Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
https://www.amazon.com/gp/f.html?C=3EZOZG4B143JS&K=1E6K7EDNZJ01O&M=urn:rtn:msg:2024112123575784a68d3791734d57aa59c8099480p0na&R=1X9F7V8OBK7Z1&T=C&U=https%3A%2F%2Fbusiness.amazon.com%2Fabredir%2Fspr%2Freturns%2Fprep%3FcontractId%3D6a0575f9-ef14-43ae-afac-f5063d154a1e%26rmaId%3DDxDwhwGcRRMA%26orderId%

Overview

General Information

Sample URL:https://www.amazon.com/gp/f.html?C=3EZOZG4B143JS&K=1E6K7EDNZJ01O&M=urn:rtn:msg:2024112123575784a68d3791734d57aa59c8099480p0na&R=1X9F7V8OBK7Z1&T=C&U=https%3A%2F%2Fbusiness.amazon.com%2Fabredir%2Fspr%2F
Analysis ID:1560598

Detection

Score:1
Range:0 - 100
Whitelisted:false
Confidence:80%

Signatures

HTML page contains hidden javascript code
Stores files to the Windows start menu directory

Classification

  • System is w10x64_ra
  • chrome.exe (PID: 5700 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • chrome.exe (PID: 6744 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 --field-trial-handle=1884,i,7088009258412178927,15525006651746148157,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • chrome.exe (PID: 6412 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.amazon.com/gp/f.html?C=3EZOZG4B143JS&K=1E6K7EDNZJ01O&M=urn:rtn:msg:2024112123575784a68d3791734d57aa59c8099480p0na&R=1X9F7V8OBK7Z1&T=C&U=https%3A%2F%2Fbusiness.amazon.com%2Fabredir%2Fspr%2Freturns%2Fprep%3FcontractId%3D6a0575f9-ef14-43ae-afac-f5063d154a1e%26rmaId%3DDxDwhwGcRRMA%26orderId%3D111-7310600-6665801%26ingress%3Dprep_email%26ref_%3Dpe_114046300_987354350_OD0201BT_E_PREPRefundConfirmation_PREP_St&H=IA4LZ8TXHBNT2KXXSODLQKAB5OKA&ref_=pe_114046300_987354350_OD0201BT_E_PREPRefundConfirmation_PREP_St" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • cleanup
No yara matches
No Sigma rule has matched
No Suricata rule has matched

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: https://www.amazon.com/ap/signin?openid.pape.max_auth_age=3600&openid.return_to=https://www.amazon.com/spr/returns/prep?contractId=6a0575f9-ef14-43ae-afac-f5063d154a1e&rmaId=DxDwhwGcRRMA&orderId=111-7310600-6665801&ingress=prep_email&ref_=pe_114046300_987354350_OD0201BT_E_PREPRefundConfirmation_PREP_St&openid.identity=http://specs.openid.net/auth/2.0/identifier_select&openid.assoc_handle=amzn_psr_desktop_us&openid.mode=checkid_setup&language=en_US&openid.claimed_id=http://specs.openid.net/auth/2.0/identifier_select&openid.ns=http://specs.openid.net/auth/2.0HTTP Parser: Base64 decoded: https://www.amazon.com/spr/returns/prep?contractId=6a0575f9-ef14-43ae-afac-f5063d154a1e
Source: https://www.amazon.com/ap/signin?openid.pape.max_auth_age=3600&openid.return_to=https://www.amazon.com/spr/returns/prep?contractId=6a0575f9-ef14-43ae-afac-f5063d154a1e&rmaId=DxDwhwGcRRMA&orderId=111-7310600-6665801&ingress=prep_email&ref_=pe_114046300_987354350_OD0201BT_E_PREPRefundConfirmation_PREP_St&openid.identity=http://specs.openid.net/auth/2.0/identifier_select&openid.assoc_handle=amzn_psr_desktop_us&openid.mode=checkid_setup&language=en_US&openid.claimed_id=http://specs.openid.net/auth/2.0/identifier_select&openid.ns=http://specs.openid.net/auth/2.0HTTP Parser: <input type="password" .../> found
Source: https://www.amazon.com/ap/signin?openid.pape.max_auth_age=3600&openid.return_to=https%3A%2F%2Fwww.amazon.com%2Fspr%2Freturns%2Fprep%3FcontractId%3D6a0575f9-ef14-43ae-afac-f5063d154a1e%26rmaId%3DDxDwhwGcRRMA%26orderId%3D111-7310600-6665801%26ingress%3Dprep_email%26ref_%3Dpe_114046300_987354350_OD0201BT_E_PREPRefundConfirmation_PREP_St&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.assoc_handle=amzn_psr_desktop_us&openid.mode=checkid_setup&language=en_US&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0HTTP Parser: No favicon
Source: https://www.amazon.com/ap/signin?openid.pape.max_auth_age=3600&openid.return_to=https%3A%2F%2Fwww.amazon.com%2Fspr%2Freturns%2Fprep%3FcontractId%3D6a0575f9-ef14-43ae-afac-f5063d154a1e%26rmaId%3DDxDwhwGcRRMA%26orderId%3D111-7310600-6665801%26ingress%3Dprep_email%26ref_%3Dpe_114046300_987354350_OD0201BT_E_PREPRefundConfirmation_PREP_St&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.assoc_handle=amzn_psr_desktop_us&openid.mode=checkid_setup&language=en_US&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0HTTP Parser: No favicon
Source: https://www.amazon.com/ap/signin?openid.pape.max_auth_age=3600&openid.return_to=https://www.amazon.com/spr/returns/prep?contractId=6a0575f9-ef14-43ae-afac-f5063d154a1e&rmaId=DxDwhwGcRRMA&orderId=111-7310600-6665801&ingress=prep_email&ref_=pe_114046300_987354350_OD0201BT_E_PREPRefundConfirmation_PREP_St&openid.identity=http://specs.openid.net/auth/2.0/identifier_select&openid.assoc_handle=amzn_psr_desktop_us&openid.mode=checkid_setup&language=en_US&openid.claimed_id=http://specs.openid.net/auth/2.0/identifier_select&openid.ns=http://specs.openid.net/auth/2.0HTTP Parser: No favicon
Source: https://www.amazon.com/ap/signin?openid.pape.max_auth_age=3600&openid.return_to=https://www.amazon.com/spr/returns/prep?contractId=6a0575f9-ef14-43ae-afac-f5063d154a1e&rmaId=DxDwhwGcRRMA&orderId=111-7310600-6665801&ingress=prep_email&ref_=pe_114046300_987354350_OD0201BT_E_PREPRefundConfirmation_PREP_St&openid.identity=http://specs.openid.net/auth/2.0/identifier_select&openid.assoc_handle=amzn_psr_desktop_us&openid.mode=checkid_setup&language=en_US&openid.claimed_id=http://specs.openid.net/auth/2.0/identifier_select&openid.ns=http://specs.openid.net/auth/2.0HTTP Parser: No favicon
Source: https://www.amazon.com/ap/signin?openid.pape.max_auth_age=3600&openid.return_to=https://www.amazon.com/spr/returns/prep?contractId=6a0575f9-ef14-43ae-afac-f5063d154a1e&rmaId=DxDwhwGcRRMA&orderId=111-7310600-6665801&ingress=prep_email&ref_=pe_114046300_987354350_OD0201BT_E_PREPRefundConfirmation_PREP_St&openid.identity=http://specs.openid.net/auth/2.0/identifier_select&openid.assoc_handle=amzn_psr_desktop_us&openid.mode=checkid_setup&language=en_US&openid.claimed_id=http://specs.openid.net/auth/2.0/identifier_select&openid.ns=http://specs.openid.net/auth/2.0HTTP Parser: No favicon
