Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Overview 2023.html

Overview

General Information

Sample name:Overview 2023.html
Analysis ID:1446965
MD5:55add7b502dca6ec2478cc6f47185628
SHA1:707dc4b5cd6387969421ab99c3cd70fd0609e681
SHA256:a02da1e9e258597fb5e2b62d5569d2822cefd60fd0cede3ae18919348e259fda

Detection

Score:48
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for domain / URL
Form action URLs do not match main URL
HTML body contains low number of good links
HTML title does not match URL
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Stores files to the Windows start menu directory

Classification

  • System is w10x64_ra
  • chrome.exe (PID: 6148 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\Desktop\Overview 2023.html MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • chrome.exe (PID: 5876 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=1984,i,6946066138044202147,2593498996008099824,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • CredentialUIBroker.exe (PID: 7988 cmdline: "C:\Windows\System32\CredentialUIBroker.exe" NonAppContainer -Embedding MD5: 91C44D67C5881747F02785101CEB5369)
  • cleanup
No yara matches
No Sigma rule has matched
No Snort rule has matched

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: human-resources-support.comVirustotal: Detection: 6%Perma Link
Source: https://login.microsoft.com/44a02942-4e5b-420a-8bc4-f60b91281f2e/fido/get?uiflavor=WebHTTP Parser: Form action: https://login.microsoftonline.com/44a02942-4e5b-420a-8bc4-f60b91281f2e/login microsoft microsoftonline
Source: https://login.microsoft.com/44a02942-4e5b-420a-8bc4-f60b91281f2e/fido/get?uiflavor=WebHTTP Parser: Form action: https://login.microsoftonline.com/44a02942-4e5b-420a-8bc4-f60b91281f2e/login microsoft microsoftonline
Source: https://login.microsoftonline.com/44a02942-4e5b-420a-8bc4-f60b91281f2e/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=5828F8E49253831767947AE071B3E87258ADFC014E4999A9%2D55C8F59085C63035BFB726C440F8504875B7C3CEE0797D357F7E758A1D8EB4F6&redirect%5Furi=https%3A%2F%2Fcityofcasey%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=99af2ba1%2De065%2D3000%2D5c13%2Df041b6990b02HTTP Parser: Number of links: 0
Source: https://login.microsoftonline.com/44a02942-4e5b-420a-8bc4-f60b91281f2e/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=5828F8E49253831767947AE071B3E87258ADFC014E4999A9%2D55C8F59085C63035BFB726C440F8504875B7C3CEE0797D357F7E758A1D8EB4F6&redirect%5Furi=https%3A%2F%2Fcityofcasey%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=99af2ba1%2De065%2D3000%2D5c13%2Df041b6990b02&sso_reload=trueHTTP Parser: Number of links: 0
Source: https://login.microsoft.com/44a02942-4e5b-420a-8bc4-f60b91281f2e/fido/get?uiflavor=WebHTTP Parser: Number of links: 0
Source: https://login.microsoftonline.com/44a02942-4e5b-420a-8bc4-f60b91281f2e/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=5828F8E49253831767947AE071B3E87258ADFC014E4999A9%2D55C8F59085C63035BFB726C440F8504875B7C3CEE0797D357F7E758A1D8EB4F6&redirect%5Furi=https%3A%2F%2Fcityofcasey%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=99af2ba1%2De065%2D3000%2D5c13%2Df041b6990b02HTTP Parser: Title: Redirecting does not match URL
Source: https://login.microsoftonline.com/44a02942-4e5b-420a-8bc4-f60b91281f2e/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=5828F8E49253831767947AE071B3E87258ADFC014E4999A9%2D55C8F59085C63035BFB726C440F8504875B7C3CEE0797D357F7E758A1D8EB4F6&redirect%5Furi=https%3A%2F%2Fcityofcasey%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=99af2ba1%2De065%2D3000%2D5c13%2Df041b6990b02&sso_reload=trueHTTP Parser: Title: Sign in to your account does not match URL
Source: https://login.microsoft.com/44a02942-4e5b-420a-8bc4-f60b91281f2e/fido/get?uiflavor=WebHTTP Parser: Title: Sign in to your account does not match URL
Source: https://login.microsoftonline.com/44a02942-4e5b-420a-8bc4-f60b91281f2e/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=5828F8E49253831767947AE071B3E87258ADFC014E4999A9%2D55C8F59085C63035BFB726C440F8504875B7C3CEE0797D357F7E758A1D8EB4F6&redirect%5Furi=https%3A%2F%2Fcityofcasey%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=99af2ba1%2De065%2D3000%2D5c13%2Df041b6990b02&sso_reload=trueHTTP Parser: <input type="password" .../> found
Source: Overview 2023.htmlHTTP Parser: No favicon
Source: file:///C:/Users/user/Desktop/Overview%202023.htmlHTTP Parser: No favicon
Source: https://login.microsoftonline.com/44a02942-4e5b-420a-8bc4-f60b91281f2e/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=5828F8E49253831767947AE071B3E87258ADFC014E4999A9%2D55C8F59085C63035BFB726C440F8504875B7C3CEE0797D357F7E758A1D8EB4F6&redirect%5Furi=https%3A%2F%2Fcityofcasey%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=99af2ba1%2De065%2D3000%2D5c13%2Df041b6990b02HTTP Parser: No favicon
Source: https://login.microsoftonline.com/44a02942-4e5b-420a-8bc4-f60b91281f2e/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=5828F8E49253831767947AE071B3E87258ADFC014E4999A9%2D55C8F59085C63035BFB726C440F8504875B7C3CEE0797D357F7E758A1D8EB4F6&redirect%5Furi=https%3A%2F%2Fcityofcasey%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=99af2ba1%2De065%2D3000%2D5c13%2Df041b6990b02HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/44a02942-4e5b-420a-8bc4-f60b91281f2e/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=5828F8E49253831767947AE071B3E87258ADFC014E4999A9%2D55C8F59085C63035BFB726C440F8504875B7C3CEE0797D357F7E758A1D8EB4F6&redirect%5Furi=https%3A%2F%2Fcityofcasey%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=99af2ba1%2De065%2D3000%2D5c13%2Df041b6990b02&sso_reload=trueHTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/44a02942-4e5b-420a-8bc4-f60b91281f2e/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=5828F8E49253831767947AE071B3E87258ADFC014E4999A9%2D55C8F59085C63035BFB726C440F8504875B7C3CEE0797D357F7E758A1D8EB4F6&redirect%5Furi=https%3A%2F%2Fcityofcasey%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=99af2ba1%2De065%2D3000%2D5c13%2Df041b6990b02&sso_reload=trueHTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/44a02942-4e5b-420a-8bc4-f60b91281f2e/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=5828F8E49253831767947AE071B3E87258ADFC014E4999A9%2D55C8F59085C63035BFB726C440F8504875B7C3CEE0797D357F7E758A1D8EB4F6&redirect%5Furi=https%3A%2F%2Fcityofcasey%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=99af2ba1%2De065%2D3000%2D5c13%2Df041b6990b02&sso_reload=trueHTTP Parser: No <meta name="author".. found
Source: https://login.microsoft.com/44a02942-4e5b-420a-8bc4-f60b91281f2e/fido/get?uiflavor=WebHTTP Parser: No <meta name="author".. found
Source: https://login.microsoft.com/44a02942-4e5b-420a-8bc4-f60b91281f2e/fido/get?uiflavor=WebHTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/44a02942-4e5b-420a-8bc4-f60b91281f2e/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=5828F8E49253831767947AE071B3E87258ADFC014E4999A9%2D55C8F59085C63035BFB726C440F8504875B7C3CEE0797D357F7E758A1D8EB4F6&redirect%5Furi=https%3A%2F%2Fcityofcasey%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=99af2ba1%2De065%2D3000%2D5c13%2Df041b6990b02HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/44a02942-4e5b-420a-8bc4-f60b91281f2e/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=5828F8E49253831767947AE071B3E87258ADFC014E4999A9%2D55C8F59085C63035BFB726C440F8504875B7C3CEE0797D357F7E758A1D8EB4F6&redirect%5Furi=https%3A%2F%2Fcityofcasey%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=99af2ba1%2De065%2D3000%2D5c13%2Df041b6990b02&sso_reload=trueHTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/44a02942-4e5b-420a-8bc4-f60b91281f2e/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=5828F8E49253831767947AE071B3E87258ADFC014E4999A9%2D55C8F59085C63035BFB726C440F8504875B7C3CEE0797D357F7E758A1D8EB4F6&redirect%5Furi=https%3A%2F%2Fcityofcasey%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=99af2ba1%2De065%2D3000%2D5c13%2Df041b6990b02&sso_reload=trueHTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/44a02942-4e5b-420a-8bc4-f60b91281f2e/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=5828F8E49253831767947AE071B3E87258ADFC014E4999A9%2D55C8F59085C63035BFB726C440F8504875B7C3CEE0797D357F7E758A1D8EB4F6&redirect%5Furi=https%3A%2F%2Fcityofcasey%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=99af2ba1%2De065%2D3000%2D5c13%2Df041b6990b02&sso_reload=trueHTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoft.com/44a02942-4e5b-420a-8bc4-f60b91281f2e/fido/get?uiflavor=WebHTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoft.com/44a02942-4e5b-420a-8bc4-f60b91281f2e/fido/get?uiflavor=WebHTTP Parser: No <meta name="copyright".. found
Source: unknownHTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.16:49719 version: TLS 1.2
Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49720 version: TLS 1.2
Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49722 version: TLS 1.2
Source: unknownHTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.16:49778 version: TLS 1.2
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 2.19.96.128
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknownTCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknownTCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknownTCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknownTCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknownTCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknownTCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknownTCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknownTCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknownTCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknownTCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknownTCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknownTCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: global trafficDNS traffic detected: DNS query: human-resources-support.com
Source: global trafficDNS traffic detected: DNS query: cityofcasey.sharepoint.com
Source: global trafficDNS traffic detected: DNS query: www.google.com
Source: global trafficDNS traffic detected: DNS query: login.microsoftonline.com
Source: global trafficDNS traffic detected: DNS query: identity.nel.measure.office.net
Source: global trafficDNS traffic detected: DNS query: aadcdn.msftauth.net
Source: global trafficDNS traffic detected: DNS query: aadcdn.msauthimages.net
Source: global trafficDNS traffic detected: DNS query: autologon.microsoftazuread-sso.com
Source: global trafficDNS traffic detected: DNS query: aadcdn.msftauthimages.net
Source: unknownNetwork traffic detected: HTTP traffic on port 49708 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49744
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49742
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49741
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49740
Source: unknownNetwork traffic detected: HTTP traffic on port 49766 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49720 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49737
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49736
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49735
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49734
Source: unknownNetwork traffic detected: HTTP traffic on port 49772 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49733
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49732
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49731
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49730
Source: unknownNetwork traffic detected: HTTP traffic on port 49732 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49711 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49784 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49728 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49749 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49763 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49729
Source: unknownNetwork traffic detected: HTTP traffic on port 49752 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49728
Source: unknownNetwork traffic detected: HTTP traffic on port 49777 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49726
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49725
Source: unknownNetwork traffic detected: HTTP traffic on port 49735 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49724
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49722
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49720
Source: unknownNetwork traffic detected: HTTP traffic on port 49731 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49706 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49729 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49760 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49745 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49688 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49719
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49716
Source: unknownNetwork traffic detected: HTTP traffic on port 49774 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49711
Source: unknownNetwork traffic detected: HTTP traffic on port 49757 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49710
Source: unknownNetwork traffic detected: HTTP traffic on port 49709 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49734 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49726 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49740 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49768 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49709
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49708
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49706
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49705
Source: unknownNetwork traffic detected: HTTP traffic on port 49737 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49771 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49733 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49710 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49784
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49780
Source: unknownNetwork traffic detected: HTTP traffic on port 49762 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49776 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49736 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49759 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49778
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49777
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49776
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49775
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49774
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49773
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49772
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49771
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49770
Source: unknownNetwork traffic detected: HTTP traffic on port 49724 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49742 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49767 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49780 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49773 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49768
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49767
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49766
Source: unknownNetwork traffic detected: HTTP traffic on port 49758 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49763
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49762
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49761
Source: unknownNetwork traffic detected: HTTP traffic on port 49678 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49760
Source: unknownNetwork traffic detected: HTTP traffic on port 49725 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49741 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49770 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49719 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49722 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49759
Source: unknownNetwork traffic detected: HTTP traffic on port 49778 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49758
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49757
Source: unknownNetwork traffic detected: HTTP traffic on port 49755 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49755
Source: unknownNetwork traffic detected: HTTP traffic on port 49673 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49752
Source: unknownNetwork traffic detected: HTTP traffic on port 49705 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49730 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49750
Source: unknownNetwork traffic detected: HTTP traffic on port 49761 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49747 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49744 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49775 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49716 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49750 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49749
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49747
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49745
Source: unknownHTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.16:49719 version: TLS 1.2
Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49720 version: TLS 1.2
Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49722 version: TLS 1.2
Source: unknownHTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.16:49778 version: TLS 1.2
Source: classification engineClassification label: mal48.winHTML@19/31@30/222
