Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
https://wetransfer.com/downloads/a83584fea59b11ef1e94d36869e8790020241209234540/89744b9472f9ce1b5e3b4ada79f2184c20241209234540/7041ff?t_exp=1734047140&t_lsid=42d44d78-6d8f-48db-8db5-5efa0c86786d&t_network=email&t_rid=ZW1haWx8Njc0ZjQ5YTNiNjM1NTFjNmY2NTg0N2Zj&t_s=download_link&t_ts=1733787940&utm_camp

Overview

General Information

Sample URL:https://wetransfer.com/downloads/a83584fea59b11ef1e94d36869e8790020241209234540/89744b9472f9ce1b5e3b4ada79f2184c20241209234540/7041ff?t_exp=1734047140&t_lsid=42d44d78-6d8f-48db-8db5-5efa0c86786d&t_net
Analysis ID:1572466
Infos:

Detection

Score:48
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Yara detected ZipBomb
HTML page contains hidden javascript code
Stores files to the Windows start menu directory

Classification

  • System is w10x64_ra
  • chrome.exe (PID: 6952 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • chrome.exe (PID: 6260 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=2008,i,173320308660370472,15969641463460629122,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • chrome.exe (PID: 7864 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4372 --field-trial-handle=2008,i,173320308660370472,15969641463460629122,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • chrome.exe (PID: 6728 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://wetransfer.com/downloads/a83584fea59b11ef1e94d36869e8790020241209234540/89744b9472f9ce1b5e3b4ada79f2184c20241209234540/7041ff?t_exp=1734047140&t_lsid=42d44d78-6d8f-48db-8db5-5efa0c86786d&t_network=email&t_rid=ZW1haWx8Njc0ZjQ5YTNiNjM1NTFjNmY2NTg0N2Zj&t_s=download_link&t_ts=1733787940&utm_campaign=TRN_TDL_01&utm_source=sendgrid&utm_medium=email&trk=TRN_TDL_01" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • rundll32.exe (PID: 4636 cmdline: C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding MD5: EF3179D498793BF4234F708D3BE28633)
  • Acrobat.exe (PID: 4104 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\Temp1_wetransfer_cmf-2024-poster-jpg_2024-12-09_2345.zip\FINAL poster.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)
    • AcroCEF.exe (PID: 2308 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
      • AcroCEF.exe (PID: 5504 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2272 --field-trial-handle=1588,i,4419266989590557744,5262710027109013525,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
  • cleanup
SourceRuleDescriptionAuthorStrings
C:\Users\user\Downloads\9bd79503-af32-4e9d-a0d9-bfeb9acd3e0d.tmpJoeSecurity_ZipBombYara detected ZipBombJoe Security
    No Sigma rule has matched
    No Suricata rule has matched

    Click to jump to signature section

    Show All Signature Results
    Source: https://wetransfer.com/downloads/a83584fea59b11ef1e94d36869e8790020241209234540/89744b9472f9ce1b5e3b4ada79f2184c20241209234540/7041ff?t_exp=1734047140&t_lsid=42d44d78-6d8f-48db-8db5-5efa0c86786d&t_network=email&t_rid=ZW1haWx8Njc0ZjQ5YTNiNjM1NTFjNmY2NTg0N2Zj&t_s=download_link&t_ts=1733787940&utm_campaign=TRN_TDL_01&utm_source=sendgrid&utm_medium=email&trk=TRN_TDL_01HTTP Parser: Base64 decoded: email|674f49a3b63551c6f65847fc
    Source: https://wetransfer.com/downloads/a83584fea59b11ef1e94d36869e8790020241209234540/89744b9472f9ce1b5e3b4ada79f2184c20241209234540/7041ff?t_exp=1734047140&t_lsid=42d44d78-6d8f-48db-8db5-5efa0c86786d&t_network=email&t_rid=ZW1haWx8Njc0ZjQ5YTNiNjM1NTFjNmY2NTg0N2Zj&t_s=download_link&t_ts=1733787940&utm_campaign=TRN_TDL_01&utm_source=sendgrid&utm_medium=email&trk=TRN_TDL_01HTTP Parser: No favicon
    Source: https://wetransfer.com/downloads/a83584fea59b11ef1e94d36869e8790020241209234540/89744b9472f9ce1b5e3b4ada79f2184c20241209234540/7041ff?t_exp=1734047140&t_lsid=42d44d78-6d8f-48db-8db5-5efa0c86786d&t_network=email&t_rid=ZW1haWx8Njc0ZjQ5YTNiNjM1NTFjNmY2NTg0N2Zj&t_s=download_link&t_ts=1733787940&utm_campaign=TRN_TDL_01&utm_source=sendgrid&utm_medium=email&trk=TRN_TDL_01HTTP Parser: No favicon
    Source: https://wetransfer.com/downloads/a83584fea59b11ef1e94d36869e8790020241209234540/89744b9472f9ce1b5e3b4ada79f2184c20241209234540/7041ff?t_exp=1734047140&t_lsid=42d44d78-6d8f-48db-8db5-5efa0c86786d&t_network=email&t_rid=ZW1haWx8Njc0ZjQ5YTNiNjM1NTFjNmY2NTg0N2Zj&t_s=download_link&t_ts=1733787940&utm_campaign=TRN_TDL_01&utm_source=sendgrid&utm_medium=email&trk=TRN_TDL_01HTTP Parser: No favicon
    Source: https://wetransfer.com/downloads/a83584fea59b11ef1e94d36869e8790020241209234540/89744b9472f9ce1b5e3b4ada79f2184c20241209234540/7041ff?t_exp=1734047140&t_lsid=42d44d78-6d8f-48db-8db5-5efa0c86786d&t_network=email&t_rid=ZW1haWx8Njc0ZjQ5YTNiNjM1NTFjNmY2NTg0N2Zj&t_s=download_link&t_ts=1733787940&utm_campaign=TRN_TDL_01&utm_source=sendgrid&utm_medium=email&trk=TRN_TDL_01HTTP Parser: No favicon
    Source: https://wetransfer.com/downloads/a83584fea59b11ef1e94d36869e8790020241209234540/89744b9472f9ce1b5e3b4ada79f2184c20241209234540/7041ff?t_exp=1734047140&t_lsid=42d44d78-6d8f-48db-8db5-5efa0c86786d&t_network=email&t_rid=ZW1haWx8Njc0ZjQ5YTNiNjM1NTFjNmY2NTg0N2Zj&t_s=download_link&t_ts=1733787940&utm_campaign=TRN_TDL_01&utm_source=sendgrid&utm_medium=email&trk=TRN_TDL_01HTTP Parser: No favicon
    Source: https://wetransfer.com/downloads/a83584fea59b11ef1e94d36869e8790020241209234540/89744b9472f9ce1b5e3b4ada79f2184c20241209234540/7041ff?t_exp=1734047140&t_lsid=42d44d78-6d8f-48db-8db5-5efa0c86786d&t_network=email&t_rid=ZW1haWx8Njc0ZjQ5YTNiNjM1NTFjNmY2NTg0N2Zj&t_s=download_link&t_ts=1733787940&utm_campaign=TRN_TDL_01&utm_source=sendgrid&utm_medium=email&trk=TRN_TDL_01HTTP Parser: No favicon
    Source: https://wetransfer.com/downloads/a83584fea59b11ef1e94d36869e8790020241209234540/89744b9472f9ce1b5e3b4ada79f2184c20241209234540/7041ff?t_exp=1734047140&t_lsid=42d44d78-6d8f-48db-8db5-5efa0c86786d&t_network=email&t_rid=ZW1haWx8Njc0ZjQ5YTNiNjM1NTFjNmY2NTg0N2Zj&t_s=download_link&t_ts=1733787940&utm_campaign=TRN_TDL_01&utm_source=sendgrid&utm_medium=email&trk=TRN_TDL_01HTTP Parser: No favicon
    Source: https://wetransfer.com/downloads/a83584fea59b11ef1e94d36869e8790020241209234540/89744b9472f9ce1b5e3b4ada79f2184c20241209234540/7041ff?t_exp=1734047140&t_lsid=42d44d78-6d8f-48db-8db5-5efa0c86786d&t_network=email&t_rid=ZW1haWx8Njc0ZjQ5YTNiNjM1NTFjNmY2NTg0N2Zj&t_s=download_link&t_ts=1733787940&utm_campaign=TRN_TDL_01&utm_source=sendgrid&utm_medium=email&trk=TRN_TDL_01HTTP Parser: No favicon
    Source: https://wetransfer.com/downloads/a83584fea59b11ef1e94d36869e8790020241209234540/89744b9472f9ce1b5e3b4ada79f2184c20241209234540/7041ff?t_exp=1734047140&t_lsid=42d44d78-6d8f-48db-8db5-5efa0c86786d&t_network=email&t_rid=ZW1haWx8Njc0ZjQ5YTNiNjM1NTFjNmY2NTg0N2Zj&t_s=download_link&t_ts=1733787940&utm_campaign=TRN_TDL_01&utm_source=sendgrid&utm_medium=email&trk=TRN_TDL_01HTTP Parser: No favicon
    Source: https://wetransfer.com/downloads/a83584fea59b11ef1e94d36869e8790020241209234540/89744b9472f9ce1b5e3b4ada79f2184c20241209234540/7041ff?t_exp=1734047140&t_lsid=42d44d78-6d8f-48db-8db5-5efa0c86786d&t_network=email&t_rid=ZW1haWx8Njc0ZjQ5YTNiNjM1NTFjNmY2NTg0N2Zj&t_s=download_link&t_ts=1733787940&utm_campaign=TRN_TDL_01&utm_source=sendgrid&utm_medium=email&trk=TRN_TDL_01HTTP Parser: No favicon
    Source: https://wetransfer.com/downloads/a83584fea59b11ef1e94d36869e8790020241209234540/89744b9472f9ce1b5e3b4ada79f2184c20241209234540/7041ff?t_exp=1734047140&t_lsid=42d44d78-6d8f-48db-8db5-5efa0c86786d&t_network=email&t_rid=ZW1haWx8Njc0ZjQ5YTNiNjM1NTFjNmY2NTg0N2Zj&t_s=download_link&t_ts=1733787940&utm_campaign=TRN_TDL_01&utm_source=sendgrid&utm_medium=email&trk=TRN_TDL_01HTTP Parser: No favicon
    Source: https://wetransfer.com/downloads/a83584fea59b11ef1e94d36869e8790020241209234540/89744b9472f9ce1b5e3b4ada79f2184c20241209234540/7041ff?t_exp=1734047140&t_lsid=42d44d78-6d8f-48db-8db5-5efa0c86786d&t_network=email&t_rid=ZW1haWx8Njc0ZjQ5YTNiNjM1NTFjNmY2NTg0N2Zj&t_s=download_link&t_ts=1733787940&utm_campaign=TRN_TDL_01&utm_source=sendgrid&utm_medium=email&trk=TRN_TDL_01HTTP Parser: No favicon
    Source: https://wetransfer.com/downloads/a83584fea59b11ef1e94d36869e8790020241209234540/89744b9472f9ce1b5e3b4ada79f2184c20241209234540/7041ff?t_exp=1734047140&t_lsid=42d44d78-6d8f-48db-8db5-5efa0c86786d&t_network=email&t_rid=ZW1haWx8Njc0ZjQ5YTNiNjM1NTFjNmY2NTg0N2Zj&t_s=download_link&t_ts=1733787940&utm_campaign=TRN_TDL_01&utm_source=sendgrid&utm_medium=email&trk=TRN_TDL_01HTTP Parser: No favicon
    Source: https://wetransfer.com/downloads/a83584fea59b11ef1e94d36869e8790020241209234540/89744b9472f9ce1b5e3b4ada79f2184c20241209234540/7041ff?t_exp=1734047140&t_lsid=42d44d78-6d8f-48db-8db5-5efa0c86786d&t_network=email&t_rid=ZW1haWx8Njc0ZjQ5YTNiNjM1NTFjNmY2NTg0N2Zj&t_s=download_link&t_ts=1733787940&utm_campaign=TRN_TDL_01&utm_source=sendgrid&utm_medium=email&trk=TRN_TDL_01HTTP Parser: No favicon
    Source: https://wetransfer.com/downloads/a83584fea59b11ef1e94d36869e8790020241209234540/89744b9472f9ce1b5e3b4ada79f2184c20241209234540/7041ff?t_exp=1734047140&t_lsid=42d44d78-6d8f-48db-8db5-5efa0c86786d&t_network=email&t_rid=ZW1haWx8Njc0ZjQ5YTNiNjM1NTFjNmY2NTg0N2Zj&t_s=download_link&t_ts=1733787940&utm_campaign=TRN_TDL_01&utm_source=sendgrid&utm_medium=email&trk=TRN_TDL_01HTTP Parser: No favicon
    Source: https://wetransfer.com/downloads/a83584fea59b11ef1e94d36869e8790020241209234540/89744b9472f9ce1b5e3b4ada79f2184c20241209234540/7041ff?t_exp=1734047140&t_lsid=42d44d78-6d8f-48db-8db5-5efa0c86786d&t_network=email&t_rid=ZW1haWx8Njc0ZjQ5YTNiNjM1NTFjNmY2NTg0N2Zj&t_s=download_link&t_ts=1733787940&utm_campaign=TRN_TDL_01&utm_source=sendgrid&utm_medium=email&trk=TRN_TDL_01HTTP Parser: No favicon
    Source: https://wetransfer.com/downloads/a83584fea59b11ef1e94d36869e8790020241209234540/89744b9472f9ce1b5e3b4ada79f2184c20241209234540/7041ff?t_exp=1734047140&t_lsid=42d44d78-6d8f-48db-8db5-5efa0c86786d&t_network=email&t_rid=ZW1haWx8Njc0ZjQ5YTNiNjM1NTFjNmY2NTg0N2Zj&t_s=download_link&t_ts=1733787940&utm_campaign=TRN_TDL_01&utm_source=sendgrid&utm_medium=email&trk=TRN_TDL_01HTTP Parser: No favicon
    Source: https://wetransfer.com/downloads/a83584fea59b11ef1e94d36869e8790020241209234540/89744b9472f9ce1b5e3b4ada79f2184c20241209234540/7041ff?t_exp=1734047140&t_lsid=42d44d78-6d8f-48db-8db5-5efa0c86786d&t_network=email&t_rid=ZW1haWx8Njc0ZjQ5YTNiNjM1NTFjNmY2NTg0N2Zj&t_s=download_link&t_ts=1733787940&utm_campaign=TRN_TDL_01&utm_source=sendgrid&utm_medium=email&trk=TRN_TDL_01HTTP Parser: No favicon
    Source: https://wetransfer.com/downloads/a83584fea59b11ef1e94d36869e8790020241209234540/89744b9472f9ce1b5e3b4ada79f2184c20241209234540/7041ff?t_exp=1734047140&t_lsid=42d44d78-6d8f-48db-8db5-5efa0c86786d&t_network=email&t_rid=ZW1haWx8Njc0ZjQ5YTNiNjM1NTFjNmY2NTg0N2Zj&t_s=download_link&t_ts=1733787940&utm_campaign=TRN_TDL_01&utm_source=sendgrid&utm_medium=email&trk=TRN_TDL_01HTTP Parser: No favicon
    Source: https://wetransfer.com/downloads/a83584fea59b11ef1e94d36869e8790020241209234540/89744b9472f9ce1b5e3b4ada79f2184c20241209234540/7041ff?t_exp=1734047140&t_lsid=42d44d78-6d8f-48db-8db5-5efa0c86786d&t_network=email&t_rid=ZW1haWx8Njc0ZjQ5YTNiNjM1NTFjNmY2NTg0N2Zj&t_s=download_link&t_ts=1733787940&utm_campaign=TRN_TDL_01&utm_source=sendgrid&utm_medium=email&trk=TRN_TDL_01HTTP Parser: No favicon
    Source: https://wetransfer.com/downloads/a83584fea59b11ef1e94d36869e8790020241209234540/89744b9472f9ce1b5e3b4ada79f2184c20241209234540/7041ff?t_exp=1734047140&t_lsid=42d44d78-6d8f-48db-8db5-5efa0c86786d&t_network=email&t_rid=ZW1haWx8Njc0ZjQ5YTNiNjM1NTFjNmY2NTg0N2Zj&t_s=download_link&t_ts=1733787940&utm_campaign=TRN_TDL_01&utm_source=sendgrid&utm_medium=email&trk=TRN_TDL_01HTTP Parser: No favicon
    Source: unknownHTTPS traffic detected: 2.18.109.164:443 -> 192.168.2.16:49737 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 2.18.109.164:443 -> 192.168.2.16:49747 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49746 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49884 version: TLS 1.2
    Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
    Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
    Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
    Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
    Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
    Source: unknownTCP traffic detected without corresponding DNS query: 2.18.109.164
    Source: unknownTCP traffic detected without corresponding DNS query: 2.18.109.164
    Source: unknownTCP traffic detected without corresponding DNS query: 2.18.109.164
    Source: unknownTCP traffic detected without corresponding DNS query: 2.18.109.164
    Source: unknownTCP traffic detected without corresponding DNS query: 2.18.109.164
    Source: unknownTCP traffic detected without corresponding DNS query: 2.18.109.164
    Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
    Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
    Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
    Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
    Source: unknownTCP traffic detected without corresponding DNS query: 2.18.109.164
    Source: unknownTCP traffic detected without corresponding DNS query: 2.18.109.164
    Source: unknownTCP traffic detected without corresponding DNS query: 2.18.109.164
    Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
    Source: unknownTCP traffic detected without corresponding DNS query: 2.18.109.164
