Edit tour

Windows Analysis Report
https://corp4.sharepoint.com/sites/TEA-IPRO-ES-ALL-OTF/List1/pendingreq.aspx?mbypass=1&ApproveAccessRequest=false&AccessRequestID=%7B897A0AEC%2DD338%2D4470%2D8DCF%2DDE0EE0657E05%7D

Overview

General Information

Sample URL:	https://corp4.sharepoint.com/sites/TEA-IPRO-ES-ALL-OTF/List1/pendingreq.aspx?mbypass=1&ApproveAccessRequest=false&AccessRequestID=%7B897A0AEC%2DD338%2D4470%2D8DCF%2DDE0EE0657E05%7D
Analysis ID:	1504844

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

HTML body contains low number of good links

HTML title does not match URL

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 5152 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://corp4.sharepoint.com/sites/TEA-IPRO-ES-ALL-OTF/List1/pendingreq.aspx?mbypass=1&ApproveAccessRequest=false&AccessRequestID=%7B897A0AEC%2DD338%2D4470%2D8DCF%2DDE0EE0657E05%7D MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6792 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1912,i,8273378759110798208,2844953686446609771,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: https://login.microsoftonline.com/8c433003-a081-4dfb-a631-100526250b1a/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=C6E44A603FB6C4B37244DD272F7D8EC3098BE601E7EF16DB%2D634F01399781BE296AE5F28234A5FFFADB8F580A2DDBACE402E3B5F8B10E4A50&redirect%5Furi=https%3A%2F%2Fcorp4%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=88444da1%2Dd0ff%2D3000%2Dc107%2D6f90e74ca5f7	HTTP Parser: Number of links: 0
Source: https://login.microsoftonline.com/8c433003-a081-4dfb-a631-100526250b1a/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=C6E44A603FB6C4B37244DD272F7D8EC3098BE601E7EF16DB%2D634F01399781BE296AE5F28234A5FFFADB8F580A2DDBACE402E3B5F8B10E4A50&redirect%5Furi=https%3A%2F%2Fcorp4%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=88444da1%2Dd0ff%2D3000%2Dc107%2D6f90e74ca5f7&sso_reload=true	HTTP Parser: Number of links: 0

Source: https://login.microsoftonline.com/8c433003-a081-4dfb-a631-100526250b1a/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=C6E44A603FB6C4B37244DD272F7D8EC3098BE601E7EF16DB%2D634F01399781BE296AE5F28234A5FFFADB8F580A2DDBACE402E3B5F8B10E4A50&redirect%5Furi=https%3A%2F%2Fcorp4%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=88444da1%2Dd0ff%2D3000%2Dc107%2D6f90e74ca5f7	HTTP Parser: Title: Redirecting does not match URL
Source: https://login.microsoftonline.com/8c433003-a081-4dfb-a631-100526250b1a/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=C6E44A603FB6C4B37244DD272F7D8EC3098BE601E7EF16DB%2D634F01399781BE296AE5F28234A5FFFADB8F580A2DDBACE402E3B5F8B10E4A50&redirect%5Furi=https%3A%2F%2Fcorp4%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=88444da1%2Dd0ff%2D3000%2Dc107%2D6f90e74ca5f7&sso_reload=true	HTTP Parser: Title: Sign in to your account does not match URL

Source: https://login.microsoftonline.com/8c433003-a081-4dfb-a631-100526250b1a/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=C6E44A603FB6C4B37244DD272F7D8EC3098BE601E7EF16DB%2D634F01399781BE296AE5F28234A5FFFADB8F580A2DDBACE402E3B5F8B10E4A50&redirect%5Furi=https%3A%2F%2Fcorp4%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=88444da1%2Dd0ff%2D3000%2Dc107%2D6f90e74ca5f7&sso_reload=true

HTTP Parser: <input type="password" .../> found

HTTP Parser: No favicon

Source: https://login.microsoftonline.com/8c433003-a081-4dfb-a631-100526250b1a/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=C6E44A603FB6C4B37244DD272F7D8EC3098BE601E7EF16DB%2D634F01399781BE296AE5F28234A5FFFADB8F580A2DDBACE402E3B5F8B10E4A50&redirect%5Furi=https%3A%2F%2Fcorp4%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=88444da1%2Dd0ff%2D3000%2Dc107%2D6f90e74ca5f7	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/8c433003-a081-4dfb-a631-100526250b1a/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=C6E44A603FB6C4B37244DD272F7D8EC3098BE601E7EF16DB%2D634F01399781BE296AE5F28234A5FFFADB8F580A2DDBACE402E3B5F8B10E4A50&redirect%5Furi=https%3A%2F%2Fcorp4%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=88444da1%2Dd0ff%2D3000%2Dc107%2D6f90e74ca5f7&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/8c433003-a081-4dfb-a631-100526250b1a/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=C6E44A603FB6C4B37244DD272F7D8EC3098BE601E7EF16DB%2D634F01399781BE296AE5F28234A5FFFADB8F580A2DDBACE402E3B5F8B10E4A50&redirect%5Furi=https%3A%2F%2Fcorp4%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=88444da1%2Dd0ff%2D3000%2Dc107%2D6f90e74ca5f7&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/8c433003-a081-4dfb-a631-100526250b1a/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=C6E44A603FB6C4B37244DD272F7D8EC3098BE601E7EF16DB%2D634F01399781BE296AE5F28234A5FFFADB8F580A2DDBACE402E3B5F8B10E4A50&redirect%5Furi=https%3A%2F%2Fcorp4%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=88444da1%2Dd0ff%2D3000%2Dc107%2D6f90e74ca5f7&sso_reload=true	HTTP Parser: No <meta name="author".. found

Source: https://login.microsoftonline.com/8c433003-a081-4dfb-a631-100526250b1a/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=C6E44A603FB6C4B37244DD272F7D8EC3098BE601E7EF16DB%2D634F01399781BE296AE5F28234A5FFFADB8F580A2DDBACE402E3B5F8B10E4A50&redirect%5Furi=https%3A%2F%2Fcorp4%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=88444da1%2Dd0ff%2D3000%2Dc107%2D6f90e74ca5f7	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/8c433003-a081-4dfb-a631-100526250b1a/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=C6E44A603FB6C4B37244DD272F7D8EC3098BE601E7EF16DB%2D634F01399781BE296AE5F28234A5FFFADB8F580A2DDBACE402E3B5F8B10E4A50&redirect%5Furi=https%3A%2F%2Fcorp4%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=88444da1%2Dd0ff%2D3000%2Dc107%2D6f90e74ca5f7&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/8c433003-a081-4dfb-a631-100526250b1a/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=C6E44A603FB6C4B37244DD272F7D8EC3098BE601E7EF16DB%2D634F01399781BE296AE5F28234A5FFFADB8F580A2DDBACE402E3B5F8B10E4A50&redirect%5Furi=https%3A%2F%2Fcorp4%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=88444da1%2Dd0ff%2D3000%2Dc107%2D6f90e74ca5f7&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/8c433003-a081-4dfb-a631-100526250b1a/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=C6E44A603FB6C4B37244DD272F7D8EC3098BE601E7EF16DB%2D634F01399781BE296AE5F28234A5FFFADB8F580A2DDBACE402E3B5F8B10E4A50&redirect%5Furi=https%3A%2F%2Fcorp4%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=88444da1%2Dd0ff%2D3000%2Dc107%2D6f90e74ca5f7&sso_reload=true	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.240.158:443 -> 192.168.2.16:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.240.158:443 -> 192.168.2.16:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.240.158:443 -> 192.168.2.16:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.240.158:443 -> 192.168.2.16:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.240.158:443 -> 192.168.2.16:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:49762 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.2
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.2
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.2
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.2
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.2
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.2
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.2
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.2
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.2
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.2
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.2
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.2
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.240.158
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.240.158
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.240.158

Source: global traffic	DNS traffic detected: DNS query: corp4.sharepoint.com
Source: global traffic	DNS traffic detected: DNS query: login.microsoftonline.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: identity.nel.measure.office.net
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.240.158:443 -> 192.168.2.16:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.240.158:443 -> 192.168.2.16:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.240.158:443 -> 192.168.2.16:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.240.158:443 -> 192.168.2.16:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.240.158:443 -> 192.168.2.16:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:49762 version: TLS 1.2

Source: classification engine

Classification label: clean1.win@14/21@18/113

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://corp4.sharepoint.com/sites/TEA-IPRO-ES-ALL-OTF/List1/pendingreq.aspx?mbypass=1&ApproveAccessRequest=false&AccessRequestID=%7B897A0AEC%2DD338%2D4470%2D8DCF%2DDE0EE0657E05%7D
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1912,i,8273378759110798208,2844953686446609771,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1912,i,8273378759110798208,2844953686446609771,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Source	Detection	Scanner	Label	Link
https://corp4.sharepoint.com/sites/TEA-IPRO-ES-ALL-OTF/List1/pendingreq.aspx?mbypass=1&ApproveAccessRequest=false&AccessRequestID=%7B897A0AEC%2DD338%2D4470%2D8DCF%2DDE0EE0657E05%7D	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
s-part-0016.t-0009.t-msedge.net	13.107.246.44	true	false	unknown
195747-ipv4v6.farm.dprodmgd106.aa-rt.sharepoint.com	52.105.216.39	true	false	unknown
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	unknown
sni1gl.wpc.omegacdn.net	152.199.21.175	true	false	unknown
www.google.com	172.217.23.100	true	false	unknown
corp4.sharepoint.com	unknown	unknown	false	unknown
identity.nel.measure.office.net	unknown	unknown	false	unknown
aadcdn.msftauth.net	unknown	unknown	false	unknown
login.microsoftonline.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://login.microsoftonline.com/8c433003-a081-4dfb-a631-100526250b1a/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=C6E44A603FB6C4B37244DD272F7D8EC3098BE601E7EF16DB%2D634F01399781BE296AE5F28234A5FFFADB8F580A2DDBACE402E3B5F8B10E4A50&redirect%5Furi=https%3A%2F%2Fcorp4%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=88444da1%2Dd0ff%2D3000%2Dc107%2D6f90e74ca5f7&sso_reload=true	false		unknown
https://login.microsoftonline.com/8c433003-a081-4dfb-a631-100526250b1a/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=C6E44A603FB6C4B37244DD272F7D8EC3098BE601E7EF16DB%2D634F01399781BE296AE5F28234A5FFFADB8F580A2DDBACE402E3B5F8B10E4A50&redirect%5Furi=https%3A%2F%2Fcorp4%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=88444da1%2Dd0ff%2D3000%2Dc107%2D6f90e74ca5f7	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.246.45	s-part-0017.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.246.44	s-part-0016.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.217.18.4	unknown	United States	15169	GOOGLEUS	false
52.105.216.39	195747-ipv4v6.farm.dprodmgd106.aa-rt.sharepoint.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
20.190.159.2	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.217.23.100	www.google.com	United States	15169	GOOGLEUS	false
142.250.186.131	unknown	United States	15169	GOOGLEUS	false
142.250.186.142	unknown	United States	15169	GOOGLEUS	false
152.199.21.175	sni1gl.wpc.omegacdn.net	United States	15133	EDGECASTUS	false
2.16.238.149	unknown	European Union	20940	AKAMAI-ASN1EU	false
216.58.212.163	unknown	United States	15169	GOOGLEUS	false
40.126.32.136	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.185.74	unknown	United States	15169	GOOGLEUS	false
40.126.32.138	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
66.102.1.84	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1504844
Start date and time:	2024-09-05 14:14:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://corp4.sharepoint.com/sites/TEA-IPRO-ES-ALL-OTF/List1/pendingreq.aspx?mbypass=1&ApproveAccessRequest=false&AccessRequestID=%7B897A0AEC%2DD338%2D4470%2D8DCF%2DDE0EE0657E05%7D
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean1.win@14/21@18/113

Warnings

Exclude process from analysis (whitelisted): svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.186.131, 66.102.1.84, 142.250.186.142, 34.104.35.123, 40.126.32.136, 20.190.160.17, 40.126.32.74, 40.126.32.138, 40.126.32.133, 40.126.32.68, 20.190.160.22, 40.126.32.76
Excluded domains from analysis (whitelisted): www.tm.ak.prd.aadg.trafficmanager.net, clients2.google.com, accounts.google.com, edgedl.me.gvt1.com, clientservices.googleapis.com, login.mso.msidentity.com, clients.l.google.com, ak.privatelink.msidentity.com, 195747-ipv4v6w.farm.dprodmgd106.sharepointonline.com.akadns.net
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: https://corp4.sharepoint.com/sites/TEA-IPRO-ES-ALL-OTF/List1/pendingreq.aspx?mbypass=1&ApproveAccessRequest=false&AccessRequestID=%7B897A0AEC%2DD338%2D4470%2D8DCF%2DDE0EE0657E05%7D

LLM Input / Output

Input	Output
URL: https://login.microsoftonline.com/8c433003-a081-4dfb-a631-100526250b1a/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D0000000 Model: jbxai	{ "brand":["Microsoft"], "contains_trigger_text":false, "prominent_button_name":"Sign in", "text_input_field_labels":["Email, phone, or Skype", "Can't access your account?"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://login.microsoftonline.com/8c433003-a081-4dfb-a631-100526250b1a/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D0000000 Model: jbxai	{ "phishing_score":1, "brand_name":"Microsoft", "reasons":"The domain name 'login.microsoftonline.com' matches the legitimate domain associated with the identified brand, Microsoft. The design is clean and professional, consistent with Microsoft's branding and user interface style. The presence of fields for email, phone, or Skype and the 'Sign-in options' link suggest that the page is designed for users to sign in using various Microsoft accounts, which is consistent with the domain name. No suspicious elements were found in the URL, and the brand association is legitimate and well-known. Therefore, the likelihood of this site being a phishing site is very low, scoring 1 out of 10."}

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Sep 5 11:14:38 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9796130246088675
Encrypted:	false
SSDEEP:
MD5:	3E10521ED34DB645D01AC15D5980C54D
SHA1:	EF551AB3794DDE7C6A4276FFC9544B560861CE7B
SHA-256:	3EB1194C36DA7804452B2EDD1C40D50709518D7014575535CBA5B9B5CF32350F
SHA-512:	30179D075436607C1DA687E8A4616F4C3C1703ACBA5462601FD795C7A87BAC3A53FF51B93AFDD3225D5664E45D4DD2377886CF54C455FA9C5FF414BBBB4AA131
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....G..-....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I%Y.a....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V%Y.a....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V%Y.a....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V%Y.a..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V%Y.a...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........~..O.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Sep 5 11:14:38 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	3.9969478235924143
Encrypted:	false
SSDEEP:
MD5:	4B189CC7C8304F01D5BDBF4BD23E6E97
SHA1:	89824B3DF0BA41FE4FC5509DBA9A7CD428450AA2
SHA-256:	023378376BE239FD84527464779C75E1CC1FAC3F79329DE2451A66B786471DD3
SHA-512:	D88024F410C5ED742752AF5D33896927B626E8D83F03094F2D6128FDD5D781F11FE7E9C672815FE2B34EC025A7422794A2560E60C9C3F4933D31F790EBAABBA7
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.......-....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I%Y.a....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V%Y.a....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V%Y.a....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V%Y.a..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V%Y.a...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........~..O.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.004656563514329
Encrypted:	false
SSDEEP:
MD5:	2DC5C71841D8EDDBF9BC560A8FDA896B
SHA1:	B4443392BB29A727DB090765AFFB71AE3B44C410
SHA-256:	BF19476EBE8D30CA6DF23035E8414C2BDD4928A754255A203CEB595AF4301BB8
SHA-512:	BD5AA9B2DEBF514181C4C1457F609B6E29301DBC8F230111AF2ED54E0C95EB3069D370418BE6C9514ED13554CFEBDDA2E02599EE4EE25DD11F4467E05021621F
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I%Y.a....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V%Y.a....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V%Y.a....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V%Y.a..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........~..O.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Sep 5 11:14:38 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9954376019119646
Encrypted:	false
SSDEEP:
MD5:	9547F88380F6A5D7647523D132504540
SHA1:	C1B1DA024C57A739AD7451E96446D054243CDE04
SHA-256:	267731C3022786D800E50B84FF8362ED0EF7FB2A09DF82AB2CA78112EAA425AC
SHA-512:	AC144F50596B0B94527BDF92C58DBCF8F282551B0AEE28750B5D9A67599E9AB29E16D36BFC97838661A399A88840371EBF068B558EE02E744170B11811EDA79B
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....@.-....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I%Y.a....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V%Y.a....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V%Y.a....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V%Y.a..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V%Y.a...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........~..O.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Sep 5 11:14:38 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9821056533861556
Encrypted:	false
SSDEEP:
MD5:	D493B127F6CC5301A35B1F3E26D32EB4
SHA1:	38F05EF02FDDA836F7B629A9553B181445DE2B0C
SHA-256:	17B9CBBB02DB3E5641FD87CA7B8714B72A3E9CC2B66309C6A7612ED81F597E7B
SHA-512:	C045CA01862B855334F9E508EBE2954788422C6FC4AE673C7F2CEFB0BAD68B82B66657875B8DF9DD15C4052F8EB44EA2339DDD1EEC00E74A3CA36F8DD3C2711B
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....&..-....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I%Y.a....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V%Y.a....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V%Y.a....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V%Y.a..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V%Y.a...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........~..O.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Sep 5 11:14:38 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.989883021601485
Encrypted:	false
SSDEEP:
MD5:	AB14DF6D9C201DC05CBB0A29EE288A96
SHA1:	DD9722F9023C3152C5F1F419D626A667E47265FB
SHA-256:	43DCEE3125D9C53CB89930572C649B2FEFEE2DAEB3610F991589387E424168ED
SHA-512:	F918BFF93023D167338D9C23D076B366E0892D77A662A9FEF4D7DA9667E891E83B1F83EFF820CBB04B36B4D047969CE138FA7517A839810F084FDCC846513A20
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....W..-....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I%Y.a....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V%Y.a....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V%Y.a....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V%Y.a..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V%Y.a...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........~..O.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1864
Category:	downloaded
Size (bytes):	673
Entropy (8bit):	7.6596900876595075
Encrypted:	false
SSDEEP:
MD5:	0E176276362B94279A4492511BFCBD98
SHA1:	389FE6B51F62254BB98939896B8C89EBEFFE2A02
SHA-256:	9A2C174AE45CAC057822844211156A5ED293E65C5F69E1D211A7206472C5C80C
SHA-512:	8D61C9E464C8F3C77BF1729E32F92BBB1B426A19907E418862EFE117DBD1F0A26FCC3A6FE1D1B22B836853D43C964F6B6D25E414649767FBEA7FE10D2048D7A1
Malicious:	false
Reputation:	unknown
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg
Preview:	...........U.n.0....}i..P..C..7l/..d........n...G....yl. .E.......Tu.F.........?$.i.s..s...C..wi$.....r....CT.U.FuS..r.e.~...G.q.....~M..mu}.0.=..&.~.e.WLX.....X..%p..i......7+.........?......WN..%>...$..c..}N....Y4?..x.1......#v...Gal9.!.9.A.u..b..>..".#A2"+...<qc.v....)3...x.p&..K.&..T.r.'....J.T....Q..=..H).X...<.r...KkX........)5i4.+.h.....5.<..5.^O.eC%V^....Nx.E..;..52..h....C"I./.`..O...f..r..n.h.r]}.G^..D.7..i.].}.G.].....{....oW............h.4...}~=6u..k...=.X..+z}.4.].....YS5..J......)......m....w.......~}.C.b_..[.u..9_7.u.u.....y.ss....:_yQ<{..K.V_Z....c.G.N.a...?/..%. .-..K.td....4...5.(.e.`G7..]t?.3..\..... ....G.H...

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Reputation:	unknown
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 141866
Category:	dropped
Size (bytes):	49804
Entropy (8bit):	7.994672288751266
Encrypted:	true
SSDEEP:
MD5:	6DE768A4DF1E0D0061CDB52EF06346C4
SHA1:	3829A667B97668008023DDA98F4C0772174C8EF6
SHA-256:	58732EEE2ED9091F4F5776DC8A8A14116CBE5A2BA1CCDA0256896BAB08A52128
SHA-512:	CC6966D2C2B43E762750102E734DA6B88D7BFB92DDB5D482EE25029337D95E997466E83001586F2B63DAEE890B5F3188E8EC0F1B084D5EB67CFEA55EDDFAD47D
Malicious:	false
Reputation:	unknown
Preview:	...........m[.8.0........OL....;w..nf.0.ff.X.'V......4.r~........=........,..JU.......T~.l..?..E.....X..\|t~P9...TN..G..?^.~.............Xx.0..Q..Fa4.#7.q...F.;......4...Q.W&~.@....O.T.y.37J.+Ggf...P....Pz.N...>..a.D..<.m./A,...Q.....WN.Q...8.Db$.G.H<...'....J,..8..{nG.2@HYkL../......=.pL....A?.&Ng.i,......2lo...$.<.3...?~pW..=...L..&x.QR.u3..#6q2....U.Y1..".M. .<W."7@......w..."H,@......0..P....p:...[...E].A..%..V.K\.......F.ir.}.Lc{s..O.g..(\|.........9o..A.t.K....Wv.l6..T.......t.........+..........-w {l..g...V..\=W.j.oaT}t.J`E..$W......;.k.\.t.w~}".....jf..W..."..a..0y........@.T.1.G0........Y_....../..........@.....]+....q\.cR.....t.3S-5g....'U.j.d......y.n,:).\|.?.FW...d...\|.......*.`.3....kMKf...#..,DM.TY+..g.........e+.>...{y..N/..g-#FV.V.p.......Xs.(..{..}..-.O..H=."...........8M.g..!H..0.~.Tdf.;...$D%N .)..!..V...'r\.... ...&....J\|."Nd%D:uw:.<W.+...H&.Z...L=..U.v....J.t.0%+...U..3M....y...L..G...p='.....pB"-..\|.....j .a".i=O.R Q2..."...

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (3450), with CRLF line terminators
Category:	downloaded
Size (bytes):	3452
Entropy (8bit):	5.117912766689607
Encrypted:	false
SSDEEP:
MD5:	CB06E9A552B197D5C0EA600B431A3407
SHA1:	04E167433F2F1038C78F387F8A166BB6542C2008
SHA-256:	1F4EDBD2416E15BD82E61BA1A8E5558D44C4E914536B1B07712181BF57934021
SHA-512:	1B4A3919E442EE4D2F30AE29B1C70DF7274E5428BCB6B3EDD84DCB92D60A0D6BDD9FA6D9DDE8EAB341FF4C12DE00A50858BF1FC5B6135B71E9E177F5A9ED34B9
Malicious:	false
Reputation:	unknown
URL:	https://login.live.com/Me.htm?v=3
Preview:	<script type="text/javascript">!function(t,e){for(var s in e)t[s]=e[s]}(this,function(t){function e(n){if(s[n])return s[n].exports;var i=s[n]={exports:{},id:n,loaded:!1};return t[n].call(i.exports,i,i.exports,e),i.loaded=!0,i.exports}var s={};return e.m=t,e.c=s,e.p="",e(0)}([function(t,e){function s(t){for(var e=f[S],s=0,n=e.length;s<n;++s)if(e[s]===t)return!0;return!1}function n(t){if(!t)return null;for(var e=t+"=",s=document.cookie.split(";"),n=0,i=s.length;n<i;n++){var a=s[n].replace(/^\s(\w+)\s=\s*/,"$1=").replace(/(\s+$)/,"");if(0===a.indexOf(e))return a.substring(e.length)}return null}function i(t,e,s){if(t)for(var n=t.split(":"),i=null,a=0,r=n.length;a<r;++a){var c=null,S=n[a].split("$");if(0===a&&(i=parseInt(S.shift()),!i))return;var l=S.length;if(l>=1){var p=o(i,S[0]);if(!p\|\|s[p])continue;c={signInName:p,idp:"msa",isSignedIn:!0}}if(l>=3&&(c.firstName=o(i,S[1]),c.lastName=o(i,S[2])),l>=4){var f=S[3],d=f.split("\|");c.otherHashedAliases=d}if(l>=5){var h=parseInt(S[4],16);h&&(c.

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
Category:	downloaded
Size (bytes):	1435
Entropy (8bit):	7.8613342322590265
Encrypted:	false
SSDEEP:
MD5:	9F368BC4580FED907775F31C6B26D6CF
SHA1:	E393A40B3E337F43057EEE3DE189F197AB056451
SHA-256:	7ECBBA946C099539C3D9C03F4B6804958900E5B90D48336EEA7E5A2ED050FA36
SHA-512:	0023B04D1EEC26719363AED57C95C1A91244C5AFF0BB53091938798FB16E230680E1F972D166B633C1D2B314B34FE0B9D7C18442410DB7DD6024E279AAFD61B0
Malicious:	false
Reputation:	unknown
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg
Preview:	...........WMo.7..+..uV.HJ...{..........&..v...(Q.F.....aW.Q.\|..~.\|{~...b{8...zv.....8\|...b.gxb.y{.x<\lS...p...p..l7...o.}.v.....t.........r..r.\|9?.......HP...r.4.aGA.j....7.!....K.n.B.Z.C.]....kj..A..p...xI...b..I!K..><.B..O....#...$.]h.bU.;.Y...).r.u....g.-w.2..vPh....q....4_..N\..@y).t{.2pj.f..4h.....NC.....x.R..P..9.....".4.`%N..&...a.@.......fS)A4.F..8e9KHE....8d.CR.K..g..Q.......a....f.....dgN.N.k..#w..........,.".%..I.q.Y.R]..7.!.:.Ux...T.qI..{..,b..2..B...Bh...[o..[4....dZ.z.!.l....E.9$..Y.'...M.,p..$..8Ns3.B.....{.....H..Se3....%.Ly...VP{.Bh.D.+....p..(..`....t....U.e....2......j...%..0.f<...q...B.k..N....03...8....l.....bS...vh..8..Q..LWXW..C.......3..Pr.V.l...^=VX\,d9f.Y;1!w.d,.qvs....f;.....Zhrr.,.U....6.Y....+Zd.R...but....".....4.L...z........L.Q......)....,.].Y.&....*ZsIVG.^...#...e..r....Z..F..c..... .QDCmV..1.~...J9..b_Oov\..X.R..._.TqH.q.5G.0{ZphQ..k...s..\.../.Dp..d`#......8.#Y...Mb.j.Q......=n4.c....p.[.SI.....0.N.

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 56820
Category:	dropped
Size (bytes):	16232
Entropy (8bit):	7.987213193680252
Encrypted:	false
SSDEEP:
MD5:	F9A55BC178DAFD6F0F57055683EE6B66
SHA1:	5C74F14D930CF8E81A230046AA5DE4B2839731D4
SHA-256:	366CF1D8C2358371A14A8BDA0B9F616C7AC24002E8BFCF074BCAEFAAF8D531F0
SHA-512:	417A7FC42328FA52CE8E0E399C0759195A789A4D36F180B982691062511246B563928E1C325B43E89CDFDB9D0B88380294D9FD6E6452BCD1C21E617193A485D7
Malicious:	false
Reputation:	unknown
Preview:	...........}Ms#G.....uh.O=.>...4..p.O$...P.IF4.".K....1..5.......7.\|.....S6..w8?......9.j.B1DwUeUeeeefef..f.Oc/._..G.............{..._..%.q..q........j<.w..O.7..."pgbV.C..k.T`..X....'v....<p....I.'..k<j@Ai..NP.6<.w.(...ey.....i8...._V.h.~.{Y....`......6..(.=...wC......es....;.~.....+../.b.E..G.:....(....'.K...&..p2...zu..w.&.?w..b2...F...7...p.M. .n.;..k?.:......i../.M..1Ah...'N]..Ll@..p... ....:N.."p.. Xx..cL...O..7.z.O.^......s.O..h..V...\|1..@.....XL....o..X/by..C..,......0.~$........._.......Z.._...~U).....j...C..`.."..t.z.-..m.]..3y...S@...'.KSzS...4.b......`.....K.[.&....._z..eF.)......'L"..E4...R.._$t.V......=.k..dv.O...b_...8u#...P,a......T..ks........f...?....X..E.."f@a.fn!$......U..B$B...\d........t......w......\?`q..........0..(...C..!..=.xk....(.w.O..".!b.4...t$g..r...7..\|.....m.;(..Y.....V...Y........._a.7./..........y0u...B.TH...].k...^..sOf.2.2'....Ra$.......N........n..#.."...3.."D..)...[...H......vwT...Jh.^.(.....s...e..?....

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113401
Category:	downloaded
Size (bytes):	20414
Entropy (8bit):	7.979508934961097
Encrypted:	false
SSDEEP:
MD5:	48981D3CF57E7C58CA7E3E851EF9354E
SHA1:	73593DE7633B10F9FFD0EF0E46280FA40FF433FF
SHA-256:	8A5E756923CC5C3F013862427B7622F58A52501C5A6017FFF2FDB2AFD94A10C2
SHA-512:	4E2B6EA222CE77E6EC12E059362DDDEA13758CDC77259FF5CF449BED5A1677E112CF49CD7ED7B1378F96FFD7C5E21BE66D2CA7EB2A9CD8026732F867FB5AE8B1
Malicious:	false
Reputation:	unknown
URL:	https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_qzvqnltrxpy99ajspyxbgq2.css
Preview:	...........}ks.6.....\.R;.J.H=-WR;..&>g^53.G.R[.DY<C..$e.WG..... )...{+'g...l............bw_f7.:x..<x.-.V5)/wE..Y...gy.0.(.-o.e.\|..._..I.....?<{.!x...W..._..^..p..E..'..Y...<.....]..6(. ..D.....Y.......:.ve.?..!..\|t...].+.......a.......\|.P...u.H.d.d.r.c[..~.L..n.-.}e.H3...r..^..iP.u..z.....)..Z.jx..C'......u..{.C...N.o.m~..F(b..f.....h..O.....6....kr.......n2m M$.R..R..i{.~.....n.dKY..#.Kn.4..G...O..l.#.a=..iU..].S.2.wY..O.\|...Z.A....].uU.._%U.<...pp..u=.....C.R..S.....0...A<......&...W..'o.T.."..jO..^+.....DiW.b..7i..7..........lKe.0.~B0.....zQu#...YB.,.{.&.6..G.6..._...J.i.?.LS$( .^.{..u.-.0....K....M&j..s.yB..+....^.)...7e.....]..eFI_.kRX.B......D[.4......+.u=>....R.`QEK...R..d...*S.. ,c5RKBK(......][..eF{T.....6...".....Uk:..S.0Ro.}B.dwJZ}U..S.F.....&.&.~\|......{..Ep.>x..._....}p..=.}...v...7?}...g..1&.......}...^...o.x.>x...../.^....._.........w.v./.........BA...{J..w..$?.}w....?zO.r..5...7.gl..z...g.?.{....R.......yGj

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 406986
Category:	downloaded
Size (bytes):	116365
Entropy (8bit):	7.997737813291819
Encrypted:	true
SSDEEP:
MD5:	2D3FBED6DDD719FCC1BFB500B612FCEC
SHA1:	CD91B795DDE806AC8A38E51CCB6E8BAD8E57DA1B
SHA-256:	B2566B646F02DF4CE30B05D8223B78130A719D4EC9E4794A0106C371ADE33CC7
SHA-512:	A870E514B325D6FDC4D154438A8DD333C7AB46E545C1B27AC4869D9F1D8594CA1CDC530F5E96C835220DDAD4E1CEF841673696978031B5237E783972AEE701D1
Malicious:	false
Reputation:	unknown
URL:	https://aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_117b650bccea354984d8.js
Preview:	...........k[.H.(.}..[..-..c.0DFxHBz.I......O.a...#yt......k...J..&...........^.~...._..j...W;.8<.....]....m...~.}<.8~s.~=.(....qm.Oy.~....jaP......h.F^......\|oZ.G.M-...,...a..~..GW\|...L....N.(y...Z-..Cm......p.......?.5/.QmS..b^K...jw..8.}..Q.....!.o..8...&X.x-.Im.F.D..U;.....-.T.:...1........8Ka..M.L.ZZ'....>........x....v.S;.<...0J.I.0.G.....B.F..c.k.~....C.:...r..,.w.q~....q......#42V.q..f\|.kK...1o.mP.}.......N..n.w6.%^M.d.;...~2I.Z..fs...S/......F..=?...5....s..N.+.A.mx...j.T......?..W._p6.\|.}\|.{O.....2..`..._......g....j..xb^^...a.y.....s......4....q.Y..^T....X,.....m..~v,.....WP.U...:O".YoRX...7..S...zI.v.......mq.....E.,z.%....L\|.>.M.'i..ki3.u+.~...x.=...?6.%?.[.G.`Z=.$.w..4.."...R.1.k.\|..N.`......3...7.].'.E..).az......<a....4q..6.(..=~..........frk..?M#^Q.z..A..M.f.......S....s..d.e91._,zO.[X.......4.G..!.9Vg.......j.-?~.z.w..f.M............,...Z....w5..#.^..M.P.'.X.n/..mW.\|......0...w../...>\...l.......h...q>.w...FC[....7.

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (64616)
Category:	downloaded
Size (bytes):	449652
Entropy (8bit):	5.4487744563423615
Encrypted:	false
SSDEEP:
MD5:	30F74EEDD39D908E24CF953F1798F3FC
SHA1:	E6E1F5FFBB3093936E9F47B291057F8460F85FAA
SHA-256:	9CDA4FC8F6F0ED5026ABBA17CBAB8A8F4B2910B4C07CAFEF892C878926BCF832
SHA-512:	D716A90FF6256E54E6FD6293B89B29FC78715E99696CEBE45F4D7881C83993F428EA4F4ADCB7889B1CD8BE81DD73DE09B2D8310B52DFB75DBE62FA1672DF528B
Malicious:	false
Reputation:	unknown
URL:	https://aadcdn.msftauth.net/shared/1.0/content/js/ConvergedLogin_PCore_MPdO7dOdkI4kz5U_F5jz_A2.js
Preview:	/!. ------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------. * . * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under the licensing terms for the Microsoft product. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise.. * . * json2.js (2016-05-01). * https://github.com/douglascrockford/JSON-js. * License: Public Domain. * . * Provided for Informational Purposes Only. * . * ----------------------------------------------- END OF THIRD PARTY NOTICE ------------------------------------------. */!function(e){function n(n){for(var t,i,o=n[0],r=n[1],s=0,c=[];s<o.length;s++)

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 119648
Category:	downloaded
Size (bytes):	40454
Entropy (8bit):	7.992737010031678
Encrypted:	true
SSDEEP:
MD5:	1D65BDDAE4EAEEFC77CB9CFECC565B5D
SHA1:	A7D87150DA1DF6AE6DB87D98760DB7D753DBF6B9
SHA-256:	B98D5BA052230DB0ABC1B0E7B09D814114F6B7C316836BEB88E7B49057DAFEC0
SHA-512:	F2CF9D120D7E18AE3FD77CD85176401A3EB7DB4AF10E16D58C21D86F738FC74525A21E3A319197435E43E50E61DFA8CB2F7207962105360E7BE5652A28165944
Malicious:	false
Reputation:	unknown
URL:	https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js
Preview:	............{{..7..y...D4e.sH.v.w......m.r.....&..b.`.P."r...~k..\(...=n#.2..5.N..N~.v'....g..G......N.~q.i.KWq.d.I..N..Z.'.,-........>.e...&Y..'ON......K\|.KQ.........^..WI.QT.oe.>..V........w.,/.Y.6..U.......Lo..U..C..{U......T....,.==.\..KrY..'wI..2wIyMw.K/.........B..{45r..r..Lw..3....I!l..lL.m....\|!..k...J...Y.......Q.I.Wt...........-....Y..mI...vs.S.TP.....]P..;j3..."..Q.]P?.+qK7.q..]J}....qt[..D.j\."....&j..3.......72.fQ..l%_..A...$.m6..>.QD@... ^F.v..2z@uao,.\|....@../....05.....4x...".I..(.._..e..R..HT.{.2O.....lT.we. _.P.'Iz..\|..y...yM..j.P...~...~6j.D.Li.e..z.tu~.lV~...qN...fg...V.7.;...<..........}...yf...`>.....g.y.<q..7.i....h..\%%.q.z.>.......^...M..u.n..1...z7t.......y..S..Bc.).....X.~.\|F.....B0..E....d.B_.Z.....[.Z./..B8.e..-U....P..]N....k.%p...l<..\......A`W^...m.J5c...._I.j.t.......Q...1..B...>^...+d.p.o.bi.D..O...~... @..m*.4.z..uLd..Bc).:.x?..`..Ey....?.2...".....2}.?.FW.\|d.~9...~.C.V..y.'..M..........`...E.77>..~?=+gs..t

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592
Category:	downloaded
Size (bytes):	621
Entropy (8bit):	7.673946009263606
Encrypted:	false
SSDEEP:
MD5:	4761405717E938D7E7400BB15715DB1E
SHA1:	76FED7C229D353A27DB3257F5927C1EAF0AB8DE9
SHA-256:	F7ED91A1DAB5BB2802A7A3B3890DF4777588CCBE04903260FBA83E6E64C90DDF
SHA-512:	E8DAC6F81EB4EBA2722E9F34DAF9B99548E5C40CCA93791FBEDA3DEBD8D6E401975FC1A75986C0E7262AFA1B9D1475E1008A89B92C8A7BEC84D8A917F221B4A2
Malicious:	false
Reputation:	unknown
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg
Preview:	..........}UMo"1..+.....G; .8l...M..$.U.AW......UaX..`'.=......\|..z3...Ms>..Y...QB..W..y..6.......?..........L.W=m....=..w.)...nw...a.z......#.y.j...m...P...#...6....6.u.u...OF.V..07b..\...s.f..U..N..B...>.d.-z..x.2..Lr.Rr)....JF.z.;Lh.....q.2.A....[.&".S..:......]........#k.U#57V..k5.tdM.j.9.FMQ2..H:.~op..H.......hQ.#...r[.T.$.@........j.xc.x0..I.B:#{iP1.e'..S4.:...mN.4)<W.A.).g.+..PZ&.$.#.6v.+.!...x...}.._...d...#.Cb..(..^k..h!..7.dx.WHB......(.6g.7.Wwt.I<.......o.;.....Oi$}f.6.....:P..!<5.(.p.e.%et.)w8LA.l9r..n.....?.F.DrK...H....0F...{.,.......{E..".......x.@..?u......../....8...

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 11970
Category:	dropped
Size (bytes):	4880
Entropy (8bit):	7.966397036823352
Encrypted:	false
SSDEEP:
MD5:	03C76051E45F8BAFD592731BA31E82BB
SHA1:	58F5464CCAB2D8096ABCA4E4324DE38B7C4B829E
SHA-256:	F8D8EEB949623360942057B5ABDB018AC7AEDE91092961BA52A417F4C64700A7
SHA-512:	253A9F9D5F59AEC12DF2B69AB71414F6EA76EBD5464C66DD107347E20E303610BC371764EEFCBEC3FA031CC03A30C556486AD9DD833A2B6FAAA3714BDC2DDA95
Malicious:	false
Reputation:	unknown
Preview:	...........Z{s..._..Fs.2.(9..RX..;[.m..LoWR2..JL)R....K.}...ERV...lfb.yp....'...........;..~:.8a.....=.:{}..pZ..E..(N...u....R.I...L.2...%..8LX$.%S..V2.$.gI.+l..Iv....3.....s}v.....q...lu..B.4S.T.0.ih.:i.X..d7.x.`..S..Y...S...!y.......`.P,.Z.<\|vI+-.\.cN..r .9..`..._..g....'K.;...........e...'N..\|[........Y1U~..\..b....%....w&nWX.'wl..X^....s).R.....z}.....h.<&r..V"!.j.7q.\|.j.'.S..O.O9s...^vz/:.#.&.J..~.;......;.y..@z.;.u.yy...)..?......'..l..i.........>.........s......[h...].^^.....v....NO\|...._...._.._......[..)is:}{..5..{.m......n%...{......7....hw.{^@.s%c....,r.{/.d.....x[..f..D..s.....1_..G.[.....A...E>.W.u"\|.Q.A.n.....+l.>...b..S..Tt....z.,..Gb20'q",..d...>....vx..@.?]..u6............9...y.n.6..k\.U..#..)...R/.b...`...<P.M~.......K.l1...Vm.xX..A............Oa...cq.......[1....@O...Z..d....X..-Gr..UI...,KD....r.v.Yii..s..Z`vl0.F.....Q....Gf.;.2.....\...X#..r.....Q.=L...D.s..d...W.@..#....I@....zmO..fA.g.v.&.......M....,N....

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113769
Category:	downloaded
Size (bytes):	35168
Entropy (8bit):	7.99275807202193
Encrypted:	true
SSDEEP:
MD5:	D3B6AE9986DF244AB03412CC700335D0
SHA1:	BAAA1F9899178938F3881F09B18265E47DA806E3
SHA-256:	CA50059111D30C2E212C90805792EB543548AEF0D4941E886A778E3DCE0B9066
SHA-512:	755C57FBC9BECE435A477F76C5E8198CA8942C23BE667ACAB83A00E5CD4F54075B10AA07C7FDC10C38FC3D5C0C406C9132FEB5B67BA5BCCC57EF796054A84E7C
Malicious:	false
Reputation:	unknown
URL:	https://aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_4285088f1dbaf52a876d.js
Preview:	...........kC.H.0......e....0.pX..Iv3..\f..0YY.m..e$.K..o...j..g.3.lpW.......[..Y.?k.Y.......8~.a..../_.;]{.............v...0..q.Dk.w...h-....Z<..l.fA..k3.7..dm....b..-...(,.$...4...f...e...AV..z.mA....O.9........k..h-.......<Z[.GQ.v3....Oq..y:..(..k.$_...._..h-...q..S.ck.=.T......Sq@.:.A.c.(....SDq..Ac.t..m.$Lc....Z...K...O<....f9..p...0Z..3.<...$YK.x.F......v....nm..s$...&..dQ4.......n-.-.......E.XD..-5~...f.....t...-_.....fsg...8kZ..\|.{{....p+Lg.t9I..P./ap......o9Wx.._{....k..,...............................7.\|..t...Ax.7..b..v..v.m-...~v...:....r..._........,...A........:..z.>.y..u.....N...^..S.......z~@..;...n...K........x..A]....F.8X&Em..P.s.....a.g.\|.d......._..C`.xQ...\..'...QP....?.R.{?....\|.>........E4.GRz...z.k.z.}....h..>.{[E.:.....Pu. ..e6_.o.p*.w...>...:...o.k~...~..&E._..}}.}%[. ..#......z.5M.b.....z..k.H.4...l..D.o...z..M.+../..`....?y.J4.=....u.....Z.....E.d.....{0H^...8.....9..h......d..6j......../..z..V<.`.F.xm.y..yt.J....

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 9285
Category:	downloaded
Size (bytes):	3921
Entropy (8bit):	7.948633187405583
Encrypted:	false
SSDEEP:
MD5:	BA9DA2AE129596B81DE1FAFFB02CD0F7
SHA1:	8208ED791107C4D13D2DB619560EAC4707B03074
SHA-256:	23DC170CF8AE0615D3E4A6F406DAE6A0FC002BB3CA385C0C2957BFE7000F147B
SHA-512:	068268534557DE84E01F01EE2E9D025F4651183AA7A46D67286FD2E2482FEC84C618F1559CEE8256F9FC1F5CE1F8EB6F5808A2F67E49CBAB1C05758A80A5FA19
Malicious:	false
Reputation:	unknown
URL:	https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/watson.min_q5ptmu8aniymd4ftuqdkda2.js
Preview:	...........Zks.6..>..F.d2.9.f.....+;..+...V..EB......m]K.}O.$E..$..26.G..8}.....Q.(.z..#.E^h.>...Bj..Z.R.r..GJ..eo.2..4UY..X....U-^..{N..3..P;:x[w...._y..[...'.....r]D..~.nr...y=..#[-.BN............~4.uV+;.m.:..\siUi...,.KW.......a&h....)...^.N....v.3.@..a.bT.....-!\.......y.WY...J?G.i.V1.T..;;n'...U..Z ..t2...5.....E2..7PoG..s.."....z...M;Ap.z.......8..}..:\|.f8.......I2G....J..Q.....OS.T!c.s........u.....0....;.k.$............s..V..K....xa..H......h....Z.yE.s..oN.x @.gnex.}E..1;7 .A.q.f]..W.!..........7,K&2.`].Y.'..j..X.A..n.I....ZxF.W.......~6O...-..[?..~..y.M...;..=.B.^....h.k.=<...0.Z........4.......K... .1K.@.<...nY.^s..p.......J..p0..>..}5.:l..?.Y.N.Z.Bu[....GTz...`.#..d...3!...4....wzp. ..Iws...W..E.o....5{..3...I\|!.]..E. o.'M..`.. ...U.(.X# .r..:..;.D....JV.Jx..4..j....5}.B.VI....)1x5..dN...(...q.y..cF..*......$......"s$.j...M`.Bu..A2..W.....\...=+...l..6..c.E0q3....7....]....&v..]...^.....u.z.cp..4\.L,.-..(..

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	36
Entropy (8bit):	4.503258334775644
Encrypted:	false
SSDEEP:
MD5:	06B313E93DD76909460FBFC0CD98CB6B
SHA1:	C4F9B2BBD840A4328F85F54873C434336A193888
SHA-256:	B4532478707B495D0BB1C21C314AEF959DD1A5E0F66E52DAD5FC332C8B697CBA
SHA-512:	EFD7E8195D9C126883C71FED3EFEDE55916848B784F8434ED2677DF5004436F7EDE9F80277CB4675C4DEB8F243B2705A3806B412FAA8842E039E9DC467C11645
Malicious:	false
Reputation:	unknown
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISFwmCAmly1gHbXRIFDdFbUVISBQ1Xevf9?alt=proto
Preview:	ChgKDQ3RW1FSGgQIVhgCIAEKBw1Xevf9GgA=

Static File Info

⊘No static file info

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://corp4.sharepoint.com/sites/TEA-IPRO-ES-ALL-OTF/List1/pendingreq.aspx?mbypass=1&ApproveAccessRequest=false&AccessRequestID=%7B897A0AEC%2DD338%2D4470%2D8DCF%2DDE0EE0657E05%7D

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 102

Chrome Cache Entry: 104

Chrome Cache Entry: 80

Chrome Cache Entry: 81

Chrome Cache Entry: 82

Chrome Cache Entry: 84

Chrome Cache Entry: 85

Chrome Cache Entry: 87

Chrome Cache Entry: 88

Chrome Cache Entry: 90

Chrome Cache Entry: 92

Chrome Cache Entry: 93

Chrome Cache Entry: 94

Chrome Cache Entry: 95

Chrome Cache Entry: 99

Static File Info

Windows Analysis Report
https://corp4.sharepoint.com/sites/TEA-IPRO-ES-ALL-OTF/List1/pendingreq.aspx?mbypass=1&ApproveAccessRequest=false&AccessRequestID=%7B897A0AEC%2DD338%2D4470%2D8DCF%2DDE0EE0657E05%7D