Source: https://www.amazon.com/ap/signin?openid.pape.max_auth_age=3600&openid.return_to=https://www.amazon.com/spr/returns/prep?contractId=6a0575f9-ef14-43ae-afac-f5063d154a1e&rmaId=DxDwhwGcRRMA&orderId=111-7310600-6665801&ingress=prep_email&ref_=pe_114046300_987354350_OD0201BT_E_PREPRefundConfirmation_PREP_St&openid.identity=http://specs.openid.net/auth/2.0/identifier_select&openid.assoc_handle=amzn_psr_desktop_us&openid.mode=checkid_setup&language=en_US&openid.claimed_id=http://specs.openid.net/auth/2.0/identifier_select&openid.ns=http://specs.openid.net/auth/2.0HTTP Parser: No favicon
Source: https://www.amazon.com/ap/signin?openid.pape.max_auth_age=3600&openid.return_to=https://www.amazon.com/spr/returns/prep?contractId=6a0575f9-ef14-43ae-afac-f5063d154a1e&rmaId=DxDwhwGcRRMA&orderId=111-7310600-6665801&ingress=prep_email&ref_=pe_114046300_987354350_OD0201BT_E_PREPRefundConfirmation_PREP_St&openid.identity=http://specs.openid.net/auth/2.0/identifier_select&openid.assoc_handle=amzn_psr_desktop_us&openid.mode=checkid_setup&language=en_US&openid.claimed_id=http://specs.openid.net/auth/2.0/identifier_select&openid.ns=http://specs.openid.net/auth/2.0HTTP Parser: No favicon
Source: https://www.amazon.com/ap/signin?openid.pape.max_auth_age=3600&openid.return_to=https://www.amazon.com/spr/returns/prep?contractId=6a0575f9-ef14-43ae-afac-f5063d154a1e&rmaId=DxDwhwGcRRMA&orderId=111-7310600-6665801&ingress=prep_email&ref_=pe_114046300_987354350_OD0201BT_E_PREPRefundConfirmation_PREP_St&openid.identity=http://specs.openid.net/auth/2.0/identifier_select&openid.assoc_handle=amzn_psr_desktop_us&openid.mode=checkid_setup&language=en_US&openid.claimed_id=http://specs.openid.net/auth/2.0/identifier_select&openid.ns=http://specs.openid.net/auth/2.0HTTP Parser: No favicon
Source: https://www.amazon.com/ap/signin?openid.pape.max_auth_age=3600&openid.return_to=https://www.amazon.com/spr/returns/prep?contractId=6a0575f9-ef14-43ae-afac-f5063d154a1e&rmaId=DxDwhwGcRRMA&orderId=111-7310600-6665801&ingress=prep_email&ref_=pe_114046300_987354350_OD0201BT_E_PREPRefundConfirmation_PREP_St&openid.identity=http://specs.openid.net/auth/2.0/identifier_select&openid.assoc_handle=amzn_psr_desktop_us&openid.mode=checkid_setup&language=en_US&openid.claimed_id=http://specs.openid.net/auth/2.0/identifier_select&openid.ns=http://specs.openid.net/auth/2.0HTTP Parser: No <meta name="author".. found
Source: https://www.amazon.com/ap/signin?openid.pape.max_auth_age=3600&openid.return_to=https://www.amazon.com/spr/returns/prep?contractId=6a0575f9-ef14-43ae-afac-f5063d154a1e&rmaId=DxDwhwGcRRMA&orderId=111-7310600-6665801&ingress=prep_email&ref_=pe_114046300_987354350_OD0201BT_E_PREPRefundConfirmation_PREP_St&openid.identity=http://specs.openid.net/auth/2.0/identifier_select&openid.assoc_handle=amzn_psr_desktop_us&openid.mode=checkid_setup&language=en_US&openid.claimed_id=http://specs.openid.net/auth/2.0/identifier_select&openid.ns=http://specs.openid.net/auth/2.0HTTP Parser: No <meta name="author".. found
Source: https://www.amazon.com/ap/signin?openid.pape.max_auth_age=3600&openid.return_to=https://www.amazon.com/spr/returns/prep?contractId=6a0575f9-ef14-43ae-afac-f5063d154a1e&rmaId=DxDwhwGcRRMA&orderId=111-7310600-6665801&ingress=prep_email&ref_=pe_114046300_987354350_OD0201BT_E_PREPRefundConfirmation_PREP_St&openid.identity=http://specs.openid.net/auth/2.0/identifier_select&openid.assoc_handle=amzn_psr_desktop_us&openid.mode=checkid_setup&language=en_US&openid.claimed_id=http://specs.openid.net/auth/2.0/identifier_select&openid.ns=http://specs.openid.net/auth/2.0HTTP Parser: No <meta name="author".. found
Source: https://www.amazon.com/ap/signin?openid.pape.max_auth_age=3600&openid.return_to=https://www.amazon.com/spr/returns/prep?contractId=6a0575f9-ef14-43ae-afac-f5063d154a1e&rmaId=DxDwhwGcRRMA&orderId=111-7310600-6665801&ingress=prep_email&ref_=pe_114046300_987354350_OD0201BT_E_PREPRefundConfirmation_PREP_St&openid.identity=http://specs.openid.net/auth/2.0/identifier_select&openid.assoc_handle=amzn_psr_desktop_us&openid.mode=checkid_setup&language=en_US&openid.claimed_id=http://specs.openid.net/auth/2.0/identifier_select&openid.ns=http://specs.openid.net/auth/2.0HTTP Parser: No <meta name="author".. found
Source: https://www.amazon.com/ap/signin?openid.pape.max_auth_age=3600&openid.return_to=https://www.amazon.com/spr/returns/prep?contractId=6a0575f9-ef14-43ae-afac-f5063d154a1e&rmaId=DxDwhwGcRRMA&orderId=111-7310600-6665801&ingress=prep_email&ref_=pe_114046300_987354350_OD0201BT_E_PREPRefundConfirmation_PREP_St&openid.identity=http://specs.openid.net/auth/2.0/identifier_select&openid.assoc_handle=amzn_psr_desktop_us&openid.mode=checkid_setup&language=en_US&openid.claimed_id=http://specs.openid.net/auth/2.0/identifier_select&openid.ns=http://specs.openid.net/auth/2.0HTTP Parser: No <meta name="author".. found
Source: https://www.amazon.com/ap/signin?openid.pape.max_auth_age=3600&openid.return_to=https://www.amazon.com/spr/returns/prep?contractId=6a0575f9-ef14-43ae-afac-f5063d154a1e&rmaId=DxDwhwGcRRMA&orderId=111-7310600-6665801&ingress=prep_email&ref_=pe_114046300_987354350_OD0201BT_E_PREPRefundConfirmation_PREP_St&openid.identity=http://specs.openid.net/auth/2.0/identifier_select&openid.assoc_handle=amzn_psr_desktop_us&openid.mode=checkid_setup&language=en_US&openid.claimed_id=http://specs.openid.net/auth/2.0/identifier_select&openid.ns=http://specs.openid.net/auth/2.0HTTP Parser: No <meta name="author".. found
Source: https://www.amazon.com/ap/signin?openid.pape.max_auth_age=3600&openid.return_to=https://www.amazon.com/spr/returns/prep?contractId=6a0575f9-ef14-43ae-afac-f5063d154a1e&rmaId=DxDwhwGcRRMA&orderId=111-7310600-6665801&ingress=prep_email&ref_=pe_114046300_987354350_OD0201BT_E_PREPRefundConfirmation_PREP_St&openid.identity=http://specs.openid.net/auth/2.0/identifier_select&openid.assoc_handle=amzn_psr_desktop_us&openid.mode=checkid_setup&language=en_US&openid.claimed_id=http://specs.openid.net/auth/2.0/identifier_select&openid.ns=http://specs.openid.net/auth/2.0HTTP Parser: No <meta name="copyright".. found
Source: https://www.amazon.com/ap/signin?openid.pape.max_auth_age=3600&openid.return_to=https://www.amazon.com/spr/returns/prep?contractId=6a0575f9-ef14-43ae-afac-f5063d154a1e&rmaId=DxDwhwGcRRMA&orderId=111-7310600-6665801&ingress=prep_email&ref_=pe_114046300_987354350_OD0201BT_E_PREPRefundConfirmation_PREP_St&openid.identity=http://specs.openid.net/auth/2.0/identifier_select&openid.assoc_handle=amzn_psr_desktop_us&openid.mode=checkid_setup&language=en_US&openid.claimed_id=http://specs.openid.net/auth/2.0/identifier_select&openid.ns=http://specs.openid.net/auth/2.0HTTP Parser: No <meta name="copyright".. found
Source: https://www.amazon.com/ap/signin?openid.pape.max_auth_age=3600&openid.return_to=https://www.amazon.com/spr/returns/prep?contractId=6a0575f9-ef14-43ae-afac-f5063d154a1e&rmaId=DxDwhwGcRRMA&orderId=111-7310600-6665801&ingress=prep_email&ref_=pe_114046300_987354350_OD0201BT_E_PREPRefundConfirmation_PREP_St&openid.identity=http://specs.openid.net/auth/2.0/identifier_select&openid.assoc_handle=amzn_psr_desktop_us&openid.mode=checkid_setup&language=en_US&openid.claimed_id=http://specs.openid.net/auth/2.0/identifier_select&openid.ns=http://specs.openid.net/auth/2.0HTTP Parser: No <meta name="copyright".. found
Source: https://www.amazon.com/ap/signin?openid.pape.max_auth_age=3600&openid.return_to=https://www.amazon.com/spr/returns/prep?contractId=6a0575f9-ef14-43ae-afac-f5063d154a1e&rmaId=DxDwhwGcRRMA&orderId=111-7310600-6665801&ingress=prep_email&ref_=pe_114046300_987354350_OD0201BT_E_PREPRefundConfirmation_PREP_St&openid.identity=http://specs.openid.net/auth/2.0/identifier_select&openid.assoc_handle=amzn_psr_desktop_us&openid.mode=checkid_setup&language=en_US&openid.claimed_id=http://specs.openid.net/auth/2.0/identifier_select&openid.ns=http://specs.openid.net/auth/2.0HTTP Parser: No <meta name="copyright".. found
Source: https://www.amazon.com/ap/signin?openid.pape.max_auth_age=3600&openid.return_to=https://www.amazon.com/spr/returns/prep?contractId=6a0575f9-ef14-43ae-afac-f5063d154a1e&rmaId=DxDwhwGcRRMA&orderId=111-7310600-6665801&ingress=prep_email&ref_=pe_114046300_987354350_OD0201BT_E_PREPRefundConfirmation_PREP_St&openid.identity=http://specs.openid.net/auth/2.0/identifier_select&openid.assoc_handle=amzn_psr_desktop_us&openid.mode=checkid_setup&language=en_US&openid.claimed_id=http://specs.openid.net/auth/2.0/identifier_select&openid.ns=http://specs.openid.net/auth/2.0HTTP Parser: No <meta name="copyright".. found
Source: https://www.amazon.com/ap/signin?openid.pape.max_auth_age=3600&openid.return_to=https://www.amazon.com/spr/returns/prep?contractId=6a0575f9-ef14-43ae-afac-f5063d154a1e&rmaId=DxDwhwGcRRMA&orderId=111-7310600-6665801&ingress=prep_email&ref_=pe_114046300_987354350_OD0201BT_E_PREPRefundConfirmation_PREP_St&openid.identity=http://specs.openid.net/auth/2.0/identifier_select&openid.assoc_handle=amzn_psr_desktop_us&openid.mode=checkid_setup&language=en_US&openid.claimed_id=http://specs.openid.net/auth/2.0/identifier_select&openid.ns=http://specs.openid.net/auth/2.0HTTP Parser: No <meta name="copyright".. found
Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49713 version: TLS 1.2
Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49715 version: TLS 1.2
Source: unknownHTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49714 version: TLS 1.2
Source: unknownHTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49808 version: TLS 1.2
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficDNS traffic detected: DNS query: www.amazon.com
Source: global trafficDNS traffic detected: DNS query: business.amazon.com
Source: global trafficDNS traffic detected: DNS query: www.google.com
Source: global trafficDNS traffic detected: DNS query: images-na.ssl-images-amazon.com
Source: global trafficDNS traffic detected: DNS query: fls-na.amazon.com
Source: global trafficDNS traffic detected: DNS query: static.siege-amazon.com
Source: global trafficDNS traffic detected: DNS query: m.media-amazon.com
Source: global trafficDNS traffic detected: DNS query: unagi-na.amazon.com
Source: global trafficDNS traffic detected: DNS query: unagi.amazon.com
Source: unknownNetwork traffic detected: HTTP traffic on port 49708 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49743
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49742
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49741
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49740
Source: unknownNetwork traffic detected: HTTP traffic on port 49789 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49800 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49766 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49743 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49720 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49795 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49739
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49738
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49737
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49736
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49735
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49734
Source: unknownNetwork traffic detected: HTTP traffic on port 49772 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49733
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49732
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49731
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49730
Source: unknownNetwork traffic detected: HTTP traffic on port 49732 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49812 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49703 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49784 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49749 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49806 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49729
Source: unknownNetwork traffic detected: HTTP traffic on port 49777 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49728
Source: unknownNetwork traffic detected: HTTP traffic on port 49714 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49727
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49726
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49724
Source: unknownNetwork traffic detected: HTTP traffic on port 49790 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49723
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49721
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49720
Source: unknownNetwork traffic detected: HTTP traffic on port 49731 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49748 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49760 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49805 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49719
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49718
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49717
Source: unknownNetwork traffic detected: HTTP traffic on port 49715 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49716
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49715
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49714
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49713
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49711
Source: unknownNetwork traffic detected: HTTP traffic on port 49726 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49765 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49796 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49708
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49705
Source: unknownNetwork traffic detected: HTTP traffic on port 49754 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49703
Source: unknownNetwork traffic detected: HTTP traffic on port 49737 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49702
Source: unknownNetwork traffic detected: HTTP traffic on port 49771 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49788
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49787
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49786
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49785
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49784
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49783
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49782
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49781
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49780
Source: unknownNetwork traffic detected: HTTP traffic on port 49785 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49807 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49776 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49713 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49736 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49791 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49759 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49779
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49778
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49777
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49776
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49775
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49774
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49773
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49772
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49771
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49770
Source: unknownNetwork traffic detected: HTTP traffic on port 49724 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49742 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49780 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49802 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49769
Source: unknownNetwork traffic detected: HTTP traffic on port 49718 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49768
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49767
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49766
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49765
Source: unknownNetwork traffic detected: HTTP traffic on port 49758 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49764
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49763
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49762
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49761
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49760
Source: unknownNetwork traffic detected: HTTP traffic on port 49702 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49741 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49764 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49770 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49719 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49797 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49801 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49759
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49758
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49756
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49755
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49754
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49752
Source: unknownNetwork traffic detected: HTTP traffic on port 49730 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49751
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49750
Source: unknownNetwork traffic detected: HTTP traffic on port 49786 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49747 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49775 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49749
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49748
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49747
Source: unknownNetwork traffic detected: HTTP traffic on port 49792 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49746
Source: unknownNetwork traffic detected: HTTP traffic on port 49746 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49781 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49769 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49803 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49717 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49711 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49728 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49763 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49752 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49798 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49735 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49787 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49729 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49793 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49751 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49774 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49782 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49799
Source: unknownNetwork traffic detected: HTTP traffic on port 49734 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49798
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49797
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49796
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49795
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49794
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49793
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49792
Source: unknownNetwork traffic detected: HTTP traffic on port 49814 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49791
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49790
Source: unknownNetwork traffic detected: HTTP traffic on port 49740 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49768 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49723 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49808 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49789
Source: unknownNetwork traffic detected: HTTP traffic on port 49733 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49779 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49727 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49762 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49799 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49810 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49816
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49815
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49814
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49812
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49810
Source: unknownNetwork traffic detected: HTTP traffic on port 49816 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49788 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49767 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49721 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49794 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49809
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49808
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49807
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49806
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49805
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49804
Source: unknownNetwork traffic detected: HTTP traffic on port 49773 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49803
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49802
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49801
Source: unknownNetwork traffic detected: HTTP traffic on port 49756 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49739 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49800
Source: unknownNetwork traffic detected: HTTP traffic on port 49783 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49678 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49815 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49809 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49778 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49755 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49738 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49673 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49705 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49761 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49804 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49716 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49750 -> 443
Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49713 version: TLS 1.2
Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49715 version: TLS 1.2
Source: unknownHTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49714 version: TLS 1.2
Source: unknownHTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49808 version: TLS 1.2
Source: classification engineClassification label: clean1.win@17/6@30/208
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 --field-trial-handle=1884,i,7088009258412178927,15525006651746148157,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.amazon.com/gp/f.html?C=3EZOZG4B143JS&K=1E6K7EDNZJ01O&M=urn:rtn:msg:2024112123575784a68d3791734d57aa59c8099480p0na&R=1X9F7V8OBK7Z1&T=C&U=https%3A%2F%2Fbusiness.amazon.com%2Fabredir%2Fspr%2Freturns%2Fprep%3FcontractId%3D6a0575f9-ef14-43ae-afac-f5063d154a1e%26rmaId%3DDxDwhwGcRRMA%26orderId%3D111-7310600-6665801%26ingress%3Dprep_email%26ref_%3Dpe_114046300_987354350_OD0201BT_E_PREPRefundConfirmation_PREP_St&H=IA4LZ8TXHBNT2KXXSODLQKAB5OKA&ref_=pe_114046300_987354350_OD0201BT_E_PREPRefundConfirmation_PREP_St"
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 --field-trial-handle=1884,i,7088009258412178927,15525006651746148157,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation1
Registry Run Keys / Startup Folder
1
Process Injection
1
Masquerading
OS Credential DumpingSystem Service DiscoveryRemote ServicesData from Local System2
Encrypted Channel
Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
Registry Run Keys / Startup Folder
1
Process Injection
LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol
Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive2
Application Layer Protocol
Automated ExfiltrationData Encrypted for Impact

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand
SourceDetectionScannerLabelLink
https://www.amazon.com/gp/f.html?C=3EZOZG4B143JS&K=1E6K7EDNZJ01O&M=urn:rtn:msg:2024112123575784a68d3791734d57aa59c8099480p0na&R=1X9F7V8OBK7Z1&T=C&U=https%3A%2F%2Fbusiness.amazon.com%2Fabredir%2Fspr%2Freturns%2Fprep%3FcontractId%3D6a0575f9-ef14-43ae-afac-f5063d154a1e%26rmaId%3DDxDwhwGcRRMA%26orderId%3D111-7310600-6665801%26ingress%3Dprep_email%26ref_%3Dpe_114046300_987354350_OD0201BT_E_PREPRefundConfirmation_PREP_St&H=IA4LZ8TXHBNT2KXXSODLQKAB5OKA&ref_=pe_114046300_987354350_OD0201BT_E_PREPRefundConfirmation_PREP_St0%Avira URL Cloudsafe
https://www.amazon.com/gp/f.html?C=3EZOZG4B143JS&K=1E6K7EDNZJ01O&M=urn:rtn:msg:2024112123575784a68d3791734d57aa59c8099480p0na&R=1X9F7V8OBK7Z1&T=C&U=https%3A%2F%2Fbusiness.amazon.com%2Fabredir%2Fspr%2Freturns%2Fprep%3FcontractId%3D6a0575f9-ef14-43ae-afac-f5063d154a1e%26rmaId%3DDxDwhwGcRRMA%26orderId%3D111-7310600-6665801%26ingress%3Dprep_email%26ref_%3Dpe_114046300_987354350_OD0201BT_E_PREPRefundConfirmation_PREP_St&H=IA4LZ8TXHBNT2KXXSODLQKAB5OKA&ref_=pe_114046300_987354350_OD0201BT_E_PREPRefundConfirmation_PREP_St0%VirustotalBrowse
No Antivirus matches
No Antivirus matches
SourceDetectionScannerLabelLink
business.amazon.com0%VirustotalBrowse
No Antivirus matches
NameIPActiveMaliciousAntivirus DetectionReputation
business.amazon.com
108.158.75.6
truefalseunknown
static.siege-amazon.com
108.158.75.113
truefalse
    high
    unagi-na.amazon.com
    44.215.129.188
    truefalse
      high
      www.google.com
      142.250.181.100
      truefalse
        high
        c.media-amazon.com
        18.165.219.107
        truefalse
          high
          d3ag4hukkh62yn.cloudfront.net
          18.165.215.158
          truefalse
            high
            media.amazon.map.fastly.net
            151.101.193.16
            truefalse
              high
              endpoint.prod.us-east-1.forester.a2z.com
              3.95.100.46
              truefalse
                high
                www.amazon.com
                unknown
                unknownfalse
                  high
                  m.media-amazon.com
                  unknown
                  unknownfalse
                    high
                    images-na.ssl-images-amazon.com
                    unknown
                    unknownfalse
                      high
                      fls-na.amazon.com
                      unknown
                      unknownfalse
                        high
                        unagi.amazon.com
                        unknown
                        unknownfalse
                          high
                          NameMaliciousAntivirus DetectionReputation
                          https://www.amazon.com/ap/signin?openid.pape.max_auth_age=3600&openid.return_to=https%3A%2F%2Fwww.amazon.com%2Fspr%2Freturns%2Fprep%3FcontractId%3D6a0575f9-ef14-43ae-afac-f5063d154a1e%26rmaId%3DDxDwhwGcRRMA%26orderId%3D111-7310600-6665801%26ingress%3Dprep_email%26ref_%3Dpe_114046300_987354350_OD0201BT_E_PREPRefundConfirmation_PREP_St&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.assoc_handle=amzn_psr_desktop_us&openid.mode=checkid_setup&language=en_US&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0false
                            unknown
                            https://www.amazon.com/ap/signin?openid.pape.max_auth_age=3600&openid.return_to=https://www.amazon.com/spr/returns/prep?contractId=6a0575f9-ef14-43ae-afac-f5063d154a1e&rmaId=DxDwhwGcRRMA&orderId=111-7310600-6665801&ingress=prep_email&ref_=pe_114046300_987354350_OD0201BT_E_PREPRefundConfirmation_PREP_St&openid.identity=http://specs.openid.net/auth/2.0/identifier_select&openid.assoc_handle=amzn_psr_desktop_us&openid.mode=checkid_setup&language=en_US&openid.claimed_id=http://specs.openid.net/auth/2.0/identifier_select&openid.ns=http://specs.openid.net/auth/2.0false
                              unknown
                              • No. of IPs < 25%
                              • 25% < No. of IPs < 50%
                              • 50% < No. of IPs < 75%
                              • 75% < No. of IPs
                              IPDomainCountryFlagASNASN NameMalicious
                              108.158.75.6
                              business.amazon.comUnited States
                              16509AMAZON-02USfalse
                              1.1.1.1
                              unknownAustralia
                              13335CLOUDFLARENETUSfalse
                              18.165.219.107
                              c.media-amazon.comUnited States
                              3MIT-GATEWAYSUSfalse
                              3.95.100.46
                              endpoint.prod.us-east-1.forester.a2z.comUnited States
                              14618AMAZON-AESUSfalse
                              151.101.193.16
                              media.amazon.map.fastly.netUnited States
                              54113FASTLYUSfalse
                              172.217.17.35
                              unknownUnited States
                              15169GOOGLEUSfalse
                              172.217.17.46
                              unknownUnited States
                              15169GOOGLEUSfalse
                              142.250.181.100
                              www.google.comUnited States
                              15169GOOGLEUSfalse
                              74.125.205.84
                              unknownUnited States
                              15169GOOGLEUSfalse
                              54.237.25.55
                              unknownUnited States
                              14618AMAZON-AESUSfalse
                              239.255.255.250
                              unknownReserved
                              unknownunknownfalse
                              18.165.215.158
                              d3ag4hukkh62yn.cloudfront.netUnited States
                              3MIT-GATEWAYSUSfalse
                              172.217.21.42
                              unknownUnited States
                              15169GOOGLEUSfalse
                              44.215.129.188
                              unagi-na.amazon.comUnited States
                              14618AMAZON-AESUSfalse
                              172.217.21.35
                              unknownUnited States
                              15169GOOGLEUSfalse
                              151.101.129.16
                              unknownUnited States
                              54113FASTLYUSfalse
                              44.215.133.78
                              unknownUnited States
                              14618AMAZON-AESUSfalse
                              108.158.75.113
                              static.siege-amazon.comUnited States
                              16509AMAZON-02USfalse
                              IP
                              192.168.2.16
                              192.168.2.15
                              Joe Sandbox version:41.0.0 Charoite
                              Analysis ID:1560598
                              Start date and time:2024-11-22 01:12:24 +01:00
                              Joe Sandbox product:CloudBasic
                              Overall analysis duration:
                              Hypervisor based Inspection enabled:false
                              Report type:full
                              Cookbook file name:defaultwindowsinteractivecookbook.jbs
                              Sample URL:https://www.amazon.com/gp/f.html?C=3EZOZG4B143JS&K=1E6K7EDNZJ01O&M=urn:rtn:msg:2024112123575784a68d3791734d57aa59c8099480p0na&R=1X9F7V8OBK7Z1&T=C&U=https%3A%2F%2Fbusiness.amazon.com%2Fabredir%2Fspr%2Freturns%2Fprep%3FcontractId%3D6a0575f9-ef14-43ae-afac-f5063d154a1e%26rmaId%3DDxDwhwGcRRMA%26orderId%3D111-7310600-6665801%26ingress%3Dprep_email%26ref_%3Dpe_114046300_987354350_OD0201BT_E_PREPRefundConfirmation_PREP_St&H=IA4LZ8TXHBNT2KXXSODLQKAB5OKA&ref_=pe_114046300_987354350_OD0201BT_E_PREPRefundConfirmation_PREP_St
                              Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                              Number of analysed new started processes analysed:13
                              Number of new started drivers analysed:0
                              Number of existing processes analysed:0
                              Number of existing drivers analysed:0
                              Number of injected processes analysed:0
                              Technologies:
                              • EGA enabled
                              Analysis Mode:stream
                              Analysis stop reason:Timeout
                              Detection:CLEAN
                              Classification:clean1.win@17/6@30/208
                              • Exclude process from analysis (whitelisted): svchost.exe
                              • Excluded IPs from analysis (whitelisted): 172.217.21.35, 172.217.17.46, 74.125.205.84, 34.104.35.123
                              • Excluded domains from analysis (whitelisted): clients2.google.com, accounts.google.com, edgedl.me.gvt1.com, www.amazon.com.edgekey.net, clientservices.googleapis.com, clients.l.google.com
                              • Not all processes where analyzed, report is missing behavior information
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Nov 21 23:12:56 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                              Category:dropped
                              Size (bytes):2673
                              Entropy (8bit):3.9828053134694255
                              Encrypted:false
                              SSDEEP:
                              MD5:C55303E27081570F26EB55708C1108BA
                              SHA1:96B79ADA461DDDDD64D37BC5B886E151F9C9E8B7
                              SHA-256:D3F2A3CBE1BFB5C6AD782480E7C230388CF44F1C4475C4FD976D509EE815EA67
                              SHA-512:076E57D9FF6C0438E11B1E50E58497E15CFD2EF4AE144BC4E5F298C7C89E0FE60D4B574991D605BAB9C3731619470C2B9BFCE7C837BCF7CC1E35B7DB9F6AD8C8
                              Malicious:false
                              Reputation:unknown
                              Preview:L..................F.@.. ...$+.,....P.Gs<..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IvY......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VvY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VvY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VvY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VvY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............{.W.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Nov 21 23:12:55 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                              Category:dropped
                              Size (bytes):2675
                              Entropy (8bit):4.000893824698097
                              Encrypted:false
                              SSDEEP:
                              MD5:B783F948B70FEF56F97A171FF04482E4
                              SHA1:B2BB90BE0E13A2A74934226781858F65AA1ECAD1