    Source: unknownTCP traffic detected without corresponding DNS query: 2.18.109.164
    Source: unknownTCP traffic detected without corresponding DNS query: 2.18.109.164
    Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
    Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
    Source: unknownTCP traffic detected without corresponding DNS query: 2.18.109.164
    Source: unknownTCP traffic detected without corresponding DNS query: 2.18.109.164
    Source: unknownTCP traffic detected without corresponding DNS query: 2.18.109.164
    Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
    Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
    Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
    Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
    Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
    Source: unknownTCP traffic detected without corresponding DNS query: 2.18.109.164
    Source: unknownTCP traffic detected without corresponding DNS query: 2.18.109.164
    Source: unknownTCP traffic detected without corresponding DNS query: 2.18.109.164
    Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
    Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
    Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
    Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
    Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
    Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
    Source: global trafficDNS traffic detected: DNS query: wetransfer.com
    Source: global trafficDNS traffic detected: DNS query: cdn.wetransfer.com
    Source: global trafficDNS traffic detected: DNS query: www.google.com
    Source: global trafficDNS traffic detected: DNS query: cdn.jsdelivr.net
    Source: global trafficDNS traffic detected: DNS query: tagging.wetransfer.com
    Source: global trafficDNS traffic detected: DNS query: ekstrom.wetransfer.net
    Source: global trafficDNS traffic detected: DNS query: auth-session-caching.wetransfer.net
    Source: global trafficDNS traffic detected: DNS query: privacy.wetransfer.com
    Source: global trafficDNS traffic detected: DNS query: bsp-proxy.wetransfer.net
    Source: global trafficDNS traffic detected: DNS query: experiments.wetransfer.com
    Source: global trafficDNS traffic detected: DNS query: analytics-v2.wetransfer.com
    Source: global trafficDNS traffic detected: DNS query: connect.facebook.net
    Source: global trafficDNS traffic detected: DNS query: s.pinimg.com
    Source: global trafficDNS traffic detected: DNS query: js.adsrvr.org
    Source: global trafficDNS traffic detected: DNS query: c.amazon-adsystem.com
    Source: global trafficDNS traffic detected: DNS query: snowplow.wetransfer.com
    Source: global trafficDNS traffic detected: DNS query: s.amazon-adsystem.com
    Source: global trafficDNS traffic detected: DNS query: insight.adsrvr.org
    Source: global trafficDNS traffic detected: DNS query: googleads.g.doubleclick.net
    Source: global trafficDNS traffic detected: DNS query: e-10220.adzerk.net
    Source: global trafficDNS traffic detected: DNS query: match.adsrvr.org
    Source: global trafficDNS traffic detected: DNS query: di.rlcdn.com
    Source: global trafficDNS traffic detected: DNS query: ara.paa-reporting-advertising.amazon
    Source: global trafficDNS traffic detected: DNS query: public.profitwell.com
    Source: global trafficDNS traffic detected: DNS query: nolan.wetransfer.net
    Source: global trafficDNS traffic detected: DNS query: ct.pinterest.com
    Source: global trafficDNS traffic detected: DNS query: cm.g.doubleclick.net
    Source: global trafficDNS traffic detected: DNS query: pixel.rubiconproject.com
    Source: global trafficDNS traffic detected: DNS query: ib.adnxs.com
    Source: global trafficDNS traffic detected: DNS query: lebowski.wetransfer.com
    Source: global trafficDNS traffic detected: DNS query: www.facebook.com
    Source: global trafficDNS traffic detected: DNS query: safety.wetransfer.com
    Source: global trafficDNS traffic detected: DNS query: cdn.brandmetrics.com
    Source: global trafficDNS traffic detected: DNS query: www.datadoghq-browser-agent.com
    Source: global trafficDNS traffic detected: DNS query: download.wetransfer.com
    Source: global trafficDNS traffic detected: DNS query: backgrounds.wetransfer.net
    Source: global trafficDNS traffic detected: DNS query: collector.brandmetrics.com
    Source: global trafficDNS traffic detected: DNS query: donny.wetransfer.com
    Source: global trafficDNS traffic detected: DNS query: s.innovid.com
    Source: global trafficDNS traffic detected: DNS query: tps.doubleverify.com
    Source: global trafficDNS traffic detected: DNS query: pixel.adsafeprotected.com
    Source: global trafficDNS traffic detected: DNS query: ag.innovid.com
    Source: global trafficDNS traffic detected: DNS query: static.adsafeprotected.com
    Source: global trafficDNS traffic detected: DNS query: dt.adsafeprotected.com
    Source: global trafficDNS traffic detected: DNS query: wepresent.wetransfer.com
    Source: global trafficDNS traffic detected: DNS query: help.wetransfer.com
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49744
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49865
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49986
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49743
    Source: unknownNetwork traffic detected: HTTP traffic on port 49817 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49864
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49985
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49742
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49863
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49984
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49741
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49862
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49983
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49740
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49861
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49982
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49860
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49981
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49980
    Source: unknownNetwork traffic detected: HTTP traffic on port 49932 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49875 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49852 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49795 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49990 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49739
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49738
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49859
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49737
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49858
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49979
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49736
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49857
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49978
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49856
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49977
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49734
    Source: unknownNetwork traffic detected: HTTP traffic on port 49772 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49855
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49976
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49733
    Source: unknownNetwork traffic detected: HTTP traffic on port 49841 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49854
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49975
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49732
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49853
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49974
    Source: unknownNetwork traffic detected: HTTP traffic on port 50085 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49731
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49852
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49730
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49851
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49972
    Source: unknownNetwork traffic detected: HTTP traffic on port 50039 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49850
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49971
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49970
    Source: unknownNetwork traffic detected: HTTP traffic on port 49703 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49967 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49784 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49749 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 50074 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 50004 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49806 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49729
    Source: unknownNetwork traffic detected: HTTP traffic on port 49943 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49728
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49849
    Source: unknownNetwork traffic detected: HTTP traffic on port 49714 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49727
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49848
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49969
    Source: unknownNetwork traffic detected: HTTP traffic on port 49978 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49726
    Source: unknownNetwork traffic detected: HTTP traffic on port 49886 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49846
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49967
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49845
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49724
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49966
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49723
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49844
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49965
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49722
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49843
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49964
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49842
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49963
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49720
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49841
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49962
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49840
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49961
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49960
    Source: unknownNetwork traffic detected: HTTP traffic on port 50015 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 50040 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49966 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49989 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49748 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49760 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 50096 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49828 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 50073 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49933 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 50028 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49805 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49719
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49839
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49838
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49959
    Source: unknownNetwork traffic detected: HTTP traffic on port 49715 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49716
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49837
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49958
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49715
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49836
    Source: unknownNetwork traffic detected: HTTP traffic on port 49921 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49957
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49714
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49835
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49956
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49713
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49834
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49955
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49712
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49833
    Source: unknownNetwork traffic detected: HTTP traffic on port 49887 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49954
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49711
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49832
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49953
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49710
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49831
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49952
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49951
    Source: unknownNetwork traffic detected: HTTP traffic on port 49839 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49864 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49950