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Windows\System32\CredentialUIBroker.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\Desktop\Overview 2023.html
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=1984,i,6946066138044202147,2593498996008099824,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=1984,i,6946066138044202147,2593498996008099824,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: unknownProcess created: C:\Windows\System32\CredentialUIBroker.exe "C:\Windows\System32\CredentialUIBroker.exe" NonAppContainer -Embedding
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: twinapi.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: twinui.appcore.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: windows.storage.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: wldp.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: windows.shell.servicehostbuilder.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: windows.ui.creddialogcontroller.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: powrprof.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: umpdc.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: wintypes.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: windows.ui.xamlhost.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: windows.ui.cred.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: wincorlib.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: mrmcorer.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: windows.ui.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: windowmanagementapi.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: textinputframework.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: inputhost.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: twinapi.appcore.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: coremessaging.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: twinapi.appcore.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: coremessaging.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: propsys.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: coreuicomponents.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: coreuicomponents.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: coremessaging.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: ntmarta.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: languageoverlayutil.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: bcp47mrm.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: windows.ui.xaml.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: bcp47langs.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: iertutil.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: dcomp.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: windows.ui.immersive.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: profapi.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: urlmon.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: netutils.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: dxgi.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: d3d11.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: dwrite.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: d3d10warp.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: windows.globalization.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: dxcore.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: d2d1.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: textshaping.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: windows.ui.xaml.controls.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: fontglyphanimator.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: dwmapi.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: windows.internal.ui.logon.proxystub.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: directmanipulation.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: credprovdatamodel.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: credprovhost.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: samcli.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: credprovs.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: cryptsp.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: smartcardcredentialprovider.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: credprovslegacy.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: cngcredui.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: facecredentialprovider.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: winhttp.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: dsreg.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: msvcp110_win.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: windows.devices.enumeration.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: structuredquery.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: biocredprov.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: ngckeyenum.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: ncrypt.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: ntasn1.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: cxcredprov.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: ngccredprov.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: certcredprovider.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: wlidcredprov.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: fidocredprov.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: aadauthhelper.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: wkscli.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: cryptngc.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: devobj.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: icu.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: credprov2fahelper.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: mswb7.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: credprovhelper.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: wtsapi32.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: winsta.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: idstore.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: samlib.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: policymanager.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: winbio.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: devdispitemprovider.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: windows.media.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: windowscodecs.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: threadpoolwinrt.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: webauthn.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: ninput.dll
Source: C:\Windows\System32\CredentialUIBroker.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A6FF50C0-56C0-71CA-5732-BED303A59628}\InProcServer32
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
Source: C:\Windows\System32\CredentialUIBroker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\CredentialUIBroker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\CredentialUIBroker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\CredentialUIBroker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\CredentialUIBroker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\CredentialUIBroker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\CredentialUIBroker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\CredentialUIBroker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\CredentialUIBroker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\CredentialUIBroker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\CredentialUIBroker.exe TID: 8028Thread sleep count: 36 > 30
Source: C:\Windows\System32\CredentialUIBroker.exeQueries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Windows\System32\CredentialUIBroker.exeQueries volume information: C:\Windows\Fonts\segmdl2.ttf VolumeInformation
Source: C:\Windows\System32\CredentialUIBroker.exeQueries volume information: C:\Windows\Fonts\segoeuisl.ttf VolumeInformation
Source: C:\Windows\System32\CredentialUIBroker.exeQueries volume information: C:\Windows\SystemResources\Windows.UI.BioFeedback\Fonts\NUIMDL2.ttf VolumeInformation
Source: C:\Windows\System32\CredentialUIBroker.exeQueries volume information: C:\Windows\SystemResources\Windows.UI.BioFeedback\Fonts\NUIMDL2.ttf VolumeInformation
Source: C:\Windows\System32\CredentialUIBroker.exeQueries volume information: C:\Windows\SystemResources\Windows.UI.BioFeedback\Fonts\NUIMDL2.ttf VolumeInformation
Source: C:\Windows\System32\CredentialUIBroker.exeQueries volume information: C:\Windows\SystemResources\Windows.UI.BioFeedback\Fonts\NUIMDL2.ttf VolumeInformation
Source: C:\Windows\System32\CredentialUIBroker.exeQueries volume information: C:\Windows\Fonts\segoeuisl.ttf VolumeInformation
Source: C:\Windows\System32\CredentialUIBroker.exeQueries volume information: C:\Windows\SystemResources\Windows.UI.BioFeedback\Fonts\NUIMDL2.ttf VolumeInformation
Source: C:\Windows\System32\CredentialUIBroker.exeQueries volume information: C:\Windows\SystemResources\Windows.UI.BioFeedback\Fonts\NUIMDL2.ttf VolumeInformation
Source: C:\Windows\System32\CredentialUIBroker.exeQueries volume information: C:\Windows\SystemResources\Windows.UI.BioFeedback\Fonts\NUIMDL2.ttf VolumeInformation
Source: C:\Windows\System32\CredentialUIBroker.exeQueries volume information: C:\Windows\SystemResources\Windows.UI.BioFeedback\Fonts\NUIMDL2.ttf VolumeInformation
Source: C:\Windows\System32\CredentialUIBroker.exeQueries volume information: C:\Windows\SystemResources\Windows.UI.BioFeedback\Fonts\NUIMDL2.ttf VolumeInformation
Source: C:\Windows\System32\CredentialUIBroker.exeQueries volume information: C:\Windows\SystemResources\Windows.UI.BioFeedback\Fonts\NUIMDL2.ttf VolumeInformation
Source: C:\Windows\System32\CredentialUIBroker.exeQueries volume information: C:\Windows\SystemResources\Windows.UI.BioFeedback\Fonts\NUIMDL2.ttf VolumeInformation
Source: C:\Windows\System32\CredentialUIBroker.exeQueries volume information: C:\Windows\SystemResources\Windows.UI.BioFeedback\Fonts\NUIMDL2.ttf VolumeInformation
Source: C:\Windows\System32\CredentialUIBroker.exeQueries volume information: C:\Windows\Fonts\segoeuisl.ttf VolumeInformation
Source: C:\Windows\System32\CredentialUIBroker.exeQueries volume information: C:\Windows\Fonts\segoeuisl.ttf VolumeInformation
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation1
DLL Side-Loading
1
Process Injection
1
Masquerading
OS Credential Dumping1
Virtualization/Sandbox Evasion
Remote ServicesData from Local System2
Encrypted Channel
Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/Job1
Registry Run Keys / Startup Folder
1
DLL Side-Loading
1
Virtualization/Sandbox Evasion
LSASS Memory11
System Information Discovery
Remote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol
Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
Registry Run Keys / Startup Folder
1
Process Injection
Security Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive2
Application Layer Protocol
Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
DLL Side-Loading
NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand
No Antivirus matches
No Antivirus matches
No Antivirus matches
SourceDetectionScannerLabelLink
human-resources-support.com7%VirustotalBrowse
dual-spo-0005.spo-msedge.net0%VirustotalBrowse
part-0039.t-0009.t-msedge.net0%VirustotalBrowse
aadcdn.msauthimages.net0%VirustotalBrowse
identity.nel.measure.office.net0%VirustotalBrowse
aadcdn.msftauth.net0%VirustotalBrowse
login.microsoftonline.com0%VirustotalBrowse
sni1gl.wpc.upsiloncdn.net0%VirustotalBrowse
part-0017.t-0009.t-msedge.net0%VirustotalBrowse
cs1100.wpc.omegacdn.net0%VirustotalBrowse
www.google.com0%VirustotalBrowse
autologon.microsoftazuread-sso.com1%VirustotalBrowse
aadcdn.msftauthimages.net0%VirustotalBrowse
SourceDetectionScannerLabelLink
file:///C:/Users/user/Desktop/Overview%202023.html0%Avira URL Cloudsafe
NameIPActiveMaliciousAntivirus DetectionReputation
human-resources-support.com
104.21.14.104
truetrueunknown
part-0039.t-0009.t-msedge.net
13.107.213.67
truefalseunknown
dual-spo-0005.spo-msedge.net
13.107.136.10
truefalseunknown
part-0017.t-0009.t-msedge.net
13.107.246.45
truefalseunknown
cs1100.wpc.omegacdn.net
152.199.23.37
truefalseunknown
sni1gl.wpc.upsiloncdn.net
152.199.21.175
truefalseunknown
www.google.com
172.217.18.4
truefalseunknown
autologon.microsoftazuread-sso.com
20.190.159.4
truefalseunknown
aadcdn.msauthimages.net
unknown
unknownfalseunknown
identity.nel.measure.office.net
unknown
unknownfalseunknown
cityofcasey.sharepoint.com
unknown
unknownfalse
    unknown
    aadcdn.msftauth.net
    unknown
    unknownfalseunknown
    login.microsoftonline.com
    unknown
    unknownfalseunknown
    aadcdn.msftauthimages.net
    unknown
    unknownfalseunknown
    NameMaliciousAntivirus DetectionReputation
    file:///C:/Users/user/Desktop/Overview%202023.htmlfalse
    • Avira URL Cloud: safe
    unknown
    https://login.microsoftonline.com/44a02942-4e5b-420a-8bc4-f60b91281f2e/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=5828F8E49253831767947AE071B3E87258ADFC014E4999A9%2D55C8F59085C63035BFB726C440F8504875B7C3CEE0797D357F7E758A1D8EB4F6&redirect%5Furi=https%3A%2F%2Fcityofcasey%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=99af2ba1%2De065%2D3000%2D5c13%2Df041b6990b02false
      unknown
      https://login.microsoftonline.com/44a02942-4e5b-420a-8bc4-f60b91281f2e/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=5828F8E49253831767947AE071B3E87258ADFC014E4999A9%2D55C8F59085C63035BFB726C440F8504875B7C3CEE0797D357F7E758A1D8EB4F6&redirect%5Furi=https%3A%2F%2Fcityofcasey%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=99af2ba1%2De065%2D3000%2D5c13%2Df041b6990b02&sso_reload=truefalse
        unknown
        • No. of IPs < 25%
        • 25% < No. of IPs < 50%
        • 50% < No. of IPs < 75%
        • 75% < No. of IPs
        IPDomainCountryFlagASNASN NameMalicious
        142.250.184.195
        unknownUnited States
        15169GOOGLEUSfalse
        1.1.1.1
        unknownAustralia
        13335CLOUDFLARENETUSfalse
        13.107.136.10
        dual-spo-0005.spo-msedge.netUnited States
        8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
        40.126.32.140
        unknownUnited States
        8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
        95.101.54.121
        unknownEuropean Union
        34164AKAMAI-LONGBfalse
        13.107.246.45
        part-0017.t-0009.t-msedge.netUnited States
        8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
        13.107.246.67
        unknownUnited States
        8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
        172.217.18.4
        www.google.comUnited States
        15169GOOGLEUSfalse
        173.194.76.84
        unknownUnited States
        15169GOOGLEUSfalse
        142.250.185.110
        unknownUnited States
        15169GOOGLEUSfalse
        20.190.159.64
        unknownUnited States
        8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
        20.190.159.75
        unknownUnited States
        8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
        104.21.14.104
        human-resources-support.comUnited States
        13335CLOUDFLARENETUStrue
        142.250.186.106
        unknownUnited States
        15169GOOGLEUSfalse
        40.126.32.76
        unknownUnited States
        8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
        13.107.213.45
        unknownUnited States
        8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
        13.107.213.67
        part-0039.t-0009.t-msedge.netUnited States
        8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
        20.190.159.4
        autologon.microsoftazuread-sso.comUnited States
        8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
        239.255.255.250
        unknownReserved
        unknownunknownfalse
        152.199.21.175
        sni1gl.wpc.upsiloncdn.netUnited States
        15133EDGECASTUSfalse
        142.250.184.227
        unknownUnited States
        15169GOOGLEUSfalse
        216.58.212.174
        unknownUnited States
        15169GOOGLEUSfalse
        IP
        192.168.2.16
        Joe Sandbox version:40.0.0 Tourmaline
        Analysis ID:1446965
        Start date and time:2024-05-24 06:11:44 +02:00
        Joe Sandbox product:CloudBasic
        Overall analysis duration:
        Hypervisor based Inspection enabled:false
        Report type:full
        Cookbook file name:defaultwindowsinteractivecookbook.jbs
        Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
        Number of analysed new started processes analysed:18
        Number of new started drivers analysed:0
        Number of existing processes analysed:0
        Number of existing drivers analysed:0
        Number of injected processes analysed:0
        Technologies:
        • EGA enabled
        Analysis Mode:stream
        Analysis stop reason:Timeout
        Sample name:Overview 2023.html
        Detection:MAL
        Classification:mal48.winHTML@19/31@30/222
        Cookbook Comments:
        • Found application associated with file extension: .html
        • Exclude process from analysis (whitelisted): dllhost.exe
        • Excluded IPs from analysis (whitelisted): 142.250.184.227, 142.250.185.110, 173.194.76.84, 34.104.35.123
        • Excluded domains from analysis (whitelisted): clients2.google.com, accounts.google.com, edgedl.me.gvt1.com, clientservices.googleapis.com, clients.l.google.com, 195493-ipv4v6e.farm.dprodmgd106.sharepointonline.com.akadns.net
        • Not all processes where analyzed, report is missing behavior information
        • Report size getting too big, too many NtOpenKeyEx calls found.
        • Report size getting too big, too many NtProtectVirtualMemory calls found.
        • Report size getting too big, too many NtQueryValueKey calls found.
        InputOutput
        URL: file:///C:/Users/user/Desktop/Overview%202023.html Model: Perplexity: mixtral-8x7b-instruct
        {
        "loginform": false,
        "reasons": [
        "No form fields for username or password are present in the text.",
        "No submit button for the form is present in the text.",
        "The text contains a link to load the page, but no login form elements are present."
        ]
        }
        Loadmg page. Click here if your page does not load automatically= 
        URL: https://login.microsoftonline.com/44a02942-4e5b-420a-8bc4-f60b91281f2e/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D00 Model: gpt-4o
        ```json
        {
          "riskscore": 1,
          "reasons": "The JavaScript code appears to be part of a legitimate configuration for a Microsoft authentication process. The URLs and parameters are consistent with Microsoft's OAuth2 authorization flow. There are no obvious signs of malicious activity such as obfuscated code, suspicious external scripts, or attempts to steal user credentials. The presence of long random hexadecimal strings is noted but not considered a risk. The risk score is set to 1 due to the inherent risk in handling authentication data, but no specific malicious behavior is detected."
        }
        //<![CDATA[
        $Config={"iMaxStackForKnockoutAsyncComponents":10000,"fShowButtons":true,"urlCdn":"https://aadcdn.msauth.net/shared/1.0/","urlDefaultFavicon":"https://aadcdn.msauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico","urlPost":"/44a02942-4e5b-420a-8bc4-f60b91281f2e/oauth2/authorize?client_id=00000003-0000-0ff1-ce00-000000000000\u0026response_mode=form_post\u0026response_type=code+id_token\u0026resource=00000003-0000-0ff1-ce00-000000000000\u0026scope=openid\u0026nonce=5828F8E49253831767947AE071B3E87258ADFC014E4999A9-55C8F59085C63035BFB726C440F8504875B7C3CEE0797D357F7E758A1D8EB4F6\u0026redirect_uri=https%3a%2f%2fcityofcasey.sharepoint.com%2f_forms%2fdefault.aspx\u0026state=OD0w\u0026claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d\u0026wsucxt=1\u0026cobrandid=11bd8083-87e0-41b5-bb78-0bc43c8a8e8a\u0026client-request-id=99af2ba1-e065-3000-5c13-f041b6990b02\u0026sso_reload=True","iPawnIcon":0,"sPOST_Username":"","sFTName":"flowToken","dynamicTenantBranding":null,"staticTenantBranding":null,"oAppCobranding":{},"iBackgroundImage":2,"fApplicationInsightsEnabled":false,"iApplicationInsightsEnabledPercentage":0,"urlSetDebugMode":"https://login.microsoftonline.com/common/debugmode","fEnableCssAnimation":true,"fAllowGrayOutLightBox":true,"fIsRemoteNGCSupported":true,"desktopSsoConfig":{"isEdgeAnaheimAllowed":true,"iwaEndpointUrlFormat":"https://autologon.microsoftazuread-sso.com/{0}/winauth/sso?client-request-id=99af2ba1-e065-3000-5c13-f041b6990b02","iwaSsoProbeUrlFormat":"https://autologon.microsoftazuread-sso.com/{0}/winauth/ssoprobe?client-request-id=99af2ba1-e065-3000-5c13-f041b6990b02","iwaIFrameUrlFormat":"https://autologon.microsoftazuread-sso.com/{0}/winauth/iframe?client-request-id=99af2ba1-e065-3000-5c13-f041b6990b02\u0026isAdalRequest=False","iwaRequestTimeoutInMs":10000,"startDesktopSsoOnPageLoad":false,"progressAnimationTimeout":10000,"isEdgeAllowed":false,"minDssoEdgeVersion":"17","isSafariAllowed":true,"redirectUri":"","isIEAllowedForSsoProbe":true,"edgeRedirectUri":"https://autologon.microsoftazuread-sso.com/common/winauth/sso/edgeredirect?client-request-id=99af2ba1-e065-3000-5c13-f041b6990b02\u0026origin=login.microsoftonline.com\u0026is_redirected=1","isFlowTokenPassedInEdge":true},"iSessionPullType":2,"fUseSameSite":true,"isGlobalTenant":true,"uiflavor":1001,"fOfflineAccountVisible":false,"fEnableUserStateFix":true,"fShowAccessPassPeek":true,"fUpdateSessionPollingLogic":true,"fEnableShowPickerCredObservable":true,"fFetchSessionsSkipDsso":true,"fUseNonMicrosoftDefaultBrandingForCiam":true,"fRemoveCustomCss":true,"fFixUICrashForApiRequestHandler":true,"fShowUpdatedKoreanPrivacyFooter":true,"fUsePostCssHotfix":true,"fUseHighContrastOverrides":true,"fFixUserFlowBranding":true,"scid":1013,"hpgact":1800,"hpgid":6,"apiCanary":"PAQABDgEAAADnfolhJpSnRYB1SVj-Hgd89J5EWm2sbUQMP9kr0w_fwd8OxgaA3W933btdB2C0NTUl0IMZnsiMojGjmEDoWUt25VNtbgKqoASEss5SIMXtj85hE7wBFpaX90kG_km2etRn_b4uTIwYaFZSnB
        URL: https://login.microsoftonline.com/44a02942-4e5b-420a-8bc4-f60b91281f2e/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D00 Model: gpt-4o
        ```json
        {
          "riskscore": 1,
          "reasons": "The provided JavaScript code appears to be handling error and success events for resources loaded from a CDN. It does not exhibit any malicious behavior such as data exfiltration, credential theft, or unauthorized access. The risk is minimal."
        }
        //<![CDATA[
        !function(t,e){!function(){var n=e.getElementsByTagName("head")[0];n&&n.addEventListener&&(n.addEventListener("error",function(e){null!==e.target&&"cdn"===e.target.getAttribute("data-loader")&&t.$Loader.OnError(e.target)},!0),n.addEventListener("load",function(e){null!==e.target&&"cdn"===e.target.getAttribute("data-loader")&&t.$Loader.OnSuccess(e.target)},!0))}()}(window,document);
        //  
        URL: https://login.microsoftonline.com/44a02942-4e5b-420a-8bc4-f60b91281f2e/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D00 Model: gpt-4o
        ```json
        {
          "riskscore": 3,
          "reasons": "The code attempts to prevent the page from being loaded in an iframe unless explicitly allowed by a configuration setting. This behavior is generally used to prevent clickjacking attacks, which is a legitimate security measure. However, it also manipulates the URL by adding a session ID, which could potentially be used for tracking or session fixation attacks if not implemented securely. Overall, the risk is low but not entirely negligible."
        }
        //<![CDATA[
        !function(){var e=window,o=e.document,i=e.$Config||{};if(e.self===e.top){o&&o.body&&(o.body.style.display="block")}else if(!i.allowFrame){var s=e.self.location.href,l=s.indexOf("#"),n=-1!==l,t=s.indexOf("?"),f=n?l:s.length,d=-1===t||n&&t>l?"?":"&";s=s.substr(0,f)+d+"iframe-request-id="+i.sessionId+s.substr(f),e.top.location=s}}();
        //  
        URL: https://login.microsoftonline.com/44a02942-4e5b-420a-8bc4-f60b91281f2e/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D0000000 Model: gpt-4o
        ```json
        {
          "phishing_score": 2,
          "brands": "Microsoft",
          "phishing": false,
          "suspicious_domain": false,
          "has_loginform": true,
          "has_captcha": false,
          "setechniques": false,
          "reasons": "The URL is using the legitimate Microsoft domain 'login.microsoftonline.com', which is commonly used for Microsoft services authentication. The login page appears to be legitimate and matches the typical design of Microsoft's login pages. There are no obvious signs of social engineering techniques or suspicious elements in the URL or the image."
        }
        URL: https://login.microsoft.com/44a02942-4e5b-420a-8bc4-f60b91281f2e/fido/get?uiflavor=Web Model: gpt-4o
        ```json
        {
          "riskscore": 0,
          "reasons": "The JavaScript code appears to be part of a legitimate login process for Microsoft services. It includes configuration settings for login modes, FIDO challenges, cookie domains, and various URLs related to Microsoft's authentication services. There are no indications of malicious behavior such as data exfiltration, credential stealing, or unauthorized access attempts. The presence of long random hexadecimal strings is typical for secure authentication processes and does not pose a risk."