                              SHA-256:1375B3723DF427D107E53B2B34F53B51B91CD26E74382021AFB77D3FD6F3E8A4
                              SHA-512:84F9F3D72C76D80A8EB6A1DA7D7B0ED2854FF06608143D1D0B5E14541C771B3BC3B826BA99A4B269ED00B47E784202C2A8FB545941157166CDBFC6083721E385
                              Malicious:false
                              Reputation:unknown
                              Preview:L..................F.@.. ...$+.,.....].Gs<..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IvY......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VvY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VvY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VvY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VvY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............{.W.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                              Category:dropped
                              Size (bytes):2689
                              Entropy (8bit):4.005071389469628
                              Encrypted:false
                              SSDEEP:
                              MD5:458B4337036928D94A7BD29E33035BAF
                              SHA1:B721F8C91F1B80D8B5302BA90DD9E913C02018E2
                              SHA-256:47484D9C37910C4006A247FA572872944C5652A23D2F6207D2634476454BFEEB
                              SHA-512:DC61DFBD92063765B915927D46234BAF141D3217737E80CF8976113FE5FACE806FEE5263F9F30B598C7F41B78DE3667191CAE2C6AD12EB9853537E52C7B7BDC0
                              Malicious:false
                              Reputation:unknown
                              Preview:L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IvY......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VvY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VvY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VvY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............{.W.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Nov 21 23:12:55 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                              Category:dropped
                              Size (bytes):2677
                              Entropy (8bit):3.998814622741756
                              Encrypted:false
                              SSDEEP:
                              MD5:D42F6012CB43EB7C6FF1505C8BEF3850
                              SHA1:36E9C012AEC0EC15FB3748F509825D186A0BE377
                              SHA-256:CB75B96C5CAE4FC2E748AB534257500D882B8DCCF7EB86C85E8722FE595E8EB0
                              SHA-512:97B6392A5F92468C0FD06E7319232D08C0C016845646105E3F4520F0229E63928F9771E58C688C078C56E5E31B4F602D883CD59A1996AF26993468A93BB0FEFD
                              Malicious:false
                              Reputation:unknown
                              Preview:L..................F.@.. ...$+.,....!..Gs<..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IvY......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VvY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VvY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VvY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VvY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............{.W.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Nov 21 23:12:55 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                              Category:dropped
                              Size (bytes):2677
                              Entropy (8bit):3.985528261367898
                              Encrypted:false
                              SSDEEP:
                              MD5:886B9361B9392EC217F59670BECAFE88
                              SHA1:A78C56E2100D1F41CA84F518658CFDE97BBAC692
                              SHA-256:163680DA6C5453D11E99E7E80AD4586A0412F66087D05DD6EFC277F2B62FB41E
                              SHA-512:AC75A74DD7C95266809D3DF7B38B7A3A02D9F0D76DDAFE16A2AA5EC6E662A06DAF19A997C949640FA3D10A29DE03F2B99C881FF9E822F7A7C23C795A5EC2272D
                              Malicious:false
                              Reputation:unknown
                              Preview:L..................F.@.. ...$+.,.....b.Gs<..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IvY......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VvY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VvY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VvY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VvY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............{.W.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Nov 21 23:12:55 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                              Category:dropped
                              Size (bytes):2679
                              Entropy (8bit):3.9923609247487897
                              Encrypted:false
                              SSDEEP:
                              MD5:1D47E81D1DB5F3867797BB7197E6F8D2
                              SHA1:1E293BC341D9984D098873E94775B95F4DF58C4F
                              SHA-256:EF469C728D71EF4389251933F50391C8858BD9CEFE9565921F94B9FC61198D73
                              SHA-512:E46E77BBAAF70986F0646A12EFB7E15F96DD4086203983D6DF238F04D9753F6C3E9ABD31974D1CBF0DC5A2A95E3E2F5C0BEE28559CF28D88FACC5A75C544B986
                              Malicious:false
                              Reputation:unknown
                              Preview:L..................F.@.. ...$+.,....AX.Gs<..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IvY......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VvY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VvY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VvY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VvY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............{.W.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                              No static file info