Edit tour

Windows Analysis Report
https://cfl.dropboxstatic.com/static/metaserver/static/images/emails/logo_glyph_34_m1%402x.png

Overview

General Information

Sample URL:	https://cfl.dropboxstatic.com/static/metaserver/static/images/emails/logo_glyph_34_m1%402x.png
Analysis ID:	1411724
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

No high impact signatures.

Classification

Process Tree

System is w10x64

chrome.exe (PID: 6052 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 3416 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=2012,i,12438914086819341870,357763529726558688,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 6248 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://cfl.dropboxstatic.com/static/metaserver/static/images/emails/logo_glyph_34_m1%402x.png" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com

Source: unknown	HTTPS traffic detected: 52.159.126.152:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 69.192.108.161:443 -> 192.168.2.6:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 69.192.108.161:443 -> 192.168.2.6:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.159.126.152:443 -> 192.168.2.6:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.159.126.152:443 -> 192.168.2.6:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.159.126.152:443 -> 192.168.2.6:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.159.126.152:443 -> 192.168.2.6:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.159.126.152:443 -> 192.168.2.6:49735 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 69.192.108.161
Source: unknown	TCP traffic detected without corresponding DNS query: 69.192.108.161
Source: unknown	TCP traffic detected without corresponding DNS query: 69.192.108.161
Source: unknown	TCP traffic detected without corresponding DNS query: 69.192.108.161
Source: unknown	TCP traffic detected without corresponding DNS query: 69.192.108.161
Source: unknown	TCP traffic detected without corresponding DNS query: 69.192.108.161
Source: unknown	TCP traffic detected without corresponding DNS query: 69.192.108.161
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 69.192.108.161
Source: unknown	TCP traffic detected without corresponding DNS query: 69.192.108.161
Source: unknown	TCP traffic detected without corresponding DNS query: 69.192.108.161
Source: unknown	TCP traffic detected without corresponding DNS query: 69.192.108.161
Source: unknown	TCP traffic detected without corresponding DNS query: 69.192.108.161
Source: unknown	TCP traffic detected without corresponding DNS query: 69.192.108.161
Source: unknown	TCP traffic detected without corresponding DNS query: 69.192.108.161
Source: unknown	TCP traffic detected without corresponding DNS query: 69.192.108.161
Source: unknown	TCP traffic detected without corresponding DNS query: 69.192.108.161
Source: unknown	TCP traffic detected without corresponding DNS query: 69.192.108.161
Source: unknown	TCP traffic detected without corresponding DNS query: 69.192.108.161
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.126.152

Source: chromecache_40.2.dr	String found in binary or memory: https://assets.dropbox.com/www/en-us/illustrations/spot/look-magnifying-glass.svg
Source: chromecache_40.2.dr	String found in binary or memory: https://cfl.dropboxstatic.com/static/images/favicon.ico
Source: chromecache_40.2.dr	String found in binary or memory: https://cfl.dropboxstatic.com/static/metaserver/static/css/error.css
Source: chromecache_40.2.dr	String found in binary or memory: https://www.dropbox.com/business?_tk=fof
Source: chromecache_40.2.dr	String found in binary or memory: https://www.dropbox.com/help?_tk=fof
Source: chromecache_40.2.dr	String found in binary or memory: https://www.dropbox.com/home?_tk=fof
Source: chromecache_40.2.dr	String found in binary or memory: https://www.dropbox.com/login?_tk=fof
Source: chromecache_40.2.dr	String found in binary or memory: https://www.dropbox.com/plus?_tk=fof
Source: chromecache_40.2.dr	String found in binary or memory: https://www.dropbox.com/register?_tk=fof

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=2012,i,12438914086819341870,357763529726558688,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://cfl.dropboxstatic.com/static/metaserver/static/images/emails/logo_glyph_34_m1%402x.png"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=2012,i,12438914086819341870,357763529726558688,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label	Link
https://cfl.dropboxstatic.com/static/metaserver/static/images/emails/logo_glyph_34_m1%402x.png	0%	Avira URL Cloud	safe
https://cfl.dropboxstatic.com/static/metaserver/static/images/emails/logo_glyph_34_m1%402x.png	0%	Virustotal		Browse