        }
        //<![CDATA[
        $Config={"iLoginMode":111,"sFidoChallenge":"O.eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6IkwxS2ZLRklfam5YYndXYzIyeFp4dzFzVUhIMCJ9.eyJhdWQiOiJ1cm46bWljcm9zb2Z0OmZpZG86Y2hhbGxlbmdlIiwiaXNzIjoiaHR0cHM6Ly9sb2dpbi5taWNyb3NvZnQuY29tIiwiaWF0IjoxNzE2NTIzOTY5LCJuYmYiOjE3MTY1MjM5NjksImV4cCI6MTcxNjUyNDI2OX0.ezkel9c0FoDlmxZLCJ133wNBbmiqWlrCUrw0yZJTRBLwBAQ5nw7t7k7B8vL9Bd2ln5Ld2ZntxFd2KteSe1TLe9Hga7oNaOhwPVnC7A2kC2YGDCviZFKqWiAM0vVPXSlMpskWOiGkDQ0KgjyElDEyyhmfn7BAshflz_XSoWnIpv_p72iy-gWuDF8PzV_ePh8WffSPBQowIdygMOVUbKLnNlFhDjlbcynVMFS2mEoICLIZb2bSgMzHnXrbsyXuaNBQ7bGOnBewAPZdRx_A51wRgkXGOSOtD23Jb4E3nMKN0P8cQY_rOv0G-9pPEreeZrhvU3DhZ802sAWxpLgDKyJQWQ","sCookieDomain":"login.microsoft.com","sCrossDomainCanary":"PAQABDgEAAADnfolhJpSnRYB1SVj-Hgd8KhuObjF2PAoBl7uaKwmbZXtUGz-xNBI0jMJ-8wIBO83YiRZbRDts-af5OgLrtw4RZ1o1Q73cdoOcv0Up1t0HEF80pI5zsC-BYO26i-fGu8bJObKdZ2JHihyH_FktyjGx2MzvR2NdjTIzkxeYj273hL696ib7GcvDwHZHp_6J8tiOrldA-7HSyoUPL45VdizIqD2dAvXmEnovAeYtBWpq3yAA","fShowConfirm":false,"fFidoUseAllowedIdentities":true,"fIsPasskey":true,"iAllowedIdentities":2,"fHideLoginPageForCredUI":true,"iMaxStackForKnockoutAsyncComponents":10000,"fShowButtons":true,"fAllowCancel":true,"urlCdn":"https://aadcdn.msauth.net/shared/1.0/","urlDefaultFavicon":"https://aadcdn.msauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico","urlFooterTOU":"https://www.microsoft.com/en-US/servicesagreement/","urlFooterPrivacy":"https://privacy.microsoft.com/en-US/privacystatement","urlPost":"https://login.microsoftonline.com/44a02942-4e5b-420a-8bc4-f60b91281f2e/login","urlPostAad":"https://login.microsoftonline.com/44a02942-4e5b-420a-8bc4-f60b91281f2e/login","urlPostMsa":"https://login.live.com/ppsecure/partnerpost.srf?scope=openid+profile+email+offline_access\u0026response_type=code\u0026client_id=51483342-085c-4d86-bf88-cf50c7252078\u0026response_mode=form_post\u0026redirect_uri=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2ffederation%2foauth2msa\u0026state=rQQIARAAnVE_TBNhHL3rlUpLgQYdHMmFCbze99191--7Jgy96x0KlSoiKmqa-_OdnFx7pXeFVsLixGLCCoOJjCwSY4xhMroxMTM5EgZDjAOJi21cHIlveHnDy8v7vd8kB_OwOAH-Qhb6LADPg4JD--oftMYyuXdT73fpdwY8u35R-rQ7lNhj07XAX6d5J6wfsIWVOG5GRVF0_Lgbeo4V0W4-WrFatBn6jbhvEmte2KpHoks9qx3EeStqdj6z7AnLnrHsQWJNIRIxiYFUSZGJDHEBqwiXDIChJhsESwoplU0dQNSzqGpJFRRFJ6aiAqLoBRnIimZqWCroCAGTKAARrGhYl3WjF6HisqxgExu4lwLLxNCQWThNjFZL7XhF6lPY8l_Rn4l0v2OtGUbxHpeslsHGAXelhT5wEwhZQFKRJCCq2AKSgCUQ20GCVwC2CiUCPYkec6mwSRu-e5Jkz5NZwBUHBzM55iYzzlwm2f2B3s7jCyMfv23fuLsPhysJAzLHA-LSAtb8yvLDB7Oz1XmPlgO70pl_MeNOVSAQ9bmguqwr5upUtyltTKMi3EmxO6nUUSo9yOUYntPvwYsUu32NOUr_55dOhtjDLHuahZm0E9otq-H67tgEhLZLAJEFgikQELQVwbYxEUDvaNkhFqHEOs2iTMoJLL8ejU1u8r5bi8NV2uCLm3ynHtUcp6_WraBNI774lO9V5Z9vbW29Hr5S-pdh5nJk-83Z19-_3v64fT56ax3MBwQvzi3eKT3pzuA5y37ccZYfvWxKsC2798U1aKrY1DyyujF9mGP-AA2\u0026flow=fido\u0026estsfed=1\u0026uaid=99af2ba1e06530005c13f041b6990b02\u0026cobrandid=11bd8083-87e0-41b5-bb78-0bc43c8a8e8a\u0026fci=00000003-0000-0ff1-ce00-000000000000\u0026wsucxt=1","urlCancel":"https://login.microso
        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri May 24 03:12:15 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
        Category:dropped
        Size (bytes):2673
        Entropy (8bit):3.991619595192481
        Encrypted:false
        SSDEEP:
        MD5:03EFFABCDEE684E2A1D23B6A69B2DD7D
        SHA1:B5741ED1128CBB11A045B302BBF13C78FF32CB87
        SHA-256:B9008F4BA6D9FD9BA70294D6D587BB5BD6B6E0AF83C4309FAD2CA41F850594C7
        SHA-512:3AFF6435EF931A58EE2C93304006EBCB3A3EAECBD307D8D16706D93F20C464E369C627AC496E31813CE7825C50B65E26D356E4C3EE0362896446F96469266199
        Malicious:false
        Reputation:unknown
        Preview:L..................F.@.. ...$+.,....H^;.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X}!....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.!....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.!....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.!..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.!...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........d'.o.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri May 24 03:12:14 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
        Category:dropped
        Size (bytes):2675
        Entropy (8bit):4.006174834472832
        Encrypted:false
        SSDEEP:
        MD5:A60E620D9D8396136FB4148C367FF00B
        SHA1:AD62E93D6A37916BE7EEAD28E7F9E0DB79B8E5C2
        SHA-256:F38666FEEC2C37BCE674EC034AB66A9E0795C3ED30EDDE41699591D88E650A3E
        SHA-512:A98BCA498ED7BF776375F08AC5E27F8D63E2D03B3AA43375703783BD416ADBE403AA3D12626A26A2861418ECB86CAF22A241CB2ABF51551CFE018729E2984BAA
        Malicious:false
        Reputation:unknown
        Preview:L..................F.@.. ...$+.,.....e......N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X}!....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.!....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.!....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.!..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.!...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........d'.o.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
        Category:dropped
        Size (bytes):2689
        Entropy (8bit):4.014045840629895
        Encrypted:false
        SSDEEP:
        MD5:D4DBC847243BA729CB3C385FD47F6841
        SHA1:8E552644B475A5C58C1E24F6350A3629A5433ECD
        SHA-256:C1E574DDE85B5E91E6A4F4409477A3D2857717B02847023AFE88E2FF116641C6
        SHA-512:7FA0C1547AFC462DCBB7CDB206CC122D73129D39CC85BEE2A5AF8CEB0AB66CB17646532CAE2E1097F0495AC646B229FE1B4C99B32FF094228CBDA4E4E2E3144D
        Malicious:false
        Reputation:unknown
        Preview:L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X}!....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.!....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.!....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.!..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........d'.o.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri May 24 03:12:14 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
        Category:dropped
        Size (bytes):2677
        Entropy (8bit):4.003332932382523
        Encrypted:false
        SSDEEP:
        MD5:3356B03AA3976C180C501F021B608EDD
        SHA1:36E3AE5227C449475A767E95974B76581E1120F2
        SHA-256:0E98EA359A53A3CDC6506BED7E48A4C76A1D66DE9E074B34A4D31D80A788E453
        SHA-512:905330B23329C4194F0483BE67CACCC7BBF22F5E45034B4AE818DC9994FAA8101A4B70A041EF65B48D8DF08D6197E6C40EB1B14F86C3550E2489D41977405B31
        Malicious:false
        Reputation:unknown
        Preview:L..................F.@.. ...$+.,....Ar(.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X}!....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.!....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.!....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.!..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.!...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........d'.o.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri May 24 03:12:15 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
        Category:dropped
        Size (bytes):2677
        Entropy (8bit):3.991395913594514
        Encrypted:false
        SSDEEP:
        MD5:0C6EBD4F221978A3C2500CAB27486053
        SHA1:AAB9E373FD6BD42A8443894D3A2A0D11840886E2
        SHA-256:DE31775281E35205BD244786B966318A47B5D6A4DA7FFBF777D7EE06EA3BA0A7
        SHA-512:A355D60C8FB71CB17FA1079E8ED50CC5FC44D071D5169A6C4757824E963391D3BBD036BAC02BB202BBA3C3E187CA869941A7B0D8BC4E508D19FECB241A83A0D7
        Malicious:false
        Reputation:unknown
        Preview:L..................F.@.. ...$+.,....l.5.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X}!....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.!....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.!....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.!..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.!...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........d'.o.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri May 24 03:12:14 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
        Category:dropped
        Size (bytes):2679
        Entropy (8bit):4.005277378493323
        Encrypted:false
        SSDEEP:
        MD5:261ECF71EF01B662B9256A4480716A64
        SHA1:2E958FC93D7B69B774C5FCCB7ADE5236CA3A0D11
        SHA-256:8B9887966419D7FA026D64F6BC722C56AD4994A07C858B4620ACD4859AFD838C
        SHA-512:2418B886464EC5BD89303CB7D7BFD366335CD7210935E5F2BB4EC6715C29F94D9F156190B56E0BF1D3187E5599C34845126B77B64876A96FAEAC93357A67A359
        Malicious:false
        Reputation:unknown
        Preview:L..................F.@.. ...$+.,............N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X}!....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.!....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.!....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.!..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.!...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........d'.o.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
        File Type:gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 141517
        Category:downloaded
        Size (bytes):49700
        Entropy (8bit):7.9953719174254045
        Encrypted:true
        SSDEEP:
        MD5:70F41E2825096C0109C16E15593B48A7
        SHA1:EB04904BC3985DEDEF82758927AEE48CCB5E8861
        SHA-256:BA6F22450E11A48BAADB351384E3E768799F370F2A47865044A9AC5C428E4650
        SHA-512:EDC4782980EDB509B2D0DFF0F759554A61AF618D28C7CCADD1392A179CB6D2556E4A5124800516166667EA7D04F13E5808E93C1E80FFC55CE0057D381BC39552
        Malicious:false
        Reputation:unknown
        URL:https://aadcdn.msauth.net/shared/1.0/content/js/BssoInterrupt_Core_RY3pVDLvjU_KKLtTKxjDFA2.js
        Preview:............[.8.8...+.w..OL..hp._..nf.0$.......t....e .o?u.l.q.../g..J.T.*U.J..k.S......T.......T.~9:?.........h.........;?.L.......W..J.U.`.F.0r..W..o...$..+....O1N....(4...R..".r.F.s...C..j.o..J...3<.%. L.....G.M.%.Ee.x".<....?..8.$.H.........Uq#Q.ER..Qr..W..)k..3.........N....:.....:.e.`.\...V........p.[....n+.......Yu..o>N.n."z.&N......!+.W......s.6r.D.....{..q/.....*:z...3h....8.g31.....X...T*..a...W..Fsg....h..u.$.........>..7.p~;uch..+t...i.?..3...+.r6.A.*.....[g:..r.?S..............;.=6.&.`.....E=W.j.oaT}p..Vd.Np..\.i^[.....u'~..".M.:q.fF..._[..rM.F?....q.1.....S}.c_...\_./....y}6...._1-|p..l@..[q......*..k.?&.0^_.Cw:s.Rs^...IR5..Bv.yYX.....N.....O..epmF".GA...@...q..;...v`M.%3..#..,DMLTY+..g.........d+.>...{}.&N/..g-#FV.V.p.......Xs.(..{..]..-...!..F...XQge.X.MP.&.3....Re...b*23v..M.a...'......c.i...9...l..Z.`.F.._%>U.'.."..;.M......D$.}..~|....*u...ma.f:\......p..jy.<.r...cjG.N...{{}M_oEr8%...|.......d..nZ.S..H.Lx...x1t.
        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
        File Type:gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 35631
        Category:downloaded
        Size (bytes):9490
        Entropy (8bit):7.971088200340372
        Encrypted:false
        SSDEEP:
        MD5:0DC24D7782AC6B4E5F1259EE87E9852B
        SHA1:BA3EF74B0469536453BEC90093BC0B639DF83D94
        SHA-256:F158BF39BBB63AB4258F6827C05A82E7C9F3CE415529B40EA78045A9343ACF0F
        SHA-512:C915759DA7C4FDEF89CECED4F169A4F2929B80E3416FF4A5F70DBE0F40B5B12B01E8126CA11DC420B9EE43239DDE94539EC9CB2175E022A4FC589D4A56A45985
        Malicious:false
        Reputation:unknown
        URL:https://aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pcredentialpicker_218298df95fa9a8999b5.js
        Preview:...........}is.F.......M^C4.;..u9..x.X....3qJ..nH.(....5...;....QK.T...JD../........_....iG..>.k.....>~~....?.O......?.N..........gHs..4..L...f.4.......t.EYz..gB[f........:.b.^ic....!.k...d....->......5|?+.$-b&4.p9....\h...L.:...s.4O.B....%L....=...Lh.(.(.....v.-.....1.......D....q. .W.4.I.....D=...A+R.:])......t...<X...@.+VL[h.".D...-..&..#.......Z;.h.$......L....:.O..._,.......H.K.@.....\L+1...41.....4..k8....UgE..g._....*....5OW..........~t.i.....SI..v.....}zA..I..-..V.?..W..R?.?...v.z....*N8H.......(.........d.\.g._..~.o..E..!Vc..z2... j.dlN..>........>......9.B....D_.g0.O.'.Y`.;.#...S..'..>\..C,6.....R........@......ei...T?...C....tT._....e..,..._/.~.E..r..{P.....\?....5....h.n..(.G9D..\.r4.?..Rd.........,.........?..ho...+.T4.>.EI.b.....S.,%..<.K./h...}.,./.X\..F\.~..U....%....j.....c.^%.><G..qz...C.....G..c.c._bq....I:.?..G.i.Z.........3.;....G..].@.*[|/..D...B..{.W|...Gg..4;M./.....\.G.]....q...'..(.....r.E....W|.A.h.ZY.....C..*..."...
        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
        File Type:MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
        Category:downloaded
        Size (bytes):17174
        Entropy (8bit):2.9129715116732746
        Encrypted:false
        SSDEEP:
        MD5:12E3DAC858061D088023B2BD48E2FA96
        SHA1:E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
        SHA-256:90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
        SHA-512:C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
        Malicious:false
        Reputation:unknown
        URL:https://aadcdn.msauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico
        Preview:..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""
        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
        File Type:ASCII text, with no line terminators
        Category:downloaded
        Size (bytes):36
        Entropy (8bit):4.503258334775644
        Encrypted:false
        SSDEEP:
        MD5:06B313E93DD76909460FBFC0CD98CB6B
        SHA1:C4F9B2BBD840A4328F85F54873C434336A193888
        SHA-256:B4532478707B495D0BB1C21C314AEF959DD1A5E0F66E52DAD5FC332C8B697CBA
        SHA-512:EFD7E8195D9C126883C71FED3EFEDE55916848B784F8434ED2677DF5004436F7EDE9F80277CB4675C4DEB8F243B2705A3806B412FAA8842E039E9DC467C11645
        Malicious:false
        Reputation:unknown
        URL:https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISFwmCAmly1gHbXRIFDdFbUVISBQ1Xevf9?alt=proto
        Preview:ChgKDQ3RW1FSGgQIVhgCIAEKBw1Xevf9GgA=
        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
        File Type:gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 55363
        Category:downloaded
        Size (bytes):15917
        Entropy (8bit):7.983409467470452
        Encrypted:false
        SSDEEP:
        MD5:F07D184D2B5BE6DB50705B731C17B8C1
        SHA1:7A572FD1B8BFB6AAF588594ABE8C0F0B4DB2EB27
        SHA-256:4078957B47B4F5FBF07742A8CD693DBAE52D7902D09740DC25F3500B0C94F339
        SHA-512:BF4E6D480791A3EE071FF000EA2A4E5BD6006B1A2344F2FD388710712FDC045F8792D9E2B0CB5F620CA6C56F048A54BCD9792DD26437005F4A77A099F6D2EFCB
        Malicious:false
        Reputation:unknown
        URL:https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_vtf__v_j2jh3v2otg9k3lq2.js
        Preview:...........}Ms#G.....u...z |..#h........C)$....`/.n...p..8...;.j.|..G_|.O.........n..How......+++++3+3.w7k..{..R.=.......~....E.......O. ......7.U.Q..?~v.Y.w..;....*._...N...e.zpb'.....7k....|.a...((-...J...W.b..^..>..1...8.....GP...e.........9.s.FX.....n.~.9..l.....ug......a%^..P.(..(X.S...a.1.$t....d4.NF.._..=.n....k.....Ql..E.-\x.0.....N.......o./Bo.....f..1....;O..>....5....d...._..8..ET...A....L...O..7.z.O.^......s.O..h..V...|1..@....XL....o..X/by..q@..,......0.~$........._.......Z.._...~U).....j...C..0..C.M.&.?[<....zg..J7...SYO.KSzS...4.b........V..k.%.[.&....._z..2.|..xz............B......S....M...5nEs2..'..mq.|b.{...Pbi(...[_Lc.Z.....U`./{z......u..[,......P...[....L|..*.a!.!.t..........t*......w.......~.....].......0..(...C.....{....)..QL..X.E. ...c.I:.3_......y...yB........,.....D+.v.Q.VM~Y..........b~.b.E]c...<..[.....*$.Y.!.^.W........`[.S*...vb...)..P.?..p....F........)p..,`l...o@.;.x.....:..f.E....<0..#K\...K(?K/O
        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
        File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Pixelmator 3.8.2, datetime=2019:04:15 16:04:57], baseline, precision 8, 1420x1080, components 3
        Category:downloaded
        Size (bytes):297531
        Entropy (8bit):7.974342505107865
        Encrypted:false
        SSDEEP:
        MD5:90DC4504A2A150B83F6FD2EE5A684A80
        SHA1:193651BD9C62E9B12DCDF80FC145E14A98E719D1
        SHA-256:39A0FA0AA773E6F6E427FDDFE1A7CB8CD9C51F57F99E3368F3482B8F033C2947
        SHA-512:CD92F5C08BF49BC914FDF63C3FFDDFA94FCDB0D920DCF819F2ABD8A9F05390C4E4DE32D28580561D8C26B91AF97C647682B1C6EE2301F366978A304B277BCF63
        Malicious:false
        Reputation:unknown
        URL:https://aadcdn.msftauthimages.net/81d6b03a-lo-17j4if57xvhnqhzv8rv8ohj0b3c2jea2fjv9nm0/logintenantbranding/0/illustration?ts=636909063169586731
        Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Pixelmator 3.8.2..2019:04:15 16:04:57.................................................8....2017:02:14 15:04:19....,http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="XMP Core 5.4.0"> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmp:CreateDate="2017-02-14T15:04:19" xmp:ModifyDate="2019-04-15T16:04:57" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <dc:subject> <rdf:Bag/> </dc:subject> </rdf:Description> </rdf:RDF> </x:xmpmeta>
        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
        File Type:gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 15708
        Category:downloaded
        Size (bytes):5515
        Entropy (8bit):7.962207969099724
        Encrypted:false
        SSDEEP:
        MD5:36ECDA9D08A21DBDBFADCE2A9B5F0E19
        SHA1:5B94BD8CF0CB10F2B18EBE3057ADD73B1DD2D238
        SHA-256:05780B1268E4D1B6C254BC6D9084EBDD7594AC9C9C3EF31B9EF421C85ECB0B35
        SHA-512:ED4A1AE543EA92CDC789582803014516817B5A15BC5FC578264E34856D46A1602CDC1F6B8579CC8E5F6C9BFB8861037B9380082AEDEBB72609AF76B586342797
        Malicious:false
        Reputation:unknown
        URL:https://aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_7c1aa7609345f99e4914.js
        Preview:...........[}w.F....Bh..i3.M..OqU.....]...&9...P,$U#......HH..N..I...s...~..*.h....G...oz.U[...4.k<}.._.:.......7.6.|..s...ja......0...I...?.._...TK&\.....&B.=.`...\3..v.k'N.Z......7........'....7.......@pm..<...o8...a..p.h1.r......7.`..sM.D..q2QtXZ. S.Bn.v.....{....A.?..Db4.iM....@....I...."........M...st ....k...D..k!.cM2K...... ..6...X.m..s.1.S.$...r.`.y....1..$."...J.sOp+..M."..[..oOj....>:..jj.$......d2.X.pz.....>....._.W....B.]...@k.S........lp.:........nH.h.o........c....i...3.........g.fbb|.X..3{|]{]..!...,`.|.wpY.0.5Y....b|.....+.9)j6.c..s.....-".fvh.6...*....!.. t...\...~.c.a.3j=@3...3?aS.u!>..z..m....B.kpE_`.81a..'Z..&KlnI...N.vn.a........Y2.... a8..f...)...z"..{z..d ...\.A.."T...o.g#.@.G<..s...].pPt......2..H.........x..w....XN....t]l....8...kNO#.F..0(...[..,./Bp.5......F...}..;..=.Rq>.k..fM.u.sy...2'g~.P..Z.....>,.w..n?*J....O..[.Y.!..0...n.a.P.1W.....]F=f..I.>. 5....V..p..M...YoV.M..j.q.pF....'.I...Y...T..g..;L.
        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
        File Type:gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592
        Category:dropped
        Size (bytes):621
        Entropy (8bit):7.673946009263606
        Encrypted:false
        SSDEEP:
        MD5:4761405717E938D7E7400BB15715DB1E
        SHA1:76FED7C229D353A27DB3257F5927C1EAF0AB8DE9
        SHA-256:F7ED91A1DAB5BB2802A7A3B3890DF4777588CCBE04903260FBA83E6E64C90DDF
        SHA-512:E8DAC6F81EB4EBA2722E9F34DAF9B99548E5C40CCA93791FBEDA3DEBD8D6E401975FC1A75986C0E7262AFA1B9D1475E1008A89B92C8A7BEC84D8A917F221B4A2
        Malicious:false
        Reputation:unknown
        Preview:..........}UMo"1..+.....G; .8l...M..$.U.AW......UaX..`'.=......|..z3...Ms>..Y...QB..W..y..6.......?..........L.W=m....=..w.)...nw...a.z......#.y.j...m...P...#...6....6.u.u...OF.V..07b..\...s.f..U..N..B...>.d.-z..x.2..Lr.Rr)....JF.z.;Lh.....q.2.A....[.&".S..:......]........#k.U#57V..k5.tdM.j.9.FMQ2..H:.~op..H.......hQ.#...r[.T.$.@........j.xc.x0..I.B:#{iP1.e'..S4.:...mN.4)<W.A.).g.+..PZ&.$.#.6v.+.!...x*...}.._...d...#.Cb..(..^k..h!..7.dx.WHB......(.6g.7.Wwt.I<.......o.;.....Oi$}f.6.....:P..!<5.(.p.e.%et.)w8LA.l9r..n.....?.F.DrK...H....0F...{.,.......{E.."....*...x.@..?u......../....8...
