Windows Analysis Report
https://rjnmail-my.sharepoint.com/:o:/p/shaam_merai/EngmZjy5pp1NkcIOlH0JzQYB5TfOUcr0IweEkkbuVBLAOw?e=5%3a4gX9qV&at=9&xsdata=MDV8MDJ8aGVscGRlc2tAcGVvLm9uLmNhfDIxMDE5Zjc5YTRmMzRhYjU2N2EyMDhkYzk3OTEzMDIyfDM5ZWU5NzA0NDNjZjRiMWQ4YjIyMjU1NjlkYTgzNzExfDB8MHw2Mzg1NTE4OTcwNDAxNjQ5MzZ8VW5rbm93bnxUV0ZwYkdac2Iz

Overview

General Information

Sample URL:	https://rjnmail-my.sharepoint.com/:o:/p/shaam_merai/EngmZjy5pp1NkcIOlH0JzQYB5TfOUcr0IweEkkbuVBLAOw?e=5%3a4gX9qV&at=9&xsdata=MDV8MDJ8aGVscGRlc2tAcGVvLm9uLmNhfDIxMDE5Zjc5YTRmMzRhYjU2N2EyMDhkYzk3OTEzMDIy
Analysis ID:	1467843
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected non-DNS traffic on DNS port

HTML page contains hidden URLs or javascript code

Stores files to the Windows start menu directory

Classification

Signatures

HTML page contains hidden URLs or javascript code

Source: https://rjnmail-my.sharepoint.com/:o:/p/shaam_merai/EngmZjy5pp1NkcIOlH0JzQYB5TfOUcr0IweEkkbuVBLAOw?e=5%3a4gX9qV&at=9&xsdata=MDV8MDJ8aGVscGRlc2tAcGVvLm9uLmNhfDIxMDE5Zjc5YTRmMzRhYjU2N2EyMDhkYzk3OTEzMDIyfDM5ZWU5NzA0NDNjZjRiMWQ4YjIyMjU1NjlkYTgzNzExfDB8MHw2Mzg1NTE4OTcwNDAxNjQ5MzZ8VW5rbm93bnxUV0ZwYkdac2IzZDhleUpXSWpvaU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZNbjA9fDB8fHw%3d&sdata=MUp2OGFEK3NHbGVRekVTc2p5bVdwTlljQ3VoVktJSWZxMS9Falg2ZWhHOD0%3d

HTTP Parser: Base64 decoded: )\.\d+))/.test(navigator.userAgent) || /[?&]env=TeamsWebView/.test(location.search) || /Teams\/((?:(\d+)\.)?(?:(\d+)\.)?(?:(\d+)\.\d+))(?:\/(\\d+))?/.test(navigator.userAgent) || window.name =...

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.5:49737 version: TLS 1.2

Detected non-DNS traffic on DNS port

Source: global traffic

TCP traffic: 192.168.2.5:49738 -> 1.1.1.1:53

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103

Source: global traffic	HTTP traffic detected: GET /:o:/p/shaam_merai/EngmZjy5pp1NkcIOlH0JzQYB5TfOUcr0IweEkkbuVBLAOw?e=5%3a4gX9qV&at=9&xsdata=MDV8MDJ8aGVscGRlc2tAcGVvLm9uLmNhfDIxMDE5Zjc5YTRmMzRhYjU2N2EyMDhkYzk3OTEzMDIyfDM5ZWU5NzA0NDNjZjRiMWQ4YjIyMjU1NjlkYTgzNzExfDB8MHw2Mzg1NTE4OTcwNDAxNjQ5MzZ8VW5rbm93bnxUV0ZwYkdac2IzZDhleUpXSWpvaU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZNbjA9fDB8fHw%3d&sdata=MUp2OGFEK3NHbGVRekVTc2p5bVdwTlljQ3VoVktJSWZxMS9Falg2ZWhHOD0%3d HTTP/1.1Host: rjnmail-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_layouts/15/1033/styles/corev15.css?rev=tMQyIYuqg6gA5d4OhqkBpg%3D%3DTAG70 HTTP/1.1Host: rjnmail-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://rjnmail-my.sharepoint.com/:o:/p/shaam_merai/EngmZjy5pp1NkcIOlH0JzQYB5TfOUcr0IweEkkbuVBLAOw?e=5%3a4gX9qV&at=9&xsdata=MDV8MDJ8aGVscGRlc2tAcGVvLm9uLmNhfDIxMDE5Zjc5YTRmMzRhYjU2N2EyMDhkYzk3OTEzMDIyfDM5ZWU5NzA0NDNjZjRiMWQ4YjIyMjU1NjlkYTgzNzExfDB8MHw2Mzg1NTE4OTcwNDAxNjQ5MzZ8VW5rbm93bnxUV0ZwYkdac2IzZDhleUpXSWpvaU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZNbjA9fDB8fHw%3d&sdata=MUp2OGFEK3NHbGVRekVTc2p5bVdwTlljQ3VoVktJSWZxMS9Falg2ZWhHOD0%3dAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_layouts/15/1033/styles/error.css?rev=tF7fyfzbaQzNoASoSDlV4A%3D%3DTAG70 HTTP/1.1Host: rjnmail-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://rjnmail-my.sharepoint.com/:o:/p/shaam_merai/EngmZjy5pp1NkcIOlH0JzQYB5TfOUcr0IweEkkbuVBLAOw?e=5%3a4gX9qV&at=9&xsdata=MDV8MDJ8aGVscGRlc2tAcGVvLm9uLmNhfDIxMDE5Zjc5YTRmMzRhYjU2N2EyMDhkYzk3OTEzMDIyfDM5ZWU5NzA0NDNjZjRiMWQ4YjIyMjU1NjlkYTgzNzExfDB8MHw2Mzg1NTE4OTcwNDAxNjQ5MzZ8VW5rbm93bnxUV0ZwYkdac2IzZDhleUpXSWpvaU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZNbjA9fDB8fHw%3d&sdata=MUp2OGFEK3NHbGVRekVTc2p5bVdwTlljQ3VoVktJSWZxMS9Falg2ZWhHOD0%3dAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ScriptResource.axd?d=m0jG364j4NGS2YAs366ZrZDboV4Z4bFzITp5H7GFyGl5jl65Lbpu-UrJGNYkJiyMKh_2o8DlLjj2JCb-mjtO9VW3kGmOPrqQt-uz2hmCl3mvyRBTYzSNC0LScv0k4JPTUCKJ93XWl7YzfH_wwkM9o132ph7t7ADI0-vM90YnialpRvumW-KQRu8tslYSpNAz0&t=74258c30 HTTP/1.1Host: rjnmail-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://rjnmail-my.sharepoint.com/:o:/p/shaam_merai/EngmZjy5pp1NkcIOlH0JzQYB5TfOUcr0IweEkkbuVBLAOw?e=5%3a4gX9qV&at=9&xsdata=MDV8MDJ8aGVscGRlc2tAcGVvLm9uLmNhfDIxMDE5Zjc5YTRmMzRhYjU2N2EyMDhkYzk3OTEzMDIyfDM5ZWU5NzA0NDNjZjRiMWQ4YjIyMjU1NjlkYTgzNzExfDB8MHw2Mzg1NTE4OTcwNDAxNjQ5MzZ8VW5rbm93bnxUV0ZwYkdac2IzZDhleUpXSWpvaU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZNbjA9fDB8fHw%3d&sdata=MUp2OGFEK3NHbGVRekVTc2p5bVdwTlljQ3VoVktJSWZxMS9Falg2ZWhHOD0%3dAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ScriptResource.axd?d=sFKYt98rkOEepMD8HaYdQxw0MdI8XppwKu-u05zm-jrdxw_0lu_7y2XSfk2fjigBSMiXa-lE5A34AyUu4bGg1HoWgo42ZIBCrXE8VVmtBgVmQ72TbUOinfYqW44dx5TAwOn4gaZ14vXlYqMzaycjq_il_bbHsGdSivnjJD1G3gQv2-7SLslJ_DcgLBUXY2VD0&t=74258c30 HTTP/1.1Host: rjnmail-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://rjnmail-my.sharepoint.com/:o:/p/shaam_merai/EngmZjy5pp1NkcIOlH0JzQYB5TfOUcr0IweEkkbuVBLAOw?e=5%3a4gX9qV&at=9&xsdata=MDV8MDJ8aGVscGRlc2tAcGVvLm9uLmNhfDIxMDE5Zjc5YTRmMzRhYjU2N2EyMDhkYzk3OTEzMDIyfDM5ZWU5NzA0NDNjZjRiMWQ4YjIyMjU1NjlkYTgzNzExfDB8MHw2Mzg1NTE4OTcwNDAxNjQ5MzZ8VW5rbm93bnxUV0ZwYkdac2IzZDhleUpXSWpvaU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZNbjA9fDB8fHw%3d&sdata=MUp2OGFEK3NHbGVRekVTc2p5bVdwTlljQ3VoVktJSWZxMS9Falg2ZWhHOD0%3dAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /WebResource.axd?d=cJDku4LPR0hyEjv_M8Kns8-LnsNih-hW-uLOSr1zW1jQmNRW7lEiJ5sSjrYld8ki7UcxJbybV3H2_HmR_ribQxD8ZBjx1xRfOab_Fx2WmQs1&t=638533172441064469 HTTP/1.1Host: rjnmail-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://rjnmail-my.sharepoint.com/:o:/p/shaam_merai/EngmZjy5pp1NkcIOlH0JzQYB5TfOUcr0IweEkkbuVBLAOw?e=5%3a4gX9qV&at=9&xsdata=MDV8MDJ8aGVscGRlc2tAcGVvLm9uLmNhfDIxMDE5Zjc5YTRmMzRhYjU2N2EyMDhkYzk3OTEzMDIyfDM5ZWU5NzA0NDNjZjRiMWQ4YjIyMjU1NjlkYTgzNzExfDB8MHw2Mzg1NTE4OTcwNDAxNjQ5MzZ8VW5rbm93bnxUV0ZwYkdac2IzZDhleUpXSWpvaU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZNbjA9fDB8fHw%3d&sdata=MUp2OGFEK3NHbGVRekVTc2p5bVdwTlljQ3VoVktJSWZxMS9Falg2ZWhHOD0%3dAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_layouts/15/images/favicon.ico?rev=47 HTTP/1.1Host: rjnmail-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://rjnmail-my.sharepoint.com/:o:/p/shaam_merai/EngmZjy5pp1NkcIOlH0JzQYB5TfOUcr0IweEkkbuVBLAOw?e=5%3a4gX9qV&at=9&xsdata=MDV8MDJ8aGVscGRlc2tAcGVvLm9uLmNhfDIxMDE5Zjc5YTRmMzRhYjU2N2EyMDhkYzk3OTEzMDIyfDM5ZWU5NzA0NDNjZjRiMWQ4YjIyMjU1NjlkYTgzNzExfDB8MHw2Mzg1NTE4OTcwNDAxNjQ5MzZ8VW5rbm93bnxUV0ZwYkdac2IzZDhleUpXSWpvaU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZNbjA9fDB8fHw%3d&sdata=MUp2OGFEK3NHbGVRekVTc2p5bVdwTlljQ3VoVktJSWZxMS9Falg2ZWhHOD0%3dAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /_layouts/15/images/favicon.ico?rev=47 HTTP/1.1Host: rjnmail-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=shRHyYyVrawGE2l&MD=B1B9KYW5 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=shRHyYyVrawGE2l&MD=B1B9KYW5 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: global traffic	DNS traffic detected: DNS query: rjnmail-my.sharepoint.com
Source: global traffic	DNS traffic detected: DNS query: spo.nel.measure.office.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: chromecache_86.2.dr	String found in binary or memory: https://res-1.cdn.office.net/bld/_layouts/15/16.0.25019.12007/1033/initstrings.js
Source: chromecache_86.2.dr	String found in binary or memory: https://res-1.cdn.office.net/bld/_layouts/15/16.0.25019.12007/blank.js
Source: chromecache_86.2.dr	String found in binary or memory: https://res-1.cdn.office.net/bld/_layouts/15/16.0.25019.12007/init.js
Source: chromecache_86.2.dr	String found in binary or memory: https://res-1.cdn.office.net/bld/_layouts/15/16.0.25019.12007/theming.js
Source: chromecache_86.2.dr	String found in binary or memory: https://res.cdn.office.net/teams-js/2.21.0/js/MicrosoftTeams.min.js

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.5:49737 version: TLS 1.2

Source: classification engine

Classification label: clean1.win@16/33@8/4

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 --field-trial-handle=2224,i,9236425076649525401,17373768222617990273,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://rjnmail-my.sharepoint.com/:o:/p/shaam_merai/EngmZjy5pp1NkcIOlH0JzQYB5TfOUcr0IweEkkbuVBLAOw?e=5%3a4gX9qV&at=9&xsdata=MDV8MDJ8aGVscGRlc2tAcGVvLm9uLmNhfDIxMDE5Zjc5YTRmMzRhYjU2N2EyMDhkYzk3OTEzMDIyfDM5ZWU5NzA0NDNjZjRiMWQ4YjIyMjU1NjlkYTgzNzExfDB8MHw2Mzg1NTE4OTcwNDAxNjQ5MzZ8VW5rbm93bnxUV0ZwYkdac2IzZDhleUpXSWpvaU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZNbjA9fDB8fHw%3d&sdata=MUp2OGFEK3NHbGVRekVTc2p5bVdwTlljQ3VoVktJSWZxMS9Falg2ZWhHOD0%3d"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 --field-trial-handle=2224,i,9236425076649525401,17373768222617990273,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.136.10	dual-spo-0005.spo-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.217.18.100	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.5

Contacted Domains

Name	IP	Active
dual-spo-0005.spo-msedge.net	13.107.136.10	true
www.google.com	172.217.18.100	true
rjnmail-my.sharepoint.com	unknown	unknown
spo.nel.measure.office.net	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://rjnmail-my.sharepoint.com/:o:/p/shaam_merai/EngmZjy5pp1NkcIOlH0JzQYB5TfOUcr0IweEkkbuVBLAOw?e=5%3a4gX9qV&at=9&xsdata=MDV8MDJ8aGVscGRlc2tAcGVvLm9uLmNhfDIxMDE5Zjc5YTRmMzRhYjU2N2EyMDhkYzk3OTEzMDIyfDM5ZWU5NzA0NDNjZjRiMWQ4YjIyMjU1NjlkYTgzNzExfDB8MHw2Mzg1NTE4OTcwNDAxNjQ5MzZ8VW5rbm93bnxUV0ZwYkdac2IzZDhleUpXSWpvaU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZNbjA9fDB8fHw%3d&sdata=MUp2OGFEK3NHbGVRekVTc2p5bVdwTlljQ3VoVktJSWZxMS9Falg2ZWhHOD0%3d	false		unknown
https://rjnmail-my.sharepoint.com/_layouts/15/1033/styles/corev15.css?rev=tMQyIYuqg6gA5d4OhqkBpg%3D%3DTAG70	false	Avira URL Cloud: safe	unknown
https://rjnmail-my.sharepoint.com/WebResource.axd?d=cJDku4LPR0hyEjv_M8Kns8-LnsNih-hW-uLOSr1zW1jQmNRW7lEiJ5sSjrYld8ki7UcxJbybV3H2_HmR_ribQxD8ZBjx1xRfOab_Fx2WmQs1&t=638533172441064469	false	Avira URL Cloud: safe	unknown
https://rjnmail-my.sharepoint.com/_layouts/15/images/favicon.ico?rev=47	false	Avira URL Cloud: safe	unknown
https://rjnmail-my.sharepoint.com/ScriptResource.axd?d=m0jG364j4NGS2YAs366ZrZDboV4Z4bFzITp5H7GFyGl5jl65Lbpu-UrJGNYkJiyMKh_2o8DlLjj2JCb-mjtO9VW3kGmOPrqQt-uz2hmCl3mvyRBTYzSNC0LScv0k4JPTUCKJ93XWl7YzfH_wwkM9o132ph7t7ADI0-vM90YnialpRvumW-KQRu8tslYSpNAz0&t=74258c30	false	Avira URL Cloud: safe	unknown
https://rjnmail-my.sharepoint.com/_layouts/15/1033/styles/error.css?rev=tF7fyfzbaQzNoASoSDlV4A%3D%3DTAG70	false	Avira URL Cloud: safe	unknown

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Jul 4 18:43:46 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	124F80B1839954D3A4337F8839AE96F5	05172BF0EDC80A03F0B5D5EF2842758F902501E7	D96D8C430D9B713A831DA2DAE66F9226DFB9C486A7E62221BD7C955626870B0B
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Jul 4 18:43:46 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	0012A5C3197C9948FB424A2E8D1E20D3	6454404120455E45544531309E4BA78B69C08F73	F6B9CF810CB03CB775EF9B087894031EB51FC49C0E2E087123E5779066C0AA78
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	B26C965C3F4B18A89C3772CC7AC3F529	B2D3FFBDBC804DE55511BE08388403DE2A577871	38B0C5D0C979D3CA005E9D447033534FB247934C25B4B2007B0BFAA89FE135D9
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Jul 4 18:43:46 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	46C809F66E78EE5E19BCDDF1521F8453	26045EB03FE181540A59CC99ABBEB167FA3ABCD6	81A43FAB79DD2867B8883C02B375BF34C60559A03034FDC37C93854B4C42D9DC
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Jul 4 18:43:46 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	549D5CBF8C34475E4C15A4BC2BF1988B	73566D8BF86BC533E1C86FE4C77F94230A7084A7	0E14EA232F2054E4222D512C5D223F342B923362A0B18CA1AE011A0322D29F6C
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Jul 4 18:43:46 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	9AF2DE640EEDADA639AE96724B3BF52F	7827F84A4BCE925A8C66487141926C85927A6C94	E8228B255FB3EC7B98975F0A03330BECBF182D069E230B591144F4DB884D54F7
Chrome Cache Entry: 76	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 40329	027A7D52E1CEED8AEF7DC13505B81D36	33CF0BCE6A4C8B44B4A80B3116C978C12EE93FD0	29061464FB6FCE2326B952EACAA95C3C6183BFEA74C3851390E9838720D372A6
Chrome Cache Entry: 77	ASCII text, with CRLF line terminators	C002BB0EB0C85B5C943E860D47D670E6	5CFB54603DF1D19741B53057948454EBD019BDDC	763520E7504C16BD8816F508C3FC4309180A6F7FD0623CA2744818B6999B6974
Chrome Cache Entry: 78	ASCII text, with very long lines (456), with no line terminators	C00C5934432450DB1EB2A306922FDF4D	7A1BE0832268B1665D75593CF1AC1EB3F1097D75	A742ACE9C468D77041CE881436B6C7F5B8D1E06C2ED00D0E38FFA834702D7C2E
Chrome Cache Entry: 79	ASCII text, with CRLF line terminators	B45EDFC9FCDB690CCDA004A8483955E0	BAEDF73329EABB32504CAC640538EE3B6B31819F	E817BF53005172205995AA07E0021BD8254A0204A1177E925F365E838C32D069
Chrome Cache Entry: 80	ASCII text, with very long lines (35238), with no line terminators	C637DE6889D81964119BA1FD124E2454	5DB2B1681BE6FF9A7B26E269CD80D817D41A01BE	18E8366C8C5590C3D056BA6CA9691B7471D6970EE00D0E22A4B68E517B54F087
Chrome Cache Entry: 81	ASCII text, with very long lines (65536), with no line terminators	4832BF4EE58A9C0023A855E80A5B424A	7C98E34B1A2AE96D2337467F843DD1524E458A70	49173F537CADBE461A165497605DD15628D613C75C4D64A7BA0F6D1F4AE5E4EF
Chrome Cache Entry: 82	MS Windows icon resource - 3 icons, 32x32, 32 bits/pixel, 24x24, 32 bits/pixel	0B60F3C9E4DA6E807E808DA7360F24F2	9AFC7ABB910DE855EFB426206E547574A1E074B7	ADDEEDEEEF393B6B1BE5BBB099B656DCD797334FF972C495CCB09CFCB1A78341
Chrome Cache Entry: 83	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 102804	B62553925BD98826C60457D2EB6B9A46	84DBBB6D9B36A587C21B5A56B1D9E587E33BA943	C58166FE4DF4BA8F25A960C21451EAF841D97F6F552F104E43431C9DB1C2E2CC
Chrome Cache Entry: 84	ASCII text, with very long lines (23437), with CRLF line terminators	964FCB2BAF87049DC68975291AE89431	D0CD8C989D44BC531472B632868D3FB2DE4B3184	B8F7BD568E379502CF0C00027581D2761C7DC14B166F5D25FC048A0B56B7BFBB
Chrome Cache Entry: 85	MS Windows icon resource - 3 icons, 32x32, 32 bits/pixel, 24x24, 32 bits/pixel	0B60F3C9E4DA6E807E808DA7360F24F2	9AFC7ABB910DE855EFB426206E547574A1E074B7	ADDEEDEEEF393B6B1BE5BBB099B656DCD797334FF972C495CCB09CFCB1A78341
Chrome Cache Entry: 86	HTML document, ASCII text, with very long lines (64259), with CRLF, LF line terminators	8E0F868C45B6A53ACBAB5731F0CE41E3	6B224EC173092B895CFD44EA565C7F1042C3840B	4A735B70735E9B4DBC961D164261F653BCEDDB225ECC0236F6824D83B8B15E8D
Chrome Cache Entry: 87	ASCII text, with very long lines (65536), with no line terminators	2DE2482829622DE740DB42E04CBCD047	2A88D65A01BDA232B97B24163F66BA7F90A63386	947D9E7117E8528021EC98FBBD6FE75A4D393A699DFFFFB3A2803EAE42845CEB
Chrome Cache Entry: 88	ASCII text, with CRLF line terminators	90EA7274F19755002360945D54C2A0D7	647B5D8BF7D119A2C97895363A07A0C6EB8CD284	40732E9DCFA704CF615E4691BB07AECFD1CC5E063220A46E4A7FF6560C77F5DB
Chrome Cache Entry: 89	ASCII text, with very long lines (65536), with no line terminators	1CFE669C56C16B6E05ECE68B579BECF0	43E0986C77CC738D318DECDFCEA3BA3C7E86DA0E	DD19BB9BE9A5959BC1BD732EFABBCC88B5A07782513851B6EC86962A6F237F27

HTML page contains hidden URLs or javascript code

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.5:49737 version: TLS 1.2

Detected non-DNS traffic on DNS port

Source: global traffic

TCP traffic: 192.168.2.5:49738 -> 1.1.1.1:53

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103

Source: global traffic	HTTP traffic detected: GET /:o:/p/shaam_merai/EngmZjy5pp1NkcIOlH0JzQYB5TfOUcr0IweEkkbuVBLAOw?e=5%3a4gX9qV&at=9&xsdata=MDV8MDJ8aGVscGRlc2tAcGVvLm9uLmNhfDIxMDE5Zjc5YTRmMzRhYjU2N2EyMDhkYzk3OTEzMDIyfDM5ZWU5NzA0NDNjZjRiMWQ4YjIyMjU1NjlkYTgzNzExfDB8MHw2Mzg1NTE4OTcwNDAxNjQ5MzZ8VW5rbm93bnxUV0ZwYkdac2IzZDhleUpXSWpvaU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZNbjA9fDB8fHw%3d&sdata=MUp2OGFEK3NHbGVRekVTc2p5bVdwTlljQ3VoVktJSWZxMS9Falg2ZWhHOD0%3d HTTP/1.1Host: rjnmail-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_layouts/15/1033/styles/corev15.css?rev=tMQyIYuqg6gA5d4OhqkBpg%3D%3DTAG70 HTTP/1.1Host: rjnmail-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://rjnmail-my.sharepoint.com/:o:/p/shaam_merai/EngmZjy5pp1NkcIOlH0JzQYB5TfOUcr0IweEkkbuVBLAOw?e=5%3a4gX9qV&at=9&xsdata=MDV8MDJ8aGVscGRlc2tAcGVvLm9uLmNhfDIxMDE5Zjc5YTRmMzRhYjU2N2EyMDhkYzk3OTEzMDIyfDM5ZWU5NzA0NDNjZjRiMWQ4YjIyMjU1NjlkYTgzNzExfDB8MHw2Mzg1NTE4OTcwNDAxNjQ5MzZ8VW5rbm93bnxUV0ZwYkdac2IzZDhleUpXSWpvaU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZNbjA9fDB8fHw%3d&sdata=MUp2OGFEK3NHbGVRekVTc2p5bVdwTlljQ3VoVktJSWZxMS9Falg2ZWhHOD0%3dAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_layouts/15/1033/styles/error.css?rev=tF7fyfzbaQzNoASoSDlV4A%3D%3DTAG70 HTTP/1.1Host: rjnmail-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://rjnmail-my.sharepoint.com/:o:/p/shaam_merai/EngmZjy5pp1NkcIOlH0JzQYB5TfOUcr0IweEkkbuVBLAOw?e=5%3a4gX9qV&at=9&xsdata=MDV8MDJ8aGVscGRlc2tAcGVvLm9uLmNhfDIxMDE5Zjc5YTRmMzRhYjU2N2EyMDhkYzk3OTEzMDIyfDM5ZWU5NzA0NDNjZjRiMWQ4YjIyMjU1NjlkYTgzNzExfDB8MHw2Mzg1NTE4OTcwNDAxNjQ5MzZ8VW5rbm93bnxUV0ZwYkdac2IzZDhleUpXSWpvaU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZNbjA9fDB8fHw%3d&sdata=MUp2OGFEK3NHbGVRekVTc2p5bVdwTlljQ3VoVktJSWZxMS9Falg2ZWhHOD0%3dAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ScriptResource.axd?d=m0jG364j4NGS2YAs366ZrZDboV4Z4bFzITp5H7GFyGl5jl65Lbpu-UrJGNYkJiyMKh_2o8DlLjj2JCb-mjtO9VW3kGmOPrqQt-uz2hmCl3mvyRBTYzSNC0LScv0k4JPTUCKJ93XWl7YzfH_wwkM9o132ph7t7ADI0-vM90YnialpRvumW-KQRu8tslYSpNAz0&t=74258c30 HTTP/1.1Host: rjnmail-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://rjnmail-my.sharepoint.com/:o:/p/shaam_merai/EngmZjy5pp1NkcIOlH0JzQYB5TfOUcr0IweEkkbuVBLAOw?e=5%3a4gX9qV&at=9&xsdata=MDV8MDJ8aGVscGRlc2tAcGVvLm9uLmNhfDIxMDE5Zjc5YTRmMzRhYjU2N2EyMDhkYzk3OTEzMDIyfDM5ZWU5NzA0NDNjZjRiMWQ4YjIyMjU1NjlkYTgzNzExfDB8MHw2Mzg1NTE4OTcwNDAxNjQ5MzZ8VW5rbm93bnxUV0ZwYkdac2IzZDhleUpXSWpvaU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZNbjA9fDB8fHw%3d&sdata=MUp2OGFEK3NHbGVRekVTc2p5bVdwTlljQ3VoVktJSWZxMS9Falg2ZWhHOD0%3dAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ScriptResource.axd?d=sFKYt98rkOEepMD8HaYdQxw0MdI8XppwKu-u05zm-jrdxw_0lu_7y2XSfk2fjigBSMiXa-lE5A34AyUu4bGg1HoWgo42ZIBCrXE8VVmtBgVmQ72TbUOinfYqW44dx5TAwOn4gaZ14vXlYqMzaycjq_il_bbHsGdSivnjJD1G3gQv2-7SLslJ_DcgLBUXY2VD0&t=74258c30 HTTP/1.1Host: rjnmail-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://rjnmail-my.sharepoint.com/:o:/p/shaam_merai/EngmZjy5pp1NkcIOlH0JzQYB5TfOUcr0IweEkkbuVBLAOw?e=5%3a4gX9qV&at=9&xsdata=MDV8MDJ8aGVscGRlc2tAcGVvLm9uLmNhfDIxMDE5Zjc5YTRmMzRhYjU2N2EyMDhkYzk3OTEzMDIyfDM5ZWU5NzA0NDNjZjRiMWQ4YjIyMjU1NjlkYTgzNzExfDB8MHw2Mzg1NTE4OTcwNDAxNjQ5MzZ8VW5rbm93bnxUV0ZwYkdac2IzZDhleUpXSWpvaU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZNbjA9fDB8fHw%3d&sdata=MUp2OGFEK3NHbGVRekVTc2p5bVdwTlljQ3VoVktJSWZxMS9Falg2ZWhHOD0%3dAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /WebResource.axd?d=cJDku4LPR0hyEjv_M8Kns8-LnsNih-hW-uLOSr1zW1jQmNRW7lEiJ5sSjrYld8ki7UcxJbybV3H2_HmR_ribQxD8ZBjx1xRfOab_Fx2WmQs1&t=638533172441064469 HTTP/1.1Host: rjnmail-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://rjnmail-my.sharepoint.com/:o:/p/shaam_merai/EngmZjy5pp1NkcIOlH0JzQYB5TfOUcr0IweEkkbuVBLAOw?e=5%3a4gX9qV&at=9&xsdata=MDV8MDJ8aGVscGRlc2tAcGVvLm9uLmNhfDIxMDE5Zjc5YTRmMzRhYjU2N2EyMDhkYzk3OTEzMDIyfDM5ZWU5NzA0NDNjZjRiMWQ4YjIyMjU1NjlkYTgzNzExfDB8MHw2Mzg1NTE4OTcwNDAxNjQ5MzZ8VW5rbm93bnxUV0ZwYkdac2IzZDhleUpXSWpvaU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZNbjA9fDB8fHw%3d&sdata=MUp2OGFEK3NHbGVRekVTc2p5bVdwTlljQ3VoVktJSWZxMS9Falg2ZWhHOD0%3dAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_layouts/15/images/favicon.ico?rev=47 HTTP/1.1Host: rjnmail-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://rjnmail-my.sharepoint.com/:o:/p/shaam_merai/EngmZjy5pp1NkcIOlH0JzQYB5TfOUcr0IweEkkbuVBLAOw?e=5%3a4gX9qV&at=9&xsdata=MDV8MDJ8aGVscGRlc2tAcGVvLm9uLmNhfDIxMDE5Zjc5YTRmMzRhYjU2N2EyMDhkYzk3OTEzMDIyfDM5ZWU5NzA0NDNjZjRiMWQ4YjIyMjU1NjlkYTgzNzExfDB8MHw2Mzg1NTE4OTcwNDAxNjQ5MzZ8VW5rbm93bnxUV0ZwYkdac2IzZDhleUpXSWpvaU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZNbjA9fDB8fHw%3d&sdata=MUp2OGFEK3NHbGVRekVTc2p5bVdwTlljQ3VoVktJSWZxMS9Falg2ZWhHOD0%3dAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /_layouts/15/images/favicon.ico?rev=47 HTTP/1.1Host: rjnmail-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=shRHyYyVrawGE2l&MD=B1B9KYW5 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=shRHyYyVrawGE2l&MD=B1B9KYW5 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: global traffic	DNS traffic detected: DNS query: rjnmail-my.sharepoint.com
Source: global traffic	DNS traffic detected: DNS query: spo.nel.measure.office.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: chromecache_86.2.dr	String found in binary or memory: https://res-1.cdn.office.net/bld/_layouts/15/16.0.25019.12007/1033/initstrings.js
Source: chromecache_86.2.dr	String found in binary or memory: https://res-1.cdn.office.net/bld/_layouts/15/16.0.25019.12007/blank.js
Source: chromecache_86.2.dr	String found in binary or memory: https://res-1.cdn.office.net/bld/_layouts/15/16.0.25019.12007/init.js
Source: chromecache_86.2.dr	String found in binary or memory: https://res-1.cdn.office.net/bld/_layouts/15/16.0.25019.12007/theming.js
Source: chromecache_86.2.dr	String found in binary or memory: https://res.cdn.office.net/teams-js/2.21.0/js/MicrosoftTeams.min.js

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.5:49737 version: TLS 1.2

Source: classification engine

Classification label: clean1.win@16/33@8/4

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 --field-trial-handle=2224,i,9236425076649525401,17373768222617990273,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://rjnmail-my.sharepoint.com/:o:/p/shaam_merai/EngmZjy5pp1NkcIOlH0JzQYB5TfOUcr0IweEkkbuVBLAOw?e=5%3a4gX9qV&at=9&xsdata=MDV8MDJ8aGVscGRlc2tAcGVvLm9uLmNhfDIxMDE5Zjc5YTRmMzRhYjU2N2EyMDhkYzk3OTEzMDIyfDM5ZWU5NzA0NDNjZjRiMWQ4YjIyMjU1NjlkYTgzNzExfDB8MHw2Mzg1NTE4OTcwNDAxNjQ5MzZ8VW5rbm93bnxUV0ZwYkdac2IzZDhleUpXSWpvaU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZNbjA9fDB8fHw%3d&sdata=MUp2OGFEK3NHbGVRekVTc2p5bVdwTlljQ3VoVktJSWZxMS9Falg2ZWhHOD0%3d"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 --field-trial-handle=2224,i,9236425076649525401,17373768222617990273,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

ID:	1467843
Product:	CloudBasic
Start time:	21:42:55
Start date:	04.07.2024
Cookbook:	browseurl.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs