Joe Sandbox Cloud Basic Analysis Report
Edit tour

Windows Analysis Report
https://sdk.fra-01.braze.eu/api/v3/data/

Overview

General Information

Sample URL:https://sdk.fra-01.braze.eu/api/v3/data/
Analysis ID:1400844
Infos:

Detection

Score:0
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

No high impact signatures.

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

Process Tree

  • System is w10x64
  • chrome.exe (PID: 5088 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • chrome.exe (PID: 3992 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 --field-trial-handle=2220,i,5778722968356699458,18003569822951770728,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • chrome.exe (PID: 6484 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" "https://sdk.fra-01.braze.eu/api/v3/data/ MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

  • • Phishing
  • • Compliance
  • • Networking
  • • System Summary

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: https://sdk.fra-01.braze.eu/api/v3/data/HTTP Parser: No favicon
Source: unknownHTTPS traffic detected: 23.51.58.94:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknownHTTPS traffic detected: 23.51.58.94:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknownTCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknownTCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknownTCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknownTCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknownTCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknownTCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknownTCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknownTCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknownTCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknownTCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknownTCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknownTCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknownTCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknownTCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknownTCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknownTCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknownTCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknownTCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknownTCP traffic detected without corresponding DNS query: 72.21.81.240
Source: unknownTCP traffic detected without corresponding DNS query: 72.21.81.240
Source: unknownTCP traffic detected without corresponding DNS query: 72.21.81.240
Source: unknownTCP traffic detected without corresponding DNS query: 72.21.81.240
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficHTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: unknownDNS traffic detected: queries for: sdk.fra-01.braze.eu
Source: unknownNetwork traffic detected: HTTP traffic on port 49675 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49741
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49740
Source: unknownNetwork traffic detected: HTTP traffic on port 49741 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49740 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49749 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49739
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49749
Source: unknownNetwork traffic detected: HTTP traffic on port 49739 -> 443
Source: unknownHTTPS traffic detected: 23.51.58.94:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknownHTTPS traffic detected: 23.51.58.94:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: classification engineClassification label: clean0.win@16/5@6/3
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 --field-trial-handle=2220,i,5778722968356699458,18003569822951770728,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" "https://sdk.fra-01.braze.eu/api/v3/data/
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 --field-trial-handle=2220,i,5778722968356699458,18003569822951770728,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath Interception1
Process Injection		1
Process Injection		OS Credential DumpingSystem Service DiscoveryRemote ServicesData from Local System1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media2
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive3
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture1
Ingress Tool Transfer		Traffic DuplicationData Destruction

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1400844 URL: https://sdk.fra-01.braze.eu... Startdate: 29/02/2024 Architecture: WINDOWS Score: 0 5 chrome.exe 1 2->5         started        8 chrome.exe 2->8         started        dnsIp3 13 192.168.2.4, 138, 443, 49723 unknown unknown 5->13 15 239.255.255.250 unknown Reserved 5->15 10 chrome.exe 5->10         started        process4 dnsIp5 17 www.google.com 142.251.40.100, 443, 49739, 49749 GOOGLEUS United States 10->17 19 sdk.fra-01.braze.eu 10->19

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
https://sdk.fra-01.braze.eu/api/v3/data/0%Avira URL Cloudsafe
https://sdk.fra-01.braze.eu/api/v3/data/1%VirustotalBrowse

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

SourceDetectionScannerLabelLink
fp2e7a.wpc.phicdn.net0%VirustotalBrowse

URLs

⊘No Antivirus matches

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
www.google.com
142.251.40.100
truefalse
    		high
    fp2e7a.wpc.phicdn.net
    		192.229.211.108
    		truefalseunknown
    sdk.fra-01.braze.eu
    		unknown
    		unknownfalse
      		high

      Contacted URLs

      NameMaliciousAntivirus DetectionReputation
      https://sdk.fra-01.braze.eu/api/v3/data/false
        		high

        World Map of Contacted IPs

        • No. of IPs < 25%
        • 25% < No. of IPs < 50%
        • 50% < No. of IPs < 75%
        • 75% < No. of IPs