Name	IP	Active	Malicious	Reputation
www.google.com	142.250.64.68	true	false	high
fp2e7a.wpc.phicdn.net	192.229.211.108	true	false	unknown
windowsupdatebg.s.llnwi.net	69.164.46.128	true	false	unknown
cfl.dropboxstatic.com	unknown	unknown	false	high

Name	Source	Malicious	Reputation
https://assets.dropbox.com/www/en-us/illustrations/spot/look-magnifying-glass.svg	chromecache_40.2.dr	false	high
https://www.dropbox.com/login?_tk=fof	chromecache_40.2.dr	false	high
https://www.dropbox.com/plus?_tk=fof	chromecache_40.2.dr	false	high
https://www.dropbox.com/business?_tk=fof	chromecache_40.2.dr	false	high
https://cfl.dropboxstatic.com/static/images/favicon.ico	chromecache_40.2.dr	false	high
https://www.dropbox.com/home?_tk=fof	chromecache_40.2.dr	false	high
https://cfl.dropboxstatic.com/static/metaserver/static/css/error.css	chromecache_40.2.dr	false	high
https://www.dropbox.com/register?_tk=fof	chromecache_40.2.dr	false	high
https://www.dropbox.com/help?_tk=fof	chromecache_40.2.dr	false	high

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
239.255.255.250	unknown	Reserved		unknown	unknown	false
142.250.64.68	www.google.com	United States		15169	GOOGLEUS	false

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1411724
Start date and time:	2024-03-19 14:17:20 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 19s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://cfl.dropboxstatic.com/static/metaserver/static/images/emails/logo_glyph_34_m1%402x.png
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean0.win@16/4@4/3
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (24654)
Category:	downloaded
Size (bytes):	26634
Entropy (8bit):	4.851177174677018
Encrypted:	false
SSDEEP:	192:IH3jEWs6v9nquuTV/gEzp6mIxUM2r/mb8aQ9aUdKVacuYIctl7ubOTP2/g5DIy2v:I3jjsQ8VqbDwTcuFc79o
MD5:	3CE58A0CD80880798704599BA76D69FF
SHA1:	9079739C4B976DCF9DDE9E3D5D912182B957D565
SHA-256:	40ED5E8524F2125904F1B794EC0CBE8FC73F2CBACAB6F700CACC848B0F8FF6B9
SHA-512:	9456807FDB3B8211C0747F5ABC5D41C2C1106BC2BE57DF113320FB0DF34D058FC449F50E74DD797225C717B90B896E5D9ABB5499CAD3C12FA978C2A05B6A76E0
Malicious:	false
Reputation:	low
URL:	https://cfl.dropboxstatic.com/favicon.ico
Preview:	<!DOCTYPE html>.<html>.<head><meta http-equiv="Content-Type" content="text/html; charset=utf-8">.<meta name="viewport" content="width=device-width, initial-scale=1" />.<title>Dropbox - 4xx</title>.<link href="https://cfl.dropboxstatic.com/static/metaserver/static/css/error.css" rel="stylesheet" type="text/css"/>.<link rel="shortcut icon" href="https://cfl.dropboxstatic.com/static/images/favicon.ico"/>.</head>.<body>.<div class="figure">.<img src="https://assets.dropbox.com/www/en-us/illustrations/spot/look-magnifying-glass.svg" alt="Error: 4xx"/>.</div>.<div id="errorbox">.<div class="not-found"> <h1>Error (4xx)</h1> We can't find the page you're looking for. <div class="not-found--links"> Here are a few links that may be helpful: <ul> <li><a href="https://www.dropbox.com/home?_tk=fof">Home</a></li> <li><a href="https://www.dropbox.com/help?_tk=fof">Help center</a></li> <li><a href="https://www.dropbox.com/login?_tk=fof">Sign in</a></li> <li><a href="https://www.dropbox.com/register?_t

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 80 x 145, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	1393
Entropy (8bit):	6.6476731542822165
Encrypted:	false
SSDEEP:	24:5wCGtLl9W6lCKCETy2PzD4OsMS3q9NikF8Kr9QZ79r:51GtLl9WSkKrv4F69NikFBWr
MD5:	D3ABDEB515464C39FD13B6AD1B52EA77
SHA1:	09642650E92A6EBC47476133E31DD71CB4AAFB17
SHA-256:	8ECF2390AC7D67B429471F3AC1F4C382B2CE288ED70E8B5033C37EA516D43D11
SHA-512:	B2DAF52BABF334238EF6F8BE59E8D82E9BBDF845CF819BFE995A1B265AE7E103BC6E2F5AABEEA6FFCAF3834437CDF87B470694A0DD7B7B026689087BA5CAC151
Malicious:	false
Reputation:	low
URL:	https://cfl.dropboxstatic.com/static/metaserver/static/images/emails/logo_glyph_34_m1%402x.png
Preview:	.PNG........IHDR...P.........c{.....sRGB...,.... cHRM..z%..............u0...`..:....o._.F....PLTE....b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..W......tRNS.......................#%'(+,-014567:;?@BEFGIKLMQRUX^_abcdejknwxy}~..................................................................(.....IDATx...Y_RA....`...X.).Kn..d...[(..).J......$.`....u1.....?.$I.$I.$I.$I.$I.$I..........L....rz&.5..0....e.P.7.r..A.<..f.:<...A.x/7..YL.6......z.@..T...j..'..-..H.&..W....4<f....Q.b>1..5.X#f...zQ..O!e...YVQ.n!e...jq.6w.9c..AT..b&e......)..'c..n.2......9..LK..2.].L...F-.....i..a..:.).t........M....F%.Tn.L.bG....S....._......8.;..SF.J

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 19, 2024 14:18:08.998297930 CET	49673	443	192.168.2.6	173.222.162.64
Mar 19, 2024 14:18:08.998303890 CET	49674	443	192.168.2.6	173.222.162.64
Mar 19, 2024 14:18:09.263999939 CET	49672	443	192.168.2.6	173.222.162.64
Mar 19, 2024 14:18:15.077481031 CET	49713	443	192.168.2.6	52.159.126.152
Mar 19, 2024 14:18:15.077533960 CET	443	49713	52.159.126.152	192.168.2.6
Mar 19, 2024 14:18:15.077613115 CET	49713	443	192.168.2.6	52.159.126.152
Mar 19, 2024 14:18:15.078243017 CET	49713	443	192.168.2.6	52.159.126.152
Mar 19, 2024 14:18:15.078265905 CET	443	49713	52.159.126.152	192.168.2.6
Mar 19, 2024 14:18:15.420795918 CET	443	49713	52.159.126.152	192.168.2.6
Mar 19, 2024 14:18:15.420886040 CET	49713	443	192.168.2.6	52.159.126.152
Mar 19, 2024 14:18:15.427412033 CET	49713	443	192.168.2.6	52.159.126.152
Mar 19, 2024 14:18:15.427423954 CET	443	49713	52.159.126.152	192.168.2.6
Mar 19, 2024 14:18:15.428508043 CET	443	49713	52.159.126.152	192.168.2.6
Mar 19, 2024 14:18:15.430483103 CET	49713	443	192.168.2.6	52.159.126.152
Mar 19, 2024 14:18:15.430620909 CET	49713	443	192.168.2.6	52.159.126.152
Mar 19, 2024 14:18:15.430629969 CET	443	49713	52.159.126.152	192.168.2.6
Mar 19, 2024 14:18:15.430807114 CET	49713	443	192.168.2.6	52.159.126.152
Mar 19, 2024 14:18:15.472238064 CET	443	49713	52.159.126.152	192.168.2.6
Mar 19, 2024 14:18:15.541484118 CET	443	49713	52.159.126.152	192.168.2.6
Mar 19, 2024 14:18:15.541954994 CET	443	49713	52.159.126.152	192.168.2.6
Mar 19, 2024 14:18:15.542031050 CET	49713	443	192.168.2.6	52.159.126.152
Mar 19, 2024 14:18:15.542937994 CET	49713	443	192.168.2.6	52.159.126.152
Mar 19, 2024 14:18:15.542958975 CET	443	49713	52.159.126.152	192.168.2.6
Mar 19, 2024 14:18:15.542969942 CET	49713	443	192.168.2.6	52.159.126.152
Mar 19, 2024 14:18:17.232211113 CET	49719	443	192.168.2.6	142.250.64.68
Mar 19, 2024 14:18:17.232244968 CET	443	49719	142.250.64.68	192.168.2.6
Mar 19, 2024 14:18:17.232357025 CET	49719	443	192.168.2.6	142.250.64.68
Mar 19, 2024 14:18:17.232552052 CET	49719	443	192.168.2.6	142.250.64.68
Mar 19, 2024 14:18:17.232567072 CET	443	49719	142.250.64.68	192.168.2.6
Mar 19, 2024 14:18:17.431385994 CET	443	49719	142.250.64.68	192.168.2.6
Mar 19, 2024 14:18:17.431615114 CET	49719	443	192.168.2.6	142.250.64.68
Mar 19, 2024 14:18:17.431632996 CET	443	49719	142.250.64.68	192.168.2.6
Mar 19, 2024 14:18:17.433345079 CET	443	49719	142.250.64.68	192.168.2.6
Mar 19, 2024 14:18:17.433428049 CET	49719	443	192.168.2.6	142.250.64.68
Mar 19, 2024 14:18:17.435429096 CET	49719	443	192.168.2.6	142.250.64.68
Mar 19, 2024 14:18:17.435537100 CET	443	49719	142.250.64.68	192.168.2.6
Mar 19, 2024 14:18:17.480601072 CET	49719	443	192.168.2.6	142.250.64.68
Mar 19, 2024 14:18:17.480608940 CET	443	49719	142.250.64.68	192.168.2.6
Mar 19, 2024 14:18:17.527548075 CET	49719	443	192.168.2.6	142.250.64.68
Mar 19, 2024 14:18:18.612571955 CET	49673	443	192.168.2.6	173.222.162.64

