Edit tour

Windows Analysis Report
https://www.dropbox.com/scl/fi/ocmxhujczma623yxj6y29/Attention-_-Salary-Amendment-Updated-Employee-Handbook-Benefit-Enrollment-2024_2025.paper?oref=e&r=ACRm_hPlErV40Cd1zIP89wkIlFQF_89rGVAuXk_8bNLVEQBbMWfgZVCOjNPS76aaZwAZfDc4Xo2P176W3am-1A-GKNdfOUMtQ0zcIcJLSeq0d7kmDrWgClTMKZWQ0Y2kzdL-oHmexUWOnpxcurKZ

Overview

General Information

Sample URL:	https://www.dropbox.com/scl/fi/ocmxhujczma623yxj6y29/Attention-_-Salary-Amendment-Updated-Employee-Handbook-Benefit-Enrollment-2024_2025.paper?oref=e&r=ACRm_hPlErV40Cd1zIP89wkIlFQF_89rGVAuXk_8bNLVEQBb
Analysis ID:	1523778
Infos:

Errors URL not reachable

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Stores files to the Windows start menu directory

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

chrome.exe (PID: 2108 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5820 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 --field-trial-handle=2020,i,6035491936615944162,2809238674400728017,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6488 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.dropbox.com/scl/fi/ocmxhujczma623yxj6y29/Attention-_-Salary-Amendment-Updated-Employee-Handbook-Benefit-Enrollment-2024_2025.paper?oref=e&r=ACRm_hPlErV40Cd1zIP89wkIlFQF_89rGVAuXk_8bNLVEQBbMWfgZVCOjNPS76aaZwAZfDc4Xo2P176W3am-1A-GKNdfOUMtQ0zcIcJLSeq0d7kmDrWgClTMKZWQ0Y2kzdL-oHmexUWOnpxcurKZ8r9xoLPtk7VkdABI-FkyJQclVoAMLGCloMq4KRb2O2vhFwo&sm=1&dl=0" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

HTTP traffic detected: GET /scl/fi/ocmxhujczma623yxj6y29/Attention-_-Salary-Amendment-Updated-Employee-Handbook-Benefit-Enrollment-2024_2025.paper?oref=e&r=ACRm_hPlErV40Cd1zIP89wkIlFQF_89rGVAuXk_8bNLVEQBbMWfgZVCOjNPS76aaZwAZfDc4Xo2P176W3am-1A-GKNdfOUMtQ0zcIcJLSeq0d7kmDrWgClTMKZWQ0Y2kzdL-oHmexUWOnpxcurKZ8r9xoLPtk7VkdABI-FkyJQclVoAMLGCloMq4KRb2O2vhFwo&sm=1&dl=0 HTTP/1.1Host: www.dropbox.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: www.dropbox.com
Source: global traffic	DNS traffic detected: DNS query: cfl.dropboxstatic.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: unknown

HTTP traffic detected: POST /threshold/xls.aspx HTTP/1.1Origin: https://www.bing.comReferer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: */*Accept-Language: en-CHContent-type: text/xmlX-Agent-DeviceId: 01000A410900D492X-BM-CBT: 1696428841X-BM-DateFormat: dd/MM/yyyyX-BM-DeviceDimensions: 784x984X-BM-DeviceDimensionsLogical: 784x984X-BM-DeviceScale: 100X-BM-DTZ: 120X-BM-Market: CHX-BM-Theme: 000000;0078d7X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66EX-Device-ClientSession: DB0AFB19004F47BC80E5208C7478FF22X-Device-isOptin: falseX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-Device-OSSKU: 48X-Device-Touch: falseX-DeviceID: 01000A410900D492X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,staticshX-MSEdge-ExternalExpType: JointCoordX-PositionerType: DesktopX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateX-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard TimeX-UserAgeClass: UnknownAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: www.bing.comContent-Length: 2484Connection: Keep-AliveCache-Control: no-cacheCookie: MUID=2F4E96DB8B7049E59AD4484C3C00F7CF; _SS=SID=1A6DEABB468B65843EB5F91B47916435&CPID=1727827925882&AC=1&CPH=d1a4eb75; _EDGE_S=SID=1A6DEABB468B65843EB5F91B47916435; SRCHUID=V=2&GUID=3D32B8AC657C4AD781A584E283227995&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231004; SRCHHPGUSR=SRCHLANG=en&IPMH=986d886c&IPMID=1696428841029&HV=1696428756; CortanaAppUID=5A290E2CC4B523E2D8B5E2E3E4CB7CB7; MUIDB=2F4E96DB8B7049E59AD4484C3C00F7CF

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703

Source: classification engine

Classification label: unknown1.win@16/39@8/4

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 --field-trial-handle=2020,i,6035491936615944162,2809238674400728017,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.dropbox.com/scl/fi/ocmxhujczma623yxj6y29/Attention-_-Salary-Amendment-Updated-Employee-Handbook-Benefit-Enrollment-2024_2025.paper?oref=e&r=ACRm_hPlErV40Cd1zIP89wkIlFQF_89rGVAuXk_8bNLVEQBbMWfgZVCOjNPS76aaZwAZfDc4Xo2P176W3am-1A-GKNdfOUMtQ0zcIcJLSeq0d7kmDrWgClTMKZWQ0Y2kzdL-oHmexUWOnpxcurKZ8r9xoLPtk7VkdABI-FkyJQclVoAMLGCloMq4KRb2O2vhFwo&sm=1&dl=0"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 --field-trial-handle=2020,i,6035491936615944162,2809238674400728017,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	unknown
www-env.dropbox-dns.com	162.125.66.18	true	false	unknown
www.google.com	216.58.206.68	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	unknown
www.dropbox.com	unknown	unknown	false	unknown
cfl.dropboxstatic.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.dropbox.com/scl/fi/ocmxhujczma623yxj6y29/Attention-_-Salary-Amendment-Updated-Employee-Handbook-Benefit-Enrollment-2024_2025.paper?oref=e&r=ACRm_hPlErV40Cd1zIP89wkIlFQF_89rGVAuXk_8bNLVEQBbMWfgZVCOjNPS76aaZwAZfDc4Xo2P176W3am-1A-GKNdfOUMtQ0zcIcJLSeq0d7kmDrWgClTMKZWQ0Y2kzdL-oHmexUWOnpxcurKZ8r9xoLPtk7VkdABI-FkyJQclVoAMLGCloMq4KRb2O2vhFwo&sm=1&dl=0	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
162.125.66.18	www-env.dropbox-dns.com	United States	19679	DROPBOXUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
216.58.206.68	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.5

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1523778
Start date and time:	2024-10-02 02:11:30 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 1m 47s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://www.dropbox.com/scl/fi/ocmxhujczma623yxj6y29/Attention-_-Salary-Amendment-Updated-Employee-Handbook-Benefit-Enrollment-2024_2025.paper?oref=e&r=ACRm_hPlErV40Cd1zIP89wkIlFQF_89rGVAuXk_8bNLVEQBbMWfgZVCOjNPS76aaZwAZfDc4Xo2P176W3am-1A-GKNdfOUMtQ0zcIcJLSeq0d7kmDrWgClTMKZWQ0Y2kzdL-oHmexUWOnpxcurKZ8r9xoLPtk7VkdABI-FkyJQclVoAMLGCloMq4KRb2O2vhFwo&sm=1&dl=0
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	UNKNOWN
Classification:	unknown1.win@16/39@8/4
Cookbook Comments:	URL browsing timeout or error

Errors

URL not reachable

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.74.195, 74.125.133.84, 142.250.184.238, 34.104.35.123, 104.16.100.29, 104.16.99.29, 184.28.90.27, 20.114.59.183, 199.232.214.172, 192.229.221.95, 20.242.39.171
Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, clientservices.googleapis.com, ctldl.windowsupdate.com, cfl.dropboxstatic.com.cdn.cloudflare.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, ocsp.digicert.com, e16604.g.akamaiedge.net, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, clients.l.google.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 1 23:12:23 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9736177288998498
Encrypted:	false
SSDEEP:	48:8LdawT6UjTH5idAKZdA19ehwiZUklqeh+y+3:8BL/9y
MD5:	1A8F881C19A3E37EDDFE920CDDEFB81C
SHA1:	A5CFD93778F9096179FA44C16B6493C18D8AD32F
SHA-256:	87E384F88CA75B25479028B7CB107C74A598F8EEB0494E13FD5DEE8789438E28
SHA-512:	3164FF9784FE82D47130F9E197BC88E23024B8FAD7DE15E98EFCC399D0039E8E2044CA0967C7DCF631DA96BD43B6EFB4615F608EB4740367EEEE7D6EF385816F
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....;p._...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IBY......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VBY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VBY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VBY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VBY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............X.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 1 23:12:23 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9906468015567977
Encrypted:	false
SSDEEP:	48:8XsdawT6UjTH5idAKZdA1weh/iZUkAQkqehty+2:8kLF9QAy
MD5:	33A991F4650DCE0158D783FC4531679E
SHA1:	71964B8CE3E5948449C6C86E40D626D026DCB312
SHA-256:	6184A9DE96D13AEA48DF289A2A6557FC5A139EAFB3F83A24C72BE9853659B2FC
SHA-512:	6681DA0A279CD045A11723454117CAE3F9D455B32B690E5D3671EC654A6335EE860245ACB4320861425689DB07F041CD5B3BA06632C6B8AC23577282336CA421
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....?._._...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IBY......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VBY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VBY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VBY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VBY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............X.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.004518224100405
Encrypted:	false
SSDEEP:	48:8x0dawT6UjsH5idAKZdA14tseh7sFiZUkmgqeh7sHy+BX:8xsLsnBy
MD5:	09C05A58EDBB9C2B930A21921DC7AF45
SHA1:	381DE9E901F8515DFE4E5851DA45345EDD5EBC40
SHA-256:	8E04570A7B9042262A5CD9CFB26E5A0DE842B0A400A6AD9846E0065E9F6B4FE9
SHA-512:	FF9D1875828DA8FFE7F32040A41E51889E33C6E13857A19AF97AEAD5AE47532FA44218BBC463D2E7225873FBD2264C55DD6A04029312EB7C7E344912AA349D05
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IBY......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VBY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VBY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VBY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............X.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 1 23:12:23 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.991658684816741
Encrypted:	false
SSDEEP:	48:8PdawT6UjTH5idAKZdA1vehDiZUkwqehZy+R:8VLGfy
MD5:	5E6D65F29B492AA0995DF0378370F38E
SHA1:	0167325DFBBC14C35C20F18CEEADCCB33E98E1D9
SHA-256:	26622CA052886DFEDF9F13652DA3A423962BD077CA5057B30849B71B77E37223
SHA-512:	0FEB0AA26394A7E09C9B3E5FC2AE0A31127D75DB83D22DF2D5E424D0F31C395B4A2B2836D05DAE8F0C361D9E724A567AC4D12DB18261269FD5D7B3D9C5BFA9CD
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......Z._...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IBY......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VBY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VBY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VBY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VBY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............X.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 1 23:12:23 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9761967825685747
Encrypted:	false
SSDEEP:	48:8rdawT6UjTH5idAKZdA1hehBiZUk1W1qehLy+C:8hLG9ry
MD5:	0A8B30E1A7A21E82F325E5F74BB126D6
SHA1:	BCC338EC32D1BE1D96E332F54F3B13F4D053754C
SHA-256:	6CD496DB264C5F7B45DA8CC1A5A0CC11661F9DEABB8E77B2AC036339C92A2144
SHA-512:	3C14CAB95D3430E3C1ABD7429327FF980CFAD9E29DAF3ECDEB76DB1C86C7936B49B1A73D169F3C9D1C79BFD30176DF26212493A72FFE1D466DEC1BFB7FA6AE19
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......i._...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IBY......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VBY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VBY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VBY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VBY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............X.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 1 23:12:23 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.990071395418555
Encrypted:	false
SSDEEP:	48:8wdawT6UjTH5idAKZdA1duT+ehOuTbbiZUk5OjqehOuTbBy+yT+:8YLYT/TbxWOvTbBy7T
MD5:	3D88E2B82A33C300BBCA6AF2D25B0740
SHA1:	2D06270625B1B2B7D1E6B867E61657AB4B8A2029
SHA-256:	B7FE274E9377ABA47B25DF8793DDE1BBABE1E5112B546A17F6379643E7531765
SHA-512:	81701291201CF600A0F29A2504E289D65973B7F411D7CB89E4321548A111042267CCA7ED325E4E84BBECCCA9C7E0D8FE20B2B7DB9BE8AA55D19B0FA68AF8EC65
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......N._...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IBY......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VBY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VBY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VBY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VBY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............X.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 53