        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
        File Type:GIF image data, version 89a, 352 x 3
        Category:dropped
        Size (bytes):3620
        Entropy (8bit):6.867828878374734
        Encrypted:false
        SSDEEP:
        MD5:B540A8E518037192E32C4FE58BF2DBAB
        SHA1:3047C1DB97B86F6981E0AD2F96AF40CDF43511AF
        SHA-256:8737D721808655F37B333F08A90185699E7E8B9BDAAA15CDB63C8448B426F95D
        SHA-512:E3612D9E6809EC192F6E2D035290B730871C269A267115E4A5515CADB7E6E14E3DD4290A35ABAA8D14CF1FA3924DC76E11926AC341E0F6F372E9FC5434B546E5
        Malicious:false
        Reputation:unknown
        Preview:GIF89a`.........iii!.......!.&Edited with ezgif.com online GIF maker.!..NETSCAPE2.0.....,....`.....6......P.l.......H....I..:qJ......k....`BY..L*..&...!.......,....`.....9..i....Q4......H..j.=.k9-5_..........j7..({.........!.......,....`.....9.......trV.......H....`.[.q6......>.. .CZ.&!.....M...!.......,....`.....8..........:......H..jJ..U..6_....../.el...q.)...*..!.......,....`.....9.....i..l.go.....H..*".U...f......._......5......n..!.......,....`.....:..i......./.....H...5%.kE/5.........In.a..@&3.....J...!.......,....`.....9.......kr.j.....H..*.-.{Im5c..............@&.........!.......,....`.....9.........j..q....H...].&..\.5.........8..S..........!.......,....`.....9.......3q.g..5....H...:u..............Al..x.q.........!.......,....`.....9......\.F....z....H...zX...ov.........h3N.x4......j..!.......,....`.....9........Q.:......H....y..^...1.........n.!.F......E...!.......,....`.....8.........i,......H....*_.21.I.........%...
        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
        File Type:gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113657
        Category:downloaded
        Size (bytes):35807
        Entropy (8bit):7.994448207898337
        Encrypted:true
        SSDEEP:
        MD5:FCF71472EFC9E614B10DFD499805F729
        SHA1:CF1FA991F9F08068F8F5F4D188D741BF5C2B7722
        SHA-256:23FF9B1A108B620EB12123003F37200042B120F3A554D3772B55F6366BDD4652
        SHA-512:B01F793C888C512F4BD1252EBA17A30C16BE3EC5E5A48BBBDD8F724EDCAEB2FD810439050A3097C27DAFDD1DE9235B39B7CF45D5341CC43A942F3F529891F379
        Malicious:false
        Reputation:unknown
        URL:https://aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_ea3e62a2bdfb2b2ee8c8.js
        Preview:...........{..8.(.........,.-.......gglu.. .m..I....~..oRv......i.(....P(......k............o.6>.|..d..........O...V..}.G..4......9.l..F.mDI.f.4...o,..EA.1...F1g..,...E..Gy...,No6.@..l....n..;....P.fQ...ty...b#I.(d.A2!j1$..m....6n.Q8.x..Y...b#c!....|.p..w#..F..i..s.Gc..b..9U.k......&@pJ..'40J......e.$.k.L(b...F.n.+..nO..6@n...A.&.,LVa......Y......V..o..% ....,......:..e.-XR. <FE.w..b..P......r.b.["~..!.....y.......V...4.;M..Y.X.{.......0].N..,.r`=...Mv....;...k....w.1p.q...(.u.3....;).. }...s....'....c...o.d....Ax.W..._...?.9..*.........3..MWI..3.p3..u.m$~Vo:n.'.8..!5h....y...6=7...hz.......f.-.).......Nc..:..u.g...~.8..4.....0P......$.=.a....#._..3.t..7Q...-....6..j.|...*.5-...B...}.VQ.&/.*..e.XeI.C../.y...{...1...Y..g..`'..F..h.o.]SHW...,..Ac_%y...M..u.O..U..`.&...Y.}....Tu..z..iv.....5..M.q.. .Bz.,..oSS.%..y.....gS1s.(.........%,fE.m.@~.4.........7.x.$0mQ..o....J.J^....~.....*.u!.~Z.iw.b...Q~).=..Tq.:.7HH.E.&6.D`.(..Cxmf.(o...^y_.v.{..K<Y.5.
        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
        File Type:gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 223759
        Category:downloaded
        Size (bytes):54318
        Entropy (8bit):7.995006031600911
        Encrypted:true
        SSDEEP:
        MD5:3F98A175D5232F665BEFFC23352D7176
        SHA1:8413FCCF22CEBAAED144736F5415F09EFD45CE48
        SHA-256:C6D80B97A3828280862163C72A94F5902F10D927FA1F6BDEAB5479B94F04F5AC
        SHA-512:93D0C9BBB7B204AE18A2392F137DC02B71A9E5352EC24267C2CEBAE5C286EEB68BCABF73F3F4B6DA1DF1D49E3998F6190D843144CD1ACDD5B4AA707CDF7CC24D
        Malicious:false
        Reputation:unknown
        URL:https://aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_8e14dcf0e3ff5580d170.js
        Preview:...........k{.F.0.}...gF.L."..eR..v.y.O....g...............~...@....f<...F./...u...;............x.y.C...y...sx.....^=}.....N.W.I.Y$.....".w....$..|..a...+.7O.eg.gW..2...8*..2)J..<^f.:.4..;....<}.....ZK.......5..,;iV&Q...9......;U:....$....DyVd....Q...N......N..".;.,//.8...X..ZP7......&shpA...a.I.C\U0i.&K..}m..1..9.N.u....^.'I/:......r...a^Ee.f..oq..e'..y..U..;...T(...<L..;X.."..8-}.^L.._w.....f.w..V.x.kK..K../.A..[....oE....G..ao0...\........Qv.7..eX..70.....|.s.}.#...:..t...$.}=....s..g.}Q..........SO.....p.%..v..|.Fo.. ..,e.......=;;..7....E.F8+7.K?.n.y'.rw.........x~...=?.?...z~.?....<...(H./.....V.*....yx.?.O.>l...E..c]..n.?..>......%<.....?....w........../.2.^...d........1b...4~.)\W....k-.n.0..._..8....qZ..^...D=...~..w...^g.........*.r.......d.O............a....R.)O.[v...C......2.....s..y...o6...6...z}8d....e<+..y.cs....X...v.O...p.....3.v.~D..IAo.<.....,H..9.xx....h.....B\.f.a.&..V...no"MJ.R...6...Y.....F<...9....s`..Q...X
        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
        File Type:gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1072
        Category:downloaded
        Size (bytes):501
        Entropy (8bit):7.533810358417031
        Encrypted:false
        SSDEEP:
        MD5:BA297DB577E890A1F50C7F314593760A
        SHA1:D93F9FF0EFB410F657410C1F4CFA55B7BC13ABD5
        SHA-256:2B4308FBE02E743CE59DFED30712AA354299BC9357C2B81084BC325613283CD6
        SHA-512:7364B143ADD330317974EE1A92AA5D238FCD2013E30DD2CC568EA50A7DF856A6392BDFD07B59C79C34220C660338D6D40B48379C23E9CFFCD16626AFDF022601
        Malicious:false
        Reputation:unknown
        URL:https://aadcdn.msauth.net/shared/1.0/content/images/credentialoptions/cred_option_passkey_1500b2043f4d1698f9df6089f67559d7.svg
        Preview:..........}S=o.0....?..\...".P-..5C..Vm..m$....;G...(4...{...t.|.i.....s.v.~.....q.vz.........p...8v......w....e....O.OO....VJ.}......s.......:..)..p.R":dO%D.....0x.*;....*-..San......'....7.UQ....;....O..u.....f.....=..(.3..J.nX.A.*..|B.%.6..."p.E8.Y.u.RJ.P..WM.dkA.W..*P.a..........w.u<.6...<....R.&2..B*..S.bnX..H0....}.B.n..b.8.=..Z.cq./..+...:Z..1a..R7,>.`..p.....J.c.=g..<..(..*K.C.k...^7...>Gp.#$..x....w]x....:Z......./R.6.U.N6.v.,...Q.Zz.....:.5..'.B?..xuW........._V..'0...
        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
        File Type:gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 981
        Category:downloaded
        Size (bytes):542
        Entropy (8bit):7.5641293776931215
        Encrypted:false
        SSDEEP:
        MD5:7569D6C5B45AB123E5B8150BB2B3BF22
        SHA1:3BE25A250F736FF3B3D809466659E3422C0A3B1B
        SHA-256:AA5FEBD7CE526B29249A3D558B4D0CE0021BB4338EE729AD6377A6BE2DABCA3E
        SHA-512:CF6721B1B8647705FEF5D18B6A3B0CF7474C3E8667F14C1A013782DD3B21EBB08F6E32052A34B8554FCAA9FC83AF4748EE29ED078AE98154DD047B979A350BD2
        Malicious:false
        Reputation:unknown
        URL:https://aadcdn.msauth.net/shared/1.0/content/images/credentialoptions/cred_option_github_fa3dbea07d478da8facde73b44f90b02.svg
        Preview:..........uS..0.....J0x|w.....@.(q.*......;.ZU.....3W.j._...0.5....P........Z..yI..$......K...r.....f.....[.....u....x....:..r.._.....5...d..pM.f.2.|s9?..p.iP.sRi.-(.V.V...2..t.i.....`.$.X H...!(...W..[.. .<aJ*@..#.i....h.Z....!'2;Rm..0.`..W.FF..O.......'&....B.oi..:....T...'..j$p..Oo'bc.,......8z$...E...N..X......F..E.b+Hnb*B.k...<.3?O..'...<a....R..G.....8%...%q.,M.S...TT...|....F.D.(.RS.F)PF..t...C.w.].a...th.m1...f....|f.*.9%....C86...*..C.....,.4...}..0....s3..i..l.C......li.!..W......9\..&.x.......u....
        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
        File Type:gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1555
        Category:dropped
        Size (bytes):606
        Entropy (8bit):7.684173827328528
        Encrypted:false
        SSDEEP:
        MD5:E9D4DB013D5154BF5DEA07A86EFDC826
        SHA1:3EC26EF21230B139585C8A4DEE0EDACF21E645D9
        SHA-256:1647D03E091826087EA981A97D69434D47CFE518EA4D41B09C198954F25E5D0C
        SHA-512:4B0D3FF26B2F6433DFA1CD2E285073BC54C4040A4CEFF0C6AF3F32EA90729AF22C0EBF53277D7201C5D793D65AD64F2AD19A1BF3F31A0ED3695380128A5D76A5
        Malicious:false
        Reputation:unknown
        Preview:..........}TMo.A..+..u..x.+@JO\z..UB..i......3^.......[.g.,..........w...s.8..pv...u...U..y.<.V..}..._wc.|.o..?W..Lg#........p<n..r.-?.q.=...Y.!ANQ54....b..Ae0...\... .....Q.0.......2..~U.5.h..1o....<.G...C...jhZ.r..i.a*....19..$...[.!..+.2IW.....v.l....Y'.m'}%..I..{.\.0.d.D...X......cI].....7.k._..{|..\$...&..G..q.H...../.q......j....q..z.&.....X..sNp.N"1..h.`;j....q............C.....^...........j(. ..x.V....D.'.I...j@..(V.V.....!........!E.<..X-....R....U<.l.Qn.2..K.VP2UEtl#.,8..H..3..sp...(0.7....K...j..6.......M....p.E..d..((../..@.....&G...^.........z..............
        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
        File Type:GIF image data, version 89a, 352 x 3
        Category:downloaded
        Size (bytes):2672
        Entropy (8bit):6.640973516071413
        Encrypted:false
        SSDEEP:
        MD5:166DE53471265253AB3A456DEFE6DA23
        SHA1:17C6DF4D7CCF1FA2C9EFD716FBAE0FC2C71C8D6D
        SHA-256:A46201581A7C7C667FD42787CD1E9ADF2F6BF809EFB7596E61A03E8DBA9ADA13
        SHA-512:80978C1D262BC225A8BA1758DF546E27B5BE8D84CBCF7E6044910E5E05E04AFFEFEC3C0DA0818145EB8A917E1A8D90F4BAC833B64A1F6DE97AD3D5FC80A02308
        Malicious:false
        Reputation:unknown
        URL:https://aadcdn.msauth.net/shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif
        Preview:GIF89a`............!..NETSCAPE2.0.....!.......,....`.....6......P.l.......H....I..:qJ......k....`BY..L*..&...!.......,....0.............<....[.\K8j.tr.g..!.......,....3............^;.*..\UK.]\.%.V.c...!.......,....7........`....lo...[.a..*Rw~i...!.......,....;........h.....l.G-.[K.,_XA]..'g..!.......,....?........i.....g....Z.}..)..u...F..!.......,....C...............P.,nt^.i....Xq...i..!.......,....F...........{^b....n.y..i...\C.-...!.......,....H..............R...o....h.xV!.z#...!.......,"...L.............r.jY..w~aP(.......[i...!.......,(...N.............r....w.aP.j.'.)Y..S..!.......,....H.........`......hew..9`.%z.xVeS..!.......,5...A.........`...\m.Vmtzw.}.d.%...Q..!.......,9...=.........h......3S..s.-W8m...Q..!.......,A...5.........h.....N...:..!..U..!.......,H.............h....M.x...f.i.4..!.......,O...'.........i...tp......(..!.......,X.............j...@.x....!.......,].............j..L..3em..!.......,e.............`......!.......,n..............{i..!..
        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
        File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Pixelmator 3.8.2, datetime=2019:04:15 16:04:57], baseline, precision 8, 1420x1080, components 3
        Category:downloaded
        Size (bytes):278517
        Entropy (8bit):7.9732559961383656
        Encrypted:false
        SSDEEP:
        MD5:C417C7AD2333FB4AFB262A4B4AFA9B35
        SHA1:297B7EEC2CC5A1A20D8432504E2A6D1396545A79
        SHA-256:CDEFA74C15E5CDEFC2B2854A4117352F35FDEE15BBA694B49413B53CBE39B0FB
        SHA-512:C190CCF513C7220A774AB2991EED44065E0E4C78BAF64D1358E1798C9FA9C2D858D745B7491DD8B32A48E12651A23E831FB78C125766A54F739ABA4D5881B615
        Malicious:false
        Reputation:unknown
        URL:https://aadcdn.msauthimages.net/81d6b03a-lo-17j4if57xvhnqhzv8rv8ohj0b3c2jea2fjv9nm0/logintenantbranding/0/illustration?ts=636909063169586731
        Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Pixelmator 3.8.2..2019:04:15 16:04:57.................................................8....2017:02:14 15:04:19....,http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="XMP Core 5.4.0"> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmp:CreateDate="2017-02-14T15:04:19" xmp:ModifyDate="2019-04-15T16:04:57" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <dc:subject> <rdf:Bag/> </dc:subject> </rdf:Description> </rdf:RDF> </x:xmpmeta>
        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
        File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Pixelmator 3.8.2, datetime=2019:04:15 16:04:57], baseline, precision 8, 1420x1080, components 3
        Category:dropped
        Size (bytes):245751
        Entropy (8bit):7.9705989856768555
        Encrypted:false
        SSDEEP:
        MD5:1378EC11F00F48E69133A56CBE289E42
        SHA1:7E408E7E02B840F3EDDA2F86B271AB1D8BB3527B
        SHA-256:B749E02489BC6A2805485E50AE2757FBC24B10826844562E606CFD672A8BE758
        SHA-512:8C10B8CF34C3F209B6F30F6EF0B399C0A05B4573DB635E77A9DFB1B23EC6C56426414D42CAFBADF554EFAC106F5A94E4C6097B39C8F3B1511717286E2CDF2F1C
        Malicious:false
        Reputation:unknown
        Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Pixelmator 3.8.2..2019:04:15 16:04:57.................................................8....2017:02:14 15:04:19....,http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="XMP Core 5.4.0"> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmp:CreateDate="2017-02-14T15:04:19" xmp:ModifyDate="2019-04-15T16:04:57" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <dc:subject> <rdf:Bag/> </dc:subject> </rdf:Description> </rdf:RDF> </x:xmpmeta>
        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
        File Type:gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 11378
        Category:downloaded
        Size (bytes):3734
        Entropy (8bit):7.9514980165469655
        Encrypted:false
        SSDEEP:
        MD5:7056872A00E9A39D11A13913C7144DCE
        SHA1:D18634CA405E318D0CBE2D19142F3BB0BFBA0255
        SHA-256:888114309745DB56CB4D9FBAF5B0D6DA80AFF7B4BBD0A48BC4F93388C0BA8962
        SHA-512:B79C8972ED5461F7456EBE9B23362D78FD39CC3D69CB60717F091CD9899370D2E4BBA8A65E8E311AAAB379F288C92F76ACD18F9F91299134F62693037B2EB35F
        Malicious:false
        Reputation:unknown
        URL:https://aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pfido_558864fb64f904ceef2f.js
        Preview:...........Z}[.....B...{U.tmo...C......v[....J..X.,.R.w...vb'N`[G..[:::.w^...s...3i>...;{..rvH:o....9..AN.:G.....M..g.c...#..sc....!..=!#!].b2.....K1"j.H$....<V....qC.`'}r.J5!G....p....jOD.x.*...=F.....x.cF..g....7$'.".}E$....&q...-(q%#1S./...rX.....Xo...kr.~.}`...oP...1J@i\#.`b...1Cy.2.%.D$..s}x8 ..(........'..Jj.L.Q. ..%.`.(;a........."..v`8w ...PQ........Q.b%...h[......../...Z_bb<..~..z...6..RQlon...&=...M_$...At....7..N._.t.q..M..H@....a..y......9.g.~N..bC.....?...........M7.....;@(r*...?}6.(...O./?..[/.~.z...hH.y7v...i<5...-....6....L....L..'...._.z8.k....n&..v.....C`v&..c.:w1..=..~.>..X...GXoY.1I[Nb...*.?.,.g1...b...R.C.}.J.Y.A.\.Y........#.....{ .|0..$f...T...a...(p'....R........i?pvC#....,.0:D.P.c.A...c.=.....R.IG.....f!=w..+I{..?....<..D.....!....P..HE.qmK.k.R...9..D)..u>..a...=sj5.....c.=B.....k6../......:..Z.^...-...d5z..!..@..+'...S<.|...;..%.Y.E..6.......m+...I......1.1...y.....7..=...'.K...).o.......7x..#Y.....;..t.\........M..F...
        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
        File Type:HTML document, ASCII text, with very long lines (2345), with CRLF line terminators
        Category:downloaded
        Size (bytes):2347
        Entropy (8bit):5.290031538794594
        Encrypted:false
        SSDEEP:
        MD5:E86EF8B6111E5FB1D1665BCDC90888C9
        SHA1:994BF7651CB967CD9053056AF2D69ACB74DB7F29
        SHA-256:3410242720DE50B090D07A23AEE2DAD879B31D36F2615732962EC4CFA8A9D458
        SHA-512:2486B491681EE91A9CD1ECC9AA011A3FB34B48358C5D7A4D503A5357BC5CE4CA22999F918D40AC60A3063940D5F326FC7E4E5713D89D5C102DE68824E371B3AB
        Malicious:false
        Reputation:unknown
        URL:https://login.live.com/Me.htm?v=3
        Preview:<script type="text/javascript">!function(n,t){for(var e in t)n[e]=t[e]}(this,function(n){function t(i){if(e[i])return e[i].exports;var s=e[i]={exports:{},id:i,loaded:!1};return n[i].call(s.exports,s,s.exports,t),s.loaded=!0,s.exports}var e={};return t.m=n,t.c=e,t.p="",t(0)}([function(n,t){function e(n){for(var t=g[c],e=0,i=t.length;e<i;++e)if(t[e]===n)return!0;return!1}function i(n){if(!n)return null;for(var t=n+"=",e=document.cookie.split(";"),i=0,s=e.length;i<s;i++){var o=e[i].replace(/^\s*(\w+)\s*=\s*/,"$1=").replace(/(\s+$)/,"");if(0===o.indexOf(t))return o.substring(t.length)}return null}function s(n,t,e){if(n)for(var i=n.split(":"),s=null,o=0,a=i.length;o<a;++o){var l=null,c=i[o].split("$");if(0===o&&(s=parseInt(c.shift()),!s))return;var p=c.length;if(p>=1){var f=r(s,c[0]);if(!f||e[f])continue;l={signInName:f,idp:"msa",isSignedIn:!0}}if(p>=3&&(l.firstName=r(s,c[1]),l.lastName=r(s,c[2])),p>=4){var g=c[3],m=g.split("|");l.otherHashedAliases=m}if(p>=5){var h=parseInt(c[4],16);h&&(l.
        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
        File Type:PNG image data, 280 x 60, 8-bit/color RGBA, non-interlaced
        Category:downloaded
        Size (bytes):8328
        Entropy (8bit):7.897314657240731
        Encrypted:false
        SSDEEP:
        MD5:B365F38DEC5167452FFF091169060C23
        SHA1:CE242D1F9A454E001810604303E953415BFB7F74
        SHA-256:BCB50FD30E329B69DBE6B0C5FAC73EBF9AC9BDC40975C562BA23321177ED3C30
        SHA-512:47FC138E00FCC41A34BC44A5BBAA0080C60BE555A7E5221D1D4580D72F955DC5C4D8425824B3DACE54A545AE8FAD35D9C53D7E102DDE90E315B8F19310A28F28
        Malicious:false
        Reputation:unknown
        URL:https://aadcdn.msauthimages.net/81d6b03a-lo-17j4if57xvhnqhzv8rv8ohj0b3c2jea2fjv9nm0/logintenantbranding/0/bannerlogo?ts=636909063186754854
        Preview:.PNG........IHDR.......<............sRGB.........pHYs.................iTXtXML:com.adobe.xmp.....<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="XMP Core 5.4.0">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xmp="http://ns.adobe.com/xap/1.0/". xmlns:tiff="http://ns.adobe.com/tiff/1.0/". xmlns:exif="http://ns.adobe.com/exif/1.0/">. <xmp:ModifyDate>2019-04-15T16:04:79</xmp:ModifyDate>. <xmp:CreatorTool>Pixelmator 3.8.2</xmp:CreatorTool>. <tiff:Orientation>1</tiff:Orientation>. <tiff:Compression>0</tiff:Compression>. <tiff:ResolutionUnit>2</tiff:ResolutionUnit>. <tiff:YResolution>72</tiff:YResolution>. <tiff:XResolution>72</tiff:XResolution>. <exif:PixelXDimension>280</exif:PixelXDimension>. <exif:ColorSpace>1</exif:ColorSpace>. <exif:PixelYDimension>60</exif:PixelYDimension>. </rdf:Description>. </rdf:RDF>.<
        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
        File Type:gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 119648
        Category:downloaded
        Size (bytes):40454
        Entropy (8bit):7.992737010031678
        Encrypted:true
        SSDEEP:
        MD5:1D65BDDAE4EAEEFC77CB9CFECC565B5D
        SHA1:A7D87150DA1DF6AE6DB87D98760DB7D753DBF6B9
        SHA-256:B98D5BA052230DB0ABC1B0E7B09D814114F6B7C316836BEB88E7B49057DAFEC0
        SHA-512:F2CF9D120D7E18AE3FD77CD85176401A3EB7DB4AF10E16D58C21D86F738FC74525A21E3A319197435E43E50E61DFA8CB2F7207962105360E7BE5652A28165944
        Malicious:false
        Reputation:unknown
        URL:https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js
        Preview:............{{..7..y...D4e.sH.v.w......m.r.....&..b.`.P."r...~k..\(...=n#.2..5.N..N~.v'....g..G......N.~q.i.KWq.d.I..N..Z.'.,-........>.e...&Y..'ON......K|.KQ.........^..WI.QT.oe.>..V........w.,/.Y.6..U.......Lo..U..C..{U......T....,.==.\..KrY..'wI..2wIyMw.K/.........B..{45r..r..Lw..3....I!l..lL.m....|!..k...J...Y.......Q.I.Wt...........-....Y..mI...vs.S.TP.....]P..;j3..."..Q.]P?.+qK7.q..]J}....qt[..D.j\."....&j..3.......72.fQ..l%_..A...$.m6..>.QD@... ^F.v..2z@uao,.|....@../....05.....4x...".I..(.._..e..R..HT.{.2O.....lT.we. _.P.'Iz..|..y...yM..j.P...~...~6*j.D.Li.e..z.tu~.lV~...qN...fg...V.7.;...<..........}...yf...`>.....g.y.*<q..7.i....h..\%%.q.z.>*.......^...M..u.n..1...z7t.......y..S..Bc.).....X.~.|F.....B0..E....d.B_.Z.....[.Z./..B8.e..-U....P..]N....k.%p...l<..\......A`W^...m.J5c...._I.j.t.......Q...1.*.B...>^...+d.p.o.bi.D..O...~... @..m*.4.z..uLd..Bc).:.x?..`..Ey....?.2...".....2}.?.FW.|d.~9...~.C.V..y.'..M..........`...E.77>..~?=+gs..t
        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
        File Type:gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 11970
        Category:downloaded
        Size (bytes):4880
        Entropy (8bit):7.966397036823352
        Encrypted:false
        SSDEEP:
        MD5:03C76051E45F8BAFD592731BA31E82BB
        SHA1:58F5464CCAB2D8096ABCA4E4324DE38B7C4B829E
        SHA-256:F8D8EEB949623360942057B5ABDB018AC7AEDE91092961BA52A417F4C64700A7
        SHA-512:253A9F9D5F59AEC12DF2B69AB71414F6EA76EBD5464C66DD107347E20E303610BC371764EEFCBEC3FA031CC03A30C556486AD9DD833A2B6FAAA3714BDC2DDA95
        Malicious:false
        Reputation:unknown
        URL:https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/frameworksupport.min_oadrnc13magb009k4d20lg2.js
        Preview:...........Z{s..._..Fs.2.(9..RX..;[.m..LoWR2..JL)R....K.}...ERV...lfb.yp....'...........;..~:.8a.....=.:{}..pZ..E..(N...u....R.I...L.2.*..%..8LX$.%S..V2.$.*gI.+l..Iv....3.....s}v.....q...lu..B.4S.T.0.ih.:i.X..d7.x.`..S..Y...S...!y.......`.P,.Z.<|vI+-.\.cN..r .9..`..._..g....'K.;...........e...'N..|[........Y1U~..\..b....%....w&nWX.'wl..X^....s).R.....z}.....h.<&r..V"!.j.7q.|.j.'.S..O.O9s...^vz/:.#.&.J..~.;......;.y..@z.;.u.yy...)..?......'..l..i.........>.........s......[h...].^^.....v....NO|...._...._.._......[..)is:}{..5..{.m......n%...{......7....hw.{^@.s%c....,r.{/.*d.....x[..f..D..s.....1_..G.[.....A...E>.W.u"|.Q.A.n.....+l.>...b..S..Tt....z.,..Gb20'q",..d...>....vx..@.?]..u6............9...y.n.6..k\.U..#..)...R/.b...`...<P.M~.......K.l1...Vm.xX..A............Oa...cq.......[1....@O...Z..d....X..-Gr..UI...,KD....r.v.Yii..s..Z`vl0.F...*..Q....Gf.;.2.....\...X*#..r...*..Q.=L...D.s..d...W.@..#....I@....zmO..fA.g.v.&.......M....,N....
        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
        File Type:gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113124
        Category:downloaded
        Size (bytes):20323
        Entropy (8bit):7.979828556028711
        Encrypted:false
        SSDEEP:
        MD5:5E3D23B9011B082A8DC2A6EEEE6559D0
        SHA1:B1A5170A25FE5AC6521D676A22ED043208180DD0
        SHA-256:AB1DEB7573547344F30492F9D9306B7037A69F8E3DB73C722C7E0B9F6FEC58FB
        SHA-512:2176967667E6F5EF1887EFDEE092584EF525C5C0992AEE1FC0E1FF91016969058B46DE75CC2272FCF2A8B579BA88C60AD32F95463C6C82046C41AD641A606F5B
        Malicious:false
        Reputation:unknown
        URL:https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_9oft0ybq1qhuafkqh5wryq2.css
        Preview:...........}ks.6.....\.R;.J.H=-WR;..&>g^53.G.R[.DY<C..$e.WG..... )...{+'g...l............bw_f7.:x..<x.-.*V5)/wE..Y...gy.0.*(.*-o.e.|..._..I.....?<{.!x...W..._..^..p..E..'..Y...<.....*]..6(. ..D..*...Y.......:.ve.?..!..|t...].+.......a.......|.P...u.H.d.d.r.c[..~.L..n.-.}e.H3...r..^..iP.u.*.z.....)..Z.jx..C'......u..{.C...N.o.m~..F(b..f.....h..O.....6....kr.......n2m M$.R..R..i{.~...*..n.dKY..#.Kn.4..G...O..l.#.a=..iU..].S.2.wY..O.|...Z.A....].uU.._%U.<...pp..u=.....C.R..S.....0...A<......&...W..'o.T.."..jO..^+.....DiW.b..7i..7..........lKe.0.~B0.....zQu#...YB.,.{*.&.6..G.6..._...J.i.?.LS$( .^.{..u.-.0....K....M&j..s.yB..+....^.)...7e.....]..eFI_.kRX.B......D[.4......+.u=>....R.`QEK...R..d...*S.. ,c5RKBK(......][..eF{T.....6...".....Uk:..S.0Ro.}B.dwJZ}U..S.F.....&.&.~|......{..Ep.>x..._....}p..=.}...v...7?}...g..1&.......}...^...o.x.>x...../.^....._.........w.v./.........BA...{J..w..$?.}w....?zO.r..5...7.gl..z...g.?.{....R.......yGj
        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
        File Type:gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 444890
        Category:downloaded
        Size (bytes):121438
        Entropy (8bit):7.997495520894356
        Encrypted:true
        SSDEEP:
        MD5:9D04112039AA1DB4EA5F49C521125D6A
        SHA1:D3BBFB157E00A0BA12A53AEE8BC05711849B51F0
        SHA-256:DFB209628564E6F287D8154B1DD0CAEA878E9FEB3EA65BDF16E49EC4354CEF69
        SHA-512:AE3C580DF190EB8EA393E669195F845FAD5A19350DCBE9FF5332BE019243CC0057A2567109A01E1BA9CC77E6F393F632A4DE6531F237F1DE08480CABCA60DF45
        Malicious:false
        Reputation:unknown
        URL:https://aadcdn.msauth.net/shared/1.0/content/js/ConvergedLogin_PCore_T2EBBtMmyv072RjbQwNpoQ2.js
        Preview:...........m[.H....~...1v#\..-Z...Ul.f0t.....R..%.$.2.../"2SJ.2U5.w..s.;................Si...+.n..7..i.....q.....t9.9..|.=.(....K..g%.;.c...F%/p.h.Fv......<./M.pVJ.Yi...2'.K..'Ph...T..".teG.[..R.....M..J;...~?&. L<......|..bVZ...J/...X..(..IR...gh$^@z...dG....4.....Z.!..5.fx.1.C.=.*..@._...b....4......t".....C).Ko.B.>...LK..YL.`zV.t.]8I57.E..E./.....Y1...^....o.id..r..L.=.... ..y....J.l.....%.'.|.|.[...YU.A..g....q.\....Zk.fTx.c..c....<..U'.}r...c....s?..hx..g...s\.....zP:.g....T...%.?..K..X..>N.........."p.ceVY.....W...m@............zl.t..?....>....A..W.....c\5U..$L...h...P2g@LU..l.^ew...ww..|.?...Z.....`.. .RT..*#=.*....."..B5........=.8...$.J......+....Y[..h..........%.((..*.),...J[.d-=3.}s..E..\..D!.....,.'z.;...o.....2........G...d...-%,u.a4...v,..'..*.c..-`/..H=."@.....>.A;A~.Do..B`K.q...Sq5....!*..1..t..8...>.......ZK;\.i..O.OY...h.j...[9....Db.......L.>..M...t.0%+.$.Ta.3+z..!.B=ZUt7t...Gf.V...=.....'.......K{....i.\o..S.dH....].,
        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
        File Type:gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 9285
        Category:downloaded
        Size (bytes):3921
        Entropy (8bit):7.948633187405583
        Encrypted:false
        SSDEEP:
        MD5:BA9DA2AE129596B81DE1FAFFB02CD0F7
        SHA1:8208ED791107C4D13D2DB619560EAC4707B03074
        SHA-256:23DC170CF8AE0615D3E4A6F406DAE6A0FC002BB3CA385C0C2957BFE7000F147B
        SHA-512:068268534557DE84E01F01EE2E9D025F4651183AA7A46D67286FD2E2482FEC84C618F1559CEE8256F9FC1F5CE1F8EB6F5808A2F67E49CBAB1C05758A80A5FA19
        Malicious:false
        Reputation:unknown
        URL:https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/watson.min_q5ptmu8aniymd4ftuqdkda2.js
        Preview:...........Zks.6..>..F.d2.9.f.....+;..+...V.*.EB......m]K.}O.$E..$..26.G..8}.....Q.(.z..#.E^h.>...Bj..Z.*R.r..GJ..eo.2..4UY..X....U-^..{N..3..P;:x[w...._y..[...'.....r]D..~.nr...y=..#[-.BN............~4.uV+;.m.:..\siUi...,.KW.......a&h....)...^.N....v.3.@..a.bT.....-!\.......y.WY...J?G.i.V1.T..;;n'...U..Z ..t2...5.....E2..7PoG..s.."....z...M;Ap.z.......8..}..:|.f8.......I2G....J..Q.....OS.T!c.s..*......u.....0....;.k.$............s..V..K....xa..H......h....Z.yE.s..oN.x @.gnex.}E..1;7 .A.q.f]..W.!..........7,K&2.`].Y.'..j..X.A..n.I....ZxF.W.......~6O...-..[?..~..y.M...;..=.B.^....h.k.=<...0.Z........4.......K... .1K.@.<...nY.^s..p.......J..p0..>..}5.:l..?.Y.N.Z.Bu[....GTz...`.#..d...3!...4....wzp. ..Iws...W..E.o....5{..3...I|!.]..E. o.'M..`.. ...U.(.X# .r..:..;.D....JV.Jx..4*..j....5}.B.VI....)1x5..dN...(...q.y..cF..*......$......"s$.j...M`.Bu..A2..W.....\...=+...l..6..c.E0q3....7....]....&v..]...^.....u.z.cp..4\.L,.-..(..
        File type:HTML document, ASCII text, with very long lines (340), with no line terminators
        Entropy (8bit):5.312170343577897
        TrID:
        • HyperText Markup Language (11001/1) 64.69%
        • HyperText Markup Language (6006/1) 35.31%
        File name:Overview 2023.html
        File size:340 bytes
        MD5:55add7b502dca6ec2478cc6f47185628
        SHA1:707dc4b5cd6387969421ab99c3cd70fd0609e681
        SHA256:a02da1e9e258597fb5e2b62d5569d2822cefd60fd0cede3ae18919348e259fda
        SHA512:dc494d44d51e45ec2feccf359d36b08e308d9737226c166434daca5ac578111b60db34f69f47eccede5eb5b396be6530ad036b6e8b307dcdb5876bb90495e9bd
        SSDEEP:6:qzxVkMRJVCNOE1fAiLGGFnOYgY1F52pZI965wnA2X1fAiLGGFnOYgY1F52NKSZDp:kxVkMxC3moGGoYg+UZxyA2XmoGGoYg+Y
        TLSH:08E07DEEF01704375FB27AA0389028A1AC8AAD921290C95CF0441A98D4FFBCDC2537D5
        File Content Preview:<html><head><meta http-equiv="refresh" content="0; url=https://human-resources-support.com/en/At/?ref=HQDEMtVV9KjvXe6baFwh9hae2P4w6YSPHB69" /></head><body>Loading page...<br><a href="https://human-resources-support.com/en/At/?ref=HQDEMtVV9KjvXe6baFwh9hae2
        Icon Hash:173149cccc490307