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 19, 2024 14:18:15.020631075 CET	53	64873	1.1.1.1	192.168.2.6
Mar 19, 2024 14:18:15.052990913 CET	53	63622	1.1.1.1	192.168.2.6
Mar 19, 2024 14:18:15.609889030 CET	53	55468	1.1.1.1	192.168.2.6
Mar 19, 2024 14:18:16.330375910 CET	58436	53	192.168.2.6	1.1.1.1
Mar 19, 2024 14:18:16.330535889 CET	53315	53	192.168.2.6	1.1.1.1
Mar 19, 2024 14:18:17.141999960 CET	58867	53	192.168.2.6	1.1.1.1
Mar 19, 2024 14:18:17.142271996 CET	50826	53	192.168.2.6	1.1.1.1
Mar 19, 2024 14:18:17.230036020 CET	53	58867	1.1.1.1	192.168.2.6
Mar 19, 2024 14:18:17.230146885 CET	53	50826	1.1.1.1	192.168.2.6
Mar 19, 2024 14:18:32.663996935 CET	53	57662	1.1.1.1	192.168.2.6
Mar 19, 2024 14:18:51.496366024 CET	53	63410	1.1.1.1	192.168.2.6
Mar 19, 2024 14:19:14.142837048 CET	53	49583	1.1.1.1	192.168.2.6
Mar 19, 2024 14:19:14.144632101 CET	53	52860	1.1.1.1	192.168.2.6

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 19, 2024 14:18:16.418606043 CET	1.1.1.1	192.168.2.6	0x72ca	No error (0)	cfl.dropboxstatic.com	cfl.dropboxstatic.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 19, 2024 14:18:16.419414997 CET	1.1.1.1	192.168.2.6	0xdc34	No error (0)	cfl.dropboxstatic.com	cfl.dropboxstatic.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 19, 2024 14:18:17.230036020 CET	1.1.1.1	192.168.2.6	0x7485	No error (0)	www.google.com		142.250.64.68	A (IP address)	IN (0x0001)	false
Mar 19, 2024 14:18:17.230146885 CET	1.1.1.1	192.168.2.6	0xe5b6	No error (0)	www.google.com			65	IN (0x0001)	false
Mar 19, 2024 14:18:29.775140047 CET	1.1.1.1	192.168.2.6	0x457b	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 19, 2024 14:18:29.775140047 CET	1.1.1.1	192.168.2.6	0x457b	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Mar 19, 2024 14:19:06.618305922 CET	1.1.1.1	192.168.2.6	0xdb5	No error (0)	windowsupdatebg.s.llnwi.net		69.164.46.128	A (IP address)	IN (0x0001)	false
Mar 19, 2024 14:19:06.618305922 CET	1.1.1.1	192.168.2.6	0xdb5	No error (0)	windowsupdatebg.s.llnwi.net		69.164.46.0	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2024-03-19 13:18:15 UTC	70	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 34 0d 0a 4d 53 2d 43 56 3a 20 35 69 78 6a 4a 68 52 66 42 45 4f 74 57 55 72 31 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 33 31 35 65 63 39 36 30 36 62 31 38 33 39 0d 0a 0d 0a Data Ascii: CNT 1 CON 304MS-CV: 5ixjJhRfBEOtWUr1.1Context: 8315ec9606b1839
2024-03-19 13:18:15 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-03-19 13:18:15 UTC	1075	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 35 32 0d 0a 4d 53 2d 43 56 3a 20 35 69 78 6a 4a 68 52 66 42 45 4f 74 57 55 72 31 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 33 31 35 65 63 39 36 30 36 62 31 38 33 39 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 78 49 49 31 7a 51 6e 78 76 58 6c 74 4d 66 58 52 31 6d 44 58 69 33 51 6d 67 78 53 4a 75 59 39 57 6c 4f 75 66 6c 4e 73 52 55 32 58 62 6b 73 71 74 4f 7a 71 47 32 44 55 36 69 2f 4e 5a 72 61 49 6e 50 37 76 37 59 66 62 6a 50 42 30 6d 6d 55 6f 74 6d 4f 2f 48 33 79 4e 2b 47 78 7a 6d 56 62 65 6f 41 46 74 50 69 2f 36 39 57 4f 41 4a 50 Data Ascii: ATH 2 CON\DEVICE 1052MS-CV: 5ixjJhRfBEOtWUr1.2Context: 8315ec9606b1839<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWxII1zQnxvXltMfXR1mDXi3QmgxSJuY9WlOuflNsRU2XbksqtOzqG2DU6i/NZraInP7v7YfbjPB0mmUotmO/H3yN+GxzmVbeoAFtPi/69WOAJP
2024-03-19 13:18:15 UTC	217	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 36 0d 0a 4d 53 2d 43 56 3a 20 35 69 78 6a 4a 68 52 66 42 45 4f 74 57 55 72 31 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 33 31 35 65 63 39 36 30 36 62 31 38 33 39 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 196MS-CV: 5ixjJhRfBEOtWUr1.3Context: 8315ec9606b1839<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-03-19 13:18:15 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-03-19 13:18:15 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 7a 6b 48 47 70 74 30 2f 36 55 43 62 33 5a 50 6f 76 74 6f 71 56 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: zkHGpt0/6UCb3ZPovtoqVw.0Payload parsing failed.

Timestamp	Bytes transferred	Direction	Data
2024-03-19 13:18:20 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-03-19 13:18:20 UTC	468	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/079C) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus2-z1 Cache-Control: public, max-age=108451 Date: Tue, 19 Mar 2024 13:18:20 GMT Connection: close X-CID: 2