    Source: unknownNetwork traffic detected: HTTP traffic on port 49944 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49726 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49910 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49853 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 50051 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49796 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49709
    Source: unknownNetwork traffic detected: HTTP traffic on port 49955 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49708
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49829
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49707
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49828
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49949
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49706
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49827
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49948
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49705
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49826
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49947
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49704
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49825
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49946
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49703
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49824
    Source: unknownNetwork traffic detected: HTTP traffic on port 49737 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49702
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49823
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49944
    Source: unknownNetwork traffic detected: HTTP traffic on port 49771 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49701
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49822
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49943
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49788
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49787
    Source: unknownNetwork traffic detected: HTTP traffic on port 50061 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49786
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49785
    Source: unknownNetwork traffic detected: HTTP traffic on port 49922 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49784
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49783
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49782
    Source: unknownNetwork traffic detected: HTTP traffic on port 50017 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49781
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49780
    Source: unknownNetwork traffic detected: HTTP traffic on port 49785 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 50026 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49807 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49701 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49980 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49713 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49736 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49759 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49779
    Source: unknownNetwork traffic detected: HTTP traffic on port 49885 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49778
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49899
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49777
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49776
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49897
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49775
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49896
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49774
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49895
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49773
    Source: unknownNetwork traffic detected: HTTP traffic on port 49862 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49772
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49771
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49770
    Source: unknownNetwork traffic detected: HTTP traffic on port 49724 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 50095 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49897 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49911 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49957 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49851 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49991 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49769
    Source: unknownNetwork traffic detected: HTTP traffic on port 50084 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49768
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49889
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49767
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49888
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49766
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49887
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49765
    Source: unknownNetwork traffic detected: HTTP traffic on port 49758 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49886
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49764
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49885
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49763
    Source: unknownNetwork traffic detected: HTTP traffic on port 49863 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49884
    Source: unknownNetwork traffic detected: HTTP traffic on port 50038 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49762
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49883
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49761
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49882
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49760
    Source: unknownNetwork traffic detected: HTTP traffic on port 49840 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49880
    Source: unknownNetwork traffic detected: HTTP traffic on port 49702 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49896 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49770 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49797 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49956 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 50005 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49979 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49759
    Source: unknownNetwork traffic detected: HTTP traffic on port 50083 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49758
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49757
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49878
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49999
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49756
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49877
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49998
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49755
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49876
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49997
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49754
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49875
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49996
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49753
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49995
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49752
    Source: unknownNetwork traffic detected: HTTP traffic on port 49923 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49994
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49751
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49993
    Source: unknownNetwork traffic detected: HTTP traffic on port 50016 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49750
    Source: unknownNetwork traffic detected: HTTP traffic on port 49818 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49871
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49992
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49870
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49991
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49990
    Source: unknownNetwork traffic detected: HTTP traffic on port 49786 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49747 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49829 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 50072 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49934 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 50027 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49749
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49748
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49869
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49747
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49868
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49989
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49746
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49867
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49988
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49745
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49866
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49987
    Source: unknownNetwork traffic detected: HTTP traffic on port 50013 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 50036 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 50059 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 50094 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49746 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49769 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49803 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 50071 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49826 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49906 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49849 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49900 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49699
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49698
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49697
    Source: unknownNetwork traffic detected: HTTP traffic on port 49837 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49711 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49975 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 50060 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49929 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50100
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50102
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50101
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50104
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50103
    Source: unknownNetwork traffic detected: HTTP traffic on port 50025 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49700 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49964 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49798 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49861 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49999 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49712 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49918 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49787 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49745 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 50001 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49986 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49850 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49963 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49757 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49799
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50007
    Source: unknownNetwork traffic detected: HTTP traffic on port 50037 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49734 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49798
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50006
    Source: unknownNetwork traffic detected: HTTP traffic on port 50012 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49797
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50009
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49796
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50008
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49795
    Source: unknownNetwork traffic detected: HTTP traffic on port 49952 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49794
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49793
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49792
    Source: unknownNetwork traffic detected: HTTP traffic on port 49814 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49791
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49790
    Source: unknownNetwork traffic detected: HTTP traffic on port 50093 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50001
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50000
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50003
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50002
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50005
    Source: unknownNetwork traffic detected: HTTP traffic on port 49895 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50004
    Source: unknownNetwork traffic detected: HTTP traffic on port 49768 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49723 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 50048 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49825 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49884 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49907 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49941 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 50082 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49789
    Source: unknownNetwork traffic detected: HTTP traffic on port 49733 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49997 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49710 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49779 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49859 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49871 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 50003 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49965 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49799 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49942 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49977 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 50081 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49816 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49919 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49954 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 50014 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 50070 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49788 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49988 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49767 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49827 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 50046 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49848 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49882 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49756 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49838 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49976 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49953 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49815 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 50092 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49722 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 50047 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49908 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 50024 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49860 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49883 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49778 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49755 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49998 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49673 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 50058 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49804 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49744 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 50002 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49987 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49920 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 50069 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49708 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49926 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49949 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50054
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50053
    Source: unknownNetwork traffic detected: HTTP traffic on port 49789 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49800 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50056
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50055
    Source: unknownNetwork traffic detected: HTTP traffic on port 49766 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50058
    Source: unknownNetwork traffic detected: HTTP traffic on port 49743 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50057
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50059
    Source: unknownNetwork traffic detected: HTTP traffic on port 49961 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49720 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49984 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 50022 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50061
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50060
    Source: unknownNetwork traffic detected: HTTP traffic on port 50102 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 50045 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49950 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49732 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49996 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 50010 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49812 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50065
    Source: unknownNetwork traffic detected: HTTP traffic on port 49858 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50064
    Source: unknownNetwork traffic detected: HTTP traffic on port 50091 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 50056 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50066
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50069
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50070
    Source: unknownNetwork traffic detected: HTTP traffic on port 49915 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50072
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50071
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50074
    Source: unknownNetwork traffic detected: HTTP traffic on port 49823 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50073
    Source: unknownNetwork traffic detected: HTTP traffic on port 49777 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 50080 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49790 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49869 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49731 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 50009 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 50034 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49697 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49972 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50076
    Source: unknownNetwork traffic detected: HTTP traffic on port 49834 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50075
    Source: unknownNetwork traffic detected: HTTP traffic on port 50057 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50078
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50077
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50079
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50081
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50080
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50083
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50082
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50085
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50084
    Source: unknownNetwork traffic detected: HTTP traffic on port 49904 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49709 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49927 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49822 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50087
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50086
    Source: unknownNetwork traffic detected: HTTP traffic on port 49870 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50089
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50088
    Source: unknownNetwork traffic detected: HTTP traffic on port 49765 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 50079 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50090
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50092
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50091
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50094
    Source: unknownNetwork traffic detected: HTTP traffic on port 49983 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50093
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50096
    Source: unknownNetwork traffic detected: HTTP traffic on port 49938 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 50023 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50095
    Source: unknownNetwork traffic detected: HTTP traffic on port 49811 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49754 -> 443
    Source: unknownHTTPS traffic detected: 2.18.109.164:443 -> 192.168.2.16:49737 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 2.18.109.164:443 -> 192.168.2.16:49747 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49746 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49884 version: TLS 1.2
    Source: classification engineClassification label: mal48.evad.win@41/8@174/294
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
    Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-12-10 09-46-51-261.log
    Source: C:\Windows\System32\rundll32.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
    Source: unknownProcess created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=2008,i,173320308660370472,15969641463460629122,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
    Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://wetransfer.com/downloads/a83584fea59b11ef1e94d36869e8790020241209234540/89744b9472f9ce1b5e3b4ada79f2184c20241209234540/7041ff?t_exp=1734047140&t_lsid=42d44d78-6d8f-48db-8db5-5efa0c86786d&t_network=email&t_rid=ZW1haWx8Njc0ZjQ5YTNiNjM1NTFjNmY2NTg0N2Zj&t_s=download_link&t_ts=1733787940&utm_campaign=TRN_TDL_01&utm_source=sendgrid&utm_medium=email&trk=TRN_TDL_01"
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=2008,i,173320308660370472,15969641463460629122,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4372 --field-trial-handle=2008,i,173320308660370472,15969641463460629122,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4372 --field-trial-handle=2008,i,173320308660370472,15969641463460629122,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: unknownProcess created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    Source: unknownProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\Temp1_wetransfer_cmf-2024-poster-jpg_2024-12-09_2345.zip\FINAL poster.pdf"
    Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
    Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2272 --field-trial-handle=1588,i,4419266989590557744,5262710027109013525,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: unknown unknown
    Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
    Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
    Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
    Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2272 --field-trial-handle=1588,i,4419266989590557744,5262710027109013525,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
    Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
    Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
    Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
    Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
    Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
    Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
    Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknown
    Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeFile opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\crash_reporter.cfg
    Source: Window RecorderWindow detected: More than 3 window changes detected
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
    Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX

    Malware Analysis System Evasion

    barindex
    Source: Yara matchFile source: C:\Users\user\Downloads\9bd79503-af32-4e9d-a0d9-bfeb9acd3e0d.tmp, type: DROPPED
    ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
    Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation1
    Registry Run Keys / Startup Folder
    1
    Process Injection
    1
    Masquerading
    OS Credential Dumping1
    Virtualization/Sandbox Evasion
    Remote ServicesData from Local System2
    Encrypted Channel
    Exfiltration Over Other Network MediumAbuse Accessibility Features
    CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
    Registry Run Keys / Startup Folder
    1
    Virtualization/Sandbox Evasion
    LSASS Memory1
    System Information Discovery
    Remote Desktop ProtocolData from Removable Media1
    Non-Application Layer Protocol
    Exfiltration Over BluetoothNetwork Denial of Service
    Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)1
    Rundll32
    Security Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive2
    Application Layer Protocol
    Automated ExfiltrationData Encrypted for Impact
    Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
    Process Injection
    NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction

    This section contains all screenshots as thumbnails, including those not shown in the slideshow.


    windows-stand
    SourceDetectionScannerLabelLink
    https://wetransfer.com/downloads/a83584fea59b11ef1e94d36869e8790020241209234540/89744b9472f9ce1b5e3b4ada79f2184c20241209234540/7041ff?t_exp=1734047140&t_lsid=42d44d78-6d8f-48db-8db5-5efa0c86786d&t_network=email&t_rid=ZW1haWx8Njc0ZjQ5YTNiNjM1NTFjNmY2NTg0N2Zj&t_s=download_link&t_ts=1733787940&utm_campaign=TRN_TDL_01&utm_source=sendgrid&utm_medium=email&trk=TRN_TDL_010%Avira URL Cloudsafe
    No Antivirus matches
    No Antivirus matches
    No Antivirus matches
    No Antivirus matches
    NameIPActiveMaliciousAntivirus DetectionReputation
    jsdelivr.map.fastly.net
    151.101.193.229
    truefalse
      high
      sp-20200324121949090600000008-54648268.eu-west-1.elb.amazonaws.com
      52.208.174.48
      truefalse
        unknown
        dg2iu7dxxehbo.cloudfront.net
        13.227.2.22
        truefalse
          unknown
          backgrounds.wetransfer.net
          18.161.111.23
          truefalse
            unknown
            wetransfer.zendesk.com
            216.198.53.1
            truefalse
              unknown
              insight.adsrvr.org
              52.223.40.198
              truefalse
                high
                scontent.xx.fbcdn.net
                157.240.196.15
                truefalse
                  high
                  cm.g.doubleclick.net
                  142.250.181.66
                  truefalse
                    high
                    www.google.com
                    142.250.181.100
                    truefalse
                      high
                      ara.paa-reporting-advertising.amazon
                      18.165.220.99
                      truefalse
                        high
                        wetransfer.fides-cdn.ethyca.com
                        3.160.188.123
                        truefalse
                          unknown
                          cdn.brandmetrics.com
                          104.26.0.90
                          truefalse
                            high
                            bsp-proxy.wetransfer.net
                            54.170.170.65
                            truefalse
                              high
                              match.adsrvr.org
                              52.223.40.198
                              truefalse
                                high
                                star-mini.c10r.facebook.com
                                157.240.195.35
                                truefalse
                                  high
                                  lebowski.wetransfer.com
                                  52.51.102.229
                                  truefalse
                                    unknown
                                    tpsc-ae1.doubleverify.com
                                    34.149.43.113
                                    truefalse
                                      high
                                      aragorn-prod-or-acai-lb.inbake.com
                                      52.43.7.224
                                      truefalse
                                        unknown
                                        s.amazon-adsystem.com
                                        98.82.157.231
                                        truefalse
                                          high
                                          e-prod-alb-s105-us-east-1-01.adzerk.net
                                          54.84.166.107
                                          truefalse
                                            unknown
                                            dna8twue3dlxq.cloudfront.net
                                            13.226.2.2
                                            truefalse
                                              unknown
                                              kube-stats-prod-or-acai-lbj.inbake.com
                                              52.13.90.14
                                              truefalse
                                                unknown
                                                firewall-external-2134955858.eu-west-1.elb.amazonaws.com
                                                52.31.60.57
                                                truefalse
                                                  unknown
                                                  d162h6x3rxav67.cloudfront.net
                                                  13.226.2.32
                                                  truefalse
                                                    high
                                                    ax-0001.ax-msedge.net
                                                    150.171.27.10
                                                    truefalse
                                                      high
                                                      d1ykf07e75w7ss.cloudfront.net
                                                      3.160.182.59
                                                      truefalse
                                                        high
                                                        safety.wetransfer.com
                                                        52.50.138.240
                                                        truefalse
                                                          unknown
                                                          download.wetransfer.com
                                                          216.137.52.33
                                                          truefalse
                                                            unknown
                                                            analytics-v2.wetransfer.com
                                                            3.160.188.77
                                                            truefalse
                                                              high
                                                              di.rlcdn.com
                                                              34.49.212.111
                                                              truefalse
                                                                unknown
                                                                googleads.g.doubleclick.net
                                                                172.217.17.34
                                                                truefalse
                                                                  high
                                                                  donny.wetransfer.com
                                                                  52.51.102.229
                                                                  truefalse
                                                                    unknown
                                                                    dt-external-217593033.us-east-1.elb.amazonaws.com
                                                                    3.214.212.104
                                                                    truefalse
                                                                      unknown
                                                                      dualstack.pinterest.map.fastly.net
                                                                      151.101.0.84
                                                                      truefalse
                                                                        unknown
                                                                        www.datadoghq-browser-agent.com
                                                                        52.84.73.38
                                                                        truefalse
                                                                          high
                                                                          cdn.wetransfer.com
                                                                          52.84.45.25
                                                                          truefalse
                                                                            high
                                                                            ekstrom.wetransfer.net
                                                                            54.170.199.174
                                                                            truefalse
                                                                              unknown
                                                                              wetransfer.com
                                                                              52.84.45.45
                                                                              truefalse
                                                                                high
                                                                                auth-session-caching.wetransfer.net
                                                                                52.208.109.105
                                                                                truefalse
                                                                                  unknown
                                                                                  experiments.wetransfer.com
                                                                                  52.84.45.95
                                                                                  truefalse
                                                                                    high
                                                                                    wepresent.wetransfer.com
                                                                                    54.230.112.39
                                                                                    truefalse
                                                                                      unknown
                                                                                      tagging.wetransfer.com
                                                                                      54.230.112.110
                                                                                      truefalse
                                                                                        high
                                                                                        ib.anycast.adnxs.com
                                                                                        185.89.210.20
                                                                                        truefalse
                                                                                          high
                                                                                          nolan.wetransfer.net
                                                                                          18.161.111.25
                                                                                          truefalse
                                                                                            unknown
                                                                                            ag.innovid.com
                                                                                            unknown
                                                                                            unknownfalse
                                                                                              unknown
                                                                                              cdn.jsdelivr.net
                                                                                              unknown
                                                                                              unknownfalse
                                                                                                high
                                                                                                snowplow.wetransfer.com
                                                                                                unknown
                                                                                                unknownfalse
                                                                                                  unknown
                                                                                                  ct.pinterest.com
                                                                                                  unknown
                                                                                                  unknownfalse
                                                                                                    high
                                                                                                    pixel.adsafeprotected.com
                                                                                                    unknown
                                                                                                    unknownfalse
                                                                                                      unknown
                                                                                                      s.innovid.com
                                                                                                      unknown
                                                                                                      unknownfalse
                                                                                                        unknown
                                                                                                        dt.adsafeprotected.com
                                                                                                        unknown
                                                                                                        unknownfalse
                                                                                                          high
                                                                                                          www.facebook.com
                                                                                                          unknown
                                                                                                          unknownfalse
                                                                                                            high
                                                                                                            js.adsrvr.org
                                                                                                            unknown
                                                                                                            unknownfalse
                                                                                                              high
                                                                                                              c.amazon-adsystem.com
                                                                                                              unknown
                                                                                                              unknownfalse
                                                                                                                high
                                                                                                                privacy.wetransfer.com
                                                                                                                unknown
                                                                                                                unknownfalse
                                                                                                                  high
                                                                                                                  pixel.rubiconproject.com
                                                                                                                  unknown
                                                                                                                  unknownfalse
                                                                                                                    high
                                                                                                                    connect.facebook.net
                                                                                                                    unknown
                                                                                                                    unknownfalse
                                                                                                                      high
                                                                                                                      public.profitwell.com
                                                                                                                      unknown
                                                                                                                      unknownfalse
                                                                                                                        high
                                                                                                                        tps.doubleverify.com
                                                                                                                        unknown
                                                                                                                        unknownfalse
                                                                                                                          high
                                                                                                                          collector.brandmetrics.com
                                                                                                                          unknown
                                                                                                                          unknownfalse
                                                                                                                            high
                                                                                                                            s.pinimg.com
                                                                                                                            unknown
                                                                                                                            unknownfalse
                                                                                                                              high
                                                                                                                              ib.adnxs.com
                                                                                                                              unknown
                                                                                                                              unknownfalse
                                                                                                                                high
                                                                                                                                help.wetransfer.com
                                                                                                                                unknown
                                                                                                                                unknownfalse
                                                                                                                                  unknown
                                                                                                                                  e-10220.adzerk.net
                                                                                                                                  unknown
                                                                                                                                  unknownfalse
                                                                                                                                    unknown
                                                                                                                                    static.adsafeprotected.com
                                                                                                                                    unknown
                                                                                                                                    unknownfalse
                                                                                                                                      high
                                                                                                                                      • No. of IPs < 25%
                                                                                                                                      • 25% < No. of IPs < 50%
                                                                                                                                      • 50% < No. of IPs < 75%
                                                                                                                                      • 75% < No. of IPs
                                                                                                                                      IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                      3.214.212.104
                                                                                                                                      dt-external-217593033.us-east-1.elb.amazonaws.comUnited States
                                                                                                                                      14618AMAZON-AESUSfalse
                                                                                                                                      52.208.109.105
                                                                                                                                      auth-session-caching.wetransfer.netUnited States
                                                                                                                                      16509AMAZON-02USfalse
                                                                                                                                      151.101.0.84
                                                                                                                                      dualstack.pinterest.map.fastly.netUnited States
                                                                                                                                      54113FASTLYUSfalse
                                                                                                                                      18.161.111.23
                                                                                                                                      backgrounds.wetransfer.netUnited States
                                                                                                                                      3MIT-GATEWAYSUSfalse
                                                                                                                                      172.217.17.67
                                                                                                                                      unknownUnited States
                                                                                                                                      15169GOOGLEUSfalse
                                                                                                                                      18.165.220.106
                                                                                                                                      unknownUnited States
                                                                                                                                      3MIT-GATEWAYSUSfalse
                                                                                                                                      151.101.193.229
                                                                                                                                      jsdelivr.map.fastly.netUnited States
                                                                                                                                      54113FASTLYUSfalse
                                                                                                                                      18.161.111.25
                                                                                                                                      nolan.wetransfer.netUnited States
                                                                                                                                      3MIT-GATEWAYSUSfalse
                                                                                                                                      52.43.7.224
                                                                                                                                      aragorn-prod-or-acai-lb.inbake.comUnited States
                                                                                                                                      16509AMAZON-02USfalse
                                                                                                                                      52.31.60.57
                                                                                                                                      firewall-external-2134955858.eu-west-1.elb.amazonaws.comUnited States
                                                                                                                                      16509AMAZON-02USfalse
                                                                                                                                      162.159.61.3
                                                                                                                                      unknownUnited States
                                                                                                                                      13335CLOUDFLARENETUSfalse
                                                                                                                                      52.13.90.14
                                                                                                                                      kube-stats-prod-or-acai-lbj.inbake.comUnited States
                                                                                                                                      16509AMAZON-02USfalse
                                                                                                                                      172.217.19.194
                                                                                                                                      unknownUnited States
                                                                                                                                      15169GOOGLEUSfalse
                                                                                                                                      23.35.236.196
                                                                                                                                      unknownUnited States
                                                                                                                                      6461ZAYO-6461USfalse
                                                                                                                                      54.230.112.110
                                                                                                                                      tagging.wetransfer.comUnited States
                                                                                                                                      16509AMAZON-02USfalse
                                                                                                                                      34.149.43.113
                                                                                                                                      tpsc-ae1.doubleverify.comUnited States
                                                                                                                                      2686ATGS-MMD-ASUSfalse
                                                                                                                                      185.89.210.20
                                                                                                                                      ib.anycast.adnxs.comGermany
                                                                                                                                      29990ASN-APPNEXUSfalse
                                                                                                                                      52.50.138.240
                                                                                                                                      safety.wetransfer.comUnited States
                                                                                                                                      16509AMAZON-02USfalse
                                                                                                                                      18.200.179.112
                                                                                                                                      unknownUnited States
                                                                                                                                      16509AMAZON-02USfalse
                                                                                                                                      3.160.182.59
                                                                                                                                      d1ykf07e75w7ss.cloudfront.netUnited States
                                                                                                                                      16509AMAZON-02USfalse
                                                                                                                                      52.206.134.223
                                                                                                                                      unknownUnited States
                                                                                                                                      14618AMAZON-AESUSfalse
                                                                                                                                      52.84.45.95
                                                                                                                                      experiments.wetransfer.comUnited States
                                                                                                                                      55960BJ-GUANGHUAN-APBeijingGuanghuanXinwangDigitalCNfalse
                                                                                                                                      92.122.16.141
                                                                                                                                      unknownEuropean Union
                                                                                                                                      16625AKAMAI-ASUSfalse
                                                                                                                                      104.26.0.90
                                                                                                                                      cdn.brandmetrics.comUnited States
                                                                                                                                      13335CLOUDFLARENETUSfalse
                                                                                                                                      1.1.1.1
                                                                                                                                      unknownAustralia
                                                                                                                                      13335CLOUDFLARENETUSfalse
                                                                                                                                      54.170.199.174
                                                                                                                                      ekstrom.wetransfer.netUnited States
                                                                                                                                      16509AMAZON-02USfalse
                                                                                                                                      172.217.17.34
                                                                                                                                      googleads.g.doubleclick.netUnited States
                                                                                                                                      15169GOOGLEUSfalse
                                                                                                                                      54.230.112.55
                                                                                                                                      unknownUnited States
                                                                                                                                      16509AMAZON-02USfalse
                                                                                                                                      18.165.220.99
                                                                                                                                      ara.paa-reporting-advertising.amazonUnited States
                                                                                                                                      3MIT-GATEWAYSUSfalse
                                                                                                                                      239.255.255.250
                                                                                                                                      unknownReserved
                                                                                                                                      unknownunknownfalse
                                                                                                                                      13.226.2.32
                                                                                                                                      d162h6x3rxav67.cloudfront.netUnited States
                                                                                                                                      16509AMAZON-02USfalse
                                                                                                                                      52.84.45.45
                                                                                                                                      wetransfer.comUnited States
                                                                                                                                      55960BJ-GUANGHUAN-APBeijingGuanghuanXinwangDigitalCNfalse
                                                                                                                                      52.223.40.198
                                                                                                                                      insight.adsrvr.orgUnited States
                                                                                                                                      8987AMAZONEXPANSIONGBfalse
                                                                                                                                      52.208.174.48
                                                                                                                                      sp-20200324121949090600000008-54648268.eu-west-1.elb.amazonaws.comUnited States
                                                                                                                                      16509AMAZON-02USfalse
                                                                                                                                      104.26.1.90
                                                                                                                                      unknownUnited States
                                                                                                                                      13335CLOUDFLARENETUSfalse
                                                                                                                                      172.217.19.206
                                                                                                                                      unknownUnited States
                                                                                                                                      15169GOOGLEUSfalse
                                                                                                                                      151.101.64.84
                                                                                                                                      unknownUnited States
                                                                                                                                      54113FASTLYUSfalse
                                                                                                                                      69.173.144.139
                                                                                                                                      unknownUnited States
                                                                                                                                      26667RUBICONPROJECTUSfalse
                                                                                                                                      34.249.56.42
                                                                                                                                      unknownUnited States
                                                                                                                                      16509AMAZON-02USfalse
                                                                                                                                      13.226.2.2
                                                                                                                                      dna8twue3dlxq.cloudfront.netUnited States
                                                                                                                                      16509AMAZON-02USfalse
                                                                                                                                      54.170.170.65
                                                                                                                                      bsp-proxy.wetransfer.netUnited States
                                                                                                                                      16509AMAZON-02USfalse
                                                                                                                                      98.82.157.231
                                                                                                                                      s.amazon-adsystem.comUnited States
                                                                                                                                      11351TWC-11351-NORTHEASTUSfalse
                                                                                                                                      13.226.2.65
                                                                                                                                      unknownUnited States
                                                                                                                                      16509AMAZON-02USfalse
                                                                                                                                      216.137.52.33
                                                                                                                                      download.wetransfer.comUnited States
                                                                                                                                      8014BATELNETBSfalse
                                                                                                                                      52.84.73.38
                                                                                                                                      www.datadoghq-browser-agent.comUnited States
                                                                                                                                      16509AMAZON-02USfalse
                                                                                                                                      3.160.188.123
                                                                                                                                      wetransfer.fides-cdn.ethyca.comUnited States
                                                                                                                                      16509AMAZON-02USfalse
                                                                                                                                      172.217.21.35
                                                                                                                                      unknownUnited States
                                                                                                                                      15169GOOGLEUSfalse
                                                                                                                                      142.250.181.66
                                                                                                                                      cm.g.doubleclick.netUnited States
                                                                                                                                      15169GOOGLEUSfalse
                                                                                                                                      157.240.195.35
                                                                                                                                      star-mini.c10r.facebook.comUnited States
                                                                                                                                      32934FACEBOOKUSfalse
                                                                                                                                      172.217.19.238
                                                                                                                                      unknownUnited States
                                                                                                                                      15169GOOGLEUSfalse
                                                                                                                                      52.51.102.229
                                                                                                                                      lebowski.wetransfer.comUnited States
                                                                                                                                      16509AMAZON-02USfalse
                                                                                                                                      3.160.188.77
                                                                                                                                      analytics-v2.wetransfer.comUnited States
                                                                                                                                      16509AMAZON-02USfalse
                                                                                                                                      18.161.111.74
                                                                                                                                      unknownUnited States
                                                                                                                                      3MIT-GATEWAYSUSfalse
                                                                                                                                      20.79.107.10
                                                                                                                                      unknownUnited States
                                                                                                                                      8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                                      151.101.65.229
                                                                                                                                      unknownUnited States
                                                                                                                                      54113FASTLYUSfalse
                                                                                                                                      34.49.212.111
                                                                                                                                      di.rlcdn.comUnited States
                                                                                                                                      2686ATGS-MMD-ASUSfalse
                                                                                                                                      142.250.181.100
                                                                                                                                      www.google.comUnited States
                                                                                                                                      15169GOOGLEUSfalse
                                                                                                                                      150.171.27.10
                                                                                                                                      ax-0001.ax-msedge.netUnited States
                                                                                                                                      8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                                      44.240.191.224
                                                                                                                                      unknownUnited States
                                                                                                                                      16509AMAZON-02USfalse
                                                                                                                                      52.84.45.25
                                                                                                                                      cdn.wetransfer.comUnited States
                                                                                                                                      55960BJ-GUANGHUAN-APBeijingGuanghuanXinwangDigitalCNfalse
                                                                                                                                      157.240.196.15
                                                                                                                                      scontent.xx.fbcdn.netUnited States
                                                                                                                                      32934FACEBOOKUSfalse
                                                                                                                                      54.84.166.107
                                                                                                                                      e-prod-alb-s105-us-east-1-01.adzerk.netUnited States
                                                                                                                                      14618AMAZON-AESUSfalse
                                                                                                                                      173.194.222.84
                                                                                                                                      unknownUnited States
                                                                                                                                      15169GOOGLEUSfalse
                                                                                                                                      18.161.111.8
                                                                                                                                      unknownUnited States
                                                                                                                                      3MIT-GATEWAYSUSfalse
                                                                                                                                      13.227.2.22
                                                                                                                                      dg2iu7dxxehbo.cloudfront.netUnited States
                                                                                                                                      16509AMAZON-02USfalse
                                                                                                                                      IP
                                                                                                                                      192.168.2.27
                                                                                                                                      192.168.2.16
                                                                                                                                      Joe Sandbox version:41.0.0 Charoite
                                                                                                                                      Analysis ID:1572466
                                                                                                                                      Start date and time:2024-12-10 15:44:42 +01:00
                                                                                                                                      Joe Sandbox product:CloudBasic
                                                                                                                                      Overall analysis duration:
                                                                                                                                      Hypervisor based Inspection enabled:false
                                                                                                                                      Report type:full
                                                                                                                                      Cookbook file name:defaultwindowsinteractivecookbook.jbs
                                                                                                                                      Sample URL:https://wetransfer.com/downloads/a83584fea59b11ef1e94d36869e8790020241209234540/89744b9472f9ce1b5e3b4ada79f2184c20241209234540/7041ff?t_exp=1734047140&t_lsid=42d44d78-6d8f-48db-8db5-5efa0c86786d&t_network=email&t_rid=ZW1haWx8Njc0ZjQ5YTNiNjM1NTFjNmY2NTg0N2Zj&t_s=download_link&t_ts=1733787940&utm_campaign=TRN_TDL_01&utm_source=sendgrid&utm_medium=email&trk=TRN_TDL_01
                                                                                                                                      Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                      Number of analysed new started processes analysed:20
                                                                                                                                      Number of new started drivers analysed:0
                                                                                                                                      Number of existing processes analysed:0
                                                                                                                                      Number of existing drivers analysed:0
                                                                                                                                      Number of injected processes analysed:0
                                                                                                                                      Technologies:
                                                                                                                                      • EGA enabled
                                                                                                                                      Analysis Mode:stream
                                                                                                                                      Analysis stop reason:Timeout
                                                                                                                                      Detection:MAL
                                                                                                                                      Classification:mal48.evad.win@41/8@174/294
                                                                                                                                      • Exclude process from analysis (whitelisted): svchost.exe
                                                                                                                                      • Excluded IPs from analysis (whitelisted): 172.217.21.35, 173.194.222.84, 172.217.19.238, 172.217.17.78, 172.217.17.46
                                                                                                                                      • Excluded domains from analysis (whitelisted): clients2.google.com, accounts.google.com, redirector.gvt1.com, clientservices.googleapis.com, clients.l.google.com
                                                                                                                                      • Not all processes where analyzed, report is missing behavior information
                                                                                                                                      • VT rate limit hit for: https://wetransfer.com/downloads/a83584fea59b11ef1e94d36869e8790020241209234540/89744b9472f9ce1b5e3b4ada79f2184c20241209234540/7041ff?t_exp=1734047140&t_lsid=42d44d78-6d8f-48db-8db5-5efa0c86786d&t_network=email&t_rid=ZW1haWx8Njc0ZjQ5YTNiNjM1NTFjNmY2NTg0N2Zj&t_s=download_link&t_ts=1733787940&utm_campaign=TRN_TDL_01&utm_source=sendgrid&utm_medium=email&trk=TRN_TDL_01
                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 10 13:45:12 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):2673
                                                                                                                                      Entropy (8bit):3.988657904193702
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:
                                                                                                                                      MD5:B7B4F79A3225C6B470634ABAB78189D7
                                                                                                                                      SHA1:8A1EE14974837D22DBF8319AC93504176F1B38AE
                                                                                                                                      SHA-256:4D4863AFE477953F69840BBCE4D452B1369099B342F60F2A30E62FBEBDA315F4
                                                                                                                                      SHA-512:536CC6C65B4F52FDB8D94623920C279CE18B96B37F00F77535B706B4AA0CA2A50611A454050AF6CEEA1E5FB36671C83EEC4CE2A4492AC18006B0A0FC9F366121
                                                                                                                                      Malicious:false
                                                                                                                                      Reputation:unknown
                                                                                                                                      Preview:L..................F.@.. ...$+.,.........K..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y.u....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.u....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.u....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.u..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.u...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 10 13:45:12 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):2675
                                                                                                                                      Entropy (8bit):4.006005126595214
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:
                                                                                                                                      MD5:CD0C0EF8950F7F5FE579EAC7DF82786A
                                                                                                                                      SHA1:E9017EAD0EECD96A86906A78D62C55CA1980D89B
                                                                                                                                      SHA-256:A363081B7E37E4054104E282AB5DF7544FA5DB6644F15A0EC46A0FDA64FE9414
                                                                                                                                      SHA-512:270D35B61C540541E3B9BC3FBC3A8D7091FA1CCFE2BF846B6ABF2963ACB7FE9A496533F39ACE0E32C6CDFFD3B4FB20A003FFD5B75CD2EBC0690E767AFBEC9135
                                                                                                                                      Malicious:false
                                                                                                                                      Reputation:unknown
                                                                                                                                      Preview:L..................F.@.. ...$+.,.........K..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y.u....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.u....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.u....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.u..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.u...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):2689
                                                                                                                                      Entropy (8bit):4.011733107118283
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:
                                                                                                                                      MD5:7AAFAEA2E01A0BA9FB94E98558AACA32
                                                                                                                                      SHA1:C238BDBB99E7E7D61DA672F23BAC98B51B2BC70B
                                                                                                                                      SHA-256:D594458632078762FC75C0AF80E98CF2FBF32FC24AB1DC7749CC82E4AAD3E9C8
                                                                                                                                      SHA-512:8DA65E2F460E603D8D7B54A01B2CD95E884C87F586474F3BDA226414434EDF3414F56ECF9A0393F24758E07ED0A9B522F9B6BB536254AD25D4F894B57627219D
                                                                                                                                      Malicious:false
                                                                                                                                      Reputation:unknown
                                                                                                                                      Preview:L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y.u....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.u....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.u....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.u..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 10 13:45:12 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):2677
                                                                                                                                      Entropy (8bit):3.999836091746542
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:
                                                                                                                                      MD5:08D33578BFC63653E630CB304137C6BD
                                                                                                                                      SHA1:5894D52FCF4081121842C76816083EA9B8DD4729
                                                                                                                                      SHA-256:6F12E4B878A1CC2837252ADDB852F87AAF1889BD7F7495FDC5045FEBADC07633
                                                                                                                                      SHA-512:6A874236851ECC05D4C493B3192E70AC8BF5D1ED0F7041F2514FC2833827CCAAC8BB0264C9973F022929C9D27468C74CDF11D76C05159CCCACB56A282BEB5B44
                                                                                                                                      Malicious:false
                                                                                                                                      Reputation:unknown
                                                                                                                                      Preview:L..................F.@.. ...$+.,....GH...K..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y.u....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.u....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.u....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.u..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.u...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 10 13:45:12 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):2677
                                                                                                                                      Entropy (8bit):3.9913721070929604
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:
                                                                                                                                      MD5:8BA6C2A25678FD95A71B56D4CBD4EEDB
                                                                                                                                      SHA1:679E167DC3C2A7B4CBF22947A49B40295A977CEF
                                                                                                                                      SHA-256:11CBE1F9373032CFA7086D55BBD7EBC9D34ED8BE183D5DB73F4A7D891F1AB684
                                                                                                                                      SHA-512:4964E8BFB8BD7368CF7D60A55F4F1B4339836671EF50F03293D5993067AC66BBCF0F260572262A57175BCC817357A797C898EA94FAA4AE3F802CAD652181DB2C
                                                                                                                                      Malicious:false
                                                                                                                                      Reputation:unknown
                                                                                                                                      Preview:L..................F.@.. ...$+.,...../...K..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y.u....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.u....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.u....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.u..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.u...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 10 13:45:12 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):2679
                                                                                                                                      Entropy (8bit):3.9940513563093605
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:
                                                                                                                                      MD5:8806DA50CCB8344D411B5674561ACD10
                                                                                                                                      SHA1:258E6DC0FB90A6C9A8B8A5106E4786C7DFE1ADD5
                                                                                                                                      SHA-256:16E0DDE522C800D41EE84E70B5DA1B0E6CF5C2C5F1E10FAC0516CB5AEE1C879B
                                                                                                                                      SHA-512:33AAA270E5D673EA06C51746E51B5EEE6FC1D1AC3BBBC93B262DD005DB37DEF52C1FE650D328AE4410315FB3D669D7A2509CB9371C45F61FE8E1FF188026AAA3
                                                                                                                                      Malicious:false
                                                                                                                                      Reputation:unknown
                                                                                                                                      Preview:L..................F.@.. ...$+.,....lG...K..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y.u....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.u....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.u....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.u..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.u...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):13184
                                                                                                                                      Entropy (8bit):7.095642150079681
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:
                                                                                                                                      MD5:FBEE68C015EBB5C4927C3E004BB81540
                                                                                                                                      SHA1:A11ED843855E25A4384A8D8D4A6BEBE7102AB757
                                                                                                                                      SHA-256:6DB00256E18C7BEBA2473605F12421CF1FDA8DC55276B969D031DD0EA829D449
                                                                                                                                      SHA-512:D6DCA44AC31F198CFCA41CDDEA32D58D9DD029E029C857A4FDF2BF036BFF5C7B93EE674810BDDF4E6FA47E7824EF539617EDDA81B4C0B27ACB151836E72B3DC3
                                                                                                                                      Malicious:true
                                                                                                                                      Yara Hits:
                                                                                                                                      • Rule: JoeSecurity_ZipBomb, Description: Yara detected ZipBomb, Source: C:\Users\user\Downloads\9bd79503-af32-4e9d-a0d9-bfeb9acd3e0d.tmp, Author: Joe Security
                                                                                                                                      Reputation:unknown
                                                                                                                                      Preview:PK...........Y..f9..N...N.....CMF 2024 Poster.jpgUT...-.Wg......JFIF.....,.,......Exif..MM.*.......;.........J.i.........R.......................>................................................................................................................................................................................................................................................................................Events....................................07..........07..............................................................................................................................................................................................................................................................................................2024:02:07 07:54:06.2024:02:07 07:54:06...E.v.e.n.t.s......XICC_PROFILE......HLino....mntrRGB XYZ .........1..acspMSFT....IEC sRGB.......................-HP ................................................cprt...P...3desc.......lwtpt......
                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):0
                                                                                                                                      Entropy (8bit):0.0
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:
                                                                                                                                      MD5:2D9580F2EDBC7245288E6CC2AEB30A8A
                                                                                                                                      SHA1:71C155C03052800560715C323F37E7450F4BC5A6
                                                                                                                                      SHA-256:CF99DC4C6A34E3CB1A5F423B135D3F90022D2F29F32B904C6E8DD2AF53823C37
                                                                                                                                      SHA-512:1394C0734E63F5576472654B4FB9C7C0CEE150D35CBC5C86BEF6E11EB08CC4E2F49CC08CDBE8624663C3380C9135B52536FBF711B4224244E052E67C28D4DE1B
                                                                                                                                      Malicious:false
                                                                                                                                      Reputation:unknown
                                                                                                                                      Preview:PK...........Y..f9..N...N.....CMF 2024 Poster.jpgUT...-.Wg......JFIF.....,.,......Exif..MM.*.......;.........J.i.........R.......................>................................................................................................................................................................................................................................................................................Events....................................07..........07..............................................................................................................................................................................................................................................................................................2024:02:07 07:54:06.2024:02:07 07:54:06...E.v.e.n.t.s......XICC_PROFILE......HLino....mntrRGB XYZ .........1..acspMSFT....IEC sRGB.......................-HP ................................................cprt...P...3desc.......lwtpt......
                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):17393421
                                                                                                                                      Entropy (8bit):7.985108403509635
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:
                                                                                                                                      MD5:2D9580F2EDBC7245288E6CC2AEB30A8A
                                                                                                                                      SHA1:71C155C03052800560715C323F37E7450F4BC5A6
                                                                                                                                      SHA-256:CF99DC4C6A34E3CB1A5F423B135D3F90022D2F29F32B904C6E8DD2AF53823C37
                                                                                                                                      SHA-512:1394C0734E63F5576472654B4FB9C7C0CEE150D35CBC5C86BEF6E11EB08CC4E2F49CC08CDBE8624663C3380C9135B52536FBF711B4224244E052E67C28D4DE1B
                                                                                                                                      Malicious:false
                                                                                                                                      Reputation:unknown
                                                                                                                                      Preview:PK...........Y..f9..N...N.....CMF 2024 Poster.jpgUT...-.Wg......JFIF.....,.,......Exif..MM.*.......;.........J.i.........R.......................>................................................................................................................................................................................................................................................................................Events....................................07..........07..............................................................................................................................................................................................................................................................................................2024:02:07 07:54:06.2024:02:07 07:54:06...E.v.e.n.t.s......XICC_PROFILE......HLino....mntrRGB XYZ .........1..acspMSFT....IEC sRGB.......................-HP ................................................cprt...P...3desc.......lwtpt......
                                                                                                                                      No static file info