        Public IPs

        IPDomainCountryFlagASNASN NameMalicious
        142.251.40.100
        		www.google.comUnited States
        		15169GOOGLEUSfalse
        239.255.255.250
        		unknownReserved
        		unknownunknownfalse

        Private

        IP
        192.168.2.4

        General Information

        Joe Sandbox version:40.0.0 Tourmaline
        Analysis ID:1400844
        Start date and time:2024-02-29 12:00:33 +01:00
        Joe Sandbox product:CloudBasic
        Overall analysis duration:0h 3m 7s
        Hypervisor based Inspection enabled:false
        Report type:full
        Cookbook file name:browseurl.jbs
        Sample URL:https://sdk.fra-01.braze.eu/api/v3/data/
        Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
        Number of analysed new started processes analysed:8
        Number of new started drivers analysed:0
        Number of existing processes analysed:0
        Number of existing drivers analysed:0
        Number of injected processes analysed:0
        Technologies:
        • HCA enabled
        • EGA enabled
        • AMSI enabled
        Analysis Mode:default
        Analysis stop reason:Timeout
        Detection:CLEAN
        Classification:clean0.win@16/5@6/3
        EGA Information:Failed
        HCA Information:
        • Successful, ratio: 100%
        • Number of executed functions: 0
        • Number of non-executed functions: 0
        • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
        • Excluded IPs from analysis (whitelisted): 142.250.80.99, 142.250.65.238, 172.253.62.84, 34.104.35.123, 151.101.65.208, 151.101.193.208, 151.101.129.208, 151.101.1.208, 13.85.23.86, 23.206.121.52, 23.206.121.20, 23.206.121.47, 23.206.121.28, 192.229.211.108, 20.242.39.171, 20.3.187.198, 142.251.40.99
        • Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, d2.shared.global.fastly.net, clientservices.googleapis.com, ctldl.windowsupdate.com, a767.dspw65.akamai.net, wu-bg-shim.trafficmanager.net, download.windowsupdate.com.edgesuite.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, ocsp.digicert.com, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, update.googleapis.com, clients.l.google.com, glb.sls.prod.dcat.dsp.trafficmanager.net
        • Not all processes where analyzed, report is missing behavior information
        • Report size getting too big, too many NtSetInformationFile calls found.

        Simulations

        Behavior and APIs

        ⊘No simulations

        Joe Sandbox View / Context

        IPs

        ⊘No context

        Domains

        ⊘No context

        ASNs

        ⊘No context

        JA3 Fingerprints

        ⊘No context

        Dropped Files

        ⊘No context

        Created / dropped Files

        Chrome Cache Entry: 40

        Download File
        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
        File Type:JSON data
        Category:downloaded
        Size (bytes):27
        Entropy (8bit):3.8841550945958043
        Encrypted:false
        SSDEEP:3:YAPFrKFkJaY:YAPFOFAaY
        MD5:0F4F0AAA6EA8F4B00B021973B681FD6A
        SHA1:34F8855DF3DD6BBF6F46D0DB73A383A240E144B3
        SHA-256:6CF6953E625A6215204D25C9AFE9EBDBA3A98AC672804BEE3B9F707A0EE4B487
        SHA-512:A5E93D6CD26043B40D79C7D67D6F48AD37220F7F8B836DBAA8ED1E453E36E2F9D07F2AE8B5B5CC21D997C45D7F4B3240C8036E1B5AF6639B8EEEAFB89FD15768
        Malicious:false
        Reputation:low
        URL:https://sdk.fra-01.braze.eu/api/v3/data/
        Preview:{"error":"405 Not Allowed"}

        Chrome Cache Entry: 41

        Download File
        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
        File Type:MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel
        Category:downloaded
        Size (bytes):15086
        Entropy (8bit):4.728520317142111
        Encrypted:false
        SSDEEP:192:jMVWu5y8ZQTY80RGOPfMLcwS8gD2F1gcP5DuYEl3qF0Oulf:jMoUZQTYT0OPkLJVgD2Fuk5DuxKulf
        MD5:B04370195EDC2F49A9E34B63909B948A
        SHA1:538110B436CBA3DB3A6C4943FB11DF8C7C470570
        SHA-256:DE47F4635AE36272F176D9391E7860951B64465F641648DEAA43876160D69C52
        SHA-512:FC854AFB1037AE47C75FA0F62E00DE5CC1CDB2E493EE946DA4F42BA2D688BE14F74358334FB407D0C4F3F897EF8F2B227F9C3C921930BE0B5BE4E55062FE65EE
        Malicious:false
        Reputation:low
        URL:https://sdk.fra-01.braze.eu/favicon.ico
        Preview:......00.... ..%..6... .... ......%........ .h....6..(...0...`..... ......$...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................|..^......r .............|......................................................................................................................................................c..nI.r..o..|.........................O..................

        Chrome Cache Entry: 42

        Download File
        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
        File Type:MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel
        Category:dropped
        Size (bytes):15086
        Entropy (8bit):4.728520317142111
        Encrypted:false
        SSDEEP:192:jMVWu5y8ZQTY80RGOPfMLcwS8gD2F1gcP5DuYEl3qF0Oulf:jMoUZQTYT0OPkLJVgD2Fuk5DuxKulf
        MD5:B04370195EDC2F49A9E34B63909B948A
        SHA1:538110B436CBA3DB3A6C4943FB11DF8C7C470570
        SHA-256:DE47F4635AE36272F176D9391E7860951B64465F641648DEAA43876160D69C52
        SHA-512:FC854AFB1037AE47C75FA0F62E00DE5CC1CDB2E493EE946DA4F42BA2D688BE14F74358334FB407D0C4F3F897EF8F2B227F9C3C921930BE0B5BE4E55062FE65EE
        Malicious:false
        Reputation:low
        Preview:......00.... ..%..6... .... ......%........ .h....6..(...0...`..... ......$...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................|..^......r .............|......................................................................................................................................................c..nI.r..o..|.........................O..................

        Static File Info

        ⊘No static file info

        Network Behavior

        Download Network PCAP: filtered – full

        Network Port Distribution

        • Total Packets: 48
        • • 443 (HTTPS)
        • • 80 (HTTP)
        • • 53 (DNS)
        TimestampSource PortDest PortSource IPDest IP
        Feb 29, 2024 12:01:23.596472979 CET49675443192.168.2.4173.222.162.32
        Feb 29, 2024 12:01:32.933803082 CET49739443192.168.2.4142.251.40.100
        Feb 29, 2024 12:01:32.933837891 CET44349739142.251.40.100192.168.2.4
        Feb 29, 2024 12:01:32.933902979 CET49739443192.168.2.4142.251.40.100
        Feb 29, 2024 12:01:32.934142113 CET49739443192.168.2.4142.251.40.100
        Feb 29, 2024 12:01:32.934158087 CET44349739142.251.40.100192.168.2.4
        Feb 29, 2024 12:01:33.203674078 CET44349739142.251.40.100192.168.2.4
        Feb 29, 2024 12:01:33.204195023 CET49739443192.168.2.4142.251.40.100
        Feb 29, 2024 12:01:33.204216957 CET44349739142.251.40.100192.168.2.4
        Feb 29, 2024 12:01:33.204544067 CET49675443192.168.2.4173.222.162.32
        Feb 29, 2024 12:01:33.205075026 CET44349739142.251.40.100192.168.2.4
        Feb 29, 2024 12:01:33.205127954 CET49739443192.168.2.4142.251.40.100
        Feb 29, 2024 12:01:33.208147049 CET49739443192.168.2.4142.251.40.100
        Feb 29, 2024 12:01:33.208211899 CET44349739142.251.40.100192.168.2.4
        Feb 29, 2024 12:01:33.251441002 CET49739443192.168.2.4142.251.40.100
        Feb 29, 2024 12:01:33.251456976 CET44349739142.251.40.100192.168.2.4
        Feb 29, 2024 12:01:33.298301935 CET49739443192.168.2.4142.251.40.100
        Feb 29, 2024 12:01:33.872570992 CET49740443192.168.2.423.51.58.94
        Feb 29, 2024 12:01:33.872596025 CET4434974023.51.58.94192.168.2.4
        Feb 29, 2024 12:01:33.872665882 CET49740443192.168.2.423.51.58.94
        Feb 29, 2024 12:01:33.875264883 CET49740443192.168.2.423.51.58.94
        Feb 29, 2024 12:01:33.875278950 CET4434974023.51.58.94192.168.2.4
        Feb 29, 2024 12:01:34.072360992 CET4434974023.51.58.94192.168.2.4
        Feb 29, 2024 12:01:34.072439909 CET49740443192.168.2.423.51.58.94
        Feb 29, 2024 12:01:34.078594923 CET49740443192.168.2.423.51.58.94
        Feb 29, 2024 12:01:34.078620911 CET4434974023.51.58.94192.168.2.4
        Feb 29, 2024 12:01:34.079046011 CET4434974023.51.58.94192.168.2.4
        Feb 29, 2024 12:01:34.126435995 CET49740443192.168.2.423.51.58.94
        Feb 29, 2024 12:01:34.272876978 CET49740443192.168.2.423.51.58.94
        Feb 29, 2024 12:01:34.313910007 CET4434974023.51.58.94192.168.2.4
        Feb 29, 2024 12:01:34.362684965 CET4434974023.51.58.94192.168.2.4
        Feb 29, 2024 12:01:34.362801075 CET4434974023.51.58.94192.168.2.4
        Feb 29, 2024 12:01:34.362862110 CET49740443192.168.2.423.51.58.94
        Feb 29, 2024 12:01:34.363147020 CET49740443192.168.2.423.51.58.94
        Feb 29, 2024 12:01:34.363173008 CET4434974023.51.58.94192.168.2.4
        Feb 29, 2024 12:01:34.363188982 CET49740443192.168.2.423.51.58.94
        Feb 29, 2024 12:01:34.363195896 CET4434974023.51.58.94192.168.2.4
        Feb 29, 2024 12:01:34.448322058 CET49741443192.168.2.423.51.58.94
        Feb 29, 2024 12:01:34.448416948 CET4434974123.51.58.94192.168.2.4
        Feb 29, 2024 12:01:34.448613882 CET49741443192.168.2.423.51.58.94
        Feb 29, 2024 12:01:34.449961901 CET49741443192.168.2.423.51.58.94
        Feb 29, 2024 12:01:34.449994087 CET4434974123.51.58.94192.168.2.4
        Feb 29, 2024 12:01:34.641257048 CET4434974123.51.58.94192.168.2.4
        Feb 29, 2024 12:01:34.641336918 CET49741443192.168.2.423.51.58.94
        Feb 29, 2024 12:01:34.642997026 CET49741443192.168.2.423.51.58.94
        Feb 29, 2024 12:01:34.643007994 CET4434974123.51.58.94192.168.2.4
        Feb 29, 2024 12:01:34.643523932 CET4434974123.51.58.94192.168.2.4
        Feb 29, 2024 12:01:34.645121098 CET49741443192.168.2.423.51.58.94
        Feb 29, 2024 12:01:34.685933113 CET4434974123.51.58.94192.168.2.4
        Feb 29, 2024 12:01:34.814093113 CET4434974123.51.58.94192.168.2.4
        Feb 29, 2024 12:01:34.814435959 CET4434974123.51.58.94192.168.2.4
        Feb 29, 2024 12:01:34.814491987 CET49741443192.168.2.423.51.58.94
        Feb 29, 2024 12:01:34.816927910 CET49741443192.168.2.423.51.58.94
        Feb 29, 2024 12:01:34.816946030 CET4434974123.51.58.94192.168.2.4
        Feb 29, 2024 12:01:43.198189974 CET44349739142.251.40.100192.168.2.4
        Feb 29, 2024 12:01:43.198360920 CET44349739142.251.40.100192.168.2.4
        Feb 29, 2024 12:01:43.198738098 CET49739443192.168.2.4142.251.40.100
        Feb 29, 2024 12:01:43.538142920 CET49739443192.168.2.4142.251.40.100
        Feb 29, 2024 12:01:43.538202047 CET44349739142.251.40.100192.168.2.4
        Feb 29, 2024 12:02:32.895543098 CET49749443192.168.2.4142.251.40.100
        Feb 29, 2024 12:02:32.895576954 CET44349749142.251.40.100192.168.2.4
        Feb 29, 2024 12:02:32.895637989 CET49749443192.168.2.4142.251.40.100
        Feb 29, 2024 12:02:32.896575928 CET49749443192.168.2.4142.251.40.100
        Feb 29, 2024 12:02:32.896589041 CET44349749142.251.40.100192.168.2.4
        Feb 29, 2024 12:02:33.171353102 CET44349749142.251.40.100192.168.2.4
        Feb 29, 2024 12:02:33.171717882 CET49749443192.168.2.4142.251.40.100
        Feb 29, 2024 12:02:33.171725035 CET44349749142.251.40.100192.168.2.4
        Feb 29, 2024 12:02:33.173191071 CET44349749142.251.40.100192.168.2.4
        Feb 29, 2024 12:02:33.173764944 CET49749443192.168.2.4142.251.40.100
        Feb 29, 2024 12:02:33.173850060 CET44349749142.251.40.100192.168.2.4
        Feb 29, 2024 12:02:33.220724106 CET49749443192.168.2.4142.251.40.100
        Feb 29, 2024 12:02:39.642801046 CET4972380192.168.2.472.21.81.240
        Feb 29, 2024 12:02:39.643062115 CET4972480192.168.2.472.21.81.240
        Feb 29, 2024 12:02:39.730648994 CET804972472.21.81.240192.168.2.4
        Feb 29, 2024 12:02:39.730835915 CET4972480192.168.2.472.21.81.240
        Feb 29, 2024 12:02:39.730963945 CET804972372.21.81.240192.168.2.4
        Feb 29, 2024 12:02:39.731034040 CET4972380192.168.2.472.21.81.240
        Feb 29, 2024 12:02:43.155745029 CET44349749142.251.40.100192.168.2.4
        Feb 29, 2024 12:02:43.155916929 CET44349749142.251.40.100192.168.2.4
        Feb 29, 2024 12:02:43.156022072 CET49749443192.168.2.4142.251.40.100
        Feb 29, 2024 12:02:43.729618073 CET49749443192.168.2.4142.251.40.100
        Feb 29, 2024 12:02:43.729643106 CET44349749142.251.40.100192.168.2.4
        TimestampSource PortDest PortSource IPDest IP
        Feb 29, 2024 12:01:29.089593887 CET53512201.1.1.1192.168.2.4
        Feb 29, 2024 12:01:29.187817097 CET53621901.1.1.1192.168.2.4
        Feb 29, 2024 12:01:29.815280914 CET53500021.1.1.1192.168.2.4
        Feb 29, 2024 12:01:30.624028921 CET6530853192.168.2.41.1.1.1
        Feb 29, 2024 12:01:30.624361992 CET5043153192.168.2.41.1.1.1
        Feb 29, 2024 12:01:30.713401079 CET53504311.1.1.1192.168.2.4
        Feb 29, 2024 12:01:32.472856045 CET5298453192.168.2.41.1.1.1
        Feb 29, 2024 12:01:32.473120928 CET6253553192.168.2.41.1.1.1
        Feb 29, 2024 12:01:32.561741114 CET53625351.1.1.1192.168.2.4
        Feb 29, 2024 12:01:32.844191074 CET5439153192.168.2.41.1.1.1
        Feb 29, 2024 12:01:32.844794989 CET5456053192.168.2.41.1.1.1
        Feb 29, 2024 12:01:32.932193995 CET53545601.1.1.1192.168.2.4
        Feb 29, 2024 12:01:32.932773113 CET53543911.1.1.1192.168.2.4
        Feb 29, 2024 12:01:46.894262075 CET53630411.1.1.1192.168.2.4
        Feb 29, 2024 12:01:46.915803909 CET138138192.168.2.4192.168.2.255
        Feb 29, 2024 12:02:05.965315104 CET53509181.1.1.1192.168.2.4
        Feb 29, 2024 12:02:28.804441929 CET53606671.1.1.1192.168.2.4
        Feb 29, 2024 12:02:28.809217930 CET53578131.1.1.1192.168.2.4

        DNS Queries

        TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
        Feb 29, 2024 12:01:30.624028921 CET192.168.2.41.1.1.10x7c2aStandard query (0)sdk.fra-01.braze.euA (IP address)IN (0x0001)false
        Feb 29, 2024 12:01:30.624361992 CET192.168.2.41.1.1.10x7ce1Standard query (0)sdk.fra-01.braze.eu65IN (0x0001)false
        Feb 29, 2024 12:01:32.472856045 CET192.168.2.41.1.1.10x3230Standard query (0)sdk.fra-01.braze.euA (IP address)IN (0x0001)false
        Feb 29, 2024 12:01:32.473120928 CET192.168.2.41.1.1.10xdf6fStandard query (0)sdk.fra-01.braze.eu65IN (0x0001)false
        Feb 29, 2024 12:01:32.844191074 CET192.168.2.41.1.1.10x79fdStandard query (0)www.google.comA (IP address)IN (0x0001)false
        Feb 29, 2024 12:01:32.844794989 CET192.168.2.41.1.1.10xbb45Standard query (0)www.google.com65IN (0x0001)false

        DNS Answers

        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
        Feb 29, 2024 12:01:30.713401079 CET1.1.1.1192.168.2.40x7ce1No error (0)sdk.fra-01.braze.eud2.shared.global.fastly.netCNAME (Canonical name)IN (0x0001)false
        Feb 29, 2024 12:01:30.713635921 CET1.1.1.1192.168.2.40x7c2aNo error (0)sdk.fra-01.braze.eud2.shared.global.fastly.netCNAME (Canonical name)IN (0x0001)false
        Feb 29, 2024 12:01:32.561741114 CET1.1.1.1192.168.2.40xdf6fNo error (0)sdk.fra-01.braze.eud2.shared.global.fastly.netCNAME (Canonical name)IN (0x0001)false
        Feb 29, 2024 12:01:32.561785936 CET1.1.1.1192.168.2.40x3230No error (0)sdk.fra-01.braze.eud2.shared.global.fastly.netCNAME (Canonical name)IN (0x0001)false
        Feb 29, 2024 12:01:32.932193995 CET1.1.1.1192.168.2.40xbb45No error (0)www.google.com65IN (0x0001)false
        Feb 29, 2024 12:01:32.932773113 CET1.1.1.1192.168.2.40x79fdNo error (0)www.google.com142.251.40.100A (IP address)IN (0x0001)false
        Feb 29, 2024 12:01:47.449345112 CET1.1.1.1192.168.2.40xbfc4No error (0)fp2e7a.wpc.2be4.phicdn.netfp2e7a.wpc.phicdn.netCNAME (Canonical name)IN (0x0001)false
        Feb 29, 2024 12:01:47.449345112 CET1.1.1.1192.168.2.40xbfc4No error (0)fp2e7a.wpc.phicdn.net192.229.211.108A (IP address)IN (0x0001)false
        Feb 29, 2024 12:02:02.065303087 CET1.1.1.1192.168.2.40x940bNo error (0)fp2e7a.wpc.2be4.phicdn.netfp2e7a.wpc.phicdn.netCNAME (Canonical name)IN (0x0001)false
        Feb 29, 2024 12:02:02.065303087 CET1.1.1.1192.168.2.40x940bNo error (0)fp2e7a.wpc.phicdn.net192.229.211.108A (IP address)IN (0x0001)false
        Feb 29, 2024 12:02:21.044779062 CET1.1.1.1192.168.2.40x3291No error (0)fp2e7a.wpc.2be4.phicdn.netfp2e7a.wpc.phicdn.netCNAME (Canonical name)IN (0x0001)false
        Feb 29, 2024 12:02:21.044779062 CET1.1.1.1192.168.2.40x3291No error (0)fp2e7a.wpc.phicdn.net192.229.211.108A (IP address)IN (0x0001)false
        Feb 29, 2024 12:02:41.689121962 CET1.1.1.1192.168.2.40x8800No error (0)fp2e7a.wpc.2be4.phicdn.netfp2e7a.wpc.phicdn.netCNAME (Canonical name)IN (0x0001)false
        Feb 29, 2024 12:02:41.689121962 CET1.1.1.1192.168.2.40x8800No error (0)fp2e7a.wpc.phicdn.net192.229.211.108A (IP address)IN (0x0001)false

        HTTP Request Dependency Graph

        • fs.microsoft.com

        HTTPS Proxied Packets

        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
        0192.168.2.44974023.51.58.94443
        TimestampBytes transferredDirectionData
        2024-02-29 11:01:34 UTC161OUTHEAD /fs/windows/config.json HTTP/1.1
        Connection: Keep-Alive
        Accept: */*
        Accept-Encoding: identity
        User-Agent: Microsoft BITS/7.8
        Host: fs.microsoft.com
        2024-02-29 11:01:34 UTC467INHTTP/1.1 200 OK
        Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json
        Content-Type: application/octet-stream
        ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7"
        Last-Modified: Tue, 16 May 2017 22:58:00 GMT
        Server: ECAcc (chd/0790)
        X-CID: 11
        X-Ms-ApiVersion: Distribute 1.2
        X-Ms-Region: prod-eus-z1
        Cache-Control: public, max-age=203057
        Date: Thu, 29 Feb 2024 11:01:34 GMT
        Connection: close
        X-CID: 2


        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
        1192.168.2.44974123.51.58.94443
        TimestampBytes transferredDirectionData
        2024-02-29 11:01:34 UTC239OUTGET /fs/windows/config.json HTTP/1.1
        Connection: Keep-Alive
        Accept: */*
        Accept-Encoding: identity
        If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT
        Range: bytes=0-2147483646
        User-Agent: Microsoft BITS/7.8
        Host: fs.microsoft.com
        2024-02-29 11:01:34 UTC456INHTTP/1.1 200 OK
        ApiVersion: Distribute 1.1
        Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json
        Content-Type: application/octet-stream
        ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7"
        Last-Modified: Tue, 16 May 2017 22:58:00 GMT
        Server: ECAcc (chd/0778)
        X-CID: 11
        Cache-Control: public, max-age=203057
        Date: Thu, 29 Feb 2024 11:01:34 GMT
        Content-Length: 55
        Connection: close
        X-CID: 2
        2024-02-29 11:01:34 UTC55INData Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d
        Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}


        Statistics

        CPU Usage

        020406080s020406080100

        Click to jump to process

        Memory Usage

        020406080s0.0050100MB

        Click to jump to process

        Behavior

        Click to jump to process

        System Behavior

        General

        Target ID:0
        Start time:12:01:25
        Start date:29/02/2024
        Path:C:\Program Files\Google\Chrome\Application\chrome.exe
        Wow64 process (32bit):false
        Commandline:C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
        Imagebase:0x7ff76e190000
        File size:3'242'272 bytes
        MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
        Has elevated privileges:true
        Has administrator privileges:true
        Programmed in:C, C++ or other language
        Reputation:low
        Has exited:false
        Show Windows behavior

        File Activities

        There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
        Show Windows behavior

        Process Activities

        There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
        Show Windows behavior

        Memory Activities

        There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
        There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
        Show Windows behavior

        Process Token Activities


        General

        Target ID:2
        Start time:12:01:26
        Start date:29/02/2024
        Path:C:\Program Files\Google\Chrome\Application\chrome.exe
        Wow64 process (32bit):false
        Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 --field-trial-handle=2220,i,5778722968356699458,18003569822951770728,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
        Imagebase:0x7ff76e190000
        File size:3'242'272 bytes
        MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
        Has elevated privileges:true
        Has administrator privileges:true
        Programmed in:C, C++ or other language
        Reputation:low
        Has exited:false
        Show Windows behavior

        File Activities

        There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
        Show Windows behavior

        Memory Activities


        General

        Target ID:3
        Start time:12:01:29
        Start date:29/02/2024
        Path:C:\Program Files\Google\Chrome\Application\chrome.exe
        Wow64 process (32bit):false
        Commandline:C:\Program Files\Google\Chrome\Application\chrome.exe" "https://sdk.fra-01.braze.eu/api/v3/data/
        Imagebase:0x7ff76e190000
        File size:3'242'272 bytes
        MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
        Has elevated privileges:true
        Has administrator privileges:true
        Programmed in:C, C++ or other language
        Reputation:low
        Has exited:true
        There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
        There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

        Disassembly

        ⊘No disassembly