Timestamp	Bytes transferred	Direction	Data
2024-03-19 13:18:20 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-03-19 13:18:21 UTC	531	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0rcGnYgAAAAANOnx9vccHTr21ROgX9ESTU0pDRURHRTAzMDkAY2VmYzI1ODMtYTliMi00NGE3LTk3NTUtYjc2ZDE3ZTA1Zjdm Cache-Control: public, max-age=108451 Date: Tue, 19 Mar 2024 13:18:21 GMT Content-Length: 55 Connection: close X-CID: 2
2024-03-19 13:18:21 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Timestamp	Bytes transferred	Direction	Data
2024-03-19 13:18:22 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 41 69 57 4b 50 32 72 38 77 55 69 32 66 45 36 43 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 34 31 34 37 32 64 61 35 37 39 65 37 64 66 63 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: AiWKP2r8wUi2fE6C.1Context: 241472da579e7dfc
2024-03-19 13:18:22 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-03-19 13:18:22 UTC	1076	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 35 33 0d 0a 4d 53 2d 43 56 3a 20 41 69 57 4b 50 32 72 38 77 55 69 32 66 45 36 43 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 34 31 34 37 32 64 61 35 37 39 65 37 64 66 63 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 78 49 49 31 7a 51 6e 78 76 58 6c 74 4d 66 58 52 31 6d 44 58 69 33 51 6d 67 78 53 4a 75 59 39 57 6c 4f 75 66 6c 4e 73 52 55 32 58 62 6b 73 71 74 4f 7a 71 47 32 44 55 36 69 2f 4e 5a 72 61 49 6e 50 37 76 37 59 66 62 6a 50 42 30 6d 6d 55 6f 74 6d 4f 2f 48 33 79 4e 2b 47 78 7a 6d 56 62 65 6f 41 46 74 50 69 2f 36 39 57 4f 41 4a Data Ascii: ATH 2 CON\DEVICE 1053MS-CV: AiWKP2r8wUi2fE6C.2Context: 241472da579e7dfc<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWxII1zQnxvXltMfXR1mDXi3QmgxSJuY9WlOuflNsRU2XbksqtOzqG2DU6i/NZraInP7v7YfbjPB0mmUotmO/H3yN+GxzmVbeoAFtPi/69WOAJ
2024-03-19 13:18:22 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 41 69 57 4b 50 32 72 38 77 55 69 32 66 45 36 43 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 34 31 34 37 32 64 61 35 37 39 65 37 64 66 63 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: AiWKP2r8wUi2fE6C.3Context: 241472da579e7dfc<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-03-19 13:18:23 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-03-19 13:18:23 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 54 75 72 52 69 77 4d 51 49 30 43 52 79 6e 75 73 56 44 6f 53 43 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: TurRiwMQI0CRynusVDoSCQ.0Payload parsing failed.

Timestamp	Bytes transferred	Direction	Data
2024-03-19 13:18:34 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 32 2f 6a 6c 63 61 7a 76 42 55 43 5a 69 57 36 33 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 38 30 63 38 62 36 39 66 35 64 64 31 36 37 34 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 2/jlcazvBUCZiW63.1Context: 280c8b69f5dd1674
2024-03-19 13:18:34 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-03-19 13:18:34 UTC	1076	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 35 33 0d 0a 4d 53 2d 43 56 3a 20 32 2f 6a 6c 63 61 7a 76 42 55 43 5a 69 57 36 33 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 38 30 63 38 62 36 39 66 35 64 64 31 36 37 34 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 78 49 49 31 7a 51 6e 78 76 58 6c 74 4d 66 58 52 31 6d 44 58 69 33 51 6d 67 78 53 4a 75 59 39 57 6c 4f 75 66 6c 4e 73 52 55 32 58 62 6b 73 71 74 4f 7a 71 47 32 44 55 36 69 2f 4e 5a 72 61 49 6e 50 37 76 37 59 66 62 6a 50 42 30 6d 6d 55 6f 74 6d 4f 2f 48 33 79 4e 2b 47 78 7a 6d 56 62 65 6f 41 46 74 50 69 2f 36 39 57 4f 41 4a Data Ascii: ATH 2 CON\DEVICE 1053MS-CV: 2/jlcazvBUCZiW63.2Context: 280c8b69f5dd1674<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWxII1zQnxvXltMfXR1mDXi3QmgxSJuY9WlOuflNsRU2XbksqtOzqG2DU6i/NZraInP7v7YfbjPB0mmUotmO/H3yN+GxzmVbeoAFtPi/69WOAJ
2024-03-19 13:18:34 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 32 2f 6a 6c 63 61 7a 76 42 55 43 5a 69 57 36 33 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 38 30 63 38 62 36 39 66 35 64 64 31 36 37 34 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 2/jlcazvBUCZiW63.3Context: 280c8b69f5dd1674<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-03-19 13:18:34 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-03-19 13:18:34 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 51 48 59 74 6c 69 47 67 71 6b 69 2b 64 4a 6d 73 78 6b 67 46 33 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: QHYtliGgqki+dJmsxkgF3w.0Payload parsing failed.

Timestamp	Bytes transferred	Direction	Data
2024-03-19 13:18:51 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 51 76 48 33 50 30 46 62 6e 45 65 51 54 59 36 62 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 63 33 39 39 31 32 35 39 31 35 38 65 33 34 64 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: QvH3P0FbnEeQTY6b.1Context: 2c3991259158e34d
2024-03-19 13:18:51 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-03-19 13:18:51 UTC	1076	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 35 33 0d 0a 4d 53 2d 43 56 3a 20 51 76 48 33 50 30 46 62 6e 45 65 51 54 59 36 62 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 63 33 39 39 31 32 35 39 31 35 38 65 33 34 64 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 78 49 49 31 7a 51 6e 78 76 58 6c 74 4d 66 58 52 31 6d 44 58 69 33 51 6d 67 78 53 4a 75 59 39 57 6c 4f 75 66 6c 4e 73 52 55 32 58 62 6b 73 71 74 4f 7a 71 47 32 44 55 36 69 2f 4e 5a 72 61 49 6e 50 37 76 37 59 66 62 6a 50 42 30 6d 6d 55 6f 74 6d 4f 2f 48 33 79 4e 2b 47 78 7a 6d 56 62 65 6f 41 46 74 50 69 2f 36 39 57 4f 41 4a Data Ascii: ATH 2 CON\DEVICE 1053MS-CV: QvH3P0FbnEeQTY6b.2Context: 2c3991259158e34d<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWxII1zQnxvXltMfXR1mDXi3QmgxSJuY9WlOuflNsRU2XbksqtOzqG2DU6i/NZraInP7v7YfbjPB0mmUotmO/H3yN+GxzmVbeoAFtPi/69WOAJ
2024-03-19 13:18:51 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 51 76 48 33 50 30 46 62 6e 45 65 51 54 59 36 62 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 63 33 39 39 31 32 35 39 31 35 38 65 33 34 64 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: QvH3P0FbnEeQTY6b.3Context: 2c3991259158e34d<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-03-19 13:18:51 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-03-19 13:18:51 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 34 76 71 69 45 72 50 32 61 45 65 64 33 79 63 77 45 54 55 30 58 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 4vqiErP2aEed3ycwETU0Xg.0Payload parsing failed.

Timestamp	Bytes transferred	Direction	Data
2024-03-19 13:19:10 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 6b 6b 4d 50 78 62 31 45 35 30 75 54 78 4e 71 7a 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 61 31 35 39 33 36 33 62 35 39 31 63 62 37 36 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: kkMPxb1E50uTxNqz.1Context: fa159363b591cb76
2024-03-19 13:19:10 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-03-19 13:19:10 UTC	1076	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 35 33 0d 0a 4d 53 2d 43 56 3a 20 6b 6b 4d 50 78 62 31 45 35 30 75 54 78 4e 71 7a 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 61 31 35 39 33 36 33 62 35 39 31 63 62 37 36 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 78 49 49 31 7a 51 6e 78 76 58 6c 74 4d 66 58 52 31 6d 44 58 69 33 51 6d 67 78 53 4a 75 59 39 57 6c 4f 75 66 6c 4e 73 52 55 32 58 62 6b 73 71 74 4f 7a 71 47 32 44 55 36 69 2f 4e 5a 72 61 49 6e 50 37 76 37 59 66 62 6a 50 42 30 6d 6d 55 6f 74 6d 4f 2f 48 33 79 4e 2b 47 78 7a 6d 56 62 65 6f 41 46 74 50 69 2f 36 39 57 4f 41 4a Data Ascii: ATH 2 CON\DEVICE 1053MS-CV: kkMPxb1E50uTxNqz.2Context: fa159363b591cb76<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWxII1zQnxvXltMfXR1mDXi3QmgxSJuY9WlOuflNsRU2XbksqtOzqG2DU6i/NZraInP7v7YfbjPB0mmUotmO/H3yN+GxzmVbeoAFtPi/69WOAJ
2024-03-19 13:19:10 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 6b 6b 4d 50 78 62 31 45 35 30 75 54 78 4e 71 7a 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 61 31 35 39 33 36 33 62 35 39 31 63 62 37 36 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: kkMPxb1E50uTxNqz.3Context: fa159363b591cb76<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-03-19 13:19:10 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-03-19 13:19:10 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 49 68 66 73 6b 38 77 69 4a 45 57 36 30 51 6b 4e 59 2f 68 43 52 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: Ihfsk8wiJEW60QkNY/hCRQ.0Payload parsing failed.