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (8531)
Category:	downloaded
Size (bytes):	8532
Entropy (8bit):	4.9029608416924
Encrypted:	false
SSDEEP:	192:zEw3JmwyswyMwuk6wysw9wy9wiw2CwuXsw/yw4m2/C6Q9d+QBcwLrOxNIqZhBn94:G+2E66ArR6a7gPA6
MD5:	A7D5C32C97182AC1736E6B284B8644EC
SHA1:	95CF00944235FC148C6EE596D9DFF5B62C102C7E
SHA-256:	BDFA8BCD8F5D4EE3252BC4EB02BB0FEC99BC5587F860562F70CDAA31B8A17C97
SHA-512:	147AEAD4CB5291AA34AF9A65FA09E44D9ED394FF56C11B1991664D2EE938AA038ACCDC2EE54DFCAB1E07903056769F9E2E09A2CD779211936CB8596D1B3AC59D
Malicious:	false
Reputation:	low
URL:	https://cfl.dropboxstatic.com/static/metaserver/static/css/google_one_tap-vflp9XDLJ.css
Preview:	#credential_picker_iframe{z-index:10002 !important}.shared-link-signup-page #credential_picker_container,.shared-link-signup-page .one-tap-tos-modal-v1{top:var(--ib-preview-toolbar-top-offset, 20px)}.file-transfers-page-body #credential_picker_container{top:calc( var(--dwg-nav__height--universal, 48px) + var(--dwg-spacing__unit--2, 16px) - 6px)}.warp-page #credential_picker_container{top:calc( var(--dwg-nav__top-offset, 0px) + var(--dwg-nav__height--universal, 48px) + var(--dwg-spacing__unit--2, 16px) - 6px)}.shared-link-file-page #credential_picker_container,.shared-link-file-page .one-tap-tos-modal-v1{top:calc(var(--titlebarHeight, 64px) + var(--dwg-spacing__unit--2, 16px) - 6px);right:calc(56px + var(--dwg-spacing__unit--2, 16px) - 6px)}.shared-link-folder-page #credential_picker_container,.shared-link-folder-page .one-tap-tos-modal-v1,.scl-folder-page #credential_picker_container,.scl-folder-page .one-tap-tos-modal-v1{top:calc(var(--titlebarHeight, 64px) + var(--dwg-spacing__unit--

Chrome Cache Entry: 54

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (27280)
Category:	dropped
Size (bytes):	27739
Entropy (8bit):	5.317372330987387
Encrypted:	false
SSDEEP:	768:XjyoFkds7JDo68QJCjZjAwsujqXWzLVG37oPZupZzePxn8lmwf0lMqQHpkq:asmNVGw/jNxKZ/
MD5:	AA6CEFBFD8B109D4391B755F877C1F57
SHA1:	806D78A42EAF33677B3F13C0B75D485D2DBB05C6
SHA-256:	090175EBFB9296786227534ED6431DE6D7988A3A4ED1CAA2C585BF084B6D11B3
SHA-512:	9EB133371D41A552C1F9CC52AD93715A7E669B4BD07D3057E93AF9E1D54671E69ABA7FDBC83226B2070644BE3D65733288A6029A966E03DD9B72B2FBC2F8F90C
Malicious:	false
Reputation:	low
Preview:	!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds\|\|{},e._sentryDebugIds[n]="937749b1-6b49-3d02-a0fd-986aaa869489")}catch(e){}}();./! For license information please see alameda_bundle_chrome_en.js.LICENSE.txt /.(()=>{var __webpack_modules__={968:(__unused_webpack_module,exports)=>{(function(){var requirejs,require,define;(function(global,Promise,undef){if(!Promise)throw new Error("No Promise implementation available");var topReq,dataMain,src,subPath,bootstrapConfig=requirejs\|\|require,hasOwn=Object.prototype.hasOwnProperty,contexts={},queue=[],currDirRegExp=/^\.\//,urlRegExp=/^\/\|\:\|\?\|\.js$/,commentRegExp=/\/\[\s\S]?\\/\|([^:"'=]\|^)\/\/.$/gm,cjsRequireRegExp=/[^.]\srequire\s$\s["']([^'"\s]+)["']\s$/g,jsSuffixRegExp=/\.js$/,slice=Array.prototype.slice;if("function"!=typeof requirejs){var asap=Promise.resolve(void 0);requirejs=topReq=newContext(

Chrome Cache Entry: 55

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1727)
Category:	downloaded
Size (bytes):	1728
Entropy (8bit):	5.079458543466473
Encrypted:	false
SSDEEP:	48:boD3AFSMbvDpVzueGEKaxOSBaKv0DEq3A7:bg3zk7/ieGEKaxnoKcDEq32
MD5:	1FAC30C2F785E8257D8E4DB8AE4A2902
SHA1:	955BA8113C4BBE01F42E548E807EA6C33207084C
SHA-256:	94B06B7DEAE3398A35DCF272C96E9117693CF18FE4430953FA2721FE8613EEE7
SHA-512:	792C0CD9DAD746D01534F11E07931F0552884641FE52A8421F35BBAE997849133E6E2C000575B11AD50BC756CBF5B43052030254C852409E29A0347C09F5EE78
Malicious:	false
Reputation:	low
URL:	https://cfl.dropboxstatic.com/static/metaserver/static/css/foundation-vflH6wwwv.css
Preview:	body,input,textarea,select,button,.normal{font-family:"Open Sans","lucida grande","Segoe UI",arial,verdana,"lucida sans unicode",tahoma,sans-serif;font-size:13px;color:var(--dig-color__text__base, #000);font-weight:normal}.maestro body:not(.dig-Button),.maestro input:not(.dig-Button),.maestro textarea:not(.dig-Button),.maestro select:not(.dig-Button),.maestro button:not(.dig-Button),.maestro .normal:not(.dig-Button){font-family:var(--dig-type__bodyfontstack, "Atlas Grotesk Web","Atlas Grotesk",AtlasGrotesk,sans-serif)}body{background-color:var(--dig-color__background__base, #fff);min-height:100%;margin:0;padding:0}a,a *{cursor:pointer;outline:none}a{color:var(--dig-color__primary__base, #0061ff);text-decoration:none}a:focus{text-decoration:underline}a img{border:0}p,h1,h2,h3,h4,h5{margin:0 0 1em 0;line-height:1.6em}h1{font-size:18pt;font-weight:normal;margin:10px 0}h2{padding-top:3px;padding-bottom:10px;margin-bottom:4px;font-size:10pt}h3{padding:0;margin:0;font-size:10pt}h4{margin:0 0

Chrome Cache Entry: 56

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3030)
Category:	downloaded
Size (bytes):	3031
Entropy (8bit):	5.072541246708305
Encrypted:	false
SSDEEP:	48:boD3AFSMbvDpVzueGEKaxOSBaKv0DEq3AbCCLS1BDRLtmfDRcz43V56Y:bg3zk7/ieGEKaxnoKcDEq385mpa3nh
MD5:	7CD34B579C76D077847E1EB2C086CCAD
SHA1:	CD36C07AC7F488668A7EE34D8BEBEC596C192AF0
SHA-256:	A63B0861254D3FFB38AA35BCE52017B3095E5FA5D8A03E085C47A895AB51BAB7
SHA-512:	2B21B2278488F11A28990FF79260F071E8901D53CEB7645860A6A0035BBEED7C8CEACB8F538650A8C88ED3C2FAC722EBBE2C2AF5553ADCEE09445797A623E75D
Malicious:	false
Reputation:	low
URL:	https://cfl.dropboxstatic.com/static/metaserver/static/css/maestro_appshell_styles-vflfNNLV5.css
Preview:	body,input,textarea,select,button,.normal{font-family:"Open Sans","lucida grande","Segoe UI",arial,verdana,"lucida sans unicode",tahoma,sans-serif;font-size:13px;color:var(--dig-color__text__base, #000);font-weight:normal}.maestro body:not(.dig-Button),.maestro input:not(.dig-Button),.maestro textarea:not(.dig-Button),.maestro select:not(.dig-Button),.maestro button:not(.dig-Button),.maestro .normal:not(.dig-Button){font-family:var(--dig-type__bodyfontstack, "Atlas Grotesk Web","Atlas Grotesk",AtlasGrotesk,sans-serif)}body{background-color:var(--dig-color__background__base, #fff);min-height:100%;margin:0;padding:0}a,a *{cursor:pointer;outline:none}a{color:var(--dig-color__primary__base, #0061ff);text-decoration:none}a:focus{text-decoration:underline}a img{border:0}p,h1,h2,h3,h4,h5{margin:0 0 1em 0;line-height:1.6em}h1{font-size:18pt;font-weight:normal;margin:10px 0}h2{padding-top:3px;padding-bottom:10px;margin-bottom:4px;font-size:10pt}h3{padding:0;margin:0;font-size:10pt}h4{margin:0 0

Chrome Cache Entry: 57

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (654)
Category:	downloaded
Size (bytes):	1036
Entropy (8bit):	5.323296704358444
Encrypted:	false
SSDEEP:	24:xeAi/ZBSoU7Z371HOu70CViTmMM8SMqSq8HiMyH8qyBNkyBDu9Qk8b+y/s2n:8z/Zcl9ROu7oMsqSqwVm8qIkODu9QkS1
MD5:	80CCDE85B980E138C0AAF5AB227EF54B
SHA1:	534A8883BD9582295FC2B867215944D66F1837E7
SHA-256:	407881C9106BEF52F6F4FE354488E31558D4D88F2A3BF2F2E8D919C35F62C9EB
SHA-512:	CFAA91DA7F071C8CF9A4ADE3A434062ED2AF292ED50254396562D35B0F994381EC748DE985C520486BFA2DF83086BAD4A633DCFA8C7389DD9EC6EF8F31A639BC
Malicious:	false
Reputation:	low
URL:	https://cfl.dropboxstatic.com/static/metaserver/static/css/dig-illustrations/index.web-vflgMzehb.css
Preview:	/ @generated -- This file is automatically synced from @dropbox/dig-illustrations@3.3.0. DO NOT MODIFY! /../. This file should not be imported into your CSS or SASS files - the CSS variables will be available on the page for you to use.. DO NOT USE THIS FILE OR THE CSS VARIABLE TOKENS WITHOUT FIRST TALKING TO THE DESIGN SYSTEMS ON-CALL (SEE #design-systems ON SLACK)./...dig-Theme--bright,:root{--color__illustration__inverse__dynamicline:#f7f5f2;--color__illustration__lightline:#f7f5f2}.dig-Theme--dark{--color__illustration__inverse__dynamicline:#1e1919}.dig-Mode--bright,.dig-Theme--bright,:root{--color__illustration__dynamicline:#1e1919}.dig-Mode--dark,.dig-Theme--dark{--color__illustration__dynamicline:#f7f5f2}.dig-Illustration{color:var(--color__illustration__dynamicline);height:100%;width:100%}.dig-Illustration.dig-Illustration--inverse{color:var(--color__illustration__inverse__dynamicline)}.dig-Illustration-spot{min-height:200px}.dig-Illustration-hero{min-height:338px}.di

Chrome Cache Entry: 58

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (55096)
Category:	downloaded
Size (bytes):	55476
Entropy (8bit):	4.944924198579946
Encrypted:	false
SSDEEP:	768:eAZXM3pHnMxWKZB5HVNN6vMEzJWJd2wtg+CRo/Y0vGrgrYFQi81A1t/OF+rwbxrO:eAZXapgCRoLvGrgsQCOFZxrnO
MD5:	A9C53D99825469261E2396DF2260ECAD
SHA1:	509BA7C7C5931AFE36B940D167B33CC4446243D4
SHA-256:	5BCCDCCE2471D5262931B52F89B9D952106C49C849BFDB4FCA5C68F6C29D6725
SHA-512:	93155CA726E306D242EA5EE80AB7E23224B50D458F615272C20F5306F0B98931D8CFA7AF0C784F560DF6AB28291098314FAC660CF9D21383ECEAAE1B418171DF
Malicious:	false
Reputation:	low
URL:	https://cfl.dropboxstatic.com/static/metaserver/static/css/dig-components/tokens-vflqcU9mY.css
Preview:	/ @generated -- This file is automatically synced from @dropbox/dig-components@20.8.0. DO NOT MODIFY! /../. This file should not be imported into your CSS or SASS files - the CSS variables will be available on the page for you to use.. DO NOT USE THIS FILE OR THE CSS VARIABLE TOKENS WITHOUT FIRST TALKING TO THE DESIGN SYSTEMS ON-CALL (SEE #design-systems ON SLACK)./...dig-Mode--bright,:root{--scheme__color:light;--scheme__inverse__color:dark;--spacing__base_unit:8px;--spacing__unit--0_5:4px;--spacing__unit--1:8px;--spacing__unit--1_5:12px;--spacing__unit--2:16px;--spacing__unit--2_5:20px;--spacing__unit--3:24px;--spacing__unit--4:32px;--spacing__unit--5:40px;--boxshadow__elevation1:0px 8px 32px rgba(30,25,25,.03),0px 8px 16px rgba(30,25,25,.03),0px 4px 8px rgba(30,25,25,.03),0px 2px 4px rgba(30,25,25,.03),0px 1px 2px rgba(30,25,25,.03);--boxshadow__elevation2:0px 16px 80px rgba(30,25,25,.03),0px 32px 48px rgba(30,25,25,.03),0px 16px 32px rgba(30,25,25,.03),0px 8px 24px rgba(3

Chrome Cache Entry: 59

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (27280)
Category:	downloaded
Size (bytes):	27739
Entropy (8bit):	5.317372330987387
Encrypted:	false
SSDEEP:	768:XjyoFkds7JDo68QJCjZjAwsujqXWzLVG37oPZupZzePxn8lmwf0lMqQHpkq:asmNVGw/jNxKZ/
MD5:	AA6CEFBFD8B109D4391B755F877C1F57
SHA1:	806D78A42EAF33677B3F13C0B75D485D2DBB05C6
SHA-256:	090175EBFB9296786227534ED6431DE6D7988A3A4ED1CAA2C585BF084B6D11B3
SHA-512:	9EB133371D41A552C1F9CC52AD93715A7E669B4BD07D3057E93AF9E1D54671E69ABA7FDBC83226B2070644BE3D65733288A6029A966E03DD9B72B2FBC2F8F90C
Malicious:	false
Reputation:	low
URL:	https://cfl.dropboxstatic.com/static/metaserver/static/js/alameda_bundle/alameda_bundle_chrome_en-vflqmzvv9.js
Preview:	!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds\|\|{},e._sentryDebugIds[n]="937749b1-6b49-3d02-a0fd-986aaa869489")}catch(e){}}();./! For license information please see alameda_bundle_chrome_en.js.LICENSE.txt /.(()=>{var __webpack_modules__={968:(__unused_webpack_module,exports)=>{(function(){var requirejs,require,define;(function(global,Promise,undef){if(!Promise)throw new Error("No Promise implementation available");var topReq,dataMain,src,subPath,bootstrapConfig=requirejs\|\|require,hasOwn=Object.prototype.hasOwnProperty,contexts={},queue=[],currDirRegExp=/^\.\//,urlRegExp=/^\/\|\:\|\?\|\.js$/,commentRegExp=/\/\[\s\S]?\\/\|([^:"'=]\|^)\/\/.$/gm,cjsRequireRegExp=/[^.]\srequire\s$\s["']([^'"\s]+)["']\s$/g,jsSuffixRegExp=/\.js$/,slice=Array.prototype.slice;if("function"!=typeof requirejs){var asap=Promise.resolve(void 0);requirejs=topReq=newContext(

Chrome Cache Entry: 60

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (830)
Category:	downloaded
Size (bytes):	831
Entropy (8bit):	4.929291155076852
Encrypted:	false
SSDEEP:	24:lJ3g+uXDL7+xZkxFAA+e2wVvykhSUhy0BIFIazBTLmDLY:lJS8szDo0Q
MD5:	D2C1CAEAF7D185B462A8D64FD0475932
SHA1:	C9E3EA63E9D3AC4FACC19BBB69A05D1A3076C51F
SHA-256:	005ED820758D4C12BEFDF1A3B2E9C30A0FA544038AF790FCC602AF1E3B63A4D1
SHA-512:	B479521B2AB44FF8DB425EE99E4E0A9894FCDDD85550000D657FEB4C30266B8DEBC52416FE2EF1CF497EBD6C1ECF886752C160AA0177C769A492E68560122CD8
Malicious:	false
Reputation:	low
URL:	https://cfl.dropboxstatic.com/static/metaserver/static/css/snackbar-vfl0sHK6v.css
Preview:	@keyframes alt-snackbarload{0%{bottom:-28px}100%{bottom:0}}.snackbar-layer{left:var(--maestro-left-nav-width, 240px);right:280px;padding:var(--spacing__base_unit)}@media only screen and (max-width: 1024px){.snackbar-layer{right:0}}@media only screen and (max-width: 735px){.snackbar-layer{left:0}}.snackbar-layer .snackbar-progress-bar{position:absolute;left:0;right:0;bottom:0}.snackbar-layer input{color:var(--color__inverse__standard__text)}.snackbar-layer-entire-page{width:100%}.snackbar-layer,.snackbar-layer-entire-page{position:fixed;display:flex;justify-content:center;bottom:0;pointer-events:none}.snackbar-layer ,.snackbar-layer-entire-page {pointer-events:auto}.snackbar-layer>,.snackbar-layer-entire-page>{flex-grow:1}.snackbar-entire-page-container{margin:0 var(--spacing__base_unit) 0 var(--spacing__base_unit)}.

Chrome Cache Entry: 61

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (304)
Category:	downloaded
Size (bytes):	305
Entropy (8bit):	4.931439734894977
Encrypted:	false
SSDEEP:	6:OXCw0UVexRJNZHXWXC+kEybGX9G4l6lm6c2XunG6HoV6HoQ:4CIVqN5GXCxEybGDT7Hw6HR
MD5:	4E2CC091FAC48A36F2EB401FA6ECE06B
SHA1:	AC35B42D5B1FF5B592A44574459A1C6CE6DFBE44
SHA-256:	EA511EB41E9199AEC50864F7CD7862DEF7BE3AE5C232DBC066AC353EA56FEC8D
SHA-512:	B7E439B7D5A48FB1D52EC78BB0CC72622717F37CCB03AA988741D9757C8CC3AFBE7FE0ECDA12970916CDF484ED9280613E7E1777942CC64A517886516D8E3692
Malicious:	false
Reputation:	low
URL:	https://cfl.dropboxstatic.com/static/metaserver/static/css/abuse/fingerprintjs_component-vflTizAkf.css
Preview:	.fingerprintjsComponent{z-index:1000;position:fixed;top:0;left:0;width:100%;height:100%;visibility:hidden}.fingerprintjsDiv{margin-left:auto;margin-right:auto;visibility:hidden}body #one-tap-fpjs-container~iframe[src='about:blank'][style*='visibility: hidden']{top:-100% !important;left:-100% !important}.

Chrome Cache Entry: 62

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3509)
Category:	downloaded
Size (bytes):	9382
Entropy (8bit):	4.873211498054136
Encrypted:	false
SSDEEP:	96:RiB8ryPBnHc3b1v8XgOLyOhrXzbSH1JyKK+:RiSePAv8XgvOpz+VJyKK+
MD5:	320915DCA4FCC14B76A6609AF3445D98
SHA1:	F51A66AB752668770DE4D50BB87C323EDC1AF699
SHA-256:	A2EFE4341FFFAC8BD9F6450113FBAC5B5D96738DCD0AF410E16C8C7055E0B652
SHA-512:	C1865BA01E864A629DF06E33F958B0D52B8CF2D9FF0DA799768A5E929D1993F99ADD73425824604327966B9DE83731AAA505BD21FAA2EF6EAE324E745A13F216
Malicious:	false
Reputation:	low
URL:	https://cfl.dropboxstatic.com/static/typescript/component_libraries/dig-experimental/src/index.web-vflMgkV3K.css
Preview:	./* -- typescript/component_libraries/dig-experimental/src/accordion/index.web.css */..exp-dig-AccordionItem,.exp-dig-AccordionWrapper{display:flex;flex-direction:column}.exp-dig-AccordionHeader{align-items:center;border-top:1px solid var(--color__standard__border);cursor:pointer;display:flex}.exp-dig-AccordionHeader-spacing--standard{padding:var(--spacing__unit--1_5) var(--spacing__unit--2)}.exp-dig-AccordionHeader-spacing--small{padding:var(--spacing__base_unit)}.exp-dig-AccordionHeader-spacing--large{padding:var(--spacing__unit--3)}.exp-dig-AccordionHeader:focus{box-shadow:inset var(--boxshadow__focusring);outline:none}.exp-dig-AccordionHeader:focus:not([data-focus-visible-added]){box-shadow:none}.exp-dig-AccordionHeader-left-accessory{display:flex;flex-shrink:0;margin-right:var(--spacing__base_unit)}.exp-dig-AccordionHeader-title-container{display:flex;flex-direction:column;flex-grow:1}.exp-dig-AccordionHeader-chevron{color:var(--color__faint__text);display:flex}.exp-dig-AccordionH

Chrome Cache Entry: 63

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3482)
Category:	downloaded
Size (bytes):	3483
Entropy (8bit):	5.013030100013651
Encrypted:	false
SSDEEP:	48:sl5ZkF1QkKwyvMdRzNKVXN5NBzDXS0zzXi0OrzNgXNKFNIx:F6k3QwyKs
MD5:	307B92102C1C5D4BAB05FFDB09A621F7
SHA1:	FA9D8945782691344FFFA9328B56D541504E1262
SHA-256:	6F4FC0817FB1A2199B277A69ED2022C6B0524DE34A2CBA7533536D40B6ABA410
SHA-512:	7D30703ECD866603DB82E2F0FC0D233D597F94652013A2B5589550952C75C0001C3573729A81E01C0D911AF8137F4A35C083DE552861C90A24150D469A918903
Malicious:	false
Reputation:	low
URL:	https://cfl.dropboxstatic.com/static/metaserver/static/css/dig/fonts-vflMHuSEC.css
Preview:	@font-face{font-family:'Atlas Grotesk Web';font-display:swap;src:url("/static/metaserver/static/fonts/paper-atlasgrotesk/AtlasGrotesk-Regular-Web-vflk7bxjs.woff2") format("woff2"),url("/static/metaserver/static/fonts/paper-atlasgrotesk/AtlasGrotesk-Regular-Web-vflyEJFZg.woff") format("woff"),url("/static/metaserver/static/fonts/paper-atlasgrotesk/AtlasGrotesk-Regular-Web-vflJ3txfq.ttf") format("truetype");font-weight:400;font-style:normal}@font-face{font-family:'Atlas Grotesk Web';font-display:swap;src:url("/static/metaserver/static/fonts/paper-atlasgrotesk/AtlasGrotesk-Medium-Web-vfl38XiTL.woff2") format("woff2"),url("/static/metaserver/static/fonts/paper-atlasgrotesk/AtlasGrotesk-Medium-Web-vflyja8tN.woff") format("woff"),url("/static/metaserver/static/fonts/paper-atlasgrotesk/AtlasGrotesk-Medium-Web-vflbI0jjP.ttf") format("truetype");font-weight:500;font-style:normal}@font-face{font-family:'Atlas Grotesk Web';font-display:swap;src:url("/static/metaserver/static/fonts/paper-atlasgrot

Chrome Cache Entry: 64

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (684)
Category:	downloaded
Size (bytes):	685
Entropy (8bit):	5.033559356693095
Encrypted:	false
SSDEEP:	12:pA7LVcO/PfNVVUragN6L03eSuET6rvLhd9cdxA1WcdWScdAzZpcDkfQk:iVcOnfNVV4NePS9T6rzhdOjAR4HDkfQk
MD5:	E2826FD92D6DCAF79021355095EC49D9
SHA1:	1572DA7F97839408214F18AF79C69611040E2084
SHA-256:	2C456C7236EE6F3541118C38AE364CF303F38926BA99C7FD65794802B172ACBD
SHA-512:	AAE0EE51EF9775A745E1B4A4607829609A54C211ED1C96303875FE6465770CBB54E267833E48C43BB7723891FF3D774F33200D6D8F5368817B085F946315EF85
Malicious:	false
Reputation:	low
URL:	https://cfl.dropboxstatic.com/static/metaserver/static/css/notify-vfl4oJv2S.css
Preview:	#notify-wrapper{width:100%;height:0px;left:0;top:0;text-align:center;position:fixed;z-index:10001}#notify-wrapper .left-align{text-align:left}#notify,.notify{margin:8px;padding:8px 16px;font-size:12px;display:inline-block}.notify-msg .button-as-link{font-size:12px}.notify-portal-component{width:100%;height:0}.server-error{background-color:#f4e5ea;border:1px solid #9a0032;color:#9a0032}.server-warning{background-color:#fef5da;border:1px solid #9a6500;color:#9a6500}.server-success{background-color:#e5efe0;border:1px solid #2d8000;color:#2d8000}.server-info{background-color:#fff;border:1px solid rgba(0,0,0,0.05);color:#666}.maestro #notify-wrapper.with-top-notification{top:48px}.

Chrome Cache Entry: 65

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (40406)
Category:	downloaded
Size (bytes):	40480
Entropy (8bit):	5.357206875268569
Encrypted:	false
SSDEEP:	384:QBN3kQxNYkRm7SHe/OR8b3obZu+osz2N6wwJCDDVUQdR:QBN32yr8LobZuy2N6wwJCDDVUQf
MD5:	56F24BF65A9DBF2F742B23862202581E
SHA1:	4A3F4D54CF39D4AC5FE022EBBDF205B462A2D30C
SHA-256:	CFAC3A2722FCB92E5844C231276C621A1F67285EB7172AB9206C56BA34BA91B8
SHA-512:	2673463BC63D4C2336D61859B797B2CB6CC35F1ACB2C964DDEADC7097AC5ED739B18C4835BA14A539FA8E515614E96D79450A4B923F6B405984063767776FE7E
Malicious:	false
Reputation:	low
URL:	https://cfl.dropboxstatic.com/static/js/file_viewer/index.web-vflVvJL9l.css
Preview:	./* -- bazel-out/k8-opt/bin/node_modules/videojs/dist/video-js.css */.@charset "UTF-8";.video-js .vjs-big-play-button .vjs-icon-placeholder:before,.video-js .vjs-modal-dialog,.vjs-button>.vjs-icon-placeholder:before,.vjs-modal-dialog .vjs-modal-dialog-content{height:100%;left:0;position:absolute;top:0;width:100%}.video-js .vjs-big-play-button .vjs-icon-placeholder:before,.vjs-button>.vjs-icon-placeholder:before{text-align:center}@font-face{font-family:VideoJS;font-style:normal;font-weight:400;src:url(data:application/font-woff;charset=utf-8;base64,d09GRgABAAAAABDkAAsAAAAAG6gAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAABHU1VCAAABCAAAADsAAABUIIslek9TLzIAAAFEAAAAPgAAAFZRiV3hY21hcAAAAYQAAADaAAADPv749/pnbHlmAAACYAAAC3AAABHQZg6OcWhlYWQAAA3QAAAAKwAAADYZw251aGhlYQAADfwAAAAdAAAAJA+RCLFobXR4AAAOHAAAABMAAACM744AAGxvY2EAAA4wAAAASAAAAEhF6kqubWF4cAAADngAAAAfAAAAIAE0AIFuYW1lAAAOmAAAASUAAAIK1cf1oHBvc3QAAA/AAAABJAAAAdPExYuNeJxjYGRgYOBiMGCwY2BycfMJYeDLSSzJY5BiYGGAAJA8MpsxJzM9kYEDxgPKsYBpDiBmg4gCACY7BUgAeJxjYGS7wTiBgZ

Chrome Cache Entry: 66

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (400)
Category:	downloaded
Size (bytes):	74477
Entropy (8bit):	4.996160179723149
Encrypted:	false
SSDEEP:	384:EQmQ4PESw2G70QZ7v767lii7J7hfEFIJG4RBXqdTF4Mh970njrPJpgFvFdk:LmQ4a2C06jmllhumFqZF4YSjlGFvFdk
MD5:	C2FB1E82F7FDBE869652AC175C9D29B1
SHA1:	D85A910ED2E0CF38EDE6DA3285B3440D4031F66A
SHA-256:	5EE372C003E43363E596A80D8254C544A5D52A649B656F91A9E8F25B148BC306
SHA-512:	A0D96C406761189E39F2C2EF3C07D6726AC8A82F075DABF0409B418F23A32CB51AFBECDC36A090532CADC1CB4E8A6BB6D0758EC146654FA832B247BFB210601F
Malicious:	false
Reputation:	low
URL:	https://cfl.dropboxstatic.com/static/metaserver/static/css/spectrum/index.web-vflwvsegv.css
Preview:	/! @generated -- DO NOT MODIFY /../* -- avatar/index.web.css */..mc-avatar-initials-16 {. font-weight: 600;. font-size: 9px;. line-height: 16px;.}..mc-avatar-initials-24 {. font-weight: 500;. font-size: 11px;. line-height: 24px;.}..mc-avatar-initials-32 {. font-weight: 600;. font-size: 13px;.}..mc-avatar-initials-40 {. font-weight: 800;. font-size: 16px;.}..mc-avatar-initials-48 {. font-weight: 700;. font-size: 19px;.}..mc-avatar-initials-56 {. font-weight: 700;. font-size: 22px;.}..mc-avatar-text {. display: -ms-flexbox;. display: flex;. -ms-flex-pack: center;. justify-content: center;. -ms-flex-align: center;. align-items: center;. border-radius: 50%;. color: var(--dig-color__secondary__on-base, #fff);.}..mc-avatar-text-inactive {. opacity: 0.5;. filter: grayscale(1);.}..mc-avatar {. display: inline-block;. vertical-align: middle;. border-radius: 50%;. overflow: hidden;. outline: 0;.}..mc-avatar-

Chrome Cache Entry: 67

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	661
Entropy (8bit):	5.129341069954787
Encrypted:	false
SSDEEP:	12:bRFP/Ga4GYLqGkwZESxqjyfUO2Fylde9hWKg2JW3dwVxK:zP/rHj/L7PyyWK5Y3KVxK
MD5:	9067859A55F8C3BA9411E359AEDAEE5A
SHA1:	D0B845A155676462C2D3FF60616E5057B3C6CE0C
SHA-256:	998169C92E5A694A77E31ED1866BA8EFF894C2A604ED244C03973876AC1796B6
SHA-512:	82D11179E0CB856EEE2086332F6859943AE37B2A9076BD331DA7D1CCFA12E525820D8D23B878D09EE41D09D60358C6392CD1BC05E26015707AE896C1D261B637
Malicious:	false
Reputation:	low
URL:	https://cfl.dropboxstatic.com/static/metaserver/static/css/dig-components/index.web-vflkGeFml.css
Preview:	@import url('./components-vflWHv-Cs.css');./* This loads after `components.css` because it contains all the legacy color tokens /.@import url('./legacy-token-migration-vfl1sMmEL.css');.@import url('./logos-vflprtpOP.css');.@import url('./icons-vfl_2f8Dj.css');.@import url('./foundations-tokens-vflkwo9I6.css');.@import url('./foundations-components-vflVZfKma.css');.@import url('./content-icons-vfliRJDVx.css');./ For any images that are circle cropped, scale them up a bit so that they're still cropped as a squircle /..dig-Avatar-image--modern[src='circle_crop=1'],..dig-Avatar-image--modern[srcset*='circle_crop=1'] {. transform: scale(1.075);.}.

Chrome Cache Entry: 68

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (6586)
Category:	downloaded
Size (bytes):	13165
Entropy (8bit):	5.1932336435436
Encrypted:	false
SSDEEP:	192:RSmDb7WLkcIGx/pHELT5LrGkC3fveMaZgnFoePIaiwov3BmGHLYH8HajoMMqxpNS:nokY/6NSFVPGH8H8Hb
MD5:	41DBD41EE50CD1A9BDE0AA789F061DBF
SHA1:	2E641003FD846ED11812B1A480139CF345C9C5E1
SHA-256:	1B7CB42B960F9512F0B4BB63A3AFA4F121CE77FFBE83D8935605474F21DD6ABB
SHA-512:	7967B3D32CA567DC27DED95174DDC41540F47E1E753758315F9031B0EC3FC498FA46A993985B743BB3FA18C1CA92E4E6018D030ADDF916D345656F9AE41D04D8
Malicious:	false
Reputation:	low
URL:	https://cfl.dropboxstatic.com/static/js/comments2/index-vflQdvUHu.css
Preview:	./* -- bazel-out/k8-opt/bin/node_modules/@dropbox/dig-tokens/dist/legacy-tokens.css */.:root{--color_background_backdrop:rgba(99,114,130,.5);--color_border_dark:#c6c9cd;--color_border_highlight:#ccd9fa;--color_border_light:#dddfe1;--color_brand_banana:#ffd830;--color_brand_black_cherry:#61082b;--color_brand_candy_apple:#d5001f;--color_brand_canopy:#005744;--color_brand_celadon:#a2d39b;--color_brand_cloud:#b4d0e7;--color_brand_dbx_blue:#0061ff;--color_brand_orchid:#ceb4ff;--color_brand_panda_black:#000;--color_brand_panda_white:#fff;--color_brand_pink_library:#ffafa2;--color_brand_rococo_gold:#ad780d;--color_brand_sand:#d8bea2;--color_brand_sapphire:#0d2481;--color_brand_stone:#d0d0d3;--color_brand_sunset:#fb570d;--color_brand_ultraviolet:#813bf6;--color_brand_wheat:#ffcb95;--color_dbx_blue_100:#0061ff;--color_dbx_blue_110:#0052d9;--color_dbx_blue_120:#0046ba;--color_dropshadow:rgba(99,114,130,.16);--color_focus_outline:#a6bdeb;--color_ink_100:#1d2737;--color_ink_15:#dddfe1;--color_ink_

Chrome Cache Entry: 69

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52632)
Category:	downloaded
Size (bytes):	52633
Entropy (8bit):	4.860512027897722
Encrypted:	false
SSDEEP:	384:Tnyx1oALzi7Y/pM2UlSg0Inyx1oALzi7Y/pM2Umh:T21m7Y/Wrkg0I21m7Y/Wr2
MD5:	26E143CBBB84833EF4F19A1AE556A1DA
SHA1:	DA99FFE748A7A99C53A075DDD1C3BE8E19E9A466
SHA-256:	452CBF28FB0CEEFC33F6A97848BB328B8647A5DB7BF7B2063593A3666E3726C9
SHA-512:	DE1B1B552075AAE674CE8D1427B665EAE82D0899DC525891657AD9B9A265A2525CDEBF208C64904617A19FA2378F17768701B18765BC6E30AF4205672F6481B7
Malicious:	false
Reputation:	low
URL:	https://cfl.dropboxstatic.com/static/metaserver/static/css/app_actions/index-vflJuFDy7.css
Preview:	.o-scrollable{overflow:auto;overflow-y:scroll;-ms-overflow-style:-ms-autohiding-scrollbar}.o-scrollable--x-only{overflow-x:scroll;overflow-y:hidden}.o-scrollable--y-only{overflow-x:hidden;overflow-y:scroll}button.c-borderless-button{background-color:inherit;cursor:pointer;margin:0;padding:0}button.c-borderless-button:focus{outline:none;box-shadow:0 0 0 2px #cce6fa;border-radius:3px}button.c-borderless-button:disabled{cursor:not-allowed;opacity:0.5}.db-modal{overflow:hidden}.db-modal-wrapper .db-modal:focus{outline:none}.tabbing .db-modal-wrapper .db-modal:focus{box-shadow:0 0 0 2px #a0d1fa}@keyframes fade-in{0%{opacity:0;transform:translate(0, -10px)}100%{opacity:1}}.unified-share-modal{animation-name:fade-in;animation-duration:0.3s;animation-iteration-count:1;animation-timing-function:ease-in-out;width:540px;display:flex;flex-direction:column;font-size:12px;margin-bottom:160px;overflow:hidden}@media (max-width: 540px){.unified-share-modal{width:100%}}.unified-share-modal *{box-sizing:

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 2, 2024 02:12:16.301048040 CEST	49674	443	192.168.2.5	23.1.237.91
Oct 2, 2024 02:12:16.301059961 CEST	49675	443	192.168.2.5	23.1.237.91
Oct 2, 2024 02:12:16.410418034 CEST	49673	443	192.168.2.5	23.1.237.91
Oct 2, 2024 02:12:24.937252998 CEST	49709	443	192.168.2.5	162.125.66.18
Oct 2, 2024 02:12:24.937355042 CEST	443	49709	162.125.66.18	192.168.2.5
Oct 2, 2024 02:12:24.937449932 CEST	49709	443	192.168.2.5	162.125.66.18
Oct 2, 2024 02:12:24.937644005 CEST	49710	443	192.168.2.5	162.125.66.18
Oct 2, 2024 02:12:24.937664986 CEST	443	49710	162.125.66.18	192.168.2.5
Oct 2, 2024 02:12:24.937732935 CEST	49710	443	192.168.2.5	162.125.66.18
Oct 2, 2024 02:12:24.937978983 CEST	49709	443	192.168.2.5	162.125.66.18
Oct 2, 2024 02:12:24.938013077 CEST	443	49709	162.125.66.18	192.168.2.5
Oct 2, 2024 02:12:24.938131094 CEST	49710	443	192.168.2.5	162.125.66.18
Oct 2, 2024 02:12:24.938152075 CEST	443	49710	162.125.66.18	192.168.2.5
Oct 2, 2024 02:12:25.575781107 CEST	443	49710	162.125.66.18	192.168.2.5
Oct 2, 2024 02:12:25.578618050 CEST	49710	443	192.168.2.5	162.125.66.18
Oct 2, 2024 02:12:25.578679085 CEST	443	49710	162.125.66.18	192.168.2.5
Oct 2, 2024 02:12:25.579806089 CEST	443	49710	162.125.66.18	192.168.2.5
Oct 2, 2024 02:12:25.579883099 CEST	49710	443	192.168.2.5	162.125.66.18
Oct 2, 2024 02:12:25.582421064 CEST	49710	443	192.168.2.5	162.125.66.18
Oct 2, 2024 02:12:25.582495928 CEST	443	49710	162.125.66.18	192.168.2.5
Oct 2, 2024 02:12:25.582865000 CEST	49710	443	192.168.2.5	162.125.66.18
Oct 2, 2024 02:12:25.582882881 CEST	443	49710	162.125.66.18	192.168.2.5
Oct 2, 2024 02:12:25.599812031 CEST	443	49709	162.125.66.18	192.168.2.5
Oct 2, 2024 02:12:25.600591898 CEST	49709	443	192.168.2.5	162.125.66.18
Oct 2, 2024 02:12:25.600608110 CEST	443	49709	162.125.66.18	192.168.2.5
Oct 2, 2024 02:12:25.601644039 CEST	443	49709	162.125.66.18	192.168.2.5
Oct 2, 2024 02:12:25.601706982 CEST	49709	443	192.168.2.5	162.125.66.18
Oct 2, 2024 02:12:25.602926016 CEST	49709	443	192.168.2.5	162.125.66.18
Oct 2, 2024 02:12:25.603015900 CEST	443	49709	162.125.66.18	192.168.2.5
Oct 2, 2024 02:12:25.623627901 CEST	49710	443	192.168.2.5	162.125.66.18
Oct 2, 2024 02:12:25.654609919 CEST	49709	443	192.168.2.5	162.125.66.18
Oct 2, 2024 02:12:25.654625893 CEST	443	49709	162.125.66.18	192.168.2.5
Oct 2, 2024 02:12:25.694567919 CEST	49709	443	192.168.2.5	162.125.66.18
Oct 2, 2024 02:12:25.902534962 CEST	49674	443	192.168.2.5	23.1.237.91
Oct 2, 2024 02:12:25.902539968 CEST	49675	443	192.168.2.5	23.1.237.91
Oct 2, 2024 02:12:26.012336969 CEST	49673	443	192.168.2.5	23.1.237.91
Oct 2, 2024 02:12:26.356523037 CEST	443	49710	162.125.66.18	192.168.2.5
Oct 2, 2024 02:12:26.356601954 CEST	49710	443	192.168.2.5	162.125.66.18
Oct 2, 2024 02:12:26.356631041 CEST	443	49710	162.125.66.18	192.168.2.5
Oct 2, 2024 02:12:26.356683016 CEST	49710	443	192.168.2.5	162.125.66.18
Oct 2, 2024 02:12:26.357383966 CEST	443	49710	162.125.66.18	192.168.2.5
Oct 2, 2024 02:12:26.357438087 CEST	49710	443	192.168.2.5	162.125.66.18
Oct 2, 2024 02:12:26.443018913 CEST	443	49710	162.125.66.18	192.168.2.5
Oct 2, 2024 02:12:26.443200111 CEST	49710	443	192.168.2.5	162.125.66.18
Oct 2, 2024 02:12:26.537714005 CEST	443	49710	162.125.66.18	192.168.2.5
Oct 2, 2024 02:12:26.537723064 CEST	443	49710	162.125.66.18	192.168.2.5
Oct 2, 2024 02:12:26.537759066 CEST	443	49710	162.125.66.18	192.168.2.5
Oct 2, 2024 02:12:26.537791967 CEST	49710	443	192.168.2.5	162.125.66.18
Oct 2, 2024 02:12:26.537822008 CEST	443	49710	162.125.66.18	192.168.2.5
Oct 2, 2024 02:12:26.537859917 CEST	49710	443	192.168.2.5	162.125.66.18
Oct 2, 2024 02:12:26.537883043 CEST	49710	443	192.168.2.5	162.125.66.18
Oct 2, 2024 02:12:26.600720882 CEST	443	49710	162.125.66.18	192.168.2.5
Oct 2, 2024 02:12:26.600744009 CEST	443	49710	162.125.66.18	192.168.2.5
Oct 2, 2024 02:12:26.600790977 CEST	49710	443	192.168.2.5	162.125.66.18
Oct 2, 2024 02:12:26.600810051 CEST	443	49710	162.125.66.18	192.168.2.5
Oct 2, 2024 02:12:26.600840092 CEST	49710	443	192.168.2.5	162.125.66.18
Oct 2, 2024 02:12:26.600894928 CEST	49710	443	192.168.2.5	162.125.66.18
Oct 2, 2024 02:12:26.629815102 CEST	443	49710	162.125.66.18	192.168.2.5
Oct 2, 2024 02:12:26.629832983 CEST	443	49710	162.125.66.18	192.168.2.5
Oct 2, 2024 02:12:26.629915953 CEST	49710	443	192.168.2.5	162.125.66.18
Oct 2, 2024 02:12:26.629933119 CEST	443	49710	162.125.66.18	192.168.2.5
Oct 2, 2024 02:12:26.630105972 CEST	49710	443	192.168.2.5	162.125.66.18
Oct 2, 2024 02:12:26.667145014 CEST	443	49710	162.125.66.18	192.168.2.5
Oct 2, 2024 02:12:26.667171001 CEST	443	49710	162.125.66.18	192.168.2.5
Oct 2, 2024 02:12:26.667207956 CEST	49710	443	192.168.2.5	162.125.66.18
Oct 2, 2024 02:12:26.667222977 CEST	443	49710	162.125.66.18	192.168.2.5
Oct 2, 2024 02:12:26.667256117 CEST	49710	443	192.168.2.5	162.125.66.18
Oct 2, 2024 02:12:26.667273045 CEST	49710	443	192.168.2.5	162.125.66.18
Oct 2, 2024 02:12:26.697278976 CEST	443	49710	162.125.66.18	192.168.2.5
Oct 2, 2024 02:12:26.697294950 CEST	443	49710	162.125.66.18	192.168.2.5
Oct 2, 2024 02:12:26.697343111 CEST	49710	443	192.168.2.5	162.125.66.18
Oct 2, 2024 02:12:26.697359085 CEST	443	49710	162.125.66.18	192.168.2.5
Oct 2, 2024 02:12:26.697387934 CEST	49710	443	192.168.2.5	162.125.66.18
Oct 2, 2024 02:12:26.697407007 CEST	49710	443	192.168.2.5	162.125.66.18
Oct 2, 2024 02:12:27.029371023 CEST	443	49710	162.125.66.18	192.168.2.5
Oct 2, 2024 02:12:27.029381990 CEST	443	49710	162.125.66.18	192.168.2.5
Oct 2, 2024 02:12:27.029414892 CEST	443	49710	162.125.66.18	192.168.2.5
Oct 2, 2024 02:12:27.029428959 CEST	443	49710	162.125.66.18	192.168.2.5
Oct 2, 2024 02:12:27.029443026 CEST	49710	443	192.168.2.5	162.125.66.18
Oct 2, 2024 02:12:27.029469013 CEST	443	49710	162.125.66.18	192.168.2.5
Oct 2, 2024 02:12:27.029485941 CEST	49710	443	192.168.2.5	162.125.66.18
Oct 2, 2024 02:12:27.029531956 CEST	49710	443	192.168.2.5	162.125.66.18
Oct 2, 2024 02:12:27.030119896 CEST	443	49710	162.125.66.18	192.168.2.5
Oct 2, 2024 02:12:27.030148029 CEST	443	49710	162.125.66.18	192.168.2.5
Oct 2, 2024 02:12:27.030180931 CEST	49710	443	192.168.2.5	162.125.66.18
Oct 2, 2024 02:12:27.030189991 CEST	443	49710	162.125.66.18	192.168.2.5
Oct 2, 2024 02:12:27.030226946 CEST	49710	443	192.168.2.5	162.125.66.18
Oct 2, 2024 02:12:27.030244112 CEST	49710	443	192.168.2.5	162.125.66.18
Oct 2, 2024 02:12:27.034288883 CEST	443	49710	162.125.66.18	192.168.2.5
Oct 2, 2024 02:12:27.034461021 CEST	49710	443	192.168.2.5	162.125.66.18
Oct 2, 2024 02:12:27.034472942 CEST	443	49710	162.125.66.18	192.168.2.5
Oct 2, 2024 02:12:27.034493923 CEST	443	49710	162.125.66.18	192.168.2.5
Oct 2, 2024 02:12:27.034544945 CEST	49710	443	192.168.2.5	162.125.66.18
Oct 2, 2024 02:12:27.034552097 CEST	443	49710	162.125.66.18	192.168.2.5
Oct 2, 2024 02:12:27.034590960 CEST	49710	443	192.168.2.5	162.125.66.18
Oct 2, 2024 02:12:27.036433935 CEST	443	49710	162.125.66.18	192.168.2.5
Oct 2, 2024 02:12:27.036463976 CEST	443	49710	162.125.66.18	192.168.2.5
Oct 2, 2024 02:12:27.036511898 CEST	49710	443	192.168.2.5	162.125.66.18
Oct 2, 2024 02:12:27.036521912 CEST	443	49710	162.125.66.18	192.168.2.5
Oct 2, 2024 02:12:27.036540031 CEST	443	49710	162.125.66.18	192.168.2.5
Oct 2, 2024 02:12:27.036550999 CEST	49710	443	192.168.2.5	162.125.66.18
Oct 2, 2024 02:12:27.036592960 CEST	49710	443	192.168.2.5	162.125.66.18
Oct 2, 2024 02:12:27.036752939 CEST	49710	443	192.168.2.5	162.125.66.18
Oct 2, 2024 02:12:27.036771059 CEST	443	49710	162.125.66.18	192.168.2.5
Oct 2, 2024 02:12:27.364984989 CEST	49721	443	192.168.2.5	216.58.206.68
Oct 2, 2024 02:12:27.365025997 CEST	443	49721	216.58.206.68	192.168.2.5
Oct 2, 2024 02:12:27.365091085 CEST	49721	443	192.168.2.5	216.58.206.68
Oct 2, 2024 02:12:27.365592003 CEST	49721	443	192.168.2.5	216.58.206.68
Oct 2, 2024 02:12:27.365607977 CEST	443	49721	216.58.206.68	192.168.2.5
Oct 2, 2024 02:12:27.657474995 CEST	443	49703	23.1.237.91	192.168.2.5
Oct 2, 2024 02:12:27.657568932 CEST	49703	443	192.168.2.5	23.1.237.91
Oct 2, 2024 02:12:27.996709108 CEST	443	49721	216.58.206.68	192.168.2.5
Oct 2, 2024 02:12:27.997967005 CEST	49721	443	192.168.2.5	216.58.206.68
Oct 2, 2024 02:12:27.997984886 CEST	443	49721	216.58.206.68	192.168.2.5
Oct 2, 2024 02:12:27.998888969 CEST	443	49721	216.58.206.68	192.168.2.5
Oct 2, 2024 02:12:27.998949051 CEST	49721	443	192.168.2.5	216.58.206.68
Oct 2, 2024 02:12:28.002481937 CEST	49721	443	192.168.2.5	216.58.206.68
Oct 2, 2024 02:12:28.002535105 CEST	443	49721	216.58.206.68	192.168.2.5
Oct 2, 2024 02:12:28.043410063 CEST	49721	443	192.168.2.5	216.58.206.68
Oct 2, 2024 02:12:28.043416977 CEST	443	49721	216.58.206.68	192.168.2.5
Oct 2, 2024 02:12:28.090281963 CEST	49721	443	192.168.2.5	216.58.206.68
Oct 2, 2024 02:12:37.957170010 CEST	443	49721	216.58.206.68	192.168.2.5
Oct 2, 2024 02:12:37.957240105 CEST	443	49721	216.58.206.68	192.168.2.5
Oct 2, 2024 02:12:37.957345963 CEST	49721	443	192.168.2.5	216.58.206.68
Oct 2, 2024 02:12:38.335201979 CEST	49703	443	192.168.2.5	23.1.237.91
Oct 2, 2024 02:12:38.335285902 CEST	49703	443	192.168.2.5	23.1.237.91
Oct 2, 2024 02:12:38.340106010 CEST	443	49703	23.1.237.91	192.168.2.5
Oct 2, 2024 02:12:38.340116024 CEST	443	49703	23.1.237.91	192.168.2.5
Oct 2, 2024 02:12:38.347623110 CEST	49741	443	192.168.2.5	23.1.237.91
Oct 2, 2024 02:12:38.347697020 CEST	443	49741	23.1.237.91	192.168.2.5
Oct 2, 2024 02:12:38.347785950 CEST	49741	443	192.168.2.5	23.1.237.91
Oct 2, 2024 02:12:38.384752035 CEST	49741	443	192.168.2.5	23.1.237.91
Oct 2, 2024 02:12:38.384812117 CEST	443	49741	23.1.237.91	192.168.2.5
Oct 2, 2024 02:12:38.989159107 CEST	443	49741	23.1.237.91	192.168.2.5
Oct 2, 2024 02:12:38.989236116 CEST	49741	443	192.168.2.5	23.1.237.91
Oct 2, 2024 02:12:39.250787020 CEST	49741	443	192.168.2.5	23.1.237.91
Oct 2, 2024 02:12:39.250860929 CEST	443	49741	23.1.237.91	192.168.2.5
Oct 2, 2024 02:12:39.251980066 CEST	443	49741	23.1.237.91	192.168.2.5
Oct 2, 2024 02:12:39.252053976 CEST	49741	443	192.168.2.5	23.1.237.91
Oct 2, 2024 02:12:39.257867098 CEST	49741	443	192.168.2.5	23.1.237.91
Oct 2, 2024 02:12:39.257947922 CEST	443	49741	23.1.237.91	192.168.2.5
Oct 2, 2024 02:12:39.282723904 CEST	49741	443	192.168.2.5	23.1.237.91
Oct 2, 2024 02:12:39.282746077 CEST	443	49741	23.1.237.91	192.168.2.5
Oct 2, 2024 02:12:39.538239002 CEST	49721	443	192.168.2.5	216.58.206.68
Oct 2, 2024 02:12:39.538288116 CEST	443	49721	216.58.206.68	192.168.2.5
Oct 2, 2024 02:12:39.703198910 CEST	443	49741	23.1.237.91	192.168.2.5
Oct 2, 2024 02:12:39.704025030 CEST	443	49741	23.1.237.91	192.168.2.5
Oct 2, 2024 02:12:39.704109907 CEST	49741	443	192.168.2.5	23.1.237.91

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 2, 2024 02:12:22.826500893 CEST	53	63852	1.1.1.1	192.168.2.5
Oct 2, 2024 02:12:22.883495092 CEST	53	52388	1.1.1.1	192.168.2.5
Oct 2, 2024 02:12:24.021471977 CEST	53	60823	1.1.1.1	192.168.2.5
Oct 2, 2024 02:12:24.928713083 CEST	56332	53	192.168.2.5	1.1.1.1
Oct 2, 2024 02:12:24.928862095 CEST	65078	53	192.168.2.5	1.1.1.1
Oct 2, 2024 02:12:24.935326099 CEST	53	56332	1.1.1.1	192.168.2.5
Oct 2, 2024 02:12:24.935863018 CEST	53	65078	1.1.1.1	192.168.2.5
Oct 2, 2024 02:12:26.635818005 CEST	57817	53	192.168.2.5	1.1.1.1
Oct 2, 2024 02:12:26.636014938 CEST	50802	53	192.168.2.5	1.1.1.1
Oct 2, 2024 02:12:27.349993944 CEST	53224	53	192.168.2.5	1.1.1.1
Oct 2, 2024 02:12:27.350138903 CEST	50664	53	192.168.2.5	1.1.1.1
Oct 2, 2024 02:12:27.357687950 CEST	53	53224	1.1.1.1	192.168.2.5
Oct 2, 2024 02:12:27.357856035 CEST	53	50664	1.1.1.1	192.168.2.5
Oct 2, 2024 02:12:29.222503901 CEST	51892	53	192.168.2.5	1.1.1.1
Oct 2, 2024 02:12:29.222836971 CEST	62898	53	192.168.2.5	1.1.1.1
Oct 2, 2024 02:12:41.961199045 CEST	53	62361	1.1.1.1	192.168.2.5

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Oct 2, 2024 02:12:29.240443945 CEST	192.168.2.5	1.1.1.1	c26b	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 2, 2024 02:12:24.928713083 CEST	192.168.2.5	1.1.1.1	0x3df0	Standard query (0)	www.dropbox.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 02:12:24.928862095 CEST	192.168.2.5	1.1.1.1	0x965e	Standard query (0)	www.dropbox.com	65	IN (0x0001)	false
Oct 2, 2024 02:12:26.635818005 CEST	192.168.2.5	1.1.1.1	0xc8d0	Standard query (0)	cfl.dropboxstatic.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 02:12:26.636014938 CEST	192.168.2.5	1.1.1.1	0xd6a1	Standard query (0)	cfl.dropboxstatic.com	65	IN (0x0001)	false
Oct 2, 2024 02:12:27.349993944 CEST	192.168.2.5	1.1.1.1	0xf2e7	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 02:12:27.350138903 CEST	192.168.2.5	1.1.1.1	0x624d	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 2, 2024 02:12:29.222503901 CEST	192.168.2.5	1.1.1.1	0x902	Standard query (0)	cfl.dropboxstatic.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 02:12:29.222836971 CEST	192.168.2.5	1.1.1.1	0x4624	Standard query (0)	cfl.dropboxstatic.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 2, 2024 02:12:24.935326099 CEST	1.1.1.1	192.168.2.5	0x3df0	No error (0)	www.dropbox.com	www-env.dropbox-dns.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 02:12:24.935326099 CEST	1.1.1.1	192.168.2.5	0x3df0	No error (0)	www-env.dropbox-dns.com		162.125.66.18	A (IP address)	IN (0x0001)	false
Oct 2, 2024 02:12:24.935863018 CEST	1.1.1.1	192.168.2.5	0x965e	No error (0)	www.dropbox.com	www-env.dropbox-dns.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 02:12:26.642811060 CEST	1.1.1.1	192.168.2.5	0xc8d0	No error (0)	cfl.dropboxstatic.com	cfl.dropboxstatic.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 02:12:26.653417110 CEST	1.1.1.1	192.168.2.5	0xd6a1	No error (0)	cfl.dropboxstatic.com	cfl.dropboxstatic.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 02:12:27.357687950 CEST	1.1.1.1	192.168.2.5	0xf2e7	No error (0)	www.google.com		216.58.206.68	A (IP address)	IN (0x0001)	false
Oct 2, 2024 02:12:27.357856035 CEST	1.1.1.1	192.168.2.5	0x624d	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 2, 2024 02:12:29.229576111 CEST	1.1.1.1	192.168.2.5	0x902	No error (0)	cfl.dropboxstatic.com	cfl.dropboxstatic.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 02:12:29.240345001 CEST	1.1.1.1	192.168.2.5	0x4624	No error (0)	cfl.dropboxstatic.com	cfl.dropboxstatic.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 02:12:37.054409981 CEST	1.1.1.1	192.168.2.5	0x75bb	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Oct 2, 2024 02:12:37.054409981 CEST	1.1.1.1	192.168.2.5	0x75bb	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Oct 2, 2024 02:12:37.586983919 CEST	1.1.1.1	192.168.2.5	0xa43d	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 02:12:37.586983919 CEST	1.1.1.1	192.168.2.5	0xa43d	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.dropbox.com

https:

www.bing.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49710	162.125.66.18	443	5820	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 00:12:25 UTC	991	OUT	GET /scl/fi/ocmxhujczma623yxj6y29/Attention-_-Salary-Amendment-Updated-Employee-Handbook-Benefit-Enrollment-2024_2025.paper?oref=e&r=ACRm_hPlErV40Cd1zIP89wkIlFQF_89rGVAuXk_8bNLVEQBbMWfgZVCOjNPS76aaZwAZfDc4Xo2P176W3am-1A-GKNdfOUMtQ0zcIcJLSeq0d7kmDrWgClTMKZWQ0Y2kzdL-oHmexUWOnpxcurKZ8r9xoLPtk7VkdABI-FkyJQclVoAMLGCloMq4KRb2O2vhFwo&sm=1&dl=0 HTTP/1.1 Host: www.dropbox.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 00:12:26 UTC	4042	IN	HTTP/1.1 200 OK Content-Security-Policy: style-src https://* 'unsafe-inline' 'unsafe-eval' ; report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist ; media-src https://* blob: ; frame-src https://* carousel: dbapi-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: ; form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://.purple.officeapps.live-int.com https://officeapps-df.live.com https://.officeapps-df.live.com https://officeapps.live.com https://*.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ h [TRUNCATED] Content-Security-Policy: report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-dynamic ; script-src 'unsafe-eval' 'strict-dynamic' 'nonce-Fc+7nV8apNXa5Shle8q5U8dcCG0=' 'nonce-/dMNZsPxDMPZqdEEQfmMQrp9Izg=' Content-Type: text/html; charset=utf-8 Pragma: no-cache Referrer-Policy: strict-origin-when-cross-origin Set-Cookie: gvc=MjQzMDkyMzQyMjM3NDQ4OTIwODQyMjA3NDU0ODY4OTI5MzU1MDQ=; Path=/; Expires=Mon, 01 Oct 2029 00:12:26 GMT; HttpOnly; Secure; SameSite=None Set-Cookie: t=HB213bkfgAFMfklp6TCvstRC; Path=/; Domain=dropbox.com; Expires=Thu, 02 Oct 2025 00:12:26 GMT; HttpOnly; Secure; SameSite=None Set-Cookie: __Host-js_csrf=HB213bkfgAFMfklp6TCvstRC; Path=/; Expires=Thu, 02 Oct 2025 00:12:26 GMT; Secure; SameSite=None Set-Cookie: __Host-ss=lDqsiqpIlc; Path=/; Expires=Thu, 02 Oct 2025 00:12:26 GMT; HttpOnly; Secure; SameSite=Strict Set-Cookie: locale=en; Path=/; Domain=dropbox.com; Expires=Mon, 01 Oct 2029 00:12:26 GMT X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none X-Robots-Tag: noindex, nofollow, noimageindex X-Xss-Protection: 1; mode=block Date: Wed, 02 Oct 2024 00:12:26 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Server: envoy Cache-Control: no-cache, no-store Vary: Accept-Encoding X-Dropbox-Response-Origin: far_remote X-Dropbox-Request-Id: c6c9395093ef4fd9932053bf3e53c3f4 Connection: close Transfer-Encoding: chunked
2024-10-02 00:12:26 UTC	1004	IN	Data Raw: 36 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6d 61 65 73 74 72 6f 20 67 6c 6f 62 61 6c 2d 68 65 61 64 65 72 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0d 0a 36 0d 0a 3c 68 65 61 64 3e 0d 0a 31 39 0d 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 0d 0a 34 31 0d 0a 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 2c 20 6e 6f 69 6d 61 67 65 69 6e 64 65 78 22 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 2f 3e 0a 0d 0a 34 37 0d 0a 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 Data Ascii: 64<!DOCTYPE html><html class="maestro global-header" xmlns="http://www.w3.org/1999/xhtml" lang="en">6<head>19<meta charset="utf-8" />41<meta content="noindex, nofollow, noimageindex" name="robots" />47<meta content="width=device-widt
2024-10-02 00:12:26 UTC	4003	IN	Data Raw: 62 63 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 66 6c 2e 64 72 6f 70 62 6f 78 73 74 61 74 69 63 2e 63 6f 6d 2f 73 74 61 74 69 63 2f 6d 65 74 61 73 65 72 76 65 72 2f 73 74 61 74 69 63 2f 63 73 73 2f 61 70 70 5f 61 63 74 69 6f 6e 73 2f 69 6e 64 65 78 2d 76 66 6c 4a 75 46 44 79 37 2e 63 73 73 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 20 61 73 3d 22 73 74 79 6c 65 22 20 64 61 74 61 2d 6c 6f 61 64 65 72 3d 22 64 62 78 5f 65 64 69 73 6f 6e 5f 70 61 67 65 5b 72 65 71 75 65 73 74 65 64 5f 63 73 73 5d 22 2f 3e 0a 0d 0a 63 38 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 66 6c 2e 64 72 6f 70 62 6f 78 73 74 61 74 69 63 2e 63 6f 6d 2f 73 Data Ascii: bc<link rel="preload" href="https://cfl.dropboxstatic.com/static/metaserver/static/css/app_actions/index-vflJuFDy7.css" crossorigin as="style" data-loader="dbx_edison_page[requested_css]"/>c8<link rel="preload" href="https://cfl.dropboxstatic.com/s
2024-10-02 00:12:26 UTC	4329	IN	Data Raw: 63 34 0d 0a 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 2f 64 4d 4e 5a 73 50 78 44 4d 50 5a 71 64 45 45 51 66 6d 4d 51 72 70 39 49 7a 67 3d 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 63 66 6c 2e 64 72 6f 70 62 6f 78 73 74 61 74 69 63 2e 63 6f 6d 2f 73 74 61 74 69 63 2f 6d 65 74 61 73 65 72 76 65 72 2f 73 74 61 74 69 63 2f 6a 73 2f 61 6c 61 6d 65 64 61 5f 62 75 6e 64 6c 65 2f 61 6c 61 6d 65 64 61 5f 62 75 6e 64 6c 65 5f 63 68 72 6f 6d 65 5f 65 6e 2d 76 66 6c 71 6d 7a 76 76 39 2e 6a 73 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 0d 0a 37 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 36 0d 0a 3c 62 6f 64 79 3e 0d 0a 31 30 30 30 0d 0a 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 46 63 26 23 34 33 3b 37 6e Data Ascii: c4<script nonce="/dMNZsPxDMPZqdEEQfmMQrp9Izg=" src="https://cfl.dropboxstatic.com/static/metaserver/static/js/alameda_bundle/alameda_bundle_chrome_en-vflqmzvv9.js" crossorigin="anonymous"></script>7</head>6<body>1000<script nonce="Fc+7n
2024-10-02 00:12:26 UTC	16384	IN	Data Raw: 34 30 30 30 0d 0a 6c 65 5f 61 6d 64 2f 64 69 73 74 2f 63 5f 61 63 74 69 76 61 74 69 6f 6e 5f 64 61 74 61 5f 73 74 6f 72 65 2d 76 66 6c 76 42 31 62 6f 42 22 2c 20 22 61 74 6c 61 73 2f 66 69 6c 65 5f 76 69 65 77 65 72 2f 73 63 6c 5f 6f 62 6f 65 5f 66 69 6c 65 5f 62 75 6e 64 6c 65 5f 61 6d 64 2f 64 69 73 74 2f 63 5f 61 64 6d 69 6e 5f 61 70 69 5f 61 64 6d 69 6e 5f 63 6f 6e 73 6f 6c 65 5f 61 70 69 5f 63 6c 69 65 6e 74 22 3a 20 22 73 74 61 74 69 63 2f 61 74 6c 61 73 2f 66 69 6c 65 5f 76 69 65 77 65 72 2f 73 63 6c 5f 6f 62 6f 65 5f 66 69 6c 65 5f 62 75 6e 64 6c 65 5f 61 6d 64 2f 64 69 73 74 2f 63 5f 61 64 6d 69 6e 5f 61 70 69 5f 61 64 6d 69 6e 5f 63 6f 6e 73 6f 6c 65 5f 61 70 69 5f 63 6c 69 65 6e 74 2d 76 66 6c 4c 55 4f 6a 2d 61 22 2c 20 22 61 74 6c 61 73 2f 66 Data Ascii: 4000le_amd/dist/c_activation_data_store-vflvB1boB", "atlas/file_viewer/scl_oboe_file_bundle_amd/dist/c_admin_api_admin_console_api_client": "static/atlas/file_viewer/scl_oboe_file_bundle_amd/dist/c_admin_api_admin_console_api_client-vflLUOj-a", "atlas/f
2024-10-02 00:12:26 UTC	16384	IN	Data Raw: 61 63 63 6f 75 6e 0d 0a 34 30 30 30 0d 0a 74 2d 6d 65 74 61 64 61 74 61 22 3a 20 22 73 74 61 74 69 63 2f 61 74 6c 61 73 2f 66 69 6c 65 5f 76 69 65 77 65 72 2f 73 63 6c 5f 6f 62 6f 65 5f 66 69 6c 65 5f 62 75 6e 64 6c 65 5f 61 6d 64 2f 64 69 73 74 2f 63 5f 64 61 74 61 74 79 70 65 73 5f 73 68 61 72 69 6e 67 5f 61 63 63 6f 75 6e 74 2d 6d 65 74 61 64 61 74 61 2d 76 66 6c 57 31 43 62 36 56 22 2c 20 22 61 74 6c 61 73 2f 66 69 6c 65 5f 76 69 65 77 65 72 2f 73 63 6c 5f 6f 62 6f 65 5f 66 69 6c 65 5f 62 75 6e 64 6c 65 5f 61 6d 64 2f 64 69 73 74 2f 63 5f 64 61 74 65 70 69 63 6b 65 72 2d 72 65 61 63 74 5f 68 6f 6f 6b 73 5f 69 6e 64 65 78 22 3a 20 22 73 74 61 74 69 63 2f 61 74 6c 61 73 2f 66 69 6c 65 5f 76 69 65 77 65 72 2f 73 63 6c 5f 6f 62 6f 65 5f 66 69 6c 65 5f 62 Data Ascii: accoun4000t-metadata": "static/atlas/file_viewer/scl_oboe_file_bundle_amd/dist/c_datatypes_sharing_account-metadata-vflW1Cb6V", "atlas/file_viewer/scl_oboe_file_bundle_amd/dist/c_datepicker-react_hooks_index": "static/atlas/file_viewer/scl_oboe_file_b
2024-10-02 00:12:26 UTC	16	IN	Data Raw: 5f 73 68 61 72 69 6e 67 2d 76 66 6c 6c 4c 0d 0a Data Ascii: _sharing-vfllL
2024-10-02 00:12:26 UTC	16384	IN	Data Raw: 34 30 30 30 0d 0a 79 61 53 35 22 2c 20 22 61 74 6c 61 73 2f 66 69 6c 65 5f 76 69 65 77 65 72 2f 73 63 6c 5f 6f 62 6f 65 5f 66 69 6c 65 5f 62 75 6e 64 6c 65 5f 61 6d 64 2f 64 69 73 74 2f 63 5f 65 6e 63 72 79 70 74 65 64 5f 66 6f 6c 64 65 72 5f 65 6b 6d 73 22 3a 20 22 73 74 61 74 69 63 2f 61 74 6c 61 73 2f 66 69 6c 65 5f 76 69 65 77 65 72 2f 73 63 6c 5f 6f 62 6f 65 5f 66 69 6c 65 5f 62 75 6e 64 6c 65 5f 61 6d 64 2f 64 69 73 74 2f 63 5f 65 6e 63 72 79 70 74 65 64 5f 66 6f 6c 64 65 72 5f 65 6b 6d 73 2d 76 66 6c 75 71 76 6d 67 6a 22 2c 20 22 61 74 6c 61 73 2f 66 69 6c 65 5f 76 69 65 77 65 72 2f 73 63 6c 5f 6f 62 6f 65 5f 66 69 6c 65 5f 62 75 6e 64 6c 65 5f 61 6d 64 2f 64 69 73 74 2f 63 5f 65 78 74 65 6e 73 69 6f 6e 73 5f 61 70 69 73 22 3a 20 22 73 74 61 74 69 Data Ascii: 4000yaS5", "atlas/file_viewer/scl_oboe_file_bundle_amd/dist/c_encrypted_folder_ekms": "static/atlas/file_viewer/scl_oboe_file_bundle_amd/dist/c_encrypted_folder_ekms-vfluqvmgj", "atlas/file_viewer/scl_oboe_file_bundle_amd/dist/c_extensions_apis": "stati
2024-10-02 00:12:26 UTC	8	IN	Data Raw: 2d 64 69 73 70 6c 0d 0a Data Ascii: -displ
2024-10-02 00:12:26 UTC	16384	IN	Data Raw: 34 30 30 30 0d 0a 61 79 2d 76 66 6c 70 5f 58 50 45 46 22 2c 20 22 61 74 6c 61 73 2f 66 69 6c 65 5f 76 69 65 77 65 72 2f 73 63 6c 5f 6f 62 6f 65 5f 66 69 6c 65 5f 62 75 6e 64 6c 65 5f 61 6d 64 2f 64 69 73 74 2f 63 5f 69 6e 76 69 74 65 5f 6d 6f 64 61 6c 73 5f 69 6e 76 69 74 65 5f 6d 6f 64 61 6c 22 3a 20 22 73 74 61 74 69 63 2f 61 74 6c 61 73 2f 66 69 6c 65 5f 76 69 65 77 65 72 2f 73 63 6c 5f 6f 62 6f 65 5f 66 69 6c 65 5f 62 75 6e 64 6c 65 5f 61 6d 64 2f 64 69 73 74 2f 63 5f 69 6e 76 69 74 65 5f 6d 6f 64 61 6c 73 5f 69 6e 76 69 74 65 5f 6d 6f 64 61 6c 2d 76 66 6c 44 6a 79 70 5f 4b 22 2c 20 22 61 74 6c 61 73 2f 66 69 6c 65 5f 76 69 65 77 65 72 2f 73 63 6c 5f 6f 62 6f 65 5f 66 69 6c 65 5f 62 75 6e 64 6c 65 5f 61 6d 64 2f 64 69 73 74 2f 63 5f 69 6e 76 69 74 65 Data Ascii: 4000ay-vflp_XPEF", "atlas/file_viewer/scl_oboe_file_bundle_amd/dist/c_invite_modals_invite_modal": "static/atlas/file_viewer/scl_oboe_file_bundle_amd/dist/c_invite_modals_invite_modal-vflDjyp_K", "atlas/file_viewer/scl_oboe_file_bundle_amd/dist/c_invite
2024-10-02 00:12:26 UTC	8	IN	Data Raw: 66 69 6c 65 5f 76 0d 0a Data Ascii: file_v

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.5	49741	23.1.237.91	443

Timestamp	Bytes transferred	Direction	Data
2024-10-02 00:12:39 UTC	2148	OUT	POST /threshold/xls.aspx HTTP/1.1 Origin: https://www.bing.com Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept: / Accept-Language: en-CH Content-type: text/xml X-Agent-DeviceId: 01000A410900D492 X-BM-CBT: 1696428841 X-BM-DateFormat: dd/MM/yyyy X-BM-DeviceDimensions: 784x984 X-BM-DeviceDimensionsLogical: 784x984 X-BM-DeviceScale: 100 X-BM-DTZ: 120 X-BM-Market: CH X-BM-Theme: 000000;0078d7 X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E X-Device-ClientSession: DB0AFB19004F47BC80E5208C7478FF22 X-Device-isOptin: false X-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A} X-Device-OSSKU: 48 X-Device-Touch: false X-DeviceID: 01000A410900D492 X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,staticsh X-MSEdge-ExternalExpType: JointCoord X-PositionerType: Desktop X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI X-Search-CortanaAvailableCapabilities: None X-Search-SafeSearch: Moderate X-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard Time X-UserAgeClass: Unknown Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: www.bing.com Content-Length: 2484 Connection: Keep-Alive Cache-Control: no-cache Cookie: MUID=2F4E96DB8B7049E59AD4484C3C00F7CF; _SS=SID=1A6DEABB468B65843EB5F91B47916435&CPID=1727827925882&AC=1&CPH=d1a4eb75; _EDGE_S=SID=1A6DEABB468B65843EB5F91B47916435; SRCHUID=V=2&GUID=3D32B8AC657C4AD781A584E283227995&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231004; SRCHHPGUSR=SRCHLANG=en&IPMH=986d886c&IPMID=1696428841029&HV=1696428756; CortanaAppUID=5A290E2CC4B523E2D8B5E2E3E4CB7CB7; MUIDB=2F4E96DB8B7049E59AD4484C3C00F7CF
2024-10-02 00:12:39 UTC	1	OUT	Data Raw: 3c Data Ascii: <
2024-10-02 00:12:39 UTC	2483	OUT	Data Raw: 43 6c 69 65 6e 74 49 6e 73 74 52 65 71 75 65 73 74 3e 3c 43 49 44 3e 33 36 34 34 46 44 37 34 44 46 31 36 36 31 38 46 30 38 46 37 45 43 30 33 44 45 35 35 36 30 30 31 3c 2f 43 49 44 3e 3c 45 76 65 6e 74 73 3e 3c 45 3e 3c 54 3e 45 76 65 6e 74 2e 43 6c 69 65 6e 74 49 6e 73 74 3c 2f 54 3e 3c 49 47 3e 37 35 32 32 38 31 35 36 37 30 33 41 34 30 44 35 42 39 37 45 35 41 36 38 33 36 46 32 41 31 43 45 3c 2f 49 47 3e 3c 44 3e 3c 21 5b 43 44 41 54 41 5b 7b 22 43 75 72 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 2f 41 53 2f 41 50 49 2f 57 69 6e 64 6f 77 73 43 6f 72 74 61 6e 61 50 61 6e 65 2f 56 32 2f 49 6e 69 74 22 2c 22 50 69 76 6f 74 22 3a 22 51 46 22 2c 22 54 22 3a 22 43 49 2e 42 6f 78 4d 6f 64 65 6c 22 2c 22 46 49 44 22 3a 22 43 49 Data Ascii: ClientInstRequest><CID>3644FD74DF16618F08F7EC03DE556001</CID><Events><E><T>Event.ClientInst</T><IG>75228156703A40D5B97E5A6836F2A1CE</IG><D><![CDATA[{"CurUrl":"https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init","Pivot":"QF","T":"CI.BoxModel","FID":"CI
2024-10-02 00:12:39 UTC	480	IN	HTTP/1.1 204 No Content Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 132DCB2133EB4528B9316BAD02290845 Ref B: LAX311000109047 Ref C: 2024-10-02T00:12:39Z Date: Wed, 02 Oct 2024 00:12:39 GMT Connection: close Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.1fed0117.1727827959.3584af2f

Target ID:	0
Start time:	20:12:17
Start date:	01/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	20:12:20
Start date:	01/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 --field-trial-handle=2020,i,6035491936615944162,2809238674400728017,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	20:12:23
Start date:	01/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.dropbox.com/scl/fi/ocmxhujczma623yxj6y29/Attention-_-Salary-Amendment-Updated-Employee-Handbook-Benefit-Enrollment-2024_2025.paper?oref=e&r=ACRm_hPlErV40Cd1zIP89wkIlFQF_89rGVAuXk_8bNLVEQBbMWfgZVCOjNPS76aaZwAZfDc4Xo2P176W3am-1A-GKNdfOUMtQ0zcIcJLSeq0d7kmDrWgClTMKZWQ0Y2kzdL-oHmexUWOnpxcurKZ8r9xoLPtk7VkdABI-FkyJQclVoAMLGCloMq4KRb2O2vhFwo&sm=1&dl=0"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Errors

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 53

Chrome Cache Entry: 54

Chrome Cache Entry: 55

Chrome Cache Entry: 56

Chrome Cache Entry: 57

Chrome Cache Entry: 58

Chrome Cache Entry: 59

Chrome Cache Entry: 60

Chrome Cache Entry: 61

Chrome Cache Entry: 62

Chrome Cache Entry: 63

Chrome Cache Entry: 64

Chrome Cache Entry: 65

Chrome Cache Entry: 66

Chrome Cache Entry: 67

Chrome Cache Entry: 68

Chrome Cache Entry: 69

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

DNS Queries