3A6B1973DC020706A1FF18041CEE899	82AC90CA6AF3E76056987B8601166330483C5A4C	491F1A377E10ED14BFB16EACCB0170C1272345E523787CCF173DD50BBBB6D8B5
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 15:24:46 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	45FB6520921E2B1B459DA1FBEFAD4DDF	8638ED94F002D6313D0BFDDA8504C1A9E6DAB58E	3ADF8522D5170757550944A177DD0FB39549A83F0187200BD946B718C290306F
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 15:24:46 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	6A079C0AE71BFC48D28A2EF70F40A0DD	F335C7E54B01E793D43DC3F2E290D8A631353566	1D67411B5CC9ED1865CA8136E1DE06538B45564D1ADCF0215803942CEA6A009D
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1948_1120480828\_metadata\verified_contents.json	JSON data	6D1D175F88B64546105E3E7C31D1129A	75A1B56F55BB62B05365A0FDBFC7941DE77CBFAF	A0BC246E8E160A9BB32FA60F4E7A04D148A17125F426509466031E07731FDF81
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1948_1120480828\manifest.fingerprint	ASCII text, with no line terminators	684DA5CCA8ADC8CA59CBE5B082CFE0B5	B8784E02DB81C5F846A7848455A2C6629A88BD64	F48C9D93CC216AF13BBFAD15DD5E6D1679CD35D318E664029DDF61EFC6E51A5D
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1948_1120480828\manifest.json	JSON data	4AAA0ED8099ECC1DA778A9BC39393808	0E4A733A5AF337F101CFA6BEA5EBC153380F7B05	20B91160E2611D3159AD82857323FEBC906457756678AB73F305C3A1E399D18D
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1948_1120480828\ssl_error_assistant.pb	data	E2F792C9E2DD86F39E8286B2EAD2FC70	8A32867614D2A23E473ED642056DED8E566687F9	AC354A4723AAA4F06BEC385DDDE4A4D0983AD51456F52B31A8068EC97D5B5EA7
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1948_1409054206\Google.Widevine.CDM.dll	PE32+ executable (DLL) (console) x86-64, for MS Windows	477C17B6448695110B4D227664AA3C48	949FF1136E0971A0176F6ADEA8ADCC0DD6030F22	CB190E7D1B002A3050705580DD51EBA895A19EB09620BDD48D63085D5D88031E
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1948_1409054206\_metadata\verified_contents.json	JSON data	3E839BA4DA1FFCE29A543C5756A19BDF	D8D84AC06C3BA27CCEF221C6F188042B741D2B91	43DAA4139D3ED90F4B4635BD4D32346EB8E8528D0D5332052FCDA8F7860DB729
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1948_1409054206\manifest.fingerprint	ASCII text, with no line terminators	D30A5BBC00F7334EEDE0795D147B2E80	78F3A6995856854CAD0C524884F74E182F9C3C57	A08C1BC41DE319392676C7389048D8B1C7424C4B74D2F6466BCF5732B8D86642
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1948_1409054206\manifest.json	JSON data	BBC03E9C7C5944E62EFC9C660B7BD2B6	83F161E3F49B64553709994B048D9F597CDE3DC6	6CCE5AD8D496BC5179FA84AF8AFC568EEBA980D8A75058C6380B64FB42298C28
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1948_1602622838\_metadata\verified_contents.json	JSON data	02616EE05EA6A0231958CD77FCDEC175	0793E7236C81BD2A5CD8541899C9D487F87865DD	F963048FF9357E180B3468835750575726BE2B51ECBC13F862EED87727DD6159
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1948_1602622838\crl-set	data	54F8B8604DEAF6F7BA988BA0F2CD8BD7	0E80D4A8372913FDC6373875912F6D77BEA1B4C8	BDB75189011250DA4C42047A4CC03A1D35DCD2F8442B73B8FF4C4C13B17989D2
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1948_1602622838\manifest.fingerprint	ASCII text, with no line terminators	A9AD3E282344E8B254E19A9E9FD588CB	56B5A56F6F8FBECF299F250FA51AE3399EB815B6	C6FF86B6C46917FE68BB1EE1EDC467D415A0F339E9A7DA3EA069774134165D07
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1948_1602622838\manifest.json	JSON data	64EDCED287F38C7D5657823D6EDA4751	154EBE31228A0E7C467DC9F3CAD0725194C0FF7A	C1D6894458922D34F4D3EB696C461D96B1FE31A3955E5A16DC295060EBD5660E
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1948_1774058300\LICENSE	ASCII text	EE002CB9E51BB8DFA89640A406A1090A	49EE3AD535947D8821FFDEB67FFC9BC37D1EBBB2	3DBD2C90050B652D63656481C3E5871C52261575292DB77D4EA63419F187A55B
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1948_1774058300\_metadata\verified_contents.json	JSON data	68E6B5733E04AB7BF19699A84D8ABBC2	1C11F06CA1AD3ED8116D356AB9164FD1D52B5CF0	F095F969D6711F53F97747371C83D5D634EAEF21C54CB1A6A1CC5B816D633709
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1948_1774058300\manifest.fingerprint	ASCII text, with no line terminators	CFB54589424206D0AE6437B5673F498D	D1EF6314F0F68EFDD0BA8F6CA9E59BFF863B1609	285AC183C35350B4B77332172413902F83726CA8F53D63859B5DA082FD425A1C
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1948_1774058300\manifest.json	JSON data	C3419069A1C30140B77045ABA38F12CF	11920F0C1E55CADC7D2893D1EEBB268B3459762A	DB9A702209807BA039871E542E8356219F342A8D9C9CA34BCD9A86727F4A3A0F
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1948_1774058300\sets.json	JSON data	EEA4913A6625BEB838B3E4E79999B627	1B4966850F1B117041407413B70BFA925FD83703	20EF4DE871ECE3C5F14867C4AE8465999C7A2CC1633525E752320E61F78A373C
Chrome Cache Entry: 197	PNG image data, 280 x 60, 8-bit colormap, non-interlaced	ED9639384619BCC6A110F1E101CC2599	44471CBB873C6BCCBD6D4B1E369ACA92AA0C207A	890CD1393BD68BD180A97E74E10B6423185637CACDADCDD34587C6DD1049C59A
Chrome Cache Entry: 198	HTML document, ASCII text, with very long lines (3450), with CRLF line terminators	CB06E9A552B197D5C0EA600B431A3407	04E167433F2F1038C78F387F8A166BB6542C2008	1F4EDBD2416E15BD82E61BA1A8E5558D44C4E914536B1B07712181BF57934021
Chrome Cache Entry: 199	GIF image data, version 89a, 352 x 3	166DE53471265253AB3A456DEFE6DA23	17C6DF4D7CCF1FA2C9EFD716FBAE0FC2C71C8D6D	A46201581A7C7C667FD42787CD1E9ADF2F6BF809EFB7596E61A03E8DBA9ADA13
Chrome Cache Entry: 201	ASCII text, with very long lines (61177)	9C837C2B6C9C441656C3C64BE6FC6401	D44AA83093C4109DDD8FFAEA60755F05D1BFE7D3	68C2994E21A564345EB3B4091DD2334C9CBDDB0AECDA45EE963C6DE2E1629B93
Chrome Cache Entry: 204	ASCII text, with very long lines (46591)	CCAA31FD031C4C856EB7B986FD9F447B	0A809EABCDB95FA04DE5F8409B3BC994ED65CBD1	3D40B4129B8B4C284908636AE46D72EA053F286FB5FE45DB78351B5B2CFC1EB9
Chrome Cache Entry: 209	JSON data	9E576E34B18E986347909C29AE6A82C6	532C767978DC2B55854B3CA2D2DF5B4DB221C934	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
Chrome Cache Entry: 211	GIF image data, version 89a, 352 x 3	B540A8E518037192E32C4FE58BF2DBAB	3047C1DB97B86F6981E0AD2F96AF40CDF43511AF	8737D721808655F37B333F08A90185699E7E8B9BDAAA15CDB63C8448B426F95D
Chrome Cache Entry: 212	SVG Scalable Vector Graphics image	BCB4D1DC4EAE64F0B2B2538209D8435A	4F10568BC1B70BC98D5297B85812C33B3E636766	A76C08E9CDC3BB87BFB57627AD8F6B46F0E5EF826CC7F046DFBAF25D7B7958EA
Chrome Cache Entry: 213	ASCII text, with very long lines (64612)	C6C029BA88D52E5312FEC69603A00340	079011F6F0662C11AE907C773EFE8E0C9338EAD0	DDD0BB1C19B3D2D045BFCDE85D2020BBA57854C887A6691B66DBA3DA1BB3AFBE
Chrome Cache Entry: 214	ASCII text, with very long lines (64616)	0D04E619F3843263D447E55E85CF14E9	2FCB499E93BCD0BE38355F6957E0FDFFF3D8B004	A286901D020DBB97BDED75B5150D495AB28566B21735000058B598E0E6667E23
Chrome Cache Entry: 216	ASCII text, with no line terminators	06B313E93DD76909460FBFC0CD98CB6B	C4F9B2BBD840A4328F85F54873C434336A193888	B4532478707B495D0BB1C21C314AEF959DD1A5E0F66E52DAD5FC332C8B697CBA
Chrome Cache Entry: 217	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors	12E3DAC858061D088023B2BD48E2FA96	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
Chrome Cache Entry: 219	SVG Scalable Vector Graphics image	CD6A6A4AD3BD272AE5C267AFCB23531E	E8610710BCEB8B50786C670FE03410F1556B50DB	461984928F94FB0CB0D85884D7B3852478C953F7EF11C60A1C93258104627CFA
Chrome Cache Entry: 220	SVG Scalable Vector Graphics image	4E48046CE74F4B89D45037C90576BFAC	4A41B3B51ED787F7B33294202DA72220C7CD2C32	8E6DB1634F1812D42516778FC890010AA57F3E39914FB4803DF2C38ABBF56D93
Chrome Cache Entry: 222	SVG Scalable Vector Graphics image	A7C769E31A628E643841187D20E149E3	BF17C986EA4C64156BA5BC140CC9AA8AE0293E24	101B76C9E720E53DBCDE473FC3C88294CAE353B626F660834439EB04D17A8F94
Chrome Cache Entry: 224	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=9, xresolution=122, yresolution=130, resolutionunit=2, software=paint.net 4.0.21], baseline, precision 8, 1920x1080, components 3	B75E9E58497B4615896DA946AF3DBAB8	28C4BBAB57AF3BD0E4ABD7CA7A8B97D8E407483F	78B440779F07B8A64DA00BCBE5A00B6573F220562FFD0368173D645FBD94B1DA
Chrome Cache Entry: 226	ASCII text, with very long lines (65536), with no line terminators	4877EFC88055D60953886EC55B04DE34	2341B026A3E2A3B01AFA1A39D1706840D75E09B3	8405362EB8F09DF13AE244DE155B51B1577274673D9728B6C81CD0278A63C8B0
Chrome Cache Entry: 227	ASCII text, with very long lines (45797)	E40761677762EAB0692F86B259C7D744	34A9B50CEC6E1163CEEFCD4D394DB6524C89A854	DA4A8DF0C326292B5BEE9C732B3C962FD67AAF2F99D850F1BF65068D573C5619
Chrome Cache Entry: 228	ASCII text, with very long lines (34709)	E03F39DA9D4FB60AF1E5228819152F88	85B2C67DFE66487DBA70F8B966ED382E14251BCD	B71E3CE58CB2A4B58D6379A0CAED17B03738E5ACC7544DC37BAE772C9B8DDB71
Chrome Cache Entry: 229	ASCII text, with very long lines (14782)	630831903F4BA9060856520624E34CFC	36DC15B9CCC3FC8EF627354BF55EF44EBD10E203	BC6804D058D5BD5B24FC04E479FC8973BEF5D3EFEAFAA9C19C60A009BF0FAC0B
Chrome Cache Entry: 232	Unicode text, UTF-8 text, with very long lines (32009)	D580777BB3A28B94F6F1D18EE17AEDA3	E78833A2DB1AA97DA3F4A1994E6AF1F0D74D7CC7	81188E8A76162C79DB4A5C10AC933C9E874C5B9EAE10E47956AD9DF704E01B28

HTML body contains low number of good links

Source: https://login.microsoftonline.com/c765d391-7aad-4c45-8362-df4ece7a3fd4/saml2/?SAMLRequest=fZJPb9QwEMW%2FSm4%2BOc4fJ9m1NiuFrpBWlAq1lAMXNGtPqFXHXjxOC9%2BebCpEe4Dr6L3fG72ZHcHkzmqY04O%2FxR8zUsoGIozJBn8VPM0TxjuMT1bj%2Fe11zx5SOpMSAuf80YfnE8pch0nAAhAXltiWp3ZstkWt643Q4NwJ9CPLDgvZerhg%2F0Jc%2BG59PlkdA4UxBe%2Bsx5Wnu7Yx9bbkHYDhUsuGb%2Bq24maUqLGDejRyzasEy46Hnn1DbUaDcsOx6Bou26LkUHQjb0FD3dSFbrZ6kRLNePSUwKeeVUUleVnwSn4uW1VJJZuvLPuCkdY1q7xg2c%2FJeVKXqJ7N0asAZEl5mJBU0upu%2BHitFqGCP629tpz%2F7znHkIIOju13F7Vat4v7D0ux71DuxOvh7uVSNwvkePgUnNW%2FssG58HwVERL2LMUZWfY%2BxAnSv2PLvFwn1vBxlSqcwLrBmIhETOxfUt%2B%2BxP43	HTTP Parser: Number of links: 0
Source: https://login.microsoftonline.com/c765d391-7aad-4c45-8362-df4ece7a3fd4/saml2/?SAMLRequest=fZJPb9QwEMW%2FSm4%2BOc4fJ9m1NiuFrpBWlAq1lAMXNGtPqFXHXjxOC9%2BebCpEe4Dr6L3fG72ZHcHkzmqY04O%2FxR8zUsoGIozJBn8VPM0TxjuMT1bj%2Fe11zx5SOpMSAuf80YfnE8pch0nAAhAXltiWp3ZstkWt643Q4NwJ9CPLDgvZerhg%2F0Jc%2BG59PlkdA4UxBe%2Bsx5Wnu7Yx9bbkHYDhUsuGb%2Bq24maUqLGDejRyzasEy46Hnn1DbUaDcsOx6Bou26LkUHQjb0FD3dSFbrZ6kRLNePSUwKeeVUUleVnwSn4uW1VJJZuvLPuCkdY1q7xg2c%2FJeVKXqJ7N0asAZEl5mJBU0upu%2BHitFqGCP629tpz%2F7znHkIIOju13F7Vat4v7D0ux71DuxOvh7uVSNwvkePgUnNW%2FssG58HwVERL2LMUZWfY%2BxAnSv2PLvFwn1vBxlSqcwLrBmIhETOxfUt%2B%2BxP43&sso_reload=true	HTTP Parser: Number of links: 0

HTML title does not match URL

Source: https://login.microsoftonline.com/c765d391-7aad-4c45-8362-df4ece7a3fd4/saml2/?SAMLRequest=fZJPb9QwEMW%2FSm4%2BOc4fJ9m1NiuFrpBWlAq1lAMXNGtPqFXHXjxOC9%2BebCpEe4Dr6L3fG72ZHcHkzmqY04O%2FxR8zUsoGIozJBn8VPM0TxjuMT1bj%2Fe11zx5SOpMSAuf80YfnE8pch0nAAhAXltiWp3ZstkWt643Q4NwJ9CPLDgvZerhg%2F0Jc%2BG59PlkdA4UxBe%2Bsx5Wnu7Yx9bbkHYDhUsuGb%2Bq24maUqLGDejRyzasEy46Hnn1DbUaDcsOx6Bou26LkUHQjb0FD3dSFbrZ6kRLNePSUwKeeVUUleVnwSn4uW1VJJZuvLPuCkdY1q7xg2c%2FJeVKXqJ7N0asAZEl5mJBU0upu%2BHitFqGCP629tpz%2F7znHkIIOju13F7Vat4v7D0ux71DuxOvh7uVSNwvkePgUnNW%2FssG58HwVERL2LMUZWfY%2BxAnSv2PLvFwn1vBxlSqcwLrBmIhETOxfUt%2B%2BxP43	HTTP Parser: Title: Redirecting does not match URL
Source: https://login.microsoftonline.com/c765d391-7aad-4c45-8362-df4ece7a3fd4/saml2/?SAMLRequest=fZJPb9QwEMW%2FSm4%2BOc4fJ9m1NiuFrpBWlAq1lAMXNGtPqFXHXjxOC9%2BebCpEe4Dr6L3fG72ZHcHkzmqY04O%2FxR8zUsoGIozJBn8VPM0TxjuMT1bj%2Fe11zx5SOpMSAuf80YfnE8pch0nAAhAXltiWp3ZstkWt643Q4NwJ9CPLDgvZerhg%2F0Jc%2BG59PlkdA4UxBe%2Bsx5Wnu7Yx9bbkHYDhUsuGb%2Bq24maUqLGDejRyzasEy46Hnn1DbUaDcsOx6Bou26LkUHQjb0FD3dSFbrZ6kRLNePSUwKeeVUUleVnwSn4uW1VJJZuvLPuCkdY1q7xg2c%2FJeVKXqJ7N0asAZEl5mJBU0upu%2BHitFqGCP629tpz%2F7znHkIIOju13F7Vat4v7D0ux71DuxOvh7uVSNwvkePgUnNW%2FssG58HwVERL2LMUZWfY%2BxAnSv2PLvFwn1vBxlSqcwLrBmIhETOxfUt%2B%2BxP43&sso_reload=true	HTTP Parser: Title: Sign in to your account does not match URL

HTTP Parser: <input type="password" .../> found

HTTP Parser: No favicon

Source: https://login.microsoftonline.com/c765d391-7aad-4c45-8362-df4ece7a3fd4/saml2/?SAMLRequest=fZJPb9QwEMW%2FSm4%2BOc4fJ9m1NiuFrpBWlAq1lAMXNGtPqFXHXjxOC9%2BebCpEe4Dr6L3fG72ZHcHkzmqY04O%2FxR8zUsoGIozJBn8VPM0TxjuMT1bj%2Fe11zx5SOpMSAuf80YfnE8pch0nAAhAXltiWp3ZstkWt643Q4NwJ9CPLDgvZerhg%2F0Jc%2BG59PlkdA4UxBe%2Bsx5Wnu7Yx9bbkHYDhUsuGb%2Bq24maUqLGDejRyzasEy46Hnn1DbUaDcsOx6Bou26LkUHQjb0FD3dSFbrZ6kRLNePSUwKeeVUUleVnwSn4uW1VJJZuvLPuCkdY1q7xg2c%2FJeVKXqJ7N0asAZEl5mJBU0upu%2BHitFqGCP629tpz%2F7znHkIIOju13F7Vat4v7D0ux71DuxOvh7uVSNwvkePgUnNW%2FssG58HwVERL2LMUZWfY%2BxAnSv2PLvFwn1vBxlSqcwLrBmIhETOxfUt%2B%2BxP43	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/c765d391-7aad-4c45-8362-df4ece7a3fd4/saml2/?SAMLRequest=fZJPb9QwEMW%2FSm4%2BOc4fJ9m1NiuFrpBWlAq1lAMXNGtPqFXHXjxOC9%2BebCpEe4Dr6L3fG72ZHcHkzmqY04O%2FxR8zUsoGIozJBn8VPM0TxjuMT1bj%2Fe11zx5SOpMSAuf80YfnE8pch0nAAhAXltiWp3ZstkWt643Q4NwJ9CPLDgvZerhg%2F0Jc%2BG59PlkdA4UxBe%2Bsx5Wnu7Yx9bbkHYDhUsuGb%2Bq24maUqLGDejRyzasEy46Hnn1DbUaDcsOx6Bou26LkUHQjb0FD3dSFbrZ6kRLNePSUwKeeVUUleVnwSn4uW1VJJZuvLPuCkdY1q7xg2c%2FJeVKXqJ7N0asAZEl5mJBU0upu%2BHitFqGCP629tpz%2F7znHkIIOju13F7Vat4v7D0ux71DuxOvh7uVSNwvkePgUnNW%2FssG58HwVERL2LMUZWfY%2BxAnSv2PLvFwn1vBxlSqcwLrBmIhETOxfUt%2B%2BxP43&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/c765d391-7aad-4c45-8362-df4ece7a3fd4/saml2/?SAMLRequest=fZJPb9QwEMW%2FSm4%2BOc4fJ9m1NiuFrpBWlAq1lAMXNGtPqFXHXjxOC9%2BebCpEe4Dr6L3fG72ZHcHkzmqY04O%2FxR8zUsoGIozJBn8VPM0TxjuMT1bj%2Fe11zx5SOpMSAuf80YfnE8pch0nAAhAXltiWp3ZstkWt643Q4NwJ9CPLDgvZerhg%2F0Jc%2BG59PlkdA4UxBe%2Bsx5Wnu7Yx9bbkHYDhUsuGb%2Bq24maUqLGDejRyzasEy46Hnn1DbUaDcsOx6Bou26LkUHQjb0FD3dSFbrZ6kRLNePSUwKeeVUUleVnwSn4uW1VJJZuvLPuCkdY1q7xg2c%2FJeVKXqJ7N0asAZEl5mJBU0upu%2BHitFqGCP629tpz%2F7znHkIIOju13F7Vat4v7D0ux71DuxOvh7uVSNwvkePgUnNW%2FssG58HwVERL2LMUZWfY%2BxAnSv2PLvFwn1vBxlSqcwLrBmIhETOxfUt%2B%2BxP43&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/c765d391-7aad-4c45-8362-df4ece7a3fd4/saml2/?SAMLRequest=fZJPb9QwEMW%2FSm4%2BOc4fJ9m1NiuFrpBWlAq1lAMXNGtPqFXHXjxOC9%2BebCpEe4Dr6L3fG72ZHcHkzmqY04O%2FxR8zUsoGIozJBn8VPM0TxjuMT1bj%2Fe11zx5SOpMSAuf80YfnE8pch0nAAhAXltiWp3ZstkWt643Q4NwJ9CPLDgvZerhg%2F0Jc%2BG59PlkdA4UxBe%2Bsx5Wnu7Yx9bbkHYDhUsuGb%2Bq24maUqLGDejRyzasEy46Hnn1DbUaDcsOx6Bou26LkUHQjb0FD3dSFbrZ6kRLNePSUwKeeVUUleVnwSn4uW1VJJZuvLPuCkdY1q7xg2c%2FJeVKXqJ7N0asAZEl5mJBU0upu%2BHitFqGCP629tpz%2F7znHkIIOju13F7Vat4v7D0ux71DuxOvh7uVSNwvkePgUnNW%2FssG58HwVERL2LMUZWfY%2BxAnSv2PLvFwn1vBxlSqcwLrBmIhETOxfUt%2B%2BxP43&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/c765d391-7aad-4c45-8362-df4ece7a3fd4/saml2/?SAMLRequest=fZJPb9QwEMW%2FSm4%2BOc4fJ9m1NiuFrpBWlAq1lAMXNGtPqFXHXjxOC9%2BebCpEe4Dr6L3fG72ZHcHkzmqY04O%2FxR8zUsoGIozJBn8VPM0TxjuMT1bj%2Fe11zx5SOpMSAuf80YfnE8pch0nAAhAXltiWp3ZstkWt643Q4NwJ9CPLDgvZerhg%2F0Jc%2BG59PlkdA4UxBe%2Bsx5Wnu7Yx9bbkHYDhUsuGb%2Bq24maUqLGDejRyzasEy46Hnn1DbUaDcsOx6Bou26LkUHQjb0FD3dSFbrZ6kRLNePSUwKeeVUUleVnwSn4uW1VJJZuvLPuCkdY1q7xg2c%2FJeVKXqJ7N0asAZEl5mJBU0upu%2BHitFqGCP629tpz%2F7znHkIIOju13F7Vat4v7D0ux71DuxOvh7uVSNwvkePgUnNW%2FssG58HwVERL2LMUZWfY%2BxAnSv2PLvFwn1vBxlSqcwLrBmIhETOxfUt%2B%2BxP43&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/c765d391-7aad-4c45-8362-df4ece7a3fd4/saml2/?SAMLRequest=fZJPb9QwEMW%2FSm4%2BOc4fJ9m1NiuFrpBWlAq1lAMXNGtPqFXHXjxOC9%2BebCpEe4Dr6L3fG72ZHcHkzmqY04O%2FxR8zUsoGIozJBn8VPM0TxjuMT1bj%2Fe11zx5SOpMSAuf80YfnE8pch0nAAhAXltiWp3ZstkWt643Q4NwJ9CPLDgvZerhg%2F0Jc%2BG59PlkdA4UxBe%2Bsx5Wnu7Yx9bbkHYDhUsuGb%2Bq24maUqLGDejRyzasEy46Hnn1DbUaDcsOx6Bou26LkUHQjb0FD3dSFbrZ6kRLNePSUwKeeVUUleVnwSn4uW1VJJZuvLPuCkdY1q7xg2c%2FJeVKXqJ7N0asAZEl5mJBU0upu%2BHitFqGCP629tpz%2F7znHkIIOju13F7Vat4v7D0ux71DuxOvh7uVSNwvkePgUnNW%2FssG58HwVERL2LMUZWfY%2BxAnSv2PLvFwn1vBxlSqcwLrBmIhETOxfUt%2B%2BxP43&sso_reload=true	HTTP Parser: No <meta name="author".. found

Source: https://login.microsoftonline.com/c765d391-7aad-4c45-8362-df4ece7a3fd4/saml2/?SAMLRequest=fZJPb9QwEMW%2FSm4%2BOc4fJ9m1NiuFrpBWlAq1lAMXNGtPqFXHXjxOC9%2BebCpEe4Dr6L3fG72ZHcHkzmqY04O%2FxR8zUsoGIozJBn8VPM0TxjuMT1bj%2Fe11zx5SOpMSAuf80YfnE8pch0nAAhAXltiWp3ZstkWt643Q4NwJ9CPLDgvZerhg%2F0Jc%2BG59PlkdA4UxBe%2Bsx5Wnu7Yx9bbkHYDhUsuGb%2Bq24maUqLGDejRyzasEy46Hnn1DbUaDcsOx6Bou26LkUHQjb0FD3dSFbrZ6kRLNePSUwKeeVUUleVnwSn4uW1VJJZuvLPuCkdY1q7xg2c%2FJeVKXqJ7N0asAZEl5mJBU0upu%2BHitFqGCP629tpz%2F7znHkIIOju13F7Vat4v7D0ux71DuxOvh7uVSNwvkePgUnNW%2FssG58HwVERL2LMUZWfY%2BxAnSv2PLvFwn1vBxlSqcwLrBmIhETOxfUt%2B%2BxP43	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/c765d391-7aad-4c45-8362-df4ece7a3fd4/saml2/?SAMLRequest=fZJPb9QwEMW%2FSm4%2BOc4fJ9m1NiuFrpBWlAq1lAMXNGtPqFXHXjxOC9%2BebCpEe4Dr6L3fG72ZHcHkzmqY04O%2FxR8zUsoGIozJBn8VPM0TxjuMT1bj%2Fe11zx5SOpMSAuf80YfnE8pch0nAAhAXltiWp3ZstkWt643Q4NwJ9CPLDgvZerhg%2F0Jc%2BG59PlkdA4UxBe%2Bsx5Wnu7Yx9bbkHYDhUsuGb%2Bq24maUqLGDejRyzasEy46Hnn1DbUaDcsOx6Bou26LkUHQjb0FD3dSFbrZ6kRLNePSUwKeeVUUleVnwSn4uW1VJJZuvLPuCkdY1q7xg2c%2FJeVKXqJ7N0asAZEl5mJBU0upu%2BHitFqGCP629tpz%2F7znHkIIOju13F7Vat4v7D0ux71DuxOvh7uVSNwvkePgUnNW%2FssG58HwVERL2LMUZWfY%2BxAnSv2PLvFwn1vBxlSqcwLrBmIhETOxfUt%2B%2BxP43&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/c765d391-7aad-4c45-8362-df4ece7a3fd4/saml2/?SAMLRequest=fZJPb9QwEMW%2FSm4%2BOc4fJ9m1NiuFrpBWlAq1lAMXNGtPqFXHXjxOC9%2BebCpEe4Dr6L3fG72ZHcHkzmqY04O%2FxR8zUsoGIozJBn8VPM0TxjuMT1bj%2Fe11zx5SOpMSAuf80YfnE8pch0nAAhAXltiWp3ZstkWt643Q4NwJ9CPLDgvZerhg%2F0Jc%2BG59PlkdA4UxBe%2Bsx5Wnu7Yx9bbkHYDhUsuGb%2Bq24maUqLGDejRyzasEy46Hnn1DbUaDcsOx6Bou26LkUHQjb0FD3dSFbrZ6kRLNePSUwKeeVUUleVnwSn4uW1VJJZuvLPuCkdY1q7xg2c%2FJeVKXqJ7N0asAZEl5mJBU0upu%2BHitFqGCP629tpz%2F7znHkIIOju13F7Vat4v7D0ux71DuxOvh7uVSNwvkePgUnNW%2FssG58HwVERL2LMUZWfY%2BxAnSv2PLvFwn1vBxlSqcwLrBmIhETOxfUt%2B%2BxP43&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/c765d391-7aad-4c45-8362-df4ece7a3fd4/saml2/?SAMLRequest=fZJPb9QwEMW%2FSm4%2BOc4fJ9m1NiuFrpBWlAq1lAMXNGtPqFXHXjxOC9%2BebCpEe4Dr6L3fG72ZHcHkzmqY04O%2FxR8zUsoGIozJBn8VPM0TxjuMT1bj%2Fe11zx5SOpMSAuf80YfnE8pch0nAAhAXltiWp3ZstkWt643Q4NwJ9CPLDgvZerhg%2F0Jc%2BG59PlkdA4UxBe%2Bsx5Wnu7Yx9bbkHYDhUsuGb%2Bq24maUqLGDejRyzasEy46Hnn1DbUaDcsOx6Bou26LkUHQjb0FD3dSFbrZ6kRLNePSUwKeeVUUleVnwSn4uW1VJJZuvLPuCkdY1q7xg2c%2FJeVKXqJ7N0asAZEl5mJBU0upu%2BHitFqGCP629tpz%2F7znHkIIOju13F7Vat4v7D0ux71DuxOvh7uVSNwvkePgUnNW%2FssG58HwVERL2LMUZWfY%2BxAnSv2PLvFwn1vBxlSqcwLrBmIhETOxfUt%2B%2BxP43&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/c765d391-7aad-4c45-8362-df4ece7a3fd4/saml2/?SAMLRequest=fZJPb9QwEMW%2FSm4%2BOc4fJ9m1NiuFrpBWlAq1lAMXNGtPqFXHXjxOC9%2BebCpEe4Dr6L3fG72ZHcHkzmqY04O%2FxR8zUsoGIozJBn8VPM0TxjuMT1bj%2Fe11zx5SOpMSAuf80YfnE8pch0nAAhAXltiWp3ZstkWt643Q4NwJ9CPLDgvZerhg%2F0Jc%2BG59PlkdA4UxBe%2Bsx5Wnu7Yx9bbkHYDhUsuGb%2Bq24maUqLGDejRyzasEy46Hnn1DbUaDcsOx6Bou26LkUHQjb0FD3dSFbrZ6kRLNePSUwKeeVUUleVnwSn4uW1VJJZuvLPuCkdY1q7xg2c%2FJeVKXqJ7N0asAZEl5mJBU0upu%2BHitFqGCP629tpz%2F7znHkIIOju13F7Vat4v7D0ux71DuxOvh7uVSNwvkePgUnNW%2FssG58HwVERL2LMUZWfY%2BxAnSv2PLvFwn1vBxlSqcwLrBmIhETOxfUt%2B%2BxP43&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/c765d391-7aad-4c45-8362-df4ece7a3fd4/saml2/?SAMLRequest=fZJPb9QwEMW%2FSm4%2BOc4fJ9m1NiuFrpBWlAq1lAMXNGtPqFXHXjxOC9%2BebCpEe4Dr6L3fG72ZHcHkzmqY04O%2FxR8zUsoGIozJBn8VPM0TxjuMT1bj%2Fe11zx5SOpMSAuf80YfnE8pch0nAAhAXltiWp3ZstkWt643Q4NwJ9CPLDgvZerhg%2F0Jc%2BG59PlkdA4UxBe%2Bsx5Wnu7Yx9bbkHYDhUsuGb%2Bq24maUqLGDejRyzasEy46Hnn1DbUaDcsOx6Bou26LkUHQjb0FD3dSFbrZ6kRLNePSUwKeeVUUleVnwSn4uW1VJJZuvLPuCkdY1q7xg2c%2FJeVKXqJ7N0asAZEl5mJBU0upu%2BHitFqGCP629tpz%2F7znHkIIOju13F7Vat4v7D0ux71DuxOvh7uVSNwvkePgUnNW%2FssG58HwVERL2LMUZWfY%2BxAnSv2PLvFwn1vBxlSqcwLrBmIhETOxfUt%2B%2BxP43&sso_reload=true	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.17:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.17:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.209.158:443 -> 192.168.2.17:49765 version: TLS 1.2

Detected non-DNS traffic on DNS port

Source: global traffic	TCP traffic: 192.168.2.17:53041 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:53041 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:53041 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:53041 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:53041 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:53041 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:53041 -> 1.1.1.1:53

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27

Source: global traffic	DNS traffic detected: DNS query: eu.knowbe4.com
Source: global traffic	DNS traffic detected: DNS query: login.microsoftonline.com
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: identity.nel.measure.office.net
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauthimages.net
Source: global traffic	DNS traffic detected: DNS query: autologon.microsoftazuread-sso.com

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53059
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49691
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 53044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49691 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53044
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746

Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.17:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.17:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.209.158:443 -> 192.168.2.17:49765 version: TLS 1.2

Creates files inside the system directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1948_1774058300
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1948_1774058300\sets.json
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1948_1774058300\manifest.json
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1948_1774058300\LICENSE
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1948_1774058300\_metadata\
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1948_1774058300\_metadata\verified_contents.json
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1948_1774058300\manifest.fingerprint
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1948_1120480828
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1948_1120480828\ssl_error_assistant.pb
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1948_1120480828\manifest.json
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1948_1120480828\_metadata\
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1948_1120480828\_metadata\verified_contents.json
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1948_1120480828\manifest.fingerprint
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1948_1409054206
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1948_1409054206\Google.Widevine.CDM.dll
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1948_1409054206\manifest.json
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1948_1409054206\_metadata\
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1948_1409054206\_metadata\verified_contents.json
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1948_1409054206\manifest.fingerprint
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1948_1602622838
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1948_1602622838\crl-set
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1948_1602622838\manifest.json
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1948_1602622838\LICENSE
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1948_1602622838\_metadata\
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1948_1602622838\_metadata\verified_contents.json
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1948_1602622838\manifest.fingerprint

Deletes files inside the Windows folder

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\chrome_BITS_1948_1929281110

Source: classification engine

Classification label: clean4.win@27/44@22/214

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1932,i,17393653513939364326,5208148675971558025,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://eu.knowbe4.com/auth/saml/91b6f5903c38"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1932,i,17393653513939364326,5208148675971558025,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Drops PE files

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1948_1409054206\Google.Widevine.CDM.dll

Jump to dropped file

Drops PE files to the windows directory (C:\Windows)

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1948_1409054206\Google.Widevine.CDM.dll

Jump to dropped file

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

ID:	1541365
Product:	CloudBasic
Start time:	18:24:12
Start date:	24.10.2024
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Windows Analysis Report
https://eu.knowbe4.com/auth/saml/91b6f5903c38

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Persistence and Installation Behavior

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Windows Analysis Report https://eu.knowbe4.com/auth/saml/91b6f5903c38

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Persistence and Installation Behavior

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Windows Analysis Report
https://eu.knowbe4.com/auth/saml/91b6f5903c38