Timestamp	Bytes transferred	Direction	Data
2024-03-19 13:19:31 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 70 71 34 4d 79 72 41 72 76 30 71 4a 70 64 55 59 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 62 36 32 33 30 38 61 31 30 61 63 64 65 63 66 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: pq4MyrArv0qJpdUY.1Context: eb62308a10acdecf
2024-03-19 13:19:31 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-03-19 13:19:31 UTC	1076	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 35 33 0d 0a 4d 53 2d 43 56 3a 20 70 71 34 4d 79 72 41 72 76 30 71 4a 70 64 55 59 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 62 36 32 33 30 38 61 31 30 61 63 64 65 63 66 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 78 49 49 31 7a 51 6e 78 76 58 6c 74 4d 66 58 52 31 6d 44 58 69 33 51 6d 67 78 53 4a 75 59 39 57 6c 4f 75 66 6c 4e 73 52 55 32 58 62 6b 73 71 74 4f 7a 71 47 32 44 55 36 69 2f 4e 5a 72 61 49 6e 50 37 76 37 59 66 62 6a 50 42 30 6d 6d 55 6f 74 6d 4f 2f 48 33 79 4e 2b 47 78 7a 6d 56 62 65 6f 41 46 74 50 69 2f 36 39 57 4f 41 4a Data Ascii: ATH 2 CON\DEVICE 1053MS-CV: pq4MyrArv0qJpdUY.2Context: eb62308a10acdecf<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWxII1zQnxvXltMfXR1mDXi3QmgxSJuY9WlOuflNsRU2XbksqtOzqG2DU6i/NZraInP7v7YfbjPB0mmUotmO/H3yN+GxzmVbeoAFtPi/69WOAJ
2024-03-19 13:19:31 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 70 71 34 4d 79 72 41 72 76 30 71 4a 70 64 55 59 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 62 36 32 33 30 38 61 31 30 61 63 64 65 63 66 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: pq4MyrArv0qJpdUY.3Context: eb62308a10acdecf<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-03-19 13:19:31 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-03-19 13:19:31 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 33 44 33 30 35 72 65 48 41 6b 32 2b 54 66 4d 50 59 6a 4f 37 65 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 3D305reHAk2+TfMPYjO7ew.0Payload parsing failed.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://cfl.dropboxstatic.com/static/metaserver/static/images/emails/logo_glyph_34_m1%402x.png

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 40

Chrome Cache Entry: 41

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: chrome.exePID: 6052, Parent PID: 6032

General

File Activities

File Opened

File Created

File Deleted

File Moved

Other File Operations

Registry Activities

Key Deleted

Key Value Deleted

Process Activities

Process Created

Windows Analysis Report
https://cfl.dropboxstatic.com/static/metaserver/static/images/emails/logo_glyph_34_m1%402x.png

Target ID:	0
Start time:	14:18:08
Start date:	19/03/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	2
Start time:	14:18:13
Start date:	19/03/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=2012,i,12438914086819341870,357763529726558688,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	4
Start time:	14:18:15
Start date:	19/03/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://cfl.dropboxstatic.com/static/metaserver/static/images/emails/logo_glyph_34_m1%402x